Script guidance

syncore · 2017-09-04T11:09:10.000Z

Hi, I am trying to create a script for my company. I am hoping someone can take a look and let me know if I am doing something wrong or point me in the right direction. This is important for my company.

The idea to this script is:

If we have a new hire from HR, I want the system to check to see if the SamAccountName is taken and if it is then I want it to add increment numbers. (i.e. SCore is taken so it will become SCore1)
If the SamAccountName is not taken the script will create the new user.
One other thing if the SamAccountName is taken it is possible to be a rehire. I want it to check that it is not a rehire. If it is I want it to re-enable the users account.

Any help will be greatly appreciated. Below is the script I have tried to put together. It has not fully been tested.

#Store the data from bulkAD.csv in the $bulkAD variable for Full Time Employees
$bulkAD = Import-csv “C:\Users\Administrator\Documents\bulkAD.csv”

#Loop through each row containing user details in the CSV file
foreach ($User in $bulkAD)
{

#Read user data from each field in each row and assign the data to a variable as below

$Firstname = $User.firstname
$Lastname = $User.lastname
$SAM = $User.firstname.Substring(0,1) + $User.lastname
$Proxydomain = “@adtest.com”
$Username = $SAM + $Proxydomain
$Password = ‘Welcome2017’
$OU = “OU=Associates,OU=MainTest,DC=adtest,DC=Com”
$Description = $User.Description
$Email = $User.firstname + $User.lastname + $Proxydomain
$HomeDir = $User.HomeDirectory + '' + $SAM
$Mgr = “CN=” + $User.manager + $OU
$Job = $User.JobTitle
$Dept = $User.department
$Company = $User.company
$StreetAddress = $User.Streetaddress
$City = $User.city
$State = $User.state
$PostCode = $User.postcode
$Country = ‘US’
$ProxyAddress1 = “SMTP:” + $Firstname + ‘.’ + $Lastname + “@adtest.com”
$ProxyAddress2 = “smtp:” + $SAM + “@adtest.com”
$Scans = $HomeDir + '' + ‘Scans’
$ReqAccess = $HomeDir + '' + ‘_Requested Access’
$Expiredate = Get-Date
$status = $User.Status
$NewSam = $SAM
$Check = (Get-ADUser -F {SamAccountName -eq $SAM})
$Found = $False

#Check to see if the user already exists in AD and is a rehire
if (Get-ADUser -F {SamAccountName -eq $SAM -and $Status -eq “rehire”})

{

Set-ADUser -Enabled $True
-Description “$Description” -Path $OU
-ChangePasswordAtLogon $true -AccountPassword (convertto-securestring $Password -AsPlainText -Force )
-Manager “$Mgr” -Department "$Dept"
-Title “$Job” -Company "$Company"
-StreetAddress $Streetaddress -State $State
-PostalCode $PostCode `
-Country “US”

}

#Check to see if the user already exists in AD
else if

{
for ($i=1; $i -le 60; $i ++) {

if ($Check) {$NewSam = “$Sam$i”}
Else {$Found = $True;Break}
}
if ($Found -eq $True)
{

New-ADUser -SamAccountName $NewSam
-UserPrincipalName “$Username” -Name "$Firstname $Lastname"
-GivenName $Firstname -Surname $Lastname
-Enabled $True -DisplayName "$Lastname, $Firstname"
-Description “$Description” -Path $OU
-EmailAddress $Email -ChangePasswordAtLogon $true
-AccountPassword (convertto-securestring $Password -AsPlainText -Force ) -HomeDirectory "$HomeDir"
-HomeDrive “H:” -Manager "$Mgr"
-Department “$Dept” -Title "$Job"
-Company “$Company” -StreetAddress $Streetaddress
-State $State -PostalCode $PostCode
-Country “US” -Add @{Proxyaddresses=$ProxyAddress1}
-Add @{Proxyaddresses=$ProxyAddress2}

#Add security groups and distributions
foreach ($Group in ($User.Group -split ‘;’))
{

Add-ADGroupMember -Identity $Group -Members $SAM

}

#Create home directory folder

New-Item $HomeDir -ItemType Directory

$IdentityReference = $Username

#Set Rules for Drives

$FileSystemAccessRights = [System.Security.AccessControl.FileSystemRights]”Modify”

$InheritanceFlags = [System.Security.AccessControl.InheritanceFlags]”ContainerInherit", [System.Security.AccessControl.InheritanceFlags]"ObjectInherit”

$PropagationFlags = [System.Security.AccessControl.PropagationFlags]”None”

$AccessControl = [System.Security.AccessControl.AccessControlType]”Allow”

#Build Access Rule from parameters

$AccessRule = NEW-OBJECT System.Security.AccessControl.FileSystemAccessRule -argumentlist $IdentityReference,$FileSystemAccessRights,$InheritanceFlags,$PropagationFlags,$AccessControl

#Get current Access Rule from Home Folder for User

$HomeFolderACL=GET-ACL -path $HomeDir

Start-Sleep -s 10

$HomeFolderACL.AddAccessRule($AccessRule)

SET-ACL –path $HomeDir -AclObject $HomeFolderACL

#Create Scans folder in Home Directory folder
New-Item $Scans -ItemType Directory

#Create _Requested Access folder in Home Directory folder
New-Item $ReqAccess -ItemType Directory

}

else if($Found)

{

#User does not exist then proceed to create the new user account

#Account will be created in the OU provided by the $OU variable read from the CSV file
New-ADUser -SamAccountName $SAM
-UserPrincipalName “$Username” -Name "$Firstname $Lastname"
-GivenName $Firstname -Surname $Lastname
-Enabled $True -DisplayName "$Lastname, $Firstname"
-Description “$Description” -Path $OU
-EmailAddress $Email -ChangePasswordAtLogon $true
-AccountPassword (convertto-securestring $Password -AsPlainText -Force ) -HomeDirectory "$HomeDir"
-HomeDrive “H:” -Manager "$Mgr"
-Department “$Dept” -Title "$Job"
-Company “$Company” -StreetAddress $Streetaddress
-State $State -PostalCode $PostCode
-Country “US” -Add @{Proxyaddresses=$ProxyAddress1}
-Add @{Proxyaddresses=$ProxyAddress2}

#Add security groups and distributions
foreach ($Group in ($User.Group -split ‘;’))
{

Add-ADGroupMember -Identity $Group -Members $SAM

}

#Create home directory folder

New-Item $HomeDir -ItemType Directory

$IdentityReference = $Username

#Set Rules for Drives

$FileSystemAccessRights = [System.Security.AccessControl.FileSystemRights]”Modify”

$InheritanceFlags = [System.Security.AccessControl.InheritanceFlags]”ContainerInherit", [System.Security.AccessControl.InheritanceFlags]"ObjectInherit”

$PropagationFlags = [System.Security.AccessControl.PropagationFlags]”None”

$AccessControl = [System.Security.AccessControl.AccessControlType]”Allow”

#Build Access Rule from parameters

$AccessRule = NEW-OBJECT System.Security.AccessControl.FileSystemAccessRule -argumentlist $IdentityReference,$FileSystemAccessRights,$InheritanceFlags,$PropagationFlags,$AccessControl

#Get current Access Rule from Home Folder for User

$HomeFolderACL=GET-ACL -path $HomeDir

Start-Sleep -s 10

$HomeFolderACL.AddAccessRule($AccessRule)

SET-ACL –path $HomeDir -AclObject $HomeFolderACL

#Create Scans folder in Home Directory folder
New-Item $Scans -ItemType Directory

#Create _Requested Access folder in Home Directory folder
New-Item $ReqAccess -ItemType Directory

}

martin9700 · 2017-09-04T12:10:14.000Z

To start, I suggest you read this: PLEASE READ BEFORE POSTING! Read if you're new to the PowerShell forum!

Pay particularly close attention to the 6th bullet point after the picture. It’s really unreasonable to think people will drop their own job and completely debug your huge script–and I’m not saying this in a mean tone, just instructional.

I would suggest taking a portion of the script and asking a specific question that you are having a problem with. You’ll have a lot better luck getting answers that way. Also, don’t forget to use the code button </> to post your code with.

jitensh · 2017-09-04T12:41:23.000Z

If we have a new hire from HR, I want the system to check to see if the SamAccountName is taken and if it is then I want it to add increment numbers. (i.e. SCore is taken so it will become SCore1)If the SamAccountName is not taken the script will create the new user.One other thing if the SamAccountName is taken it is possible to be a rehire. I want it to check that it is not a rehire. If it is I want it to re-enable the users account.

I don’t think 3 things are possible

Use code format to paste code

try {
    if (!(get-aduser -Filter {samaccountname -eq "$SAM"})){
     $Parameters = @{
    'SamAccountName'        = $Sam
    'UserPrincipalName'     = $UPN 
    'Name'                  = $Fullname
    
}

New-ADUser @Parameters

$a=1;
else
{
$sam="Core$a++"

}

syncore · 2017-09-04T13:32:30.000Z

Thank you, JitenSh! My apologies for not posting in the correct format, I am still new to this site. Will not happen again.

So, there is no way to incorporate the third option, even if I have a column on my CSV that says Rehire? Maybe something like this and I set parameters for the rehire.

try {
if (!(get-aduser -Filter {samaccountname -eq "$SAM" -and $User.Status -eq "Rehire"})){
	
$RehireParameters = @{
'Enabled' $True 
'Description' = "$Description" 
'ChangePasswordAtLogon' = $true 
'AccountPassword' = (convertto-securestring $Password -AsPlainText -Force )
}
	
$NewHireParameters = @{
'SamAccountName'        = $Sam
'UserPrincipalName'     = $UPN 
'Name'                  = $Fullname
    
}

Set-ADUser @$RehireParameters

else

New-ADUser @$NewHireParameters

$a=1;
else
{
$sam="Core$a++"

}

jitensh · 2017-09-04T14:31:43.000Z

Really don’t have a AD to check, may be something like. Also Tagging Neally and gungnir

$Users=import-csv c:\users.csv

```
foreach ($user in $Users) {
$stx=$user.status
    try {
        $ADUser = Get-ADUser -Identity $user -ErrorAction Stop
    }
    catch {
        if ($_ -like "*Cannot find an object with identity: '$user'*") {
            New-aduser
        }
        else {
            "An error occurred: $_"
        }
        continue
    }
    if ($_ -like "*User '$($ADUser.SamAccountName)' exists.*" -and $stx -eq "Rehire"){
   # rehire parameters
}
}
```

@alexw @gungnir

psophos · 2017-09-04T14:42:04.000Z

syncore:

Thank you, JitenSh! My apologies for not posting in the correct format, I am still new to this site. Will not happen again.

It happens. Now you know better

So, there is no way to incorporate the third option, even if I have a column on my CSV that says Rehire? Maybe something like this and I set parameters for the rehire.

I would have said that it is not a good idea, but you already have the data in your csv.
So you can simplify this part a little:

    if ($Status -eq "rehire")
    {
        Set-ADUser  -Identity $SAM `
            -Enabled $True `
            ...

        continue
    }

Just check for the status and assume the user already exists.

Unless you have a strict process for removing users. In that case it get’;s more complex.

Really you need to work out the flow in advance.

rehire:
    account still exists: 
        re-enable
        next user
    account is gone: 
        new hire
new hire:
    create user
        if error, change SAM
    -or-    
    check SAM
        exists: 
            create new SAM, repeat check
    create user

These are the questions/steps you need to establish to support your existing internal IT processes.

syncore · 2017-09-04T17:58:28.000Z

Hi, thank you for everyone’s help. Our company policy is to only disable accounts, not remove. It would be easier to remove accounts. So the workflow that you provided is exactly our process. Now I need to make it possible.

Do you know where I can find examples that I can view that could be helpful?

M Boyle:

rehire:
    account still exists: 
        re-enable
        next user
    account is gone: 
        new hire
new hire:
    create user
        if error, change SAM
    -or-    
    check SAM
        exists: 
            create new SAM, repeat check
    create user

psophos · 2017-09-04T18:31:04.000Z

Hmm, deleting users after a certain time period would generally be better. You’ll slowly use up those available SamAccountNames if nothing else. Actually those and sensible email addresses.

Added error handling when enabling an existing user. So the re-hire option is simple enough.

    # Check to see if the user already exists in AD and is a rehire
    if ($Status -eq "rehire")
    {
        try 
        {
            Set-ADUser  -Identity $SAM `
                -Enabled $True `
                -ErrorAction Stop `
                ....
        }
        catch 
        {
            Write-Warning "Failed to re-enable this account: $SAM"
        }

        continue
    }

The continue causes the flow to jump to the top of the loop and get the next user.

Next step is to create a new user account. There are plenty of exampel on spiceworks. Bit of searching as it comes up very regularly.

I should add that most of the AD cmdlets like New-ADUser and Set-ADUser have a -WhatIf parameter. You can use that for testing as it will tell you what it’s going to do without actually doing it.

syncore · 2017-09-04T22:19:12.000Z

Thank you again for your help. So if I incorporate the information that you suggested then after continue, I would include the create new user. I am somewhat new to Powershell and I am understanding.

Could something like below work? Also, am I on the right path for the adding increment numbers to the end of the SamAccountName in case the name is taken?

if ($Status -eq "rehire")
    {
        try 
        {
            Set-ADUser  -Identity $SAM `
                -Enabled $True `
                -ErrorAction Stop `
                ....
        }
        catch 
        {
            Write-Warning "Failed to re-enable this account: $SAM"
        }

        continue
    }

if (!(get-aduser -Filter {samaccountname -eq "$SAM"})){
	
$NewHireParameters = @{
'SamAccountName'        = $Sam
'UserPrincipalName'     = $UPN 
'Name'                  = $Fullname
    
}

New-ADUser @$NewHireParameters

$a=1;
else
{
$sam="$Sam$a++"

}

psophos · 2017-09-05T06:33:50.000Z

Could something like below work? Also, am I on the right path for the adding increment numbers to the end of the SamAccountName in case the name is taken?

Ish. Using splatting is good New-ADUser @$NewHireParameters

$sam="$Sam$a++"

Never do this. Always perform your increment ($a++) on a line by itself. Then you know what the value is.

Otherwise it makes your code prone to subtle bugs that are a pain to find and fix. Not what you want starting out

As for the new user part. You will probably be looking at some form of loop in order to handle the problem of multiple existing users with similar SAMAccountNames.

I really should fire up a VM and do some proper testing.