· 9 years ago · Jul 11, 2017, 10:24 PM
1$DomainEmail="@TEST.lan"
2$DomainName="DC=TEST,DC=lan"
3$NTDomain="TEST"
4
5$InFile = "C:\Scripts\StudentADAccounts\students.csv"
6$LogFile = "C:\Scripts\StudentADAccounts\logfile.csv"
7
8
9
10# Hash Table of drive letters, either puts Z: if location has file server, or nulls the value if location doesn't
11$HomeDriveLetter = @{
12"AA" = "Z:"
13"AB" = $null
14"AC" = "Z:"
15"AD" = "Z:"
16}
17
18Import-Module ActiveDirectory
19
20#############################################
21# Function : CreateStudentAccount
22# Notes : Check if student account exists.
23# If it doesnt, create it.
24#############################################
25function CreateStudentAccount {
26
27 Param ([string]$UserName, [string]$Password)
28
29 # Set other variables
30 $defpassword = (ConvertTo-SecureString "$UserPass" -AsPlainText -force)
31 $UserEmail = $UserName + $DomainEmail
32 $UserDisplayName = $acct.FirstName+" "+$acct.LastName
33 $UserStateID = $acct.StateID
34 $UserSchoolID = $acct.Schoolid
35 # Look for user with same EmployeeID
36 $GetID = Get-ADuser -LDAPFilter "(EmployeeID=$UserStateID)" -SearchBase "OU=Students,OU=_User Accounts,$DomainName"
37 $CheckExist = try {$GetID} catch {$null}
38 $DN = $GetID | Select -Expand DistinguishedName
39 $SN = $GetID | Select -Expand SamAccountName
40
41 if(($CheckExist -ne $null) -and (($CheckExist | Select -ExpandProperty SamAccountName) -eq $SamName)){
42 # User Already Exists, Set a meaningful return Value
43 $CreateStudentAccount = "$UserName Exists/Correct"
44 } elseif (($CheckExist -ne $null) -and ($SN -ne $SamName)) {
45 Rename-ADObject -Identity $DN -NewName $SamName
46
47 Set-ADUser $SN -DisplayName ($UserDisplayName) `
48 -SamAccountName ($SamName) `
49 -EmailAddress ($UserEmail) `
50 -UserPrincipalName ($UserEmail) `
51 -Givenname $acct.FirstName `
52 -Surname $acct.LastName `
53 -Enabled $true `
54 -homeDrive $HomeDriveLetter.Get_Item($UserSchoolID) `
55 -homeDirectory $HomeDirPath.Get_Item($UserSchoolID) `
56 -ProfilePath $ManProfilePath.Get_Item($UserSchoolID) `
57
58 $CreateStudentAccount = "Renamed Account"
59 } Else {
60
61 # Create the User's AD Account
62 try {
63 New-ADUser -DisplayName ($acct.FirstName+" "+$acct.LastName) `
64 -Name ($UserName) `
65 -SamAccountName ($SamName) -EmailAddress ($UserEmail) `
66 -UserPrincipalName ($UserEmail) `
67 -AccountPassword ($defpassword) `
68 -EmployeeID ($acct.StateID) `
69 -givenname $acct.FirstName `
70 -surname $acct.LastName `
71 -Description $acct.StateID `
72 -Enabled $true `
73 -ChangePasswordAtLogon $false `
74 -homeDrive $HomeDriveLetter.Get_Item($acct.Schoolid) `
75 -HomeDirectory $HomeDirPath.Get_Item($acct.Schoolid) `
76 -ProfilePath $ManProfilePath.Get_Item($acct.Schoolid) `
77 -Path "OU=$($acct.Schoolid),OU=Students,OU=_User Accounts,$DomainName"
78 $CreateStudentAccount = "$UserName Created"
79 }
80 catch [system.Object] {
81 $CreateStudentAccount = "Error Creating User : $UserName"
82
83 }
84 }
85
86 $CreateStudentAccount
87
88}
89# End function CreateStudentAccount
90# -------------------------------------------
91
92#############################################
93# Function: Move to OU's based on CSV
94# Notes: Makes sure users are in right OU
95#############################################
96function MoveToOU {
97 $UserLoc = ((Get-ADUser -Identity $SamName -Properties DistinguishedName).DistinguishedName -split ",",2)[1]
98 $UserDN = (Get-ADUser -Identity $SamName).DistinguishedName
99
100 $TargetOU = "OU=$($acct.Schoolid),OU=Students,OU=_User Accounts,$DomainName"
101 if($UserLoc -eq $TargetOU){
102 $MoveToOU = "Correct OU"
103 } else {
104 Move-ADObject -Identity $UserDN -TargetPath $TargetOU
105 $MoveToOU = "Moved $SamName to $TargetOU"
106 Set-ADUser -Identity $SamName `
107 -homeDrive $HomeDriveLetter.Get_Item($acct.Schoolid) `
108 -HomeDirectory $HomeDirPath.Get_Item($acct.Schoolid) `
109 -ProfilePath $ManProfilePath.Get_Item($acct.Schoolid) `
110 -Enabled $true
111 }
112 $MoveToOU
113}
114
115# End function MoveToOU
116# -------------------------------------------
117
118#############################################
119# Function: Create student home drive
120# Notes: Check if home drive exists
121# Create if it doesnt.
122#############################################
123function CreateHomeFolder {
124
125 $HomeFolder = $HomeDirPath.Get_Item($acct.Schoolid)
126 $CheckHomeFolder = try {Test-Path -Path $HomeFolder} catch {$null}
127
128 if (($CheckHomeFolder -eq $False) -and ($HomeFolder -ne $null)) {
129 New-Item -path $HomeFolder -type directory | Out-Null
130 $CreateHomeFolder="Has Been Made"
131 } else {
132 $CreateHomeFolder="Exists or NA"
133 }
134 $CreateHomeFolder
135}
136# End function CreateHomeFolder
137# -------------------------------------------
138# ---------------------------------------------------------------------------
139# SetFolderACL
140#
141# ---------------------------------------------------------------------------
142function SetFolderACL {
143
144 $SetFolderACL = "No Work Done"
145 $tdir = $HomeDirPath.Get_Item($acct.Schoolid)
146
147 if ($tdir -ne $null) {
148 try {
149 $acl = Get-Acl $tdir
150 $acl.SetAccessRuleProtection($True, $False)
151 $rule = New-Object System.Security.AccessControl.FileSystemAccessRule("Everyone","FullControl", "ContainerInherit, ObjectInherit", "None", "Allow")
152 $acl.RemoveAccessRuleAll($rule)
153 $rule = New-Object System.Security.AccessControl.FileSystemAccessRule("Administrators","FullControl", "ContainerInherit, ObjectInherit", "None", "Allow")
154 $acl.AddAccessRule($rule)
155 $rule = New-Object System.Security.AccessControl.FileSystemAccessRule("SYSTEM","FullControl", "ContainerInherit, ObjectInherit", "None", "Allow")
156 $acl.AddAccessRule($rule)
157 $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($SamName,"Modify,DeleteSubdirectoriesAndFiles, TakeOwnership", "ContainerInherit, ObjectInherit", "None","Allow")
158 $acl.AddAccessRule($rule)
159 $account=New-Object System.Security.Principal.NTAccount($NTDomain,$SamName)
160 $acl.SetOwner($account)
161 $acl | Set-Acl $tdir
162 $SetFolderACL = "$tdir ACL set OK"
163 } catch [system.Object] {
164 $SetFolderACL = "Error setting $tdir ACL"
165 }
166 } else {
167 $SetFolderACL = "No directory to ACL"
168 }
169 $SetFolderACL
170}
171# ---------------------------------------------------------------------------
172
173#############################################
174# Main
175#############################################
176
177$AcctList=Import-CSV $InFile
178
179# Obj entries are for producing logfile
180$ObjArr = @()
181$ObjIdx = 0
182
183foreach ($acct in $AcctList) {
184
185 # Create username
186 $UserName = $acct.UserName
187 $SamName = $acct.SamName
188 $Obj = New-Object System.object
189 $Obj | Add-Member -Type NoteProperty -name UserName -value $UserName
190 # Create password
191 $UserPass = $acct.Password
192 $Obj | Add-Member -Type NoteProperty -name UserPass -value $UserPass
193
194 # Hash Table of home directory path, null value if no file server
195 $HomeDirPath = @{
196 "AA" = "\\server\students\aa\$UserName"
197 "AB" = $null
198 "AC" = "\\server\students\ac\$UserName"
199 "AD" = "\\server\students\ad\$UserName"
200 }
201
202 # Hash Table of mandatory profile path, null value if no mandatory profile
203 $ManProfilePath = @{
204 "AA" = $null
205 "AB" = $null
206 "AC" = "\\test.lan\ac\Profiles\Man\Students\Student"
207 "AD" = $null
208 }
209
210 # Create users
211 $CreatedStatus=CreateStudentAccount $UserName $UserPass #$SamName
212 $Obj | Add-Member -Type NoteProperty -name CreatedStatus -value $CreatedStatus
213
214 # Move to OU
215 $OUStatus=MoveToOU
216 $Obj | Add-Member -Type NoteProperty -name OUStatus -value $OUStatus
217
218 # Create the User's Folder
219 $FolderStatus=CreateHomeFolder #$UserName $acct.ID
220 $Obj | Add-Member -Type NoteProperty -name FolderStatus -value $FolderStatus
221
222 # Set home folder ACL
223
224 $ACLStatus=SetFolderACL #$UserName
225 $Obj | Add-Member -Type NoteProperty -name ACLStatus -value $ACLStatus
226
227 $ObjArr += $Obj
228 $ObjIdx ++
229}
230
231$ObjArr | Export-CSV $LogFile -notype
232
233# Find accounts that are 1. Not in CSV and 2. Have EmployeeID and disable them
234$IDS = Import-CSV -Path ".\students.csv" | Select-object -ExpandProperty StateID
235Get-ADUser -filter * -SearchBase "OU=Students,OU=_User Accounts,$DomainName" -Properties EmployeeID | ? {$_.distinguishedname -notmatch 'OU=Disabled'} |
236 Where-Object{$_.EmployeeID -and ($IDS -notcontains $_.EmployeeID)} | Disable-ADAccount
237
238# Find all disabled user accounts and move to the disabled OU
239
240Search-ADAccount -AccountDisabled -UsersOnly -SearchBase "OU=Students,OU=_User Accounts,$DomainName" | ? {$_.distinguishedname -notmatch 'OU=Disabled'} |
241Move-ADObject -TargetPath "OU=Disabled,OU=Students,OU=_User Accounts,$DomainName"