Copying user powershell

reubenhyman1629 · 2022-03-17T18:06:15.000Z

Trying to get help on the error here

$MirrorUser = Get-ADUser -filter “givenName -eq ‘Ray’ -and surname -eq ‘Test’”
$MirrorThis = Get-ADUser $MirrorUser -Properties *
New-ADUser -Name ‘Raymond Test’ -Instance $MirrorThis

Error below

New-ADUser : The operation failed because UPN value provided for addition/modification is not unique forest-wide

At line:3 char:1

New-ADUser -Name ‘Raymond Test’ -Instance $MirrorThis

CategoryInfo : NotSpecified: (CN=Raymond Test…ate,DC=ca,DC=us:String) [New-ADUser], ADException + FullyQualifiedErrorId : ActiveDirectoryServer:8648,Microsoft.ActiveDirectory.Management.Commands.NewADUser

Neally · 2022-03-17T18:12:54.000Z

If you post code, please use the ‘Insert Code’ button. Please and thank you!

PLEASE READ BEFORE POSTING! Read if you're new to the PowerShell forum! Programming & Development

Hi, and welcome to the PowerShell forum! Don’t apologize for being a “noob” or “newbie” or “n00b.” There’s just no need – nobody will think you’re stupid, and the forums are all about asking questions. Just ask! Use a descriptive subject. Don't say "Need help" or "PowerShell Help", actually summarize what the problem is. It helps the rest of us keep track of which problem is which. Don’t post massive scripts. We’re all volunteers and we don’t have time to read all that, nor will we copy, past…

192033ab-bb8f-4032-88a5-8e2313af0344-codebutton_small.png

Neally · 2022-03-17T18:15:49.000Z

Reuben3112:

Error below

New-ADUser : The operation failed because UPN value provided for addition/modification is not unique forest-wide

You’ll need to supply a unique UPN for the new user.

since you feed it the instance into, you still have to provide a unique userprincipalname

46d96778-c975-44ee-ad85-91c5c72d6f3d-2022-03-17_12-20-02.png800×157 58.3 KB

andytechacct · 2022-03-17T18:21:34.000Z

Here you go, just edit as needed:

<#
This will copy a user and then set the new users info for new hires. 
#>

#Import module
Import-Module activedirectory

# Section for you to define your variables

#Set new users info here:
$firstname = 'Eric'
$lastname = 'Short'
$title = "janitor"

#set old user account here that you are copying:
$olduser = "usernamehere"

#Set the new user AD account (example: rstimpy):
$newuser = "rstimpy"

#Path to the OU where they're account is being placed:
$path='OU=users,DC=domain,DC=com'

#prompts for you to set their PW:
$password = Read-Host -Prompt "Set New Users Password" -AsSecureString

#Copies user based of old user attributes:
$userinstance = Get-ADUser -Identity $olduser -Properties Title,Office,Manager,Description,Department,Office

# Create a new user account
New-ADUser -SAMAccountName $newuser -Instance $userinstance -DisplayName "$firstname $lastname" -GivenName $firstname -Name "$firstname $lastname" -Surname $lastname -UserPrincipalName ($firstname+"."+$lastname+"@intervala.com") -AccountPassword $password -ChangePasswordAtLogon $true -Enabled $true -path $path 

Write-Host "Creating new user account $newuser" -Foreground Green
Start-Sleep -Seconds 10

#Copies old user groups to new user account:
Get-ADUser -Identity $olduser -Properties Memberof | Select-Object -ExpandProperty memberof | Add-ADGroupMember -Members $newuser

Write-Host "Importing Groups from $olduser to $newuser" -Foreground Green
Start-Sleep -Seconds 10

Set-ADUser -Identity $newuser -Enabled $true
Set-ADUser -Identity $newuser -DisplayName "$firstname $lastname"  -StreetAddress "1 Tech Dr., Suite 1" -City "Pleasant" -State "MA" -PostalCode "11111" -Office "mainoffice" -OfficePhone "999-999-9999" -Country "US"
Set-ADUser -Identity $newuser -Description "$title" -EmailAddress ($firstname+"."+$lastname+"@domain.com") -ScriptPath "logon.bat"
Set-ADUser -Identity $newuser -Title "$title"
Set-ADUser -Identity $newuser -add @{ProxyAddresses=("SMTP:"+$firstname+"."+$lastname+"@idomain.com")}
Set-ADUser -Identity $newuser -Company "workplace"

New-Item -Path $upath -ItemType Directory
New-Item -Path $upath2 -ItemType Directory
Write-Host "Scan folder created at: $upath for users: $newuser" -Foreground Green
Start-Sleep -Seconds 3

#Sets Permissions
$acl = Get-Acl -Path $upath
$permission = $newuser, 'FullControl', 'ContainerInherit, ObjectInherit', 'None', 'Allow'
$rule = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule -ArgumentList $permission
$acl.SetAccessRule($rule)
$acl | Set-Acl -Path $upath
Write-Host "Setting ACL Permissions for $newuser. Please Wait..." -Foreground Green
Start-Sleep -Seconds 60

#AD Sync
Invoke-Command -ComputerName  "DC-Server-Here" -ScriptBlock {Start-ADSyncSyncCycle -PolicyType delta} 
Write-Host "Syncing AD. Please Wait..." -Foreground Green
Start-Sleep -Seconds 10

Write-Host "New AD user: $newuser has been created, tasks completed. Have a good day!" -Foreground Green

reubenhyman1629 · 2022-03-17T19:00:16.000Z

Okay,

Thanks

DoctorDNS · 2022-03-18T10:54:55.000Z

So to answer the question (i ) - the message: “New-ADUser : The operation failed because UPN value provided for addition/modification is not unique forest-wide” means you are trying to create a new user, but the UPN you have specified is already in use.

You need to change the UPN for the new user.

mmcdonald62 · 2022-03-18T13:37:34.000Z

In an attempt to over-complicate and over-automate user creation in the past, I used the following in a user copy script to determine the Samaccountname/UPN to use. We used FirstinitialLastname as a naming scheme. If Johnny Depp (JDepp) is already in AD and we hired a new user Johann Depp, then I would want the new user to be JoDepp or JohDepp or JohaDepp and so on. The script relies on a error from get-aduser stating the name was not found, the name that was not found is set to samaccountname. I added a bunch of comments below to make this clearer, it’s been years since I looked at this and it probably has its flaws, but it worked for us and I’ll admit this became more of a “can I do it” vs “do I need it” addition to the script.

$Firstname = "Johann"               #Provided via read-host
$Lastname = "Depp"                  #Provided via read-host

$Firstname = (get-culture).textinfo.totitlecase("$Firstname")   #Fix capitalization
$Lastname = (get-culture).textinfo.totitlecase("$Lastname")     #Fix capitalization

$error.clear()                      #Clear Error Var

#Run loop until length of frist name is reached. Set variable a to i, check for user in ad with firnameinitials preprended to lastname.
#The loop runs until the username is not found in AD and an error is returned.
#JDepp was found and returned, next get-aduser will search for JoDepp, if found the search for JohDepp
try
{for ($i = 1; $i -le $Firstname.Length; $i++) {$a=$i;Get-Aduser -identity "$($Firstname.Substring(0,$i))$Lastname"}}
catch 
{$Errorrecord = $_}

#If there was an error from the previous get-aduser, set the samaccountname using substring of value a from above.
if  (!$error)
    {write-host "`nSuggested username has too many matches, create this account manually!"  -ForegroundColor Red ;break }
    else
    {$Samaccountname = "$($Firstname.Substring(0,$a))$Lastname"}