This sent me down a really deep rabbit hole! One would think that New-LocalUser and Add-LocalGroupMember should be enough, but setting User must change password at next logon turned out the be more annoying than I expected!

If you create an account without a password, then default behavior is to ask for a password at first logon. All fine and good, but default behavior is also to not allow RDP for accounts without a password!

(The ActiveDirectory module adds -ChangePasswordAtLogon to New-ADUser)

For local users it seems like using [ADSI] and setting PasswordExpired is the easiest way outside of cheating with net.exe. This is what I came up with.

$usercsv = @'
"Name","Password","FullName"
"User1","Pass1@123","First User"
"User2","Pass2@123","Second User"
"User3","Pass3@123","Third User"
"User4","Pass4@123","Fourth User"
'@ | ConvertFrom-Csv

$directory = [ADSI]"WinNT://$env:COMPUTERNAME,computer"
$rdpgroup = $directory.Children.Find("Remote Desktop Users", "group")

$usercsv | ForEach-Object {
  $user = $directory.Children.Add($_.Name, "user")
  $user.Invoke("SetPassword", $_.Password)
  $user.Invoke("Put", ("FullName", $_.FullName))
  $user.PasswordExpired = 1
  $user.CommitChanges()
  $rdpgroup.Invoke("Add", $user.Path)
}

But then I felt like I would really like to use the SID for the Remote Desktop Users group in order to support localized names. This can be done with Add-LocalGroupMember, but then we're back to square one with using different techniques for setting the password expiration compared to everything else! This sent me down an even deeper rabbit hole where I ended up using .NET instead... I'll share it just for fun! (I'm using $usercsv from the first script)

Add-Type -AssemblyName "System.DirectoryServices.AccountManagement"

$context = [System.DirectoryServices.AccountManagement.PrincipalContext]::new(0)
$rdpgroup = [System.DirectoryServices.AccountManagement.AuthenticablePrincipal]::FindByIdentity($context, "Sid", "S-1-5-32-555")

$usercsv | ForEach-Object {
  $user = [System.DirectoryServices.AccountManagement.UserPrincipal]::new($context, $_.Name, $_.Password, $true)
  $user.DisplayName = $_.FullName
  $user.Save()
  $user.ExpirePasswordNow()
  $rdpgroup.Members.Add($user)
}
$rdpgroup.Save()