new push
This commit is contained in:
Gramzon
+7
-7
@@ -10,7 +10,7 @@
|
||||
New-ADGroup -Name "IT Support" `
|
||||
-GroupScope Global `
|
||||
-GroupCategory Security `
|
||||
-Path "OU=Groups,DC=InfraIT,DC=sec"
|
||||
-Path "OU=Groups,DC=RohanIT,DC=sec"
|
||||
|
||||
|
||||
### Deleting a Group
|
||||
@@ -28,19 +28,19 @@ Remove-ADGroup -Identity "IT Support" -Confirm:$false
|
||||
$groups = @(
|
||||
@{
|
||||
Name = "IT Support"
|
||||
Path = "OU=IT,OU=Groups,DC=InfraIT,DC=sec"
|
||||
Path = "OU=IT,OU=Groups,DC=RohanIT,DC=sec"
|
||||
Scope = "Global"
|
||||
Category = "Security"
|
||||
},
|
||||
@{
|
||||
Name = "HR Team"
|
||||
Path = "OU=HR,OU=Groups,DC=InfraIT,DC=sec"
|
||||
Path = "OU=HR,OU=Groups,DC=RohanIT,DC=sec"
|
||||
Scope = "Global"
|
||||
Category = "Security"
|
||||
},
|
||||
@{
|
||||
Name = "Finance Users"
|
||||
Path = "OU=Finance,OU=Groups,DC=InfraIT,DC=sec"
|
||||
Path = "OU=Finance,OU=Groups,DC=RohanIT,DC=sec"
|
||||
Scope = "Global"
|
||||
Category = "Security"
|
||||
}
|
||||
@@ -202,14 +202,14 @@ function Remove-CustomADGroupMember {
|
||||
$groups = @(
|
||||
@{
|
||||
Name = "IT Support"
|
||||
Path = "OU=IT,OU=Groups,DC=InfraIT,DC=sec"
|
||||
Path = "OU=IT,OU=Groups,DC=RohanIT,DC=sec"
|
||||
Scope = "Global"
|
||||
Category = "Security"
|
||||
Members = @("John.Doe", "Jane.Smith", "Help Desk")
|
||||
},
|
||||
@{
|
||||
Name = "HR Team"
|
||||
Path = "OU=HR,OU=Groups,DC=InfraIT,DC=sec"
|
||||
Path = "OU=HR,OU=Groups,DC=RohanIT,DC=sec"
|
||||
Scope = "Global"
|
||||
Category = "Security"
|
||||
Members = @("Sarah.Johnson", "HR Managers")
|
||||
@@ -240,4 +240,4 @@ Add-CustomADGroupMember -GroupName "HR Team" -Members @("New.Employee")
|
||||
#5. Handling errors at each step
|
||||
#6. Providing clear feedback for all operations
|
||||
|
||||
#Remember to replace "DC=InfraIT,DC=sec" and the OU paths with your actual domain structure. Also ensure that the users and groups you're referencing actually exist in your Active Directory environment.
|
||||
#Remember to replace "DC=RohanIT,DC=sec" and the OU paths with your actual domain structure. Also ensure that the users and groups you're referencing actually exist in your Active Directory environment.
|
||||
+19
-19
@@ -7,7 +7,7 @@
|
||||
|
||||
### Creating a Basic OU
|
||||
#powershell
|
||||
New-ADOrganizationalUnit -Name "TestOU" -Path "DC=infrait,DC=sec"
|
||||
New-ADOrganizationalUnit -Name "Riddermark" -Path "DC=RohanIT,DC=sec"
|
||||
|
||||
### Deleting the OU
|
||||
#There are two approaches to delete an OU:
|
||||
@@ -15,20 +15,20 @@ New-ADOrganizationalUnit -Name "TestOU" -Path "DC=infrait,DC=sec"
|
||||
#### Option 1: Disable Protection and Delete
|
||||
#powershell
|
||||
# First, disable the protection
|
||||
Set-ADOrganizationalUnit -Identity "OU=TestOU,DC=infrait,DC=sec" -ProtectedFromAccidentalDeletion $false
|
||||
Set-ADOrganizationalUnit -Identity "OU=TestOU,DC=RohanIT,DC=sec" -ProtectedFromAccidentalDeletion $false
|
||||
|
||||
# Then delete the OU
|
||||
Remove-ADOrganizationalUnit -Identity "OU=TestOU,DC=infrait,DC=sec" -Confirm:$false
|
||||
Remove-ADOrganizationalUnit -Identity "OU=TestOU,DC=RohanIT,DC=sec" -Confirm:$false
|
||||
|
||||
|
||||
#### Option 2: Create OU Without Protection
|
||||
#When creating new OUs, you can disable the protection from the start:
|
||||
#powershell
|
||||
# Create OU with protection disabled
|
||||
New-ADOrganizationalUnit -Name "TestOU" -Path "DC=infrait,DC=sec" -ProtectedFromAccidentalDeletion $false
|
||||
New-ADOrganizationalUnit -Name "Groups" -Path "DC=RohanIT,DC=sec" -ProtectedFromAccidentalDeletion $false
|
||||
|
||||
# Now you can delete it without first disabling protection
|
||||
Remove-ADOrganizationalUnit -Identity "OU=TestOU,DC=infrait,DC=sec" -Confirm:$false
|
||||
Remove-ADOrganizationalUnit -Identity "OU=Groups,DC=RohanIT,DC=sec" -Confirm:$false
|
||||
|
||||
|
||||
## Checking OU Existence Before Creation
|
||||
@@ -38,16 +38,16 @@ Remove-ADOrganizationalUnit -Identity "OU=TestOU,DC=infrait,DC=sec" -Confirm:$fa
|
||||
### Checking and Creating an OU
|
||||
#powershell
|
||||
# First command: Check if OU exists
|
||||
if (-not(Get-ADOrganizationalUnit -Filter "Name -eq 'TestOU'" -SearchBase "DC=infrait,DC=sec")) {
|
||||
New-ADOrganizationalUnit -Name "TestOU" -Path "DC=infrait,DC=sec"
|
||||
if (-not(Get-ADOrganizationalUnit -Filter "Name -eq 'TestOU'" -SearchBase "DC=RohanIT,DC=sec")) {
|
||||
New-ADOrganizationalUnit -Name "TestOU" -Path "DC=RohanIT,DC=sec"
|
||||
}
|
||||
|
||||
|
||||
### Deleting with Verification
|
||||
#powershell
|
||||
# Second command: Check if OU exists before deleting
|
||||
if (Get-ADOrganizationalUnit -Filter "Name -eq 'TestOU'" -SearchBase "DC=infrait,DC=sec") {
|
||||
Remove-ADOrganizationalUnit -Identity "OU=TestOU,DC=infrait,DC=sec" -Recursive -Confirm:$false
|
||||
if (Get-ADOrganizationalUnit -Filter "Name -eq 'TestOU'" -SearchBase "DC=RohanIT,DC=sec") {
|
||||
Remove-ADOrganizationalUnit -Identity "OU=TestOU,DC=RohanIT,DC=sec" -Recursive -Confirm:$false
|
||||
}
|
||||
|
||||
|
||||
@@ -57,8 +57,8 @@ if (Get-ADOrganizationalUnit -Filter "Name -eq 'TestOU'" -SearchBase "DC=infrait
|
||||
|
||||
#powershell
|
||||
# Define the OU details
|
||||
$ouName = "TestOU"
|
||||
$domainPath = "DC=infrait,DC=sec"
|
||||
$ouName = "Riddermark"
|
||||
$domainPath = "DC=RohanIT,DC=sec"
|
||||
$ouPath = "OU=$ouName,$domainPath"
|
||||
|
||||
# Try to create the OU with error handling
|
||||
@@ -84,25 +84,25 @@ try {
|
||||
#To find the path of an existing OU:
|
||||
#powershell
|
||||
# Get the Distinguished Name of an existing OU
|
||||
Get-ADOrganizationalUnit -Filter "Name -eq 'ParentOU'" -SearchBase "DC=infrait,DC=sec" |
|
||||
Get-ADOrganizationalUnit -Filter "Name -eq 'ParentOU'" -SearchBase "DC=RohanIT,DC=sec" |
|
||||
Select-Object -ExpandProperty DistinguishedName
|
||||
|
||||
|
||||
### Creating an OU Inside Another OU
|
||||
#powershell
|
||||
# First, create the parent OU
|
||||
New-ADOrganizationalUnit -Name "ParentOU" -Path "DC=infrait,DC=sec"
|
||||
New-ADOrganizationalUnit -Name "ParentOU" -Path "DC=RohanIT,DC=sec"
|
||||
|
||||
# Then create a child OU inside the parent OU
|
||||
New-ADOrganizationalUnit -Name "ChildOU" -Path "OU=ParentOU,DC=infrait,DC=sec"
|
||||
New-ADOrganizationalUnit -Name "Riders" -Path "OU=Riddermark,DC=RohanIT,DC=sec"
|
||||
|
||||
|
||||
### Complete Example with Nested OUs and Error Handling
|
||||
#powershell
|
||||
# Define the OU structure
|
||||
$parentOUName = "ParentOU"
|
||||
$childOUName = "ChildOU"
|
||||
$domainPath = "DC=infrait,DC=sec"
|
||||
$parentOUName = "Riddermark"
|
||||
$childOUName = "Riders"
|
||||
$domainPath = "DC=RohanIT,DC=sec"
|
||||
|
||||
# Function to create an OU with error handling
|
||||
function Create-ADOU {
|
||||
@@ -167,7 +167,7 @@ $ouStructure = @{
|
||||
)
|
||||
}
|
||||
|
||||
$domainPath = "DC=InfraIT,DC=sec"
|
||||
$domainPath = "DC=RohanIT,DC=sec"
|
||||
|
||||
# Function to create an OU with error handling
|
||||
function New-CustomADOU {
|
||||
@@ -296,4 +296,4 @@ function Remove-OUStructure {
|
||||
#6. Safe removal process (children before parents)
|
||||
#7. Status checking before each operation
|
||||
|
||||
#Remember to replace "DC=InfraIT,DC=Sec" with your actual domain path in all examples.
|
||||
#Remember to replace "DC=RohanIT,DC=Sec" with your actual domain path in all examples.
|
||||
|
||||
@@ -0,0 +1,194 @@
|
||||
# ===============================
|
||||
# 1) CREATE DFS FOLDERS (LINKS)
|
||||
# ===============================
|
||||
Invoke-Command -ComputerName srv1 -ScriptBlock {
|
||||
# Create DFS folders for each department
|
||||
$departments = @('Finance','Sales','IT','Consultants','HR')
|
||||
foreach ($dept in $departments) {
|
||||
# This will create a DFS link under the existing DFS root \\RohanIT.sec\files
|
||||
New-DfsnFolder -Path "\\RohanIT.sec\files\$dept" `
|
||||
-TargetPath "\\srv1\$dept" `
|
||||
-EnableTargetFailback $true
|
||||
}
|
||||
}
|
||||
|
||||
# ===============================
|
||||
# 2) VERIFY DFS NAMESPACE CONFIG
|
||||
# ===============================
|
||||
Invoke-Command -ComputerName srv1 -ScriptBlock {
|
||||
Write-Host "Verifying DFS root..."
|
||||
Get-DfsnRoot -Path "\\RohanIT.sec\files"
|
||||
|
||||
Write-Host "`nVerifying DFS folders..."
|
||||
Get-DfsnFolder -Path "\\RohanIT.sec\files\*" |
|
||||
Format-Table Path,TargetPath,State -AutoSize
|
||||
}
|
||||
|
||||
# ===============================
|
||||
# 3) CREATE REQUIRED AD GROUPS
|
||||
# ===============================
|
||||
# Import the AD module locally (ensure RSAT AD tools are installed)
|
||||
Import-Module ActiveDirectory
|
||||
|
||||
# Define the OU path (adjust to your AD)
|
||||
$OUPath = "OU=Groups,DC=RohanIT,DC=sec"
|
||||
|
||||
# List of local groups to create
|
||||
$localGroups = @(
|
||||
"l_fullAccess-hr-share",
|
||||
"l_fullAccess-it-share",
|
||||
"l_fullAccess-sales-share",
|
||||
"l_fullAccess-finance-share",
|
||||
"l_fullAccess-consultants-share"
|
||||
)
|
||||
|
||||
foreach ($lg in $localGroups) {
|
||||
# Check if group already exists
|
||||
$groupExists = Get-ADGroup -Filter "Name -eq '$lg'" -ErrorAction SilentlyContinue
|
||||
if (-not $groupExists) {
|
||||
Write-Host "Creating AD local group: $lg"
|
||||
New-ADGroup -Name $lg `
|
||||
-Path $OUPath `
|
||||
-GroupScope DomainLocal `
|
||||
-GroupCategory Security `
|
||||
-SamAccountName $lg `
|
||||
-Description "Full access local group for $lg"
|
||||
}
|
||||
else {
|
||||
Write-Host "Group '$lg' already exists. Skipping creation."
|
||||
}
|
||||
}
|
||||
|
||||
# ============================================
|
||||
# 4) ADD GLOBAL GROUPS AS MEMBERS TO LOCAL
|
||||
# ============================================
|
||||
# Mapping: local group -> matching global group
|
||||
# (Assumes your global groups follow the pattern g_all_<dept>)
|
||||
$groupMapping = @{
|
||||
'l_fullAccess-hr-share' = 'g_all_hr'
|
||||
'l_fullAccess-it-share' = 'g_all_it'
|
||||
'l_fullAccess-sales-share' = 'g_all_sales'
|
||||
'l_fullAccess-finance-share' = 'g_all_finance'
|
||||
'l_fullAccess-consultants-share' = 'g_all_consultants'
|
||||
}
|
||||
|
||||
foreach ($localGroup in $groupMapping.Keys) {
|
||||
$globalGroup = $groupMapping[$localGroup]
|
||||
|
||||
# Verify both groups exist
|
||||
$lgObject = Get-ADGroup -Filter "Name -eq '$localGroup'" -ErrorAction SilentlyContinue
|
||||
$ggObject = Get-ADGroup -Filter "Name -eq '$globalGroup'" -ErrorAction SilentlyContinue
|
||||
|
||||
if ($lgObject -and $ggObject) {
|
||||
Write-Host "`nAdding $globalGroup to $localGroup..."
|
||||
try {
|
||||
Add-ADGroupMember -Identity $localGroup -Members $globalGroup -ErrorAction Stop
|
||||
Write-Host "Successfully added $globalGroup to $localGroup."
|
||||
}
|
||||
catch {
|
||||
Write-Warning "Could not add $globalGroup to $localGroup. `nError: $_"
|
||||
}
|
||||
}
|
||||
else {
|
||||
Write-Warning "Either $localGroup or $globalGroup does not exist in AD. Check naming and OU paths."
|
||||
}
|
||||
}
|
||||
|
||||
# ======================================
|
||||
# 5) CONFIGURE NTFS PERMISSIONS
|
||||
# ======================================
|
||||
Invoke-Command -ComputerName srv1 -ScriptBlock {
|
||||
# Map each folder to its domain local group
|
||||
$folderPermissions = @{
|
||||
'HR' = 'l_fullAccess-hr-share'
|
||||
'IT' = 'l_fullAccess-it-share'
|
||||
'Sales' = 'l_fullAccess-sales-share'
|
||||
'Finance' = 'l_fullAccess-finance-share'
|
||||
'Consultants' = 'l_fullAccess-consultants-share'
|
||||
}
|
||||
|
||||
foreach ($folder in $folderPermissions.Keys) {
|
||||
$path = "C:\shares\$folder"
|
||||
$group = $folderPermissions[$folder]
|
||||
|
||||
Write-Host "`nConfiguring NTFS permissions on $path..."
|
||||
|
||||
# Create a new, "clean" ACL (removing inheritance)
|
||||
$acl = New-Object System.Security.AccessControl.DirectorySecurity
|
||||
$acl.SetAccessRuleProtection($true, $false) # Disable inheritance, remove inherited perms
|
||||
|
||||
# Build and add required rules
|
||||
$adminRule = New-Object System.Security.AccessControl.FileSystemAccessRule(
|
||||
"BUILTIN\Administrators",
|
||||
"FullControl",
|
||||
"ContainerInherit,ObjectInherit",
|
||||
"None",
|
||||
"Allow"
|
||||
)
|
||||
$systemRule = New-Object System.Security.AccessControl.FileSystemAccessRule(
|
||||
"NT AUTHORITY\SYSTEM",
|
||||
"FullControl",
|
||||
"ContainerInherit,ObjectInherit",
|
||||
"None",
|
||||
"Allow"
|
||||
)
|
||||
$groupRule = New-Object System.Security.AccessControl.FileSystemAccessRule(
|
||||
$group,
|
||||
"FullControl",
|
||||
"ContainerInherit,ObjectInherit",
|
||||
"None",
|
||||
"Allow"
|
||||
)
|
||||
|
||||
[void]$acl.AddAccessRule($adminRule)
|
||||
[void]$acl.AddAccessRule($systemRule)
|
||||
[void]$acl.AddAccessRule($groupRule)
|
||||
|
||||
# Apply new ACL to the folder
|
||||
Set-Acl -Path $path -AclObject $acl
|
||||
Write-Host "NTFS Permissions set for $folder"
|
||||
}
|
||||
|
||||
# Also configure the DFS root folder (C:\dfsroots\files)
|
||||
Write-Host "`nConfiguring NTFS permissions on DFS root (C:\dfsroots\files)..."
|
||||
$dfsPath = "C:\dfsroots\files"
|
||||
$dfsAcl = New-Object System.Security.AccessControl.DirectorySecurity
|
||||
$dfsAcl.SetAccessRuleProtection($true, $false)
|
||||
|
||||
# Re-use the base rules
|
||||
$dfsAcl.AddAccessRule($adminRule)
|
||||
$dfsAcl.AddAccessRule($systemRule)
|
||||
|
||||
# Grant full control to all dept local groups
|
||||
foreach ($deptGroup in $folderPermissions.Values) {
|
||||
$deptRule = New-Object System.Security.AccessControl.FileSystemAccessRule(
|
||||
$deptGroup,
|
||||
"FullControl",
|
||||
"ContainerInherit,ObjectInherit",
|
||||
"None",
|
||||
"Allow"
|
||||
)
|
||||
[void]$dfsAcl.AddAccessRule($deptRule)
|
||||
}
|
||||
|
||||
Set-Acl -Path $dfsPath -AclObject $dfsAcl
|
||||
Write-Host "NTFS Permissions set for DFS root."
|
||||
}
|
||||
|
||||
# ====================================
|
||||
# 6) VERIFY NTFS PERMISSIONS
|
||||
# ====================================
|
||||
Invoke-Command -ComputerName srv1 -ScriptBlock {
|
||||
$folders = @('HR', 'IT', 'Sales', 'Finance', 'Consultants')
|
||||
foreach ($folder in $folders) {
|
||||
Write-Host "`nPermissions for $folder folder:" -ForegroundColor Yellow
|
||||
(Get-Acl -Path "C:\shares\$folder").Access |
|
||||
Select-Object IdentityReference, FileSystemRights
|
||||
}
|
||||
|
||||
Write-Host "`nPermissions for DFS root (C:\dfsroots\files):" -ForegroundColor Yellow
|
||||
(Get-Acl -Path "C:\dfsroots\files").Access |
|
||||
Select-Object IdentityReference, FileSystemRights
|
||||
}
|
||||
|
||||
Write-Host "`nAll steps completed. DFS links, AD groups, membership, and NTFS permissions have been configured."
|
||||
+197
@@ -0,0 +1,197 @@
|
||||
Import-Module ActiveDirectory
|
||||
|
||||
# 1. Set your domain DN
|
||||
$DomainDN = "DC=RohanIT,DC=sec"
|
||||
|
||||
# 2. Function to create OU if it doesn't exist
|
||||
function New-MyOU {
|
||||
param(
|
||||
[string]$Name,
|
||||
[string]$ParentDN
|
||||
)
|
||||
$checkOU = Get-ADOrganizationalUnit -Filter "Name -eq '$Name'" -SearchBase $ParentDN -ErrorAction SilentlyContinue
|
||||
if (-not $checkOU) {
|
||||
try {
|
||||
New-ADOrganizationalUnit -Name $Name -Path $ParentDN -ErrorAction Stop | Out-Null
|
||||
Write-Host "Created OU: $Name in $ParentDN"
|
||||
}
|
||||
catch {
|
||||
Write-Warning "Failed to create OU: $Name. $_"
|
||||
}
|
||||
}
|
||||
else {
|
||||
Write-Host "OU '$Name' already exists under $ParentDN. Skipping."
|
||||
}
|
||||
}
|
||||
|
||||
# 3. Function to create random password
|
||||
function New-RandomPassword {
|
||||
param([int]$length = 12)
|
||||
$chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()'
|
||||
-join ((1..$length) | ForEach-Object { $chars[(Get-Random -Maximum $chars.Length)] })
|
||||
}
|
||||
|
||||
# --- CREATE THE OU STRUCTURE ---
|
||||
|
||||
# 4. Create top-level OUs
|
||||
New-MyOU -Name "RohanIT_Users" -ParentDN $DomainDN
|
||||
New-MyOU -Name "RohanIT_Computers" -ParentDN $DomainDN
|
||||
New-MyOU -Name "RohanIT_Groups" -ParentDN $DomainDN
|
||||
|
||||
# Sub-OUs: RohanIT_Users
|
||||
$usersOU = "OU=RohanIT_Users,$DomainDN"
|
||||
New-MyOU -Name "Finance" -ParentDN $usersOU
|
||||
New-MyOU -Name "Sales" -ParentDN $usersOU
|
||||
New-MyOU -Name "IT" -ParentDN $usersOU
|
||||
New-MyOU -Name "Consultants" -ParentDN $usersOU
|
||||
New-MyOU -Name "HR" -ParentDN $usersOU
|
||||
|
||||
# Sub-OUs: RohanIT_Computers
|
||||
$computersOU = "OU=RohanIT_Computers,$DomainDN"
|
||||
New-MyOU -Name "Workstations" -ParentDN $computersOU
|
||||
New-MyOU -Name "Servers" -ParentDN $computersOU
|
||||
|
||||
$workstationsOU = "OU=Workstations,$computersOU"
|
||||
New-MyOU -Name "Finance" -ParentDN $workstationsOU
|
||||
New-MyOU -Name "Sales" -ParentDN $workstationsOU
|
||||
New-MyOU -Name "IT" -ParentDN $workstationsOU
|
||||
New-MyOU -Name "Consultants" -ParentDN $workstationsOU
|
||||
New-MyOU -Name "HR" -ParentDN $workstationsOU
|
||||
|
||||
# Sub-OUs: RohanIT_Groups
|
||||
$groupsOU = "OU=RohanIT_Groups,$DomainDN"
|
||||
New-MyOU -Name "Global" -ParentDN $groupsOU
|
||||
New-MyOU -Name "Local" -ParentDN $groupsOU
|
||||
|
||||
# --- CREATE GLOBAL GROUPS FOR DEPARTMENTS ---
|
||||
$globalOU = "OU=Global,$groupsOU"
|
||||
$departments = @("Finance","Sales","IT","Consultants","HR")
|
||||
|
||||
foreach ($dept in $departments) {
|
||||
$groupName = "GG_$dept"
|
||||
$exists = Get-ADGroup -Filter "Name -eq '$groupName'" -SearchBase $globalOU -ErrorAction SilentlyContinue
|
||||
if (-not $exists) {
|
||||
try {
|
||||
New-ADGroup -Name $groupName -GroupScope Global -Path $globalOU -SamAccountName $groupName
|
||||
Write-Host "Created Global Group: $groupName"
|
||||
}
|
||||
catch {
|
||||
Write-Warning "Failed to create group $groupName. $_"
|
||||
}
|
||||
}
|
||||
else {
|
||||
Write-Host "Group '$groupName' already exists. Skipping."
|
||||
}
|
||||
}
|
||||
|
||||
# --- CREATE USERS & ADD TO GROUPS ---
|
||||
|
||||
# Example distribution:
|
||||
# Finance: 2 users, HR: 1 user, Sales: 2 users, IT: 2 users, Consultants: 9 users
|
||||
$usersToCreate = @(
|
||||
# Finance (1)
|
||||
@{ Department="Finance"; FirstName="Bob"; LastName="Olsen" },
|
||||
|
||||
|
||||
# HR (1)
|
||||
@{ Department="HR"; FirstName="Harry"; LastName="Hope" },
|
||||
|
||||
# Sales (2)
|
||||
@{ Department="Sales"; FirstName="Sally"; LastName="Amberlamps" },
|
||||
@{ Department="Sales"; FirstName="Sam"; LastName="Brannmann" },
|
||||
|
||||
# IT (2)
|
||||
@{ Department="IT"; FirstName="Kåre"; LastName="Monsen" },
|
||||
@{ Department="IT"; FirstName="Iris"; LastName="Elaiassen" },
|
||||
|
||||
# Consultants (9)
|
||||
@{ Department="Consultants"; FirstName="Vilfred"; LastName="Williassen" },
|
||||
@{ Department="Consultants"; FirstName="May"; LastName="Karstensen" },
|
||||
@{ Department="Consultants"; FirstName="Mons"; LastName="Andersen" },
|
||||
@{ Department="Consultants"; FirstName="Anders"; LastName="Monsen" },
|
||||
@{ Department="Consultants"; FirstName="Ali"; LastName="Muhammed" },
|
||||
@{ Department="Consultants"; FirstName="Kristian"; LastName="Kristoffersen" },
|
||||
@{ Department="Consultants"; FirstName="Nicolai"; LastName="Stiansen" },
|
||||
@{ Department="Consultants"; FirstName="Marita"; LastName="Bruun" },
|
||||
@{ Department="Consultants"; FirstName="Ellie"; LastName="Eiliassen" }
|
||||
)
|
||||
|
||||
foreach ($u in $usersToCreate) {
|
||||
$dept = $u.Department
|
||||
$fn = $u.FirstName
|
||||
$ln = $u.LastName
|
||||
$fullName = "$fn $ln"
|
||||
# SamAccountName: e.g. "jfin1", "sfin2", etc.
|
||||
$sam = ($fn.Substring(0,1) + $ln).ToLower()
|
||||
$upn = $sam + "@" + ($DomainDN.Replace("DC=", "").Replace(",", "."))
|
||||
$userOU = "OU=$dept,OU=RohanIT_Users,$DomainDN"
|
||||
$password = New-RandomPassword -length 12
|
||||
|
||||
# Create user if doesn't exist
|
||||
$checkUser = Get-ADUser -Filter "SamAccountName -eq '$sam'" -SearchBase $userOU -ErrorAction SilentlyContinue
|
||||
if (-not $checkUser) {
|
||||
try {
|
||||
New-ADUser -Name $fullName `
|
||||
-SamAccountName $sam `
|
||||
-UserPrincipalName $upn `
|
||||
-Path $userOU `
|
||||
-GivenName $fn `
|
||||
-Surname $ln `
|
||||
-Department $dept `
|
||||
-AccountPassword (ConvertTo-SecureString $password -AsPlainText -Force) `
|
||||
-ChangePasswordAtLogon $true `
|
||||
-Enabled $true
|
||||
|
||||
Write-Host "Created user: $fullName (SAM=$sam) in $dept. Password=$password"
|
||||
|
||||
# Add user to the correct Global Group
|
||||
$groupName = "GG_$dept"
|
||||
Add-ADGroupMember -Identity $groupName -Members $sam
|
||||
Write-Host " Added $fullName to $groupName."
|
||||
}
|
||||
catch {
|
||||
Write-Warning "Error creating user $fullName. $_"
|
||||
}
|
||||
}
|
||||
else {
|
||||
Write-Host "User $sam already exists in OU=$dept. Skipping."
|
||||
}
|
||||
}
|
||||
|
||||
Write-Host "`nDone creating OUs, groups, and users in RohanIT.sec domain."
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<# This instance created users; Created user: Bob Olsen (SAM=bolsen) in Finance. Password=CF&TXrJSPJ%m
|
||||
Added Bob Olsen to GG_Finance.
|
||||
Created user: Harry Hope (SAM=hhope) in HR. Password=Test1234*
|
||||
Added Harry Hope to GG_HR.
|
||||
Created user: Sally Amberlamps (SAM=samberlamps) in Sales. Password=#G6AiBWvKdL#
|
||||
Added Sally Amberlamps to GG_Sales.
|
||||
Created user: Sam Brannmann (SAM=sbrannmann) in Sales. Password=4ibXzHoEgSpT
|
||||
Added Sam Brannmann to GG_Sales.
|
||||
Created user: Kåre Monsen (SAM=kmonsen) in IT. Password=fXLDR!y!a8M7
|
||||
Added Kåre Monsen to GG_IT.
|
||||
Created user: Iris Elaiassen (SAM=ielaiassen) in IT. Password=XBtY$%6$3A&g
|
||||
Added Iris Elaiassen to GG_IT.
|
||||
Created user: Vilfred Williassen (SAM=vwilliassen) in Consultants. Password=)yTowvb%y$yX
|
||||
Added Vilfred Williassen to GG_Consultants.
|
||||
Created user: May Karstensen (SAM=mkarstensen) in Consultants. Password=)#Ht@dunTB2X
|
||||
Added May Karstensen to GG_Consultants.
|
||||
Created user: Mons Andersen (SAM=mandersen) in Consultants. Password=Gp6ydyD)y)yx
|
||||
Added Mons Andersen to GG_Consultants.
|
||||
Created user: Anders Monsen (SAM=amonsen) in Consultants. Password=vbL*cj7A^HGy
|
||||
Added Anders Monsen to GG_Consultants.
|
||||
Created user: Ali Muhammed (SAM=amuhammed) in Consultants. Password=ThXb(JJySU^N
|
||||
Added Ali Muhammed to GG_Consultants.
|
||||
Created user: Kristian Kristoffersen (SAM=kkristoffersen) in Consultants. Password=UGHy6nDiJjnf
|
||||
Added Kristian Kristoffersen to GG_Consultants.
|
||||
Created user: Nicolai Stiansen (SAM=nstiansen) in Consultants. Password=*Pwz3U)X(4pF
|
||||
Added Nicolai Stiansen to GG_Consultants.
|
||||
Created user: Marita Bruun (SAM=mbruun) in Consultants. Password=ngHxu3C3mWKV
|
||||
Added Marita Bruun to GG_Consultants.
|
||||
Created user: Ellie Eiliassen (SAM=eeiliassen) in Consultants. Password=fh3o1jS5pjDq
|
||||
Added Ellie Eiliassen to GG_Consultants.
|
||||
#>
|
||||
Reference in New Issue
Block a user