1FirstName,LastName,Username,Department,Title,Manager,Email
2John,Smith,jsmith,IT,Systems Administrator,administrator@company.com,jsmith@company.com
3Sarah,Johnson,sjohnson,HR,HR Manager,bwilliams@company.com,sjohnson@company.com
4Michael,Williams,mwilliams,Finance,Financial Analyst,djones@company.com,mwilliams@company.com
5Emily,Brown,ebrown,Marketing,Marketing Coordinator,sjohnson@company.com,ebrown@company.com

1$testUsers = @(
2    [PSCustomObject]@{FirstName='John'; LastName='Doe'; Username='jdoe'; Department='IT'; Title='Analyst'; Email='jdoe@company.com'}
3    [PSCustomObject]@{FirstName='Jane'; LastName='Smith'; Username='jsmith'; Department='HR'; Title='Manager'; Email='jsmith@company.com'}
4    [PSCustomObject]@{FirstName='Bob'; LastName='Wilson'; Username='bwilson'; Department='Finance'; Title='Accountant'; Email='bwilson@company.com'}
5)
6
7$testUsers | Export-Csv -Path "test_users.csv" -NoTypeInformation -Encoding UTF8

1# Import AD Module
2Import-Module ActiveDirectory
3
4# Verify module loaded
5if (!(Get-Module -Name ActiveDirectory)) {
6    Write-Error "Active Directory module not available. Install RSAT tools."
7    exit
8}
9
10Write-Host "Active Directory module loaded successfully" -ForegroundColor Green

1# Configuration
2$csvPath = "C:\Scripts\new_users.csv"
3$logPath = "C:\Scripts\Logs\user_creation_$(Get-Date -Format 'yyyyMMdd_HHmmss').log"
4$passwordPath = "C:\Scripts\Passwords\passwords_$(Get-Date -Format 'yyyyMMdd_HHmmss').txt"
5$domain = "company.com"
6$defaultPassword = $null  # Will generate random passwords
7$baseOU = "OU=Users,DC=company,DC=com"
8$homeDirectoryPath = "\\fileserver\home$"
9
10# Department to OU mapping
11$departmentOUs = @{
12    'IT'        = "OU=IT,OU=Users,DC=company,DC=com"
13    'HR'        = "OU=HR,OU=Users,DC=company,DC=com"
14    'Finance'   = "OU=Finance,OU=Users,DC=company,DC=com"
15    'Marketing' = "OU=Marketing,OU=Users,DC=company,DC=com"
16    'Sales'     = "OU=Sales,OU=Users,DC=company,DC=com"
17}
18
19# Create directories if they don't exist
20$logDir = Split-Path $logPath -Parent
21$passwordDir = Split-Path $passwordPath -Parent
22if (!(Test-Path $logDir)) { New-Item -Path $logDir -ItemType Directory -Force }
23if (!(Test-Path $passwordDir)) { New-Item -Path $passwordDir -ItemType Directory -Force }

1function Generate-RandomPassword {
2    <#
3    .SYNOPSIS
4    Generates a secure random password meeting complexity requirements
5    
6    .PARAMETER Length
7    Length of password (default: 12)
8    
9    .OUTPUTS
10    SecureString password
11    #>
12    param(
13        [int]$Length = 12
14    )
15    
16    # Character sets
17    $lowercase = 'abcdefghijklmnopqrstuvwxyz'
18    $uppercase = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ'
19    $numbers = '0123456789'
20    $special = '!@#$%^&*()-_=+[]{}|;:,.<>?'
21    
22    # Ensure at least one of each type
23    $password = ""
24    $password += $lowercase[(Get-Random -Minimum 0 -Maximum $lowercase.Length)]
25    $password += $uppercase[(Get-Random -Minimum 0 -Maximum $uppercase.Length)]
26    $password += $numbers[(Get-Random -Minimum 0 -Maximum $numbers.Length)]
27    $password += $special[(Get-Random -Minimum 0 -Maximum $special.Length)]
28    
29    # Fill remaining length with random characters
30    $allChars = $lowercase + $uppercase + $numbers + $special
31    for ($i = 0; $i -lt ($Length - 4); $i++) {
32        $password += $allChars[(Get-Random -Minimum 0 -Maximum $allChars.Length)]
33    }
34    
35    # Shuffle the password
36    $passwordArray = $password.ToCharArray()
37    $passwordArray = $passwordArray | Get-Random -Count $passwordArray.Length
38    $password = -join $passwordArray
39    
40    # Convert to SecureString
41    return (ConvertTo-SecureString $password -AsPlainText -Force)
42}

1function Write-Log {
2    <#
3    .SYNOPSIS
4    Writes message to log file and console
5    #>
6    param(
7        [string]$Message,
8        [ValidateSet('Info','Success','Warning','Error')]
9        [string]$Level = 'Info'
10    )
11    
12    $timestamp = Get-Date -Format 'yyyy-MM-dd HH:mm:ss'
13    $logMessage = "[$timestamp] [$Level] $Message"
14    
15    # Console output with colors
16    $color = switch ($Level) {
17        'Success' { 'Green' }
18        'Warning' { 'Yellow' }
19        'Error'   { 'Red' }
20        default   { 'White' }
21    }
22    Write-Host $logMessage -ForegroundColor $color
23    
24    # File output
25    Add-Content -Path $logPath -Value $logMessage
26}

1function New-BulkADUsers {
2    <#
3    .SYNOPSIS
4    Creates multiple AD users from CSV file
5    #>
6    
7    # Start logging
8    Write-Log "===== Bulk AD User Creation Started =====" -Level Info
9    Write-Log "CSV Path: $csvPath" -Level Info
10    Write-Log "Log Path: $logPath" -Level Info
11    
12    # Import CSV
13    try {
14        $users = Import-Csv -Path $csvPath -Encoding UTF8
15        Write-Log "Successfully imported $($users.Count) users from CSV" -Level Success
16    }
17    catch {
18        Write-Log "Failed to import CSV: $_" -Level Error
19        return
20    }
21    
22    # Validate CSV columns
23    $requiredColumns = @('FirstName', 'LastName', 'Username', 'Department', 'Email')
24    $csvColumns = $users[0].PSObject.Properties.Name
25    $missingColumns = $requiredColumns | Where-Object { $_ -notin $csvColumns }
26    
27    if ($missingColumns) {
28        Write-Log "Missing required columns: $($missingColumns -join ', ')" -Level Error
29        return
30    }
31    
32    # Statistics
33    $stats = @{
34        Total = $users.Count
35        Created = 0
36        Skipped = 0
37        Failed = 0
38    }
39    
40    # Initialize password export array
41    $passwordExport = @()
42    
43    # Process each user
44    foreach ($user in $users) {
45        Write-Log "Processing user: $($user.Username)" -Level Info
46        
47        try {
48            # Check if user already exists
49            $existingUser = Get-ADUser -Filter "SAMAccountName -eq '$($user.Username)'" -ErrorAction SilentlyContinue
50            
51            if ($existingUser) {
52                Write-Log "User $($user.Username) already exists. Skipping." -Level Warning
53                $stats.Skipped++
54                continue
55            }
56            
57            # Determine OU based on department
58            $targetOU = $departmentOUs[$user.Department]
59            if (!$targetOU) {
60                Write-Log "No OU mapping for department: $($user.Department). Using base OU." -Level Warning
61                $targetOU = $baseOU
62            }
63            
64            # Verify OU exists
65            try {
66                Get-ADOrganizationalUnit -Identity $targetOU -ErrorAction Stop | Out-Null
67            }
68            catch {
69                Write-Log "OU does not exist: $targetOU. Using base OU." -Level Warning
70                $targetOU = $baseOU
71            }
72            
73            # Generate password
74            $password = Generate-RandomPassword -Length 12
75            $plainPassword = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto(
76                [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($password)
77            )
78            
79            # Build user parameters
80            $userParams = @{
81                SAMAccountName        = $user.Username
82                UserPrincipalName     = "$($user.Username)@$domain"
83                Name                  = "$($user.FirstName) $($user.LastName)"
84                GivenName             = $user.FirstName
85                Surname               = $user.LastName
86                DisplayName           = "$($user.FirstName) $($user.LastName)"
87                EmailAddress          = $user.Email
88                Department            = $user.Department
89                Title                 = $user.Title
90                Path                  = $targetOU
91                AccountPassword       = $password
92                Enabled               = $true
93                ChangePasswordAtLogon = $true
94                Description           = "Created via bulk import on $(Get-Date -Format 'yyyy-MM-dd')"
95            }
96            
97            # Optional: Add manager if specified
98            if ($user.Manager) {
99                try {
100                    $manager = Get-ADUser -Filter "mail -eq '$($user.Manager)' -or SAMAccountName -eq '$($user.Manager)'" -ErrorAction Stop
101                    $userParams.Manager = $manager.DistinguishedName
102                }
103                catch {
104                    Write-Log "Manager not found: $($user.Manager)" -Level Warning
105                }
106            }
107            
108            # Create AD user
109            New-ADUser @userParams -ErrorAction Stop
110            Write-Log "Successfully created user: $($user.Username)" -Level Success
111            $stats.Created++
112            
113            # Create home directory
114            $homeDirPath = Join-Path $homeDirectoryPath $user.Username
115            if (!(Test-Path $homeDirPath)) {
116                New-Item -Path $homeDirPath -ItemType Directory -Force | Out-Null
117                
118                # Set permissions (user has full control)
119                $acl = Get-Acl $homeDirPath
120                $userSID = (Get-ADUser -Identity $user.Username).SID
121                $accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule(
122                    $userSID, 'FullControl', 'ContainerInherit,ObjectInherit', 'None', 'Allow'
123                )
124                $acl.SetAccessRule($accessRule)
125                Set-Acl -Path $homeDirPath -AclObject $acl
126                
127                Write-Log "Created home directory: $homeDirPath" -Level Success
128            }
129            
130            # Set home directory attribute
131            Set-ADUser -Identity $user.Username -HomeDirectory $homeDirPath -HomeDrive "H:"
132            
133            # Add to password export
134            $passwordExport += [PSCustomObject]@{
135                Username    = $user.Username
136                Name        = "$($user.FirstName) $($user.LastName)"
137                Email       = $user.Email
138                Password    = $plainPassword
139                Department  = $user.Department
140            }
141            
142        }
143        catch {
144            Write-Log "Failed to create user $($user.Username): $_" -Level Error
145            $stats.Failed++
146        }
147    }
148    
149    # Export passwords to secure file
150    try {
151        $passwordExport | Export-Csv -Path $passwordPath -NoTypeInformation -Encoding UTF8
152        Write-Log "Passwords exported to: $passwordPath" -Level Success
153        
154        # Set restrictive permissions on password file
155        $acl = Get-Acl $passwordPath
156        $acl.SetAccessRuleProtection($true, $false)  # Disable inheritance
157        $adminRule = New-Object System.Security.AccessControl.FileSystemAccessRule(
158            "BUILTIN\Administrators", "FullControl", "Allow"
159        )
160        $acl.SetAccessRule($adminRule)
161        Set-Acl -Path $passwordPath -AclObject $acl
162    }
163    catch {
164        Write-Log "Failed to export passwords: $_" -Level Error
165    }
166    
167    # Summary
168    Write-Log "===== Bulk User Creation Complete =====" -Level Info
169    Write-Log "Total users processed: $($stats.Total)" -Level Info
170    Write-Log "Successfully created: $($stats.Created)" -Level Success
171    Write-Log "Skipped (already exist): $($stats.Skipped)" -Level Warning
172    Write-Log "Failed: $($stats.Failed)" -Level Error
173}

1# Run the bulk user creation
2New-BulkADUsers

1# Create test CSV with 3 users
2$testUsers = @(
3    [PSCustomObject]@{FirstName='Test'; LastName='User1'; Username='testuser1'; Department='IT'; Title='Test'; Email='testuser1@company.com'}
4    [PSCustomObject]@{FirstName='Test'; LastName='User2'; Username='testuser2'; Department='HR'; Title='Test'; Email='testuser2@company.com'}
5    [PSCustomObject]@{FirstName='Test'; LastName='User3'; Username='testuser3'; Department='Finance'; Title='Test'; Email='testuser3@company.com'}
6)
7$testUsers | Export-Csv -Path "C:\Scripts\test_users.csv" -NoTypeInformation
8
9# Update CSV path in script
10$csvPath = "C:\Scripts\test_users.csv"
11
12# Run script
13New-BulkADUsers

1# Check users exist
2Get-ADUser -Filter "SAMAccountName -like 'testuser*'" | Select-Object SAMAccountName, Name, EmailAddress, Department
3
4# Check home directories
5Get-ChildItem "\\fileserver\home$\testuser*"
6
7# Review password file
8Import-Csv "C:\Scripts\Passwords\passwords_*.txt" | Format-Table

1$csvPath = "C:\Scripts\new_users.csv"
2New-BulkADUsers

1# Add to user parameters section
2if ($user.Department) {
3    $groupName = "$($user.Department)_Users"
4    try {
5        $group = Get-ADGroup -Filter "Name -eq '$groupName'" -ErrorAction Stop
6        Add-ADGroupMember -Identity $group -Members $user.Username -ErrorAction Stop
7        Write-Log "Added $($user.Username) to group: $groupName" -Level Success
8    }
9    catch {
10        Write-Log "Failed to add to group $groupName: $_" -Level Warning
11    }
12}

1function Send-WelcomeEmail {
2    param($User, $Password)
3    
4    $emailParams = @{
5        To         = $User.Email
6        From       = "it@company.com"
7        Subject    = "Welcome to Company - Your Account Information"
8        Body       = @"
9Hello $($User.FirstName),
10
11Your account has been created:
12Username: $($User.Username)
13Temporary Password: $Password
14Email: $($User.Email)
15
16Please change your password upon first login.
17
18IT Department
19"@
20        SmtpServer = "smtp.company.com"
21    }
22    
23    Send-MailMessage @emailParams
24}
25
26# Call after user creation
27Send-WelcomeEmail -User $user -Password $plainPassword

1# After successful user creation
2if ($user.Manager) {
3    $managerEmail = (Get-ADUser -Filter "SAMAccountName -eq '$($user.Manager)'").EmailAddress
4    Send-MailMessage -To $managerEmail -From "it@company.com" `
5        -Subject "New Team Member Account Created" `
6        -Body "A new account has been created for $($user.FirstName) $($user.LastName) in your department." `
7        -SmtpServer "smtp.company.com"
8}

1function Test-EmailAddress {
2    param([string]$Email)
3    return $Email -match '^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$'
4}
5
6# Before user creation
7if (!(Test-EmailAddress -Email $user.Email)) {
8    Write-Log "Invalid email format: $($user.Email). Skipping user." -Level Error
9    $stats.Failed++
10    continue
11}

1# Windows Server
2Install-WindowsFeature -Name RSAT-AD-PowerShell
3
4# Windows 10/11
5Get-WindowsCapability -Online | Where-Object Name -like 'Rsat.ActiveDirectory*' | Add-WindowsCapability -Online

1if ($existingUser) {
2    Set-ADUser -Identity $user.Username -EmailAddress $user.Email -Title $user.Title
3    Write-Log "Updated existing user: $($user.Username)" -Level Success
4}

1$baseUsername = $user.Username
2$counter = 1
3while (Get-ADUser -Filter "SAMAccountName -eq '$($user.Username)'" -ErrorAction SilentlyContinue) {
4    $user.Username = "$baseUsername$counter"
5    $counter++
6}

1New-ADUser @userParams -Server "dc01.otherdomain.com" -Credential $cred

1$DisplayName = "$($user.FirstName) $($user.LastName)" -replace '[^\w\s\-]', ''