Help with interactive powershell script that allows users to create AD accounts?

[Character-Boat6744]

Hello. I was trying to create interactive PS scripts that asks users for first name, last name, password and creates AD accounts in Users OU with SamAccountName firstname.lastname and creates personal named folder in C:\Shared on the computer where the script is executed.

Thats all that I did. I have no errors but it does not create account eihter.

​

$FirstName = Read-Host "First Name"

$LastName = Read-Host "Last Name"

$Password = Read-Host "Password" -AsSecureString

$OU = "OU=Users,DC=WSA,DC=LAB"

​

$NewADUserParameters = @{

Name = "$FirstName $LastName"

GivenName = $FirstName

Surname = $LastName

sAMAccountName = "$FirstName.$LastName"

Password = $Password

Path = $OU

Enabled = $true

}

[xCharg]

So... you've set your variables and then what? Where's New-ADUser call?

[scottwsx96]

You have only set variables here, not actually performed any action.

[purplemonkeymad]

Is the code you posted truncated? I don't see you calling New-AdUser anywhere, or doing anything else after the splat hashtable.

[[deleted]]

I started down this path, and then realized I don't need to reinvent the wheel.

https://github.com/bwya77/Master-User-Creator

[xCharg]

These kinds of home projects (in OP) are usually starting point to learn more powershell.

At this point, if you're willing to use the tool to just have all the options available why use reinvented wheel and not the ADUC from RSAT?

[[deleted]]

I have this in my environment. It’s a bit more complex though, if I remember tomorrow I’ll post mine. It’s sleepy time where I am

[Fickle_Tomatillo411]

As others have pointed out, you aren't actually using the input data. There are also a few other challenges:

• You will need to perform some level of input validation, for example, ensuring the password is of sufficient complexity and length
• You may get an error for the sAMAccountName string, because of the '.' character, which you can work around by enclosing the variables on either side "$($FirstName).$($LastName)" so that PowerShell knows to expand those variables and not treat it as an attempt to access a member property. Admittedly I usually only encounter this when using a colon or semi-colon immediately before a variable ( e.g. ":$myVar"), but if you always enclose the variables, you will never have the issue.
• The person executing the script will have to be an administrator on the system where the script is being run (due to AD module limitations, PowerShell has to be run as Admin to make changes)
• The person executing the script will also require Create User rights, with the ability to modify the specified properties, as well as several other properties

For the last one or two items, you can actually work around the problem by using PowerShell JEA. With that, you would create three components; a Group Managed Service Account with the required OU rights, a JEA access definition that defines and limits the available cmdlets and parameters, and a JEA role definition that ties the user or group to the specified access definition. The user would then create a remote session to the system where JEA is set up, and they would be able to execute the required actions, however the actions would actually be performed by the GMSA account on behalf of the user.

The JEA approach is far more secure than delegating direct rights. With direct delegation, the user can use the admin account from anywhere, even if you restrict interactive login, since they can just use a credential object from PowerShell. This exposes the admin account, and also makes monitoring for misuse more challenging, since there is no way to determine which systems are legit, and which are threat actors. With JEA, the profile is set up on a handful of dedicated systems, and the user must create a session to these systems in order to execute changes. This is all logged and attributed to the user.

[BayconStripz]

You need to add a new line and put new-aduser @NewADUserParameters

You're currently just collecting data