SERVER-004 · Script

Create and Configure Directory User

Creates one or many directory user accounts with name, OU, job details, manager and groups set.

Version 1.0.0Language PowerShellUpdated November 2026

What it does

Creates a single user from the settings below, or many users from a CSV file. Preview mode (default) checks every row and logs exactly what it would create, without changing anything. Apply mode creates the accounts, enabled, with a random password that must be changed at first sign-in, then adds the groups. Existing accounts are never changed; they are skipped and listed. Generated passwords are saved to a protected file that only SYSTEM and Administrators can read. They are never written to the log.

CSV columns (GivenName and Surname are required, the rest are optional): GivenName, Surname, SamAccountName, Path, Department, Title, Office, Company, Manager, EmployeeID, Email, Description, Groups (separate several groups with a semicolon)

Requirements

Windows PowerShell 5.1 and the ActiveDirectory module (RSAT). Rights to create users in the target OU and edit the listed groups.

How to run it

Run as: a service account with the directory rights the script lists, or SYSTEM on a domain controller or the server being checked
Run from: a domain-joined management server or admin workstation with the RSAT tools, as a scheduled task or from your management tool
Script type: PowerShell 5.1, 64-bit
User interaction: none; the script never prompts
Timeout: 30 minutes for large directories or many servers

Settings

Name	What it does	Options	Default
Mode	Preview (default) or Apply.	Preview, Apply	Preview
CsvPath	Path to a CSV file of users to create. Leave empty to create the single user below.
GivenName	First name, for a single user.
Surname	Last name, for a single user.
SamAccountName	Sign-in name. Leave empty to build it from -NameFormat.
Path	OU for new accounts, as a distinguished name. A Path column in the CSV overrides it.
NameFormat	How to build the sign-in name when none is given: first.last (default), flast, firstl or first_last.	first.last, flast, firstl, first_last	first.last
UpnSuffix	Sign-in suffix, for example school.org. Default: the domain DNS name.
Department	Department, for a single user or as the default for CSV rows.
Title	Job title, for a single user.
Office	Office or building.
Company	Company or school name.
Manager	Manager's sign-in name.
Groups	Groups to add every new user to.		(none)
PasswordLength	Length of the generated first password. Default: 16.		16
ChangeAtSignIn	Yes (default) makes the user set a new password at first sign-in.	Yes, No	Yes
Server	Optional domain controller to use for every change.

Exit codes

0 = All rows created (or would be created, in Preview)
1 = Some rows were skipped or failed (see log)
2 = Script error (see log)

Testing steps

Run it first with the mode set to Preview on one test OU, test account or test server. Nothing is changed in that mode.
Read the log and confirm the planned changes are what you expect.
Run your chosen settings on the same test target and confirm the result.
Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
Roll out to a small group next, then everyone.

Rollback steps

Preview mode changes nothing. To undo an Apply run, delete the new accounts listed in the report (Remove-ADUser), then delete the protected password file in the Runbookia Secure folder.

Version and change log

Version	Date	Changes
1.0.0	November 2026	First release.