Windows Server 2012 : Administering Active Directory objects using ADAC (part 4) - Common administration tasks - Creating users

5/19/2014 1:54:18 AM

Creating users

A second example of common Active Directory management tasks you can perform using ADAC is creating new user accounts and managing existing user accounts. To create a new user account, simply right-click on the appropriate organizational unit, select New, and then select User. Then fill in the necessary information on the Create User properties page, as shown in Figure 8.

Figure 8. Creating a new user account using ADAC.

After you click OK to create the new user account and return the focus to ADAC, you can click the small caret at the bottom right of ADAC to display the Windows PowerShell History Viewer, which allows you to view the actual Windows PowerShell commands that are executed whenever you perform administrative tasks with ADAC. Figure 9 shows the commands involved during the creation of the new user account for Karen Berg that was shown previously in Figure 8. Note that a simple task like creating a single new user might require executing several different Windows PowerShell commands.

Figure 9. The Windows PowerShell History Viewer contents after creating new user Karen Berg.

The actual Windows PowerShell commands needed to create the new user Karen Berg in the preceding example were as follows:

New-ADUser -DisplayName:"Karen Berg" -GivenName:"Karen" -Name:"Karen Berg"
   -Path:"OU=Seattle Users OU,OU=Seattle OU,DC=corp,DC=contoso,DC=com"
   -SamAccountName:"kberg" -Server:"SEA-SRV-1.corp.contoso.com"
   -Surname:"Berg" -Type:"user" -UserPrincipalName:[email protected]
Set-ADAccountPassword -Identity:"CN=Karen Berg,OU=Seattle Users OU,
   OU=Seattle OU,DC=corp,DC=contoso,DC=com" -NewPassword:"System.Security.SecureString"
   -Reset:$null -Server:"SEA-SRV-1.corp.contoso.com"
Enable-ADAccount -Identity:"CN=Karen Berg,OU=Seattle Users OU,
   OU=Seattle OU,DC=corp,DC=contoso,DC=com" -Server:"SEA-SRV-1.corp.contoso.com"
Set-ADObject -Identity:"CN=Karen Berg,OU=Seattle Users OU,
   OU=Seattle OU,DC=corp,DC=contoso,DC=com" -ProtectedFromAccidentalDeletion:$true
   -Server:"SEA-SRV-1.corp.contoso.com"
Set-ADAccountExpiration -DateTime:"09/02/2012 00:00:00" -Identity:"CN=Karen Berg,
   OU=Seattle Users OU,OU=Seattle OU,DC=corp,DC=contoso,DC=com"
   -Server:"SEA-SRV-1.corp.contoso.com"
Set-ADAccountControl -AccountNotDelegated:$false -
AllowReversiblePasswordEncryption:$true
   -CannotChangePassword:$true -DoesNotRequirePreAuth:$false
   -Identity:"CN=Karen Berg,OU=Seattle Users OU,OU=Seattle OU,DC=corp,DC=contoso,
   DC=com" -PasswordNeverExpires:$true -Server:"SEA-SRV-1.corp.contoso.com"
   -UseDESKeyOnly:$false
Set-ADUser -ChangePasswordAtLogon:$false -Identity:"CN=Karen Berg,
   OU=Seattle Users OU,OU=Seattle OU,DC=corp,DC=contoso,DC=com"
   -Server:"SEA-SRV-1.corp.contoso.com" -SmartcardLogonRequired:$false

To copy the commands shown in the History Viewer to your clipboard, first click to select them and then click Copy at the top of the Windows PowerShell History pane. You can then paste the commands into an editor like Notepad, customize them as needed, and use them as a basis for performing a bulk creation of new users with the addition of some Windows PowerShell scripting.

Other tasks you can perform using ADAC

Creating new groups, computer accounts, and InetOrgPerson objects is a similar process to the one just shown and should require no further explanation. Here are some other tasks you can perform using ADAC:

Selecting a domain or domain controller to perform your administrative tasks on
Raising the forest or domain functional level
Enabling the Active Directory Recycle Bin
Configuring fine-grained password policies
Configuring Dynamic Access Control

Note

Dynamic Access Control

Dynamic Access Control (DAC) is another new feature of Active Directory in Windows Server 2012. You use DAC to implement a claims-based authorization solution. In this type of solution, you use central access policies, rules, and claim types to enable the use of file-classification information in authorization decisions. With DAC, you can define access and audit policies in a simple and flexible way that can significantly reduce the number of groups you need to manage in your Active Directory environment.

Tasks you cannot perform using ADAC

There are a number of Active Directory management tasks you cannot perform using ADAC, such as the following:

Delegate administrative control over Active Directory OUs and the objects they contain.
Create and manage sites, site links, subnets and similar objects.
Create trusts between domains or forests.
Directly edit the configuration, schema, or application directory partitions.

To perform such tasks, you need to use the following familiar tools:

Active Directory Users And Computers
Active Directory Sites And Services
Active Directory Domains And Trusts
ADSI Edit

Others

- Windows Server 2012 : Administering Active Directory objects using ADAC (part 3) - Common administration tasks - Creating organizational units

- Windows Server 2012 : Administering Active Directory objects using ADAC (part 2) - Searching Active Directory

- Windows Server 2012 : Administering Active Directory objects using ADAC (part 1) - Overview of ADAC

- Windows Server 2012 : Managing print servers using Windows PowerShell (part 2) - Managing printers, printer drivers, and print jobs

- Windows Server 2012 : Managing print servers using Windows PowerShell (part 1) - Viewing information about printers, printer drivers, and print jobs

- Windows 8 : System Protection and Recovery - Advanced recovery and restoration options

- Windows 8 : System Protection and Recovery - Advanced settings and features for Windows recovery

- Sharepoint 2013 : Managing an Office 365 SharePoint Site - Create a New Public Site Collection

- Sharepoint 2013 : Managing an Office 365 SharePoint Site - Create a New Private Site Collection

- Sharepoint 2013 : Managing an Office 365 SharePoint Site - Sign In to Office 365 SharePoint Administrator Console