This document provides instructions and examples for working with Active Directory using Windows PowerShell commands. It demonstrates how to check for existing users, disable and enable user accounts, navigate the Active Directory structure using PowerShell drive paths, retrieve user properties, and import multiple new users from a CSV file using a foreach loop. The key steps are to set up an isolated Active Directory forest for testing, verify a user exists with Get-ADUser, disable and enable a test account, navigate AD paths from the PowerShell prompt, retrieve user properties, and import new users from a CSV template file into the specified OU.
2. Windows Server 2008 R2
Active Directory running and configured
Windows Power Shell
Windows Active Directory PowerShell command list
http://technet.microsoft.com/en-
us/library/ee617195.aspx
A couple of users in Active Directory that we can
manipulate
3.
4.
5.
6.
7.
8. DCPromo starts up a New Active Directory Forrest
For this case your AD should be on its own and not part
of a regular AD Domain.
All users will be local to the isolated AD Domain
The Domain Functional Level in this case does not
matter, you can choose 2003 or 2008
Add DNS and all the features needed for the AD
process
Run Active Directory Users and Computers under
Administrative Tools (start – administrative tools –
users and computers)
9.
10.
11.
12.
13. We want to check out a user to see if the user exists in
AD
Get-aduser jackfrost
23. Import-Module ActiveDirectory
$Users = Import-Csv ".myusers.csv"
foreach ($User in $Users)
{
$OU = "OU=MyUsers,OU=MyStuff,DC=mydomain,DC=local,DC=com"
$Detailedname = $User.firstname + " " + $User.lastname
$Firstname = $User.Firstname
$FirstLetterFirstname = $Firstname.substring(0,1) #not used this but left it in
$SAM = $User.Firstname.tolower() + "." + $user.lastname.tolower()
$userprinci = $SAM + "@mydomain.local.com"
$logonscript = "logscript.vbs"
$homedir = "servermyarea" + $SAM + "My Documents"
#tried this alternative
#$homedir = "servermyarea%username%My Documents"
New-ADUser -Name $Detailedname -SamAccountName $SAM -UserPrincipalName
$userprinci -DisplayName $Detailedname -GivenName
$user.firstname -Surname $user.lastname -Path $OU -HomeDrive "H:" -HomeDirectory
$homedir -scriptpath $logonscript -
PasswordNeverExpires $True -PassThru
#the password is blank on this example
}
24. You have all the basic commands
The script on the preceding page requires a CSV file of
user names
Look at how the script was set up to determine what
should be in the CSV file, (detailedName, FirstName,
FirstLetterFirstName, SAM, ect)
Build a CSV with those headers and enter a couple of
entries in the file
Attempt to import
Submit the CSV file, and a screen cap of the AD Users
Container with your new people