Yusuf Ozturk » 2010

Blogroll

Badges

Community

Creating New FTP User on Active Directory with Powershell

Posted in Hosting & IIS7, Windows Powershell, Windows Server | No Comment | 4,014 views | 02/03/2010 12:43

Creates a new user on Active Directory and sets “Password never expires”

Function Add-FTPUser
{
Param ($FTPUsername, $FTPPassword)
 
    $ADDomain = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
    $ADDomainName = $ADDomain.Name
    $ADServer = ($ADDomain.InfrastructureRoleOwner.Name.Split(".")[0])
    $FQDN = "DC=" + $ADDomain.Name -Replace("\.",",DC=")
    $ADDomain = [ADSI] "LDAP://$ADServer/$FQDN"
    $CustomerOU = [ADSI] "LDAP://$CustomerOU,$FQDN"
    $User = [ADSI] "LDAP://CN=$FTPUsername,$CustomerOU,$FQDN"
    $PrincipalName = $FTPUsername + "@" + $ADDomainName
    $AddADUser = $CustomerOU.Create("User","CN=$FTPUsername")
    $AddADUser.Put("Description", "$FTPUsername")
    $AddADUser.Put("sAMAccountName", "$FTPUsername")
    $AddADUser.Put("userPrincipalName", "$PrincipalName")
    $AddADUser.Put("DisplayName", "$FTPUsername")
    $AddADUser.SetInfo()
    $AddADUser.SetPassword($FTPPassword)
    $AddADUser.SetInfo()
    $AddADUser.Psbase.Invokeset("AccountDisabled", "False")
    $AddADUser.SetInfo()
    $AddADUser.Put("userAccountControl", "65536")
    $AddADUser.SetInfo()
}

I didn’t change Primary Group of my FTP user. Because I don’t need for ACL.

Creating New IIS User on Active Directory with Powershell

Posted in Hosting & IIS7, Windows Powershell, Windows Server | No Comment | 5,832 views | 02/03/2010 12:40

Creates a new user on Active Directory, sets “Password never expires” and changes primary group of user.

Function Add-IISUser
{
Param ($Username, $Password)
 
    $ADDomain = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
    $ADDomainName = $ADDomain.Name
    $ADServer = ($ADDomain.InfrastructureRoleOwner.Name.Split(".")[0])
    $FQDN = "DC=" + $ADDomain.Name -Replace("\.",",DC=")
    $ADDomain = [ADSI] "LDAP://$ADServer/$FQDN"
    $CustomerOU = [ADSI] "LDAP://$CustomerOU,$FQDN"
    $User = [ADSI] "LDAP://CN=$Username,$CustomerOU,$FQDN"
    $PrincipalName = $Username + "@" + $ADDomainName
    $AddADUser = $CustomerOU.Create("User","CN=$Username")
    $AddADUser.Put("Description", "$Username")
    $AddADUser.Put("sAMAccountName", "$Username")
    $AddADUser.Put("userPrincipalName", "$PrincipalName")
    $AddADUser.Put("DisplayName", "$Username")
    $AddADUser.SetInfo()
    $AddADUser.SetPassword($Password)
    $AddADUser.SetInfo()
    $AddADUser.Psbase.Invokeset("AccountDisabled", "False")
    $AddADUser.SetInfo()
    $AddADUser.Put("userAccountControl", "65536")
    $AddADUser.SetInfo()
    $DomainNC = ([ADSI]"LDAP://RootDSE").DefaultNamingContext
    $DomainUsers = [ADSI]"LDAP://CN=Domain Users,CN=Users,$DomainNC"
    $DomainUsers.GetInfoEx(@("primaryGroupToken"), 0)
    $OldGroupToken = $DomainUsers.Get("primaryGroupToken")
    $DomainGuests = [ADSI]"LDAP://CN=IIS_USERS,CN=Users,$DomainNC"
    $DomainGuests.GetInfoEx(@("primaryGroupToken"), 0)
    $NewGroupToken = $DomainGuests.Get("primaryGroupToken")
    $DomainGuests.Add([String]($AddADUser.AdsPath))
    $AddADUser.Put("primaryGroupId", $NewGroupToken)
    $AddADUser.SetInfo()
    $DomainUsers.Remove([String]($AddADUser.AdsPath))
}

Our new Primary Group is IIS_USERS as you see. You can change that group name.

Getting Active Directory Information with Powershell

Posted in Hosting & IIS7, Windows Powershell, Windows Server | 1 Comment | 12,170 views | 02/03/2010 12:35

My script works on all Active Directory Infrastructures without any change on script.

Function Get-ADInfo
{
    $ADDomain = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
    $ADDomainName = $ADDomain.Name
    $Netbios = $ADDomain.Name.Split(".")[0].ToUpper()
    $ADServer = ($ADDomain.InfrastructureRoleOwner.Name.Split(".")[0])
    $FQDN = "DC=" + $ADDomain.Name -Replace("\.",",DC=")
 
    $Results = New-Object Psobject
    $Results | Add-Member Noteproperty Domain $ADDomainName
    $Results | Add-Member Noteproperty FQDN $FQDN
    $Results | Add-Member Noteproperty Server $ADServer
    $Results | Add-Member Noteproperty Netbios $Netbios
    Write-Output $Results
}

Usage is pretty simple:

Get-ADInfo

Thats all! :)

Getting Netbios name:

(Get-ADInfo).Netbios

Getting FQDN:

(Get-ADInfo).FQDN

Getting Active Directory Domain Name:

(Get-ADInfo).$ADDomainName

Getting Active Directory Primary Server Name:

(Get-ADInfo).$ADServer

You can use this in your all scripts. You no longer need any active directory information.

Removing Active Directory User with Powershell

Posted in Hosting & IIS7, Windows Powershell, Windows Server | No Comment | 4,670 views | 02/03/2010 12:26

It’s very easy to remove an Active Directory user with Powershell.

1 2	$CustomerOU = [ADSI] "LDAP://$CustomerOU,$FQDN" $RemoveADUser = $CustomerOU.Delete("User", "CN=$Username")

Again and again, please be sure about your LDAP path.

Changing Active Directory User Password with Powershell

Posted in Hosting & IIS7, Windows Powershell, Windows Server | No Comment | 8,560 views | 02/03/2010 12:23

You see how easy to change ad user password with Powershell.

1
2
3

$ADUser = [ADSI] "LDAP://CN=$Username,$CustomerOU,$FQDN"
$ADUser.SetPassword($Password)
$ADUser.SetInfo()

Again, be careful to LDAP name. Have fun!

Setting Primary Groups of Active Directory Users with Powershell

Posted in Hosting & IIS7, Windows Powershell, Windows Server | 1 Comment | 9,746 views | 02/03/2010 12:19

As you know, changing Primary Group of Active Directory users is a difficult job for system administrators.
You need to set a new one, then assign that as a primary, after all you can remove old group.
But that’s easy if you know Powershell.

$User = [ADSI] "LDAP://CN=$Username,$CustomerOU,$FQDN"
$DomainNC = ([ADSI]"LDAP://RootDSE").DefaultNamingContext
$DomainUsers = [ADSI]"LDAP://CN=Domain Users,CN=Users,$DomainNC"
$DomainUsers.GetInfoEx(@("primaryGroupToken"), 0)
$OldGroupToken = $DomainUsers.Get("primaryGroupToken")
$DomainGuests = [ADSI]"LDAP://CN=IIS_USERS,CN=Users,$DomainNC"
$DomainGuests.GetInfoEx(@("primaryGroupToken"), 0)
$NewGroupToken = $DomainGuests.Get("primaryGroupToken")
$DomainGuests.Add([String]($User.AdsPath))
$User.Put("primaryGroupId", $NewGroupToken)
$User.SetInfo()
$DomainUsers.Remove([String]($User.AdsPath))

This script simply set IIS_USERS as a primary group of Active Directory users.

Setting “Password never expires” for Active Directory Users with Powershell

Posted in Hosting & IIS7, Windows Powershell, Windows Server | 1 Comment | 10,806 views | 02/03/2010 12:13

You have to set “Password never expires” for some active directory users like IIS or SCVMM users. To do this with Powershell, we’ll simply use “userAccountControl” property with Powershell.

1
2
3

$User = [ADSI] "LDAP://CN=$Username,$CustomerOU,$FQDN"
$User.Put("userAccountControl", "65536")
$User.SetInfo()

65536 means “Password never expires”. Be careful with LDAP name.