Powershell AD 脚本 - 在帐户名称末尾添加一个数字

【问题标题】：Powershell AD Script - Add a number onto the end of account NamePowershell AD 脚本 - 在帐户名称末尾添加一个数字
【发布时间】：2018-06-05 07:16:38
【问题描述】：

关于这个可怕脚本的另一个问题。我撞到了一堵砖墙。 在我的组织中创建用户名的方式是 SurnameInitial。但是，如果帐户已经存在，我们会在末尾添加一个数字。如果该数字存在，它将更改为下一个数字（TestT、TestT1、TestT2 ...等）

我不知道如何让脚本执行此操作，如果 AD 中已经存在帐户，它根本不会创建帐户

以下是相关代码，可帮助您了解它当前如何管理帐户创建。

#region Unique Field Data

# Acquiring unique field data
$GivenName = Read-Host -Prompt "What Is The New User's First Name?"
Write-Host " "

$Surname = Read-Host -Prompt "What Is The New User's Last Name?"
Write-Host " "

$Description = Read-Host -Prompt "What Is The Job Title & Department Of The New User? [Please format as Job Title – Dept]"
Write-Host " "

#endregion

#region Data Generation

$DisplayName = $GivenName + " " + $Surname

$Mail = $GivenName + "." + $Surname + "@" + "RE"

$MailAlias = $GivenName + "." + $Surname + "@" + $DNSRoot2

$SInitial = $Surname[0]
$Initial = $GivenName[0]
$SAMAccountName = $Surname+$Initial
$SAMAccountLower = $SAMAccountName.ToLower()
$UserPrincipalName = $Surname+$Initial
$HD = "U"
$HDir = "\\RBHFILRED002\"
$AC = "Users_01$\"
$DH = "Users_02$\"
$IM = "Users_03$\"
$NS = "Users_04$\"
$TZ = "Users_05$\"
$Folder = if ($SInitial -in 'a','b','c'){$AC}
      ElseIf ($SInitial -in 'd','e','f', 'g','h'){$DH}
      ElseIf ($SInitial -in 'i','j','k', 'l','m'){$IM}
      ElseIf ($SInitial -in 'n','o','p', 'q','r','s'){$NS}
      Else {$TZ}

$group1 = "zz Everyone"
$group2 = "Safeboot Domain Users"
cls

#endregion

#region User Creation

# Create The User

Get-ChildItem
New-ADUser -path "OU=Users,OU=RBFT,DC=rbbh-tr,DC=nhs,DC=uk" -SamAccountName $Surname$Initial -Name $DisplayName -DisplayName $DisplayName -GivenName $GivenName -Surname $Surname -EmailAddress $Mail -UserPrincipalName $Surname$Initial@rbbh-tr.nhs.uk -Title $title -HomeDrive $HD -HomeDirectory $HDir$Folder$Surname$Initial -Description $Description -ChangePasswordAtLogon $true -PasswordNeverExpires $false -AccountPassword $defpassword -Enabled $true -PassThru
Add-ADGroupMember -Identity $group1  -Members $SAMAccountName
Add-ADGroupMember -Identity $group2  -Members $SAMAccountName
Write-Host " "

cls
echo "Please Wait Whilst We Find The AD Account & Create The Exchange Mailbox.."
Start-Sleep -s 30

Enable-Mailbox -Identity $SAMAccountName
cls

#endregion

希望我的代码清晰，可以理解，希望你们能够提供支持。

先发制人的谢谢

在下面编辑

所以我使用下面的建议扩展了脚本。

#region User Creation

# Create The User


$i = 1
$AccountCreated = $False
Do {
Try {
New-ADUser -path "OU=Users,OU=RBFT,DC=rbbh-tr,DC=nhs,DC=uk" -SamAccountName $Surname$Initial -Name $DisplayName -DisplayName $DisplayName -GivenName $GivenName -Surname $Surname -EmailAddress $Mail -UserPrincipalName $Surname$Initial@rbbh-tr.nhs.uk -Title $title -HomeDrive $HD -HomeDirectory $HDir$Folder$Surname$Initial -Description $Description -ChangePasswordAtLogon $true -PasswordNeverExpires $false -AccountPassword $defpassword -Enabled $true -PassThru 
Add-ADGroupMember -Identity $group1 -Members $SAMAccountName
Add-ADGroupMember -Identity $group2 -Members $SAMAccountName
Set $AccountCreated to $True
}
Catch {
New-ADUser -path "OU=Users,OU=RBFT,DC=rbbh-tr,DC=nhs,DC=uk" -SamAccountName $Surname$Initial$I -Name $DisplayName -DisplayName $DisplayName -GivenName $GivenName -Surname $Surname -UserPrincipalName $Surname$Initial$I@rbbh-tr.nhs.uk -Title $title -HomeDrive $HD -HomeDirectory $HDir$Folder$Surname$Initial -Description $Description -ChangePasswordAtLogon $true -PasswordNeverExpires $false -AccountPassword $defpassword -Enabled $true -PassThru 
Add-ADGroupMember -Identity $group1 -Members $SAMAccountName
Add-ADGroupMember -Identity $group2 -Members $SAMAccountName
Increment $I
}
}
Until ($AccountCreated -eq $True)

cls
echo "Please Wait Whilst We Find The AD Account & Create The Exchange Mailbox.."
Start-Sleep -s 30

Enable-Mailbox -Identity $SAMAccountName
cls

#endregion

#region Post-Creation

echo "Username:" $SAMAccountName
Write-Host " "
echo "Password:" "Welcome123"
Write-Host " "
echo "Email:" $Mail
Write-Host " "
echo "Job Title - Department:" $Description
Write-Host " "
echo "Home Directory:" $HDir$Folder$Surname$Initial
Write-Host " "

#endregion

但是，这会创建帐户。但不会使用递增的用户名更新交换创建（因此不会创建邮箱），不会创建正确的主目录，并且不会根据是否递增来回显正确的详细信息。

我现在不知道该怎么做

编辑两个

在 James C 的进一步帮助下，我创建了以下代码。但是，它不会创建邮件帐户。现在抛出一个错误。

$defaultname = $SAMAccountName
$i = 1
cls

#endregion

#region User Creation

# Create The User


While ((Get-ADUser -Identity $SAMAccountName) -ne $null){
$SamAccountName = $defaultname + [string]$i
$i++
}

$NewUserParams = @{
path                  = "OU=Users,OU=RBFT,DC=rbbh-tr,DC=nhs,DC=uk"
SamAccountName        = $SAMAccountName
Name                  = $DisplayName
DisplayName           = $DisplayName
GivenName             = $GivenName
Surname               = $Surname
EmailAddress          = $Mail
UserPrincipalName     = "$SAMAccountName@rbbh-tr.nhs.uk"
Title                 = $title
HomeDrive             = $HomeDrive
HomeDirectory         = "$HDir$Folder$SAMAccountName"
Description           = $Description
ChangePasswordAtLogon = $true
PasswordNeverExpires  = $false
AccountPassword       = $defpassword
Enabled               = $true
}

New-ADUser @NewUserParams
Add-ADGroupMember -Identity $group1  -Members $SAMAccountName
Add-ADGroupMember -Identity $group2  -Members $SAMAccountName

cls
echo "Please Wait Whilst We Find The AD Account & Create The Exchange Mailbox.."
Start-Sleep -s 30

Enable-Mailbox -Identity $SAMAccountName
cls

#endregion

#region Post-Creation

echo "Username:" $SAMAccountName
Write-Host " "
echo "Password:" "Welcome123"
Write-Host " "
echo "Email:" $Mail
Write-Host " "
echo "Job Title - Department:" $Description
Write-Host " "
echo "Home Directory:" $HDir$Folder$SAMAccountName
Write-Host " "

#endregion

它会产生以下错误

Name        : Microsoft.Exchange.Management.PowerShell.E2010
PSVersion   : 1.0
Description : Admin Tasks for the Exchange Server

Name        : Microsoft.Exchange.Management.Powershell.Support
PSVersion   : 1.0
Description : Support Tasks for the Exchange Server

This tool is to be used for creating User Accounts for the RBFT Domain under Ultima Business Solutions only. If this     applies, please hit any key to continue.

Get-ADUser : Cannot find an object with identity: 'TimmsJ1' under: 'DC=rbbh-tr,DC=nhs,DC=uk'. At C:\Users\timmsj\Desktop\Scripts\User_Creation\RBFT_UC_Dev.ps1:139 char:9
+ While ((Get-ADUser -Identity $SAMAccountName) -ne $null){
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (TimmsJ1:ADUser) [Get-ADUser],     ADIdentityNotFoundException
+ FullyQualifiedErrorId : Cannot find an object with identity: 'TimmsJ1' under: 'DC=rbbh-tr,DC=nhs,DC=uk'.,Microsoft.ActiveDirectory.Management.Comm  ands.GetADUser

New-ADUser : An attempt was made to add an object to the directory with a name that is already in use At C:\Users\timmsj\Desktop\Scripts\User_Creation\RBFT_UC_Dev.ps1:163 char:1
+ New-ADUser @NewUserParams
+ ~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : NotSpecified: (CN=Timms James,...tr,DC=nhs,DC=uk 
   :String) [New-ADUser], ADException
+ FullyQualifiedErrorId : An attempt was made to add an object to the dire ctory with a name that is already in use,Microsoft.ActiveDirectory.Managem  ent.Commands.NewADUser

Add-ADGroupMember : Cannot find an object with identity: 'TimmsJ1' under: 'DC=rbbh-tr,DC=nhs,DC=uk'. At C:\Users\timmsj\Desktop\Scripts\User_Creation\RBFT_UC_Dev.ps1:164 char:1
+ Add-ADGroupMember -Identity $group1  -Members $SAMAccountName
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : ObjectNotFound: (TimmsJ1:ADPrincipal) [Add-ADGro upMember], ADIdentityNotFoundException
+ FullyQualifiedErrorId : SetADGroupMember.ValidateMembersParameter,Micros oft.ActiveDirectory.Management.Commands.AddADGroupMember

Add-ADGroupMember : Cannot find an object with identity: 'TimmsJ1' under: 'DC=rbbh-tr,DC=nhs,DC=uk'. At C:\Users\timmsj\Desktop\Scripts\User_Creation\RBFT_UC_Dev.ps1:165 char:1
+ Add-ADGroupMember -Identity $group2  -Members $SAMAccountName
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : ObjectNotFound: (TimmsJ1:ADPrincipal) [Add-ADGro upMember], ADIdentityNotFoundException
+ FullyQualifiedErrorId : SetADGroupMember.ValidateMembersParameter,Microsoft.ActiveDirectory.Management.Commands.AddADGroupMember

Please Wait Whilst We Find The AD Account & Create The Exchange Mailbox..
Enable-Mailbox : The operation couldn't be performed because object 'TimmsJ1' couldn't be found on 'ad1.rbbh-tr.nhs.uk'. At C:\Users\timmsj\Desktop\Scripts\User_Creation\RBFT_UC_Dev.ps1:171 char:1
+ Enable-Mailbox -Identity $SAMAccountName
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : NotSpecified: (0:Int32) [Enable-Mailbox], Manage mentObjectNotFoundException
+ FullyQualifiedErrorId : 2B788636,Microsoft.Exchange.Management.Recipient Tasks.EnableMailbox

Username:
TimmsJ1

Password:
Welcome123

Email:
James.Timms@royalberkshire.nhs.uk

Job Title - Department:
Ultima - Ultima

Home Directory:
\\RBHFILRED002\Users_05$\TimmsJ1

You will need to manually set the new user's group memberships. Please Do 
This Before Sending The User's Account Details.


Press Any Key To Close

如果 $SAMAccount 重复，它会创建用户帐户和电子邮件，但是如果 GivenName 和 Surname 重复，则根本不会创建帐户。

这是为英国的国家健康信托基金服务的，所以很明显很多员工，尤其是同名的员工都会有重复的名字。

有什么解决办法吗？

编辑三个

通过创建一个新字符串来解决上述问题。 但是，如果 First + Second 名称与另一个名称重复，该帐户仍将拒绝创建。

如前所述，这是一个问题，因为 NHS 中有很多人同名。

#region Data Generation

$DisplayName = $Surname + " " + $GivenName

$Mail = $GivenName + "." + $Surname + "@" + "royalberkshire.nhs.uk"

$MailAlias = $GivenName + "." + $Surname + "@" + $DNSRoot2

$SInitial = $Surname[0]
$Initial = $GivenName[0]
$SAMAccountName = $Surname + "" + $Initial
$SAMAccountLower = $SAMAccountName.ToLower()
$UserPrincipalName = $Surname+$Initial
$HD = "U"
$HDir = "\\RBHFILRED002\"
$AC = "Users_01$\"
$DH = "Users_02$\"
$IM = "Users_03$\"
$NS = "Users_04$\"
$TZ = "Users_05$\"

$Folder = if ($SInitial -in 'a','b','c'){$AC}
      ElseIf ($SInitial -in 'd','e','f', 'g','h'){$DH}
      ElseIf ($SInitial -in 'i','j','k', 'l','m'){$IM}
      ElseIf ($SInitial -in 'n','o','p', 'q','r','s'){$NS}
      Else {$TZ}

$group1 = "zz Everyone"
$group2 = "Safeboot Domain Users"

$defaultname = $SAMAccountName
$email = $GivenName + "." + $Surname
$i = 1
cls

#endregion

#region User Creation

# Create The User

While ((Get-ADUser -Identity $SAMAccountName -ErrorAction SilentlyContinue) -ne $null){
$SamAccountName = $defaultname + [string]$i
$Mail = $email + [string]$i + "@" + "royalberkshire.nhs.uk"
$i++

}

$NewUserParams = @{
path                  = "OU=Users,OU=RBFT,DC=rbbh-tr,DC=nhs,DC=uk"
SamAccountName        = $SAMAccountName
Name                  = $DisplayName
DisplayName           = $DisplayName
GivenName             = $GivenName
Surname               = $Surname
EmailAddress          = $Mail
UserPrincipalName     = "$SAMAccountName@rbbh-tr.nhs.uk"
Title                 = $title
HomeDrive             = $HomeDrive
HomeDirectory         = "$HDir$Folder$SAMAccountName"
Description           = $Description
ChangePasswordAtLogon = $true
PasswordNeverExpires  = $false
AccountPassword       = $defpassword
Enabled               = $true
}

New-ADUser @NewUserParams
Add-ADGroupMember -Identity $group1  -Members $SAMAccountName
Start-Sleep -s 10
Add-ADGroupMember -Identity $group2  -Members $SAMAccountName

cls
echo "Please Wait Whilst We Find The AD Account & Create The Exchange Mailbox.."
Start-Sleep -s 30

Enable-Mailbox -Identity $SAMAccountName
cls

#endregion

再一次，有什么想法吗？

【问题讨论】：

  • 您需要这样做：询问用户输入 -> 检查现有匹配用户 (Get-ADUSer) -> 更新用户输入（如果需要，添加数字后缀）-> 创建新的用户。我没有看到您执行第 2 步或第 3 步。
  • 我该怎么做？

标签： powershell active-directory


【解决方案1】：

使用带有Get-ADUser 的Do/While 循环搜索免费用户名，并使用$VariableName++ 在每个循环中增加用户名的编号。

还更新了您的New-ADUser 命令以使用splatting，因为这样更易于阅读。

#didn't include rest of your code above here as it hasn't changed

$group1 = "zz Everyone"
$group2 = "Safeboot Domain Users"

$defaultname = $SAMAccountName
$i = 1

While ((Get-ADUser -Identity $SAMAccountName -ErrorAction SilentlyContinue) -ne $null){
    $SamAccountName = $defaultname + [string]$i
    $i++
}

$NewUserParams = @{
    path                  = "OU=Users,OU=RBFT,DC=rbbh-tr,DC=nhs,DC=uk"
    SamAccountName        = $SAMAccountName
    Name                  = $DisplayName
    DisplayName           = $DisplayName
    GivenName             = $GivenName
    Surname               = $Surname
    EmailAddress          = "$GivenName.$Surname$i@royalberkshire.nhs.uk"
    UserPrincipalName     = "$SAMAccountName@rbbh-tr.nhs.uk"
    Title                 = $title
    HomeDrive             = $HomeDrive
    HomeDirectory         = "$HDir$Folder$Surname$Initial"
    Description           = $Description
    ChangePasswordAtLogon = $true
    PasswordNeverExpires  = $false
    AccountPassword       = $defpassword
    Enabled               = $true
}

New-ADUser @NewUserParams
Add-ADGroupMember -Identity $group1  -Members $SAMAccountName
Add-ADGroupMember -Identity $group2  -Members $SAMAccountName

Write-Output "Please Wait Whilst We Find The AD Account & Create The Exchange Mailbox.."
Start-Sleep -s 30
Enable-Mailbox -Identity $SAMAccountName

【讨论】：

  • 我给你做个测试。这次真是万分感谢。唯一似乎没有完成的事情是带有号码的电子邮件。我该怎么做呢，因为电子邮件需要给定name.surname（如果需要的话）@royalberkshire.nhs.uk
  • 此外，只要帐户存在，它似乎就会引发错误。它根本不增加
  • 你能帮忙吗？
  • 将代码更新为单个 while 语句，因为这样更简洁
  • 与其重复查询AD，我可能会查询一次$ExistingUsers = (Get-ADUser -LDAPFilter "(sAMAccountName=$defaultname*)").SamAccountName，然后在循环查找唯一帐户时检查$SamAccountName -in $ExistingUsers。
【解决方案2】：

好的，只是给你一个想法尝试这样的事情

$Myusername = "test"
$Mastername = $Myusername
For ($i=0; $i -le 10; $i++) {
Write-Host $Myusername
$myusername = $Mastername + $i
}

【讨论】：

  • 这并没有回答问题，它所做的只是输出一个用户名列表，其中添加了数字。没有说明如何测试候选用户名并选择第一个可用的选项。
  • @JamesC。你能帮忙吗？
【解决方案3】：

您可以将您的帐户创建放在一个 do until 循环中，其中包含一个 try catch ，即类似这样的半 sudo 代码

$i = 1
$AccountCreated = $False
Do {
$i = 1
$AccountCreated = $False
$AccountName = $Surname$Initial
Do {
Try {
New-ADUser -path "OU=Users,OU=RBFT,DC=rbbh-tr,DC=nhs,DC=uk" -SamAccountName 
$AccountName = $Surname$Initial -Name $DisplayName -DisplayName $DisplayName 
-GivenName $GivenName -Surname $Surname -EmailAddress $Mail - 
UserPrincipalName $AccountName@rbbh-tr.nhs.uk -Title $title -HomeDrive $HD - 
HomeDirectory $HDir$Folder$AccountName -Description $Description - 
ChangePasswordAtLogon $true -PasswordNeverExpires $false -AccountPassword 
$defpassword -Enabled $true -PassThru 
Add-ADGroupMember -Identity $group1 -Members $SAMAccountName
Add-ADGroupMember -Identity $group2 -Members $SAMAccountName
Set $AccountCreated to $True
}
Catch {
$AccountName = $Surname$Initial + $i
Increment $I
}
}
}
Until ($AccountCreated -eq $True)

【讨论】：

  • 它需要扩大数量。我们有时可以有 10 个人使用相同的用户名，因为它是一项国家卫生服务。 SamS / SamS1 / SamS2 / SamS3
  • 应该在 catch 块中，第一次创建帐户失败时，将应用到帐户名称的末尾，并且 $I 会增加。然后它将尝试再次创建帐户，如果失败，它将再次进入 catch 块并将 2 附加到末尾等。
  • 所以我将 2 添加到脚本的末尾还是不？
  • 我已经明白你的意思了，但是我现在有一个问题。该脚本还为用户创建了一个交换邮箱，使用Enable-Mailbox -Identity $SAMAccountName 但是，这显然标志着用户的交换帐户已经存在。如果必须使用 $i，我如何让它考虑 $i。同样在最后，我回显了用户名，如果必须使用 $i @simon，显然这是错误的用户名
  • 好的，您可以将交易所账户的创建放入一个函数中，该函数在 try 块中的账户创建后被调用。这只会在成功创建帐户后调用。这样您就可以知道交换帐户所需的用户名
猜你喜欢
  • 2015-07-25
  • 2020-11-09
  • 1970-01-01
  • 1970-01-01
  • 1970-01-01
  • 2016-01-08
  • 1970-01-01
  • 1970-01-01
  • 2016-06-19
相关资源
最近更新 更多
热门标签
Java Python linux javascript Mysql C# Docker 算法 前端 SpringBoot Redis Vue spring 设计模式 .net core .net kubernetes c++ 数据库 数据结构 大数据 js 机器学习 微服务 Android Go 程序员 面试 JVM ASP.net core 云原生 人工智能 后端 PHP git CSS golang k8s Nginx Django mybatis 深度学习 多线程 React 架构 devops 爬虫 云计算 Spring Boot LeetCode