new push
This commit is contained in:
+7
-7
@@ -10,7 +10,7 @@
|
|||||||
New-ADGroup -Name "IT Support" `
|
New-ADGroup -Name "IT Support" `
|
||||||
-GroupScope Global `
|
-GroupScope Global `
|
||||||
-GroupCategory Security `
|
-GroupCategory Security `
|
||||||
-Path "OU=Groups,DC=InfraIT,DC=sec"
|
-Path "OU=Groups,DC=RohanIT,DC=sec"
|
||||||
|
|
||||||
|
|
||||||
### Deleting a Group
|
### Deleting a Group
|
||||||
@@ -28,19 +28,19 @@ Remove-ADGroup -Identity "IT Support" -Confirm:$false
|
|||||||
$groups = @(
|
$groups = @(
|
||||||
@{
|
@{
|
||||||
Name = "IT Support"
|
Name = "IT Support"
|
||||||
Path = "OU=IT,OU=Groups,DC=InfraIT,DC=sec"
|
Path = "OU=IT,OU=Groups,DC=RohanIT,DC=sec"
|
||||||
Scope = "Global"
|
Scope = "Global"
|
||||||
Category = "Security"
|
Category = "Security"
|
||||||
},
|
},
|
||||||
@{
|
@{
|
||||||
Name = "HR Team"
|
Name = "HR Team"
|
||||||
Path = "OU=HR,OU=Groups,DC=InfraIT,DC=sec"
|
Path = "OU=HR,OU=Groups,DC=RohanIT,DC=sec"
|
||||||
Scope = "Global"
|
Scope = "Global"
|
||||||
Category = "Security"
|
Category = "Security"
|
||||||
},
|
},
|
||||||
@{
|
@{
|
||||||
Name = "Finance Users"
|
Name = "Finance Users"
|
||||||
Path = "OU=Finance,OU=Groups,DC=InfraIT,DC=sec"
|
Path = "OU=Finance,OU=Groups,DC=RohanIT,DC=sec"
|
||||||
Scope = "Global"
|
Scope = "Global"
|
||||||
Category = "Security"
|
Category = "Security"
|
||||||
}
|
}
|
||||||
@@ -202,14 +202,14 @@ function Remove-CustomADGroupMember {
|
|||||||
$groups = @(
|
$groups = @(
|
||||||
@{
|
@{
|
||||||
Name = "IT Support"
|
Name = "IT Support"
|
||||||
Path = "OU=IT,OU=Groups,DC=InfraIT,DC=sec"
|
Path = "OU=IT,OU=Groups,DC=RohanIT,DC=sec"
|
||||||
Scope = "Global"
|
Scope = "Global"
|
||||||
Category = "Security"
|
Category = "Security"
|
||||||
Members = @("John.Doe", "Jane.Smith", "Help Desk")
|
Members = @("John.Doe", "Jane.Smith", "Help Desk")
|
||||||
},
|
},
|
||||||
@{
|
@{
|
||||||
Name = "HR Team"
|
Name = "HR Team"
|
||||||
Path = "OU=HR,OU=Groups,DC=InfraIT,DC=sec"
|
Path = "OU=HR,OU=Groups,DC=RohanIT,DC=sec"
|
||||||
Scope = "Global"
|
Scope = "Global"
|
||||||
Category = "Security"
|
Category = "Security"
|
||||||
Members = @("Sarah.Johnson", "HR Managers")
|
Members = @("Sarah.Johnson", "HR Managers")
|
||||||
@@ -240,4 +240,4 @@ Add-CustomADGroupMember -GroupName "HR Team" -Members @("New.Employee")
|
|||||||
#5. Handling errors at each step
|
#5. Handling errors at each step
|
||||||
#6. Providing clear feedback for all operations
|
#6. Providing clear feedback for all operations
|
||||||
|
|
||||||
#Remember to replace "DC=InfraIT,DC=sec" and the OU paths with your actual domain structure. Also ensure that the users and groups you're referencing actually exist in your Active Directory environment.
|
#Remember to replace "DC=RohanIT,DC=sec" and the OU paths with your actual domain structure. Also ensure that the users and groups you're referencing actually exist in your Active Directory environment.
|
||||||
+19
-19
@@ -7,7 +7,7 @@
|
|||||||
|
|
||||||
### Creating a Basic OU
|
### Creating a Basic OU
|
||||||
#powershell
|
#powershell
|
||||||
New-ADOrganizationalUnit -Name "TestOU" -Path "DC=infrait,DC=sec"
|
New-ADOrganizationalUnit -Name "Riddermark" -Path "DC=RohanIT,DC=sec"
|
||||||
|
|
||||||
### Deleting the OU
|
### Deleting the OU
|
||||||
#There are two approaches to delete an OU:
|
#There are two approaches to delete an OU:
|
||||||
@@ -15,20 +15,20 @@ New-ADOrganizationalUnit -Name "TestOU" -Path "DC=infrait,DC=sec"
|
|||||||
#### Option 1: Disable Protection and Delete
|
#### Option 1: Disable Protection and Delete
|
||||||
#powershell
|
#powershell
|
||||||
# First, disable the protection
|
# First, disable the protection
|
||||||
Set-ADOrganizationalUnit -Identity "OU=TestOU,DC=infrait,DC=sec" -ProtectedFromAccidentalDeletion $false
|
Set-ADOrganizationalUnit -Identity "OU=TestOU,DC=RohanIT,DC=sec" -ProtectedFromAccidentalDeletion $false
|
||||||
|
|
||||||
# Then delete the OU
|
# Then delete the OU
|
||||||
Remove-ADOrganizationalUnit -Identity "OU=TestOU,DC=infrait,DC=sec" -Confirm:$false
|
Remove-ADOrganizationalUnit -Identity "OU=TestOU,DC=RohanIT,DC=sec" -Confirm:$false
|
||||||
|
|
||||||
|
|
||||||
#### Option 2: Create OU Without Protection
|
#### Option 2: Create OU Without Protection
|
||||||
#When creating new OUs, you can disable the protection from the start:
|
#When creating new OUs, you can disable the protection from the start:
|
||||||
#powershell
|
#powershell
|
||||||
# Create OU with protection disabled
|
# Create OU with protection disabled
|
||||||
New-ADOrganizationalUnit -Name "TestOU" -Path "DC=infrait,DC=sec" -ProtectedFromAccidentalDeletion $false
|
New-ADOrganizationalUnit -Name "Groups" -Path "DC=RohanIT,DC=sec" -ProtectedFromAccidentalDeletion $false
|
||||||
|
|
||||||
# Now you can delete it without first disabling protection
|
# Now you can delete it without first disabling protection
|
||||||
Remove-ADOrganizationalUnit -Identity "OU=TestOU,DC=infrait,DC=sec" -Confirm:$false
|
Remove-ADOrganizationalUnit -Identity "OU=Groups,DC=RohanIT,DC=sec" -Confirm:$false
|
||||||
|
|
||||||
|
|
||||||
## Checking OU Existence Before Creation
|
## Checking OU Existence Before Creation
|
||||||
@@ -38,16 +38,16 @@ Remove-ADOrganizationalUnit -Identity "OU=TestOU,DC=infrait,DC=sec" -Confirm:$fa
|
|||||||
### Checking and Creating an OU
|
### Checking and Creating an OU
|
||||||
#powershell
|
#powershell
|
||||||
# First command: Check if OU exists
|
# First command: Check if OU exists
|
||||||
if (-not(Get-ADOrganizationalUnit -Filter "Name -eq 'TestOU'" -SearchBase "DC=infrait,DC=sec")) {
|
if (-not(Get-ADOrganizationalUnit -Filter "Name -eq 'TestOU'" -SearchBase "DC=RohanIT,DC=sec")) {
|
||||||
New-ADOrganizationalUnit -Name "TestOU" -Path "DC=infrait,DC=sec"
|
New-ADOrganizationalUnit -Name "TestOU" -Path "DC=RohanIT,DC=sec"
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
### Deleting with Verification
|
### Deleting with Verification
|
||||||
#powershell
|
#powershell
|
||||||
# Second command: Check if OU exists before deleting
|
# Second command: Check if OU exists before deleting
|
||||||
if (Get-ADOrganizationalUnit -Filter "Name -eq 'TestOU'" -SearchBase "DC=infrait,DC=sec") {
|
if (Get-ADOrganizationalUnit -Filter "Name -eq 'TestOU'" -SearchBase "DC=RohanIT,DC=sec") {
|
||||||
Remove-ADOrganizationalUnit -Identity "OU=TestOU,DC=infrait,DC=sec" -Recursive -Confirm:$false
|
Remove-ADOrganizationalUnit -Identity "OU=TestOU,DC=RohanIT,DC=sec" -Recursive -Confirm:$false
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
@@ -57,8 +57,8 @@ if (Get-ADOrganizationalUnit -Filter "Name -eq 'TestOU'" -SearchBase "DC=infrait
|
|||||||
|
|
||||||
#powershell
|
#powershell
|
||||||
# Define the OU details
|
# Define the OU details
|
||||||
$ouName = "TestOU"
|
$ouName = "Riddermark"
|
||||||
$domainPath = "DC=infrait,DC=sec"
|
$domainPath = "DC=RohanIT,DC=sec"
|
||||||
$ouPath = "OU=$ouName,$domainPath"
|
$ouPath = "OU=$ouName,$domainPath"
|
||||||
|
|
||||||
# Try to create the OU with error handling
|
# Try to create the OU with error handling
|
||||||
@@ -84,25 +84,25 @@ try {
|
|||||||
#To find the path of an existing OU:
|
#To find the path of an existing OU:
|
||||||
#powershell
|
#powershell
|
||||||
# Get the Distinguished Name of an existing OU
|
# Get the Distinguished Name of an existing OU
|
||||||
Get-ADOrganizationalUnit -Filter "Name -eq 'ParentOU'" -SearchBase "DC=infrait,DC=sec" |
|
Get-ADOrganizationalUnit -Filter "Name -eq 'ParentOU'" -SearchBase "DC=RohanIT,DC=sec" |
|
||||||
Select-Object -ExpandProperty DistinguishedName
|
Select-Object -ExpandProperty DistinguishedName
|
||||||
|
|
||||||
|
|
||||||
### Creating an OU Inside Another OU
|
### Creating an OU Inside Another OU
|
||||||
#powershell
|
#powershell
|
||||||
# First, create the parent OU
|
# First, create the parent OU
|
||||||
New-ADOrganizationalUnit -Name "ParentOU" -Path "DC=infrait,DC=sec"
|
New-ADOrganizationalUnit -Name "ParentOU" -Path "DC=RohanIT,DC=sec"
|
||||||
|
|
||||||
# Then create a child OU inside the parent OU
|
# Then create a child OU inside the parent OU
|
||||||
New-ADOrganizationalUnit -Name "ChildOU" -Path "OU=ParentOU,DC=infrait,DC=sec"
|
New-ADOrganizationalUnit -Name "Riders" -Path "OU=Riddermark,DC=RohanIT,DC=sec"
|
||||||
|
|
||||||
|
|
||||||
### Complete Example with Nested OUs and Error Handling
|
### Complete Example with Nested OUs and Error Handling
|
||||||
#powershell
|
#powershell
|
||||||
# Define the OU structure
|
# Define the OU structure
|
||||||
$parentOUName = "ParentOU"
|
$parentOUName = "Riddermark"
|
||||||
$childOUName = "ChildOU"
|
$childOUName = "Riders"
|
||||||
$domainPath = "DC=infrait,DC=sec"
|
$domainPath = "DC=RohanIT,DC=sec"
|
||||||
|
|
||||||
# Function to create an OU with error handling
|
# Function to create an OU with error handling
|
||||||
function Create-ADOU {
|
function Create-ADOU {
|
||||||
@@ -167,7 +167,7 @@ $ouStructure = @{
|
|||||||
)
|
)
|
||||||
}
|
}
|
||||||
|
|
||||||
$domainPath = "DC=InfraIT,DC=sec"
|
$domainPath = "DC=RohanIT,DC=sec"
|
||||||
|
|
||||||
# Function to create an OU with error handling
|
# Function to create an OU with error handling
|
||||||
function New-CustomADOU {
|
function New-CustomADOU {
|
||||||
@@ -296,4 +296,4 @@ function Remove-OUStructure {
|
|||||||
#6. Safe removal process (children before parents)
|
#6. Safe removal process (children before parents)
|
||||||
#7. Status checking before each operation
|
#7. Status checking before each operation
|
||||||
|
|
||||||
#Remember to replace "DC=InfraIT,DC=Sec" with your actual domain path in all examples.
|
#Remember to replace "DC=RohanIT,DC=Sec" with your actual domain path in all examples.
|
||||||
|
|||||||
@@ -0,0 +1,194 @@
|
|||||||
|
# ===============================
|
||||||
|
# 1) CREATE DFS FOLDERS (LINKS)
|
||||||
|
# ===============================
|
||||||
|
Invoke-Command -ComputerName srv1 -ScriptBlock {
|
||||||
|
# Create DFS folders for each department
|
||||||
|
$departments = @('Finance','Sales','IT','Consultants','HR')
|
||||||
|
foreach ($dept in $departments) {
|
||||||
|
# This will create a DFS link under the existing DFS root \\RohanIT.sec\files
|
||||||
|
New-DfsnFolder -Path "\\RohanIT.sec\files\$dept" `
|
||||||
|
-TargetPath "\\srv1\$dept" `
|
||||||
|
-EnableTargetFailback $true
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
# ===============================
|
||||||
|
# 2) VERIFY DFS NAMESPACE CONFIG
|
||||||
|
# ===============================
|
||||||
|
Invoke-Command -ComputerName srv1 -ScriptBlock {
|
||||||
|
Write-Host "Verifying DFS root..."
|
||||||
|
Get-DfsnRoot -Path "\\RohanIT.sec\files"
|
||||||
|
|
||||||
|
Write-Host "`nVerifying DFS folders..."
|
||||||
|
Get-DfsnFolder -Path "\\RohanIT.sec\files\*" |
|
||||||
|
Format-Table Path,TargetPath,State -AutoSize
|
||||||
|
}
|
||||||
|
|
||||||
|
# ===============================
|
||||||
|
# 3) CREATE REQUIRED AD GROUPS
|
||||||
|
# ===============================
|
||||||
|
# Import the AD module locally (ensure RSAT AD tools are installed)
|
||||||
|
Import-Module ActiveDirectory
|
||||||
|
|
||||||
|
# Define the OU path (adjust to your AD)
|
||||||
|
$OUPath = "OU=Groups,DC=RohanIT,DC=sec"
|
||||||
|
|
||||||
|
# List of local groups to create
|
||||||
|
$localGroups = @(
|
||||||
|
"l_fullAccess-hr-share",
|
||||||
|
"l_fullAccess-it-share",
|
||||||
|
"l_fullAccess-sales-share",
|
||||||
|
"l_fullAccess-finance-share",
|
||||||
|
"l_fullAccess-consultants-share"
|
||||||
|
)
|
||||||
|
|
||||||
|
foreach ($lg in $localGroups) {
|
||||||
|
# Check if group already exists
|
||||||
|
$groupExists = Get-ADGroup -Filter "Name -eq '$lg'" -ErrorAction SilentlyContinue
|
||||||
|
if (-not $groupExists) {
|
||||||
|
Write-Host "Creating AD local group: $lg"
|
||||||
|
New-ADGroup -Name $lg `
|
||||||
|
-Path $OUPath `
|
||||||
|
-GroupScope DomainLocal `
|
||||||
|
-GroupCategory Security `
|
||||||
|
-SamAccountName $lg `
|
||||||
|
-Description "Full access local group for $lg"
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
Write-Host "Group '$lg' already exists. Skipping creation."
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
# ============================================
|
||||||
|
# 4) ADD GLOBAL GROUPS AS MEMBERS TO LOCAL
|
||||||
|
# ============================================
|
||||||
|
# Mapping: local group -> matching global group
|
||||||
|
# (Assumes your global groups follow the pattern g_all_<dept>)
|
||||||
|
$groupMapping = @{
|
||||||
|
'l_fullAccess-hr-share' = 'g_all_hr'
|
||||||
|
'l_fullAccess-it-share' = 'g_all_it'
|
||||||
|
'l_fullAccess-sales-share' = 'g_all_sales'
|
||||||
|
'l_fullAccess-finance-share' = 'g_all_finance'
|
||||||
|
'l_fullAccess-consultants-share' = 'g_all_consultants'
|
||||||
|
}
|
||||||
|
|
||||||
|
foreach ($localGroup in $groupMapping.Keys) {
|
||||||
|
$globalGroup = $groupMapping[$localGroup]
|
||||||
|
|
||||||
|
# Verify both groups exist
|
||||||
|
$lgObject = Get-ADGroup -Filter "Name -eq '$localGroup'" -ErrorAction SilentlyContinue
|
||||||
|
$ggObject = Get-ADGroup -Filter "Name -eq '$globalGroup'" -ErrorAction SilentlyContinue
|
||||||
|
|
||||||
|
if ($lgObject -and $ggObject) {
|
||||||
|
Write-Host "`nAdding $globalGroup to $localGroup..."
|
||||||
|
try {
|
||||||
|
Add-ADGroupMember -Identity $localGroup -Members $globalGroup -ErrorAction Stop
|
||||||
|
Write-Host "Successfully added $globalGroup to $localGroup."
|
||||||
|
}
|
||||||
|
catch {
|
||||||
|
Write-Warning "Could not add $globalGroup to $localGroup. `nError: $_"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
Write-Warning "Either $localGroup or $globalGroup does not exist in AD. Check naming and OU paths."
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
# ======================================
|
||||||
|
# 5) CONFIGURE NTFS PERMISSIONS
|
||||||
|
# ======================================
|
||||||
|
Invoke-Command -ComputerName srv1 -ScriptBlock {
|
||||||
|
# Map each folder to its domain local group
|
||||||
|
$folderPermissions = @{
|
||||||
|
'HR' = 'l_fullAccess-hr-share'
|
||||||
|
'IT' = 'l_fullAccess-it-share'
|
||||||
|
'Sales' = 'l_fullAccess-sales-share'
|
||||||
|
'Finance' = 'l_fullAccess-finance-share'
|
||||||
|
'Consultants' = 'l_fullAccess-consultants-share'
|
||||||
|
}
|
||||||
|
|
||||||
|
foreach ($folder in $folderPermissions.Keys) {
|
||||||
|
$path = "C:\shares\$folder"
|
||||||
|
$group = $folderPermissions[$folder]
|
||||||
|
|
||||||
|
Write-Host "`nConfiguring NTFS permissions on $path..."
|
||||||
|
|
||||||
|
# Create a new, "clean" ACL (removing inheritance)
|
||||||
|
$acl = New-Object System.Security.AccessControl.DirectorySecurity
|
||||||
|
$acl.SetAccessRuleProtection($true, $false) # Disable inheritance, remove inherited perms
|
||||||
|
|
||||||
|
# Build and add required rules
|
||||||
|
$adminRule = New-Object System.Security.AccessControl.FileSystemAccessRule(
|
||||||
|
"BUILTIN\Administrators",
|
||||||
|
"FullControl",
|
||||||
|
"ContainerInherit,ObjectInherit",
|
||||||
|
"None",
|
||||||
|
"Allow"
|
||||||
|
)
|
||||||
|
$systemRule = New-Object System.Security.AccessControl.FileSystemAccessRule(
|
||||||
|
"NT AUTHORITY\SYSTEM",
|
||||||
|
"FullControl",
|
||||||
|
"ContainerInherit,ObjectInherit",
|
||||||
|
"None",
|
||||||
|
"Allow"
|
||||||
|
)
|
||||||
|
$groupRule = New-Object System.Security.AccessControl.FileSystemAccessRule(
|
||||||
|
$group,
|
||||||
|
"FullControl",
|
||||||
|
"ContainerInherit,ObjectInherit",
|
||||||
|
"None",
|
||||||
|
"Allow"
|
||||||
|
)
|
||||||
|
|
||||||
|
[void]$acl.AddAccessRule($adminRule)
|
||||||
|
[void]$acl.AddAccessRule($systemRule)
|
||||||
|
[void]$acl.AddAccessRule($groupRule)
|
||||||
|
|
||||||
|
# Apply new ACL to the folder
|
||||||
|
Set-Acl -Path $path -AclObject $acl
|
||||||
|
Write-Host "NTFS Permissions set for $folder"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Also configure the DFS root folder (C:\dfsroots\files)
|
||||||
|
Write-Host "`nConfiguring NTFS permissions on DFS root (C:\dfsroots\files)..."
|
||||||
|
$dfsPath = "C:\dfsroots\files"
|
||||||
|
$dfsAcl = New-Object System.Security.AccessControl.DirectorySecurity
|
||||||
|
$dfsAcl.SetAccessRuleProtection($true, $false)
|
||||||
|
|
||||||
|
# Re-use the base rules
|
||||||
|
$dfsAcl.AddAccessRule($adminRule)
|
||||||
|
$dfsAcl.AddAccessRule($systemRule)
|
||||||
|
|
||||||
|
# Grant full control to all dept local groups
|
||||||
|
foreach ($deptGroup in $folderPermissions.Values) {
|
||||||
|
$deptRule = New-Object System.Security.AccessControl.FileSystemAccessRule(
|
||||||
|
$deptGroup,
|
||||||
|
"FullControl",
|
||||||
|
"ContainerInherit,ObjectInherit",
|
||||||
|
"None",
|
||||||
|
"Allow"
|
||||||
|
)
|
||||||
|
[void]$dfsAcl.AddAccessRule($deptRule)
|
||||||
|
}
|
||||||
|
|
||||||
|
Set-Acl -Path $dfsPath -AclObject $dfsAcl
|
||||||
|
Write-Host "NTFS Permissions set for DFS root."
|
||||||
|
}
|
||||||
|
|
||||||
|
# ====================================
|
||||||
|
# 6) VERIFY NTFS PERMISSIONS
|
||||||
|
# ====================================
|
||||||
|
Invoke-Command -ComputerName srv1 -ScriptBlock {
|
||||||
|
$folders = @('HR', 'IT', 'Sales', 'Finance', 'Consultants')
|
||||||
|
foreach ($folder in $folders) {
|
||||||
|
Write-Host "`nPermissions for $folder folder:" -ForegroundColor Yellow
|
||||||
|
(Get-Acl -Path "C:\shares\$folder").Access |
|
||||||
|
Select-Object IdentityReference, FileSystemRights
|
||||||
|
}
|
||||||
|
|
||||||
|
Write-Host "`nPermissions for DFS root (C:\dfsroots\files):" -ForegroundColor Yellow
|
||||||
|
(Get-Acl -Path "C:\dfsroots\files").Access |
|
||||||
|
Select-Object IdentityReference, FileSystemRights
|
||||||
|
}
|
||||||
|
|
||||||
|
Write-Host "`nAll steps completed. DFS links, AD groups, membership, and NTFS permissions have been configured."
|
||||||
+197
@@ -0,0 +1,197 @@
|
|||||||
|
Import-Module ActiveDirectory
|
||||||
|
|
||||||
|
# 1. Set your domain DN
|
||||||
|
$DomainDN = "DC=RohanIT,DC=sec"
|
||||||
|
|
||||||
|
# 2. Function to create OU if it doesn't exist
|
||||||
|
function New-MyOU {
|
||||||
|
param(
|
||||||
|
[string]$Name,
|
||||||
|
[string]$ParentDN
|
||||||
|
)
|
||||||
|
$checkOU = Get-ADOrganizationalUnit -Filter "Name -eq '$Name'" -SearchBase $ParentDN -ErrorAction SilentlyContinue
|
||||||
|
if (-not $checkOU) {
|
||||||
|
try {
|
||||||
|
New-ADOrganizationalUnit -Name $Name -Path $ParentDN -ErrorAction Stop | Out-Null
|
||||||
|
Write-Host "Created OU: $Name in $ParentDN"
|
||||||
|
}
|
||||||
|
catch {
|
||||||
|
Write-Warning "Failed to create OU: $Name. $_"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
Write-Host "OU '$Name' already exists under $ParentDN. Skipping."
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
# 3. Function to create random password
|
||||||
|
function New-RandomPassword {
|
||||||
|
param([int]$length = 12)
|
||||||
|
$chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()'
|
||||||
|
-join ((1..$length) | ForEach-Object { $chars[(Get-Random -Maximum $chars.Length)] })
|
||||||
|
}
|
||||||
|
|
||||||
|
# --- CREATE THE OU STRUCTURE ---
|
||||||
|
|
||||||
|
# 4. Create top-level OUs
|
||||||
|
New-MyOU -Name "RohanIT_Users" -ParentDN $DomainDN
|
||||||
|
New-MyOU -Name "RohanIT_Computers" -ParentDN $DomainDN
|
||||||
|
New-MyOU -Name "RohanIT_Groups" -ParentDN $DomainDN
|
||||||
|
|
||||||
|
# Sub-OUs: RohanIT_Users
|
||||||
|
$usersOU = "OU=RohanIT_Users,$DomainDN"
|
||||||
|
New-MyOU -Name "Finance" -ParentDN $usersOU
|
||||||
|
New-MyOU -Name "Sales" -ParentDN $usersOU
|
||||||
|
New-MyOU -Name "IT" -ParentDN $usersOU
|
||||||
|
New-MyOU -Name "Consultants" -ParentDN $usersOU
|
||||||
|
New-MyOU -Name "HR" -ParentDN $usersOU
|
||||||
|
|
||||||
|
# Sub-OUs: RohanIT_Computers
|
||||||
|
$computersOU = "OU=RohanIT_Computers,$DomainDN"
|
||||||
|
New-MyOU -Name "Workstations" -ParentDN $computersOU
|
||||||
|
New-MyOU -Name "Servers" -ParentDN $computersOU
|
||||||
|
|
||||||
|
$workstationsOU = "OU=Workstations,$computersOU"
|
||||||
|
New-MyOU -Name "Finance" -ParentDN $workstationsOU
|
||||||
|
New-MyOU -Name "Sales" -ParentDN $workstationsOU
|
||||||
|
New-MyOU -Name "IT" -ParentDN $workstationsOU
|
||||||
|
New-MyOU -Name "Consultants" -ParentDN $workstationsOU
|
||||||
|
New-MyOU -Name "HR" -ParentDN $workstationsOU
|
||||||
|
|
||||||
|
# Sub-OUs: RohanIT_Groups
|
||||||
|
$groupsOU = "OU=RohanIT_Groups,$DomainDN"
|
||||||
|
New-MyOU -Name "Global" -ParentDN $groupsOU
|
||||||
|
New-MyOU -Name "Local" -ParentDN $groupsOU
|
||||||
|
|
||||||
|
# --- CREATE GLOBAL GROUPS FOR DEPARTMENTS ---
|
||||||
|
$globalOU = "OU=Global,$groupsOU"
|
||||||
|
$departments = @("Finance","Sales","IT","Consultants","HR")
|
||||||
|
|
||||||
|
foreach ($dept in $departments) {
|
||||||
|
$groupName = "GG_$dept"
|
||||||
|
$exists = Get-ADGroup -Filter "Name -eq '$groupName'" -SearchBase $globalOU -ErrorAction SilentlyContinue
|
||||||
|
if (-not $exists) {
|
||||||
|
try {
|
||||||
|
New-ADGroup -Name $groupName -GroupScope Global -Path $globalOU -SamAccountName $groupName
|
||||||
|
Write-Host "Created Global Group: $groupName"
|
||||||
|
}
|
||||||
|
catch {
|
||||||
|
Write-Warning "Failed to create group $groupName. $_"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
Write-Host "Group '$groupName' already exists. Skipping."
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
# --- CREATE USERS & ADD TO GROUPS ---
|
||||||
|
|
||||||
|
# Example distribution:
|
||||||
|
# Finance: 2 users, HR: 1 user, Sales: 2 users, IT: 2 users, Consultants: 9 users
|
||||||
|
$usersToCreate = @(
|
||||||
|
# Finance (1)
|
||||||
|
@{ Department="Finance"; FirstName="Bob"; LastName="Olsen" },
|
||||||
|
|
||||||
|
|
||||||
|
# HR (1)
|
||||||
|
@{ Department="HR"; FirstName="Harry"; LastName="Hope" },
|
||||||
|
|
||||||
|
# Sales (2)
|
||||||
|
@{ Department="Sales"; FirstName="Sally"; LastName="Amberlamps" },
|
||||||
|
@{ Department="Sales"; FirstName="Sam"; LastName="Brannmann" },
|
||||||
|
|
||||||
|
# IT (2)
|
||||||
|
@{ Department="IT"; FirstName="Kåre"; LastName="Monsen" },
|
||||||
|
@{ Department="IT"; FirstName="Iris"; LastName="Elaiassen" },
|
||||||
|
|
||||||
|
# Consultants (9)
|
||||||
|
@{ Department="Consultants"; FirstName="Vilfred"; LastName="Williassen" },
|
||||||
|
@{ Department="Consultants"; FirstName="May"; LastName="Karstensen" },
|
||||||
|
@{ Department="Consultants"; FirstName="Mons"; LastName="Andersen" },
|
||||||
|
@{ Department="Consultants"; FirstName="Anders"; LastName="Monsen" },
|
||||||
|
@{ Department="Consultants"; FirstName="Ali"; LastName="Muhammed" },
|
||||||
|
@{ Department="Consultants"; FirstName="Kristian"; LastName="Kristoffersen" },
|
||||||
|
@{ Department="Consultants"; FirstName="Nicolai"; LastName="Stiansen" },
|
||||||
|
@{ Department="Consultants"; FirstName="Marita"; LastName="Bruun" },
|
||||||
|
@{ Department="Consultants"; FirstName="Ellie"; LastName="Eiliassen" }
|
||||||
|
)
|
||||||
|
|
||||||
|
foreach ($u in $usersToCreate) {
|
||||||
|
$dept = $u.Department
|
||||||
|
$fn = $u.FirstName
|
||||||
|
$ln = $u.LastName
|
||||||
|
$fullName = "$fn $ln"
|
||||||
|
# SamAccountName: e.g. "jfin1", "sfin2", etc.
|
||||||
|
$sam = ($fn.Substring(0,1) + $ln).ToLower()
|
||||||
|
$upn = $sam + "@" + ($DomainDN.Replace("DC=", "").Replace(",", "."))
|
||||||
|
$userOU = "OU=$dept,OU=RohanIT_Users,$DomainDN"
|
||||||
|
$password = New-RandomPassword -length 12
|
||||||
|
|
||||||
|
# Create user if doesn't exist
|
||||||
|
$checkUser = Get-ADUser -Filter "SamAccountName -eq '$sam'" -SearchBase $userOU -ErrorAction SilentlyContinue
|
||||||
|
if (-not $checkUser) {
|
||||||
|
try {
|
||||||
|
New-ADUser -Name $fullName `
|
||||||
|
-SamAccountName $sam `
|
||||||
|
-UserPrincipalName $upn `
|
||||||
|
-Path $userOU `
|
||||||
|
-GivenName $fn `
|
||||||
|
-Surname $ln `
|
||||||
|
-Department $dept `
|
||||||
|
-AccountPassword (ConvertTo-SecureString $password -AsPlainText -Force) `
|
||||||
|
-ChangePasswordAtLogon $true `
|
||||||
|
-Enabled $true
|
||||||
|
|
||||||
|
Write-Host "Created user: $fullName (SAM=$sam) in $dept. Password=$password"
|
||||||
|
|
||||||
|
# Add user to the correct Global Group
|
||||||
|
$groupName = "GG_$dept"
|
||||||
|
Add-ADGroupMember -Identity $groupName -Members $sam
|
||||||
|
Write-Host " Added $fullName to $groupName."
|
||||||
|
}
|
||||||
|
catch {
|
||||||
|
Write-Warning "Error creating user $fullName. $_"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
Write-Host "User $sam already exists in OU=$dept. Skipping."
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
Write-Host "`nDone creating OUs, groups, and users in RohanIT.sec domain."
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
<# This instance created users; Created user: Bob Olsen (SAM=bolsen) in Finance. Password=CF&TXrJSPJ%m
|
||||||
|
Added Bob Olsen to GG_Finance.
|
||||||
|
Created user: Harry Hope (SAM=hhope) in HR. Password=Test1234*
|
||||||
|
Added Harry Hope to GG_HR.
|
||||||
|
Created user: Sally Amberlamps (SAM=samberlamps) in Sales. Password=#G6AiBWvKdL#
|
||||||
|
Added Sally Amberlamps to GG_Sales.
|
||||||
|
Created user: Sam Brannmann (SAM=sbrannmann) in Sales. Password=4ibXzHoEgSpT
|
||||||
|
Added Sam Brannmann to GG_Sales.
|
||||||
|
Created user: Kåre Monsen (SAM=kmonsen) in IT. Password=fXLDR!y!a8M7
|
||||||
|
Added Kåre Monsen to GG_IT.
|
||||||
|
Created user: Iris Elaiassen (SAM=ielaiassen) in IT. Password=XBtY$%6$3A&g
|
||||||
|
Added Iris Elaiassen to GG_IT.
|
||||||
|
Created user: Vilfred Williassen (SAM=vwilliassen) in Consultants. Password=)yTowvb%y$yX
|
||||||
|
Added Vilfred Williassen to GG_Consultants.
|
||||||
|
Created user: May Karstensen (SAM=mkarstensen) in Consultants. Password=)#Ht@dunTB2X
|
||||||
|
Added May Karstensen to GG_Consultants.
|
||||||
|
Created user: Mons Andersen (SAM=mandersen) in Consultants. Password=Gp6ydyD)y)yx
|
||||||
|
Added Mons Andersen to GG_Consultants.
|
||||||
|
Created user: Anders Monsen (SAM=amonsen) in Consultants. Password=vbL*cj7A^HGy
|
||||||
|
Added Anders Monsen to GG_Consultants.
|
||||||
|
Created user: Ali Muhammed (SAM=amuhammed) in Consultants. Password=ThXb(JJySU^N
|
||||||
|
Added Ali Muhammed to GG_Consultants.
|
||||||
|
Created user: Kristian Kristoffersen (SAM=kkristoffersen) in Consultants. Password=UGHy6nDiJjnf
|
||||||
|
Added Kristian Kristoffersen to GG_Consultants.
|
||||||
|
Created user: Nicolai Stiansen (SAM=nstiansen) in Consultants. Password=*Pwz3U)X(4pF
|
||||||
|
Added Nicolai Stiansen to GG_Consultants.
|
||||||
|
Created user: Marita Bruun (SAM=mbruun) in Consultants. Password=ngHxu3C3mWKV
|
||||||
|
Added Marita Bruun to GG_Consultants.
|
||||||
|
Created user: Ellie Eiliassen (SAM=eeiliassen) in Consultants. Password=fh3o1jS5pjDq
|
||||||
|
Added Ellie Eiliassen to GG_Consultants.
|
||||||
|
#>
|
||||||
Reference in New Issue
Block a user