Active Directory 2008 : Automating the Creation of User Accounts (part 1)

Users in a domain often share many similar properties. For example, all sales representatives can belong to the same security groups, log on to the network during similar hours, and have home folders and roaming profiles stored on the same server. When you create a new user, you can simply copy an existing user account rather than create a blank account and populate each property.

Since the days of Microsoft Windows NT 4.0, Windows has supported the concept of user account templates. A user account template is a generic user account prepopulated with common properties. For example, you can create a template account for sales representatives that is preconfigured with group memberships, logon hours, a home folder, and a roaming profile path.

To create a user account template, simply create a user account and prepopulate appropriate attributes. We recommend that you use a naming standard that makes templates easy to find. For example, configure the full name of the user with an underscore (_) as the first character, such as _Sales User. The underscore prefix will cause all templates to appear at the top of the list of users in an organizational unit (OU).

To create a user based on the template, perform the following steps:

After a user is created by copying the template, you can view and modify its attributes in the Properties dialog box of the new account. It’s important to realize that not all attributes are copied from the template. The list below summarizes the attributes that are copied from the template, grouped by the tabs in the Properties dialog box.

It is not useful to configure any other attributes in the template, as they will not be copied to new accounts.

One of a suite of Active Directory command-line tools collectively called DS commands. The following DS commands are supported in Windows Server 2008 R2:

Most of the DS commands take two modifiers after the command itself: the object type and the object’s DN. For example, the following command adds a user account for Mike Fitzmaurice:

dsadd user "cn=Mike Fitzmaurice,ou=User Accounts,dc=contoso,dc=com"

The object type, user, immediately follows the command. After the object type is the object’s DN. When the object’s DN includes a space, surround the DN with quotes. The following command removes the same user:

dsrm "cn=Mike Fitzmaurice,ou=User Accounts,dc=contoso,dc=com"

DS commands that read or manipulate attributes of objects include Dsquery.exe, Dsget.exe, and Dsmod.exe. To specify an attribute, include it as a parameter after the object’s DN. For example, the following command retrieves the home folder path for Mike Fitzmaurice:

dsget user "cn=Mike Fitzmaurice,ou=User Accounts,dc=contoso,dc=com" -hmdir

The parameter of a DS command that represents an attribute, for example, hmdir, is not always the same as the name of the attribute in the Active Directory Users And Computers snap-in or in the schema.

Use the DSAdd command to create objects in Active Directory. The DSAdd User command creates a user object and accepts parameters that specify properties of the user. The following command shows the basic parameters required to create a user account:

dsadd user "User DN" -samid "pre-Windows 2000 logon name" -pwd {Password | *}
   -mustchpwd yes

The -pwd parameter specifies the password. If it is set to an asterisk (*), you are prompted for a user password. The -mustchpwd parameter specifies that the user must change the password at next logon.

DSAdd User accepts several parameters that specify properties of the user object. The following command creates a user with some of the more important fields populated:

dsadd user "cn=Amy Strande,ou=User Accounts,dc=contoso,dc=com" -samid Amy.Strande
   -fn Amy -ln Strande -display "Strande, Amy" -pwd Pa$$w0rd -desc "Vice President, IT"

Most parameter names are self-explanatory: -email, -profile, and -company, for example. Type dsadd user /? or search the Windows Server 2008 R2 Help and Support Center for thorough documentation of the DSAdd User parameters.

CSVDE is a command-line tool that imports or exports Active Directory objects from or to a comma-delimited text file (also known as a comma-separated value text file, or .csv file). Comma-delimited files can be created, modified, and opened with tools as familiar as Notepad and Microsoft Office Excel. If you have user information in existing Excel or Microsoft Office Access databases, you will find that CSVDE is a powerful way to take advantage of that information to automate user account creation.

The basic syntax of the CSVDE command for export is:

csvde -f filename

However, that command will export all objects in your Active Directory domain. You will want to limit the scope of the export, which you can do with the following four parameters:

The output of a CSVDE export lists the selected, exported LDAP attribute names on the first line. Each object follows, one per line. Here’s a sample file:

DN,objectClass,sn,givenName,sAMAccountName,userPrincipalName
"CN=David Jones,OU=User Accounts,DC=contoso,DC=com",user,Jones,David,david.jones,
   [email protected]
"CN=Lisa Andrews,OU=User Accounts,DC=contoso,DC=com",user,Andrews,Lisa,lisa.andrews,
   [email protected]

CSVDE can also create user accounts by importing a .csv file. If you have user information in existing Excel or Access databases, you will find that CSVDE is a powerful way to take advantage of that information to automate user account creation.

The basic syntax of the CSVDE command for import is:

csvde -i -f Filename [-k]

The -i parameter specifies import mode; without it, the default mode of CSVDE is export. The -f parameter identifies the file name to import from or export to. The -k parameter is useful during import operations because it instructs CSVDE to ignore errors, including Object Already Exists errors.

The import file itself is a comma-delimited text file (.csv or .txt) in which the first line defines the imported attributes by their LDAP attribute names. Each object follows, one per line, and must contain exactly the attributes listed on the first line. Here’s a sample file:

DN,objectClass,sn,givenName,sAMAccountName,userPrincipalName
"CN=David Jones,OU=User Accounts,DC=contoso,DC=com",user,Jones,David,david.jones,
   [email protected]
"CN=Lisa Andrews,OU=User Accounts,DC=contoso,DC=com",user,Andrews,Lisa,lisa.andrews,
   [email protected]

This file, when imported by the CSVDE command, will create user objects for David Jones and Lisa Andrews in the User Accounts OU. The user logon names, last name and first name, are configured by the file. You cannot use CSVDE to import passwords, and without a password, the user account will be disabled initially. After you have reset the password, you can enable the object.