I'm trying to write a script, but it stops working after making all OU's. The OU's are all made perfectly only the users and groups don't get created which in turn doesn't add the users to the designated groups.
I tried figuring this out one on my own, but can't seem to find the flaw in the script.
# import required modules
Import-Module ActiveDirectory
# Set Password
$password = ConvertTo-SecureString "W@chtw00rd" -AsPlainText -Force
#Set FilePath
$filepath = "C:\Users\Administrator\Desktop\Lijst met Medewerkers FitNu.csv"
# Import file into variable
$users = Import-Csv $filepath
# Loop through rows, set variables and make new users
ForEach ($user in $users) { $fname = $user.'Voornaam' $surname = $user.'Achternaam' $jtitle = $user.'Functie' $officephone = $user.'Telefoon' $office = $user.'Locatie' $department = $user.'Afdeling' $OUpath = $user.'Organizational Unit' $title = $user.'Functie' $location = $user.'Locatie'
# Make OU's New-ADOrganizationalUnit -Name "Asgard" -Path "DC=Asgard,DC=com" -ProtectedFromAccidentalDeletion $false New-ADOrganizationalUnit -Name "$location" -Path "OU=Asgard,DC=Asgard,DC=com" -ProtectedFromAccidentalDeletion $false New-ADOrganizationalUnit -Name "$department" -Path "OU=$location,OU=Asgard,DC=Asgard,DC=com" -ProtectedFromAccidentalDeletion $false New-ADOrganizationalUnit -Name "DomainLocal" -Path "OU=$location,OU=Asgard,DC=Asgard,DC=com" -ProtectedFromAccidentalDeletion $false
# Make Users New-ADUser -Name "$fname" -GivenName "$fname" -UserPrincipalName "$fname $surname" -Surname "$surname" -Path "OU=$location,OU=$department,OU=Asgard,DC=Asgard,DC=com" -ProfilePath "\\Thor\UserProfiles\$fname" -Homedrive "D" -Homedirectory "\\Thor\UserData\$fname" -AccountPassword $password -OfficePhone "+31$officephone" -Office "$office" -Department "$department" -Title "$title" -PasswordNeverExpires $True -ChangePasswordAtLogon $False -Enabled $True
# Make Groups $globalgroup = "GG_"+"$department"+"_"+"$location[0]" New-ADGroup -Name $globalgroup -GroupCategory Security -GroupScope Global -Path "OU=$location,OU=$department,OU=Asgard,DC=Asgard,DC=com" $domaingroupr = "DL_"+"$department"+"_"+"$location[0]"+"_R" New-ADGroup -Name $domaingroupr -Groupcategory Security -GroupScope DomainLocal -Path "OU=$location,OU=DomainLocal,DC=Asgard,DC=com" $domaingrouprw = "DL_"+"$deparment"+"_"+"$location[0]"+"_RW" New-ADGroup -Name $domaingrouprw -Groupcategory Security -Groupscope DomainLocal -Path "OU=$location,OU=DomainLocal,DC=Asgard,DC=com"
# Add Users to group Add-ADGroupMember -Identity $globalgroup -Members $user
}2 Answers
Your problem is here:
-UserPrincipalName "$fname $surname"
The User Principal Name should be username@domain and therefor cannot contain spaces. Because it is invalid it says Identity not found. I do not see any username construction anywhere in the script, so that's your next step. Its likely that just the username can be set here though, just make sure it does not contain spaces. A period is acceptable, but best is username@domain.
-UserPrincipalName specifies a user principal name (UPN) in the format <user>@<DNS-domain-name>. A UPN is a friendly name assigned by an administrator that is shorter than the LDAP distinguished name used by the system and easier to remember. The UPN is independent of the user object's distinguished name, so a user object can be moved or renamed without affecting the user logon name. When logging on using a UPN, users no longer have to choose a domain from a list on the logon dialog box.
Source:
The Add-AdGroupMember takes for its -Member parameter an (array of) values. These must be either the users DistinguishedName, ObjectGUID, ObjectSID, SamAccountName or a Microsoft.ActiveDirectory.Management.ADUser object.
You are feeding it the $user object from your CSV, which has none of these properties.
The way to go there is to capture the result of the New-ADUser cmdlet in a variable and use that (or one of the above mentioned properties from that) object for the -Member parameter.
Also, I would strongly advise to use Splatting the parameters so you don't have to create those horrible long lines of code where mistakes can be made quite easily.
Try:
$userParams = @{ # you forgot this one SamAccountName = $user.Achternaam # and UserPrincipalName must have format: username@domain name (UPN suffix) UserPrincipalName = '{0}@asgard.com' -f $user.Achternaam Name = '{0} {1}' -f $user.Voornaam, $user.Achternaam GivenName = $user.Voornaam Surname = $user.Achternaam AccountPassword = $password ProfilePath = '\\Thor\UserProfiles\{0}' -f $user.Achternaam Path = 'OU={0},OU={1},OU=Asgard,DC=Asgard,DC=com' -f $user.Locatie, $user.Afdeling Homedrive = 'D' Homedirectory = '\\Thor\UserData\{0}' -f $user.Achternaam OfficePhone = '+31{0}'-f $user.Telefoon Office = $user.Locatie Department = $user.Afdeling Title = $user.Functie PasswordNeverExpires = $True ChangePasswordAtLogon = $False Enabled = $True
}
$ADUser = New-ADUser @userParams -PassThru # use PassThru to capture the newly created userNow that you have an ADUser object, you can use that on the Add-ADGroupMember line:
Add-ADGroupMember -Identity $globalgroup -Members $ADUserP.S. It is also advisable to first check if a user with that SamAccountName already exists in the domain, and if so output a warning and skip that user. For that use:
foreach ($user in $users) { $ADUSer = Get-ADUser -Filter "SamAccountName -eq '$($user.Achternaam)'" -ErrorAction SilentlyContinue if ($ADUser) { Write-Warning "A user '$($user.Achternaam)' already exists in the domain" continue # skip this user and proceed with the next one } # here the rest of the code
}O yes, the reason why New-ADUser failed was:
- You didn't specify the (required) SamAccountName
- The UserPrincipalName was syntactically wrong (see inline comment)
