Yusuf Ozturk

Creating New FTP User on Active Directory with Powershell

admin — Tue, 02 Mar 2010 09:43:27 +0000

Creates a new user on Active Directory and sets “Password never expires”

Function Add-FTPUser
{
Param ($FTPUsername, $FTPPassword)
 
    $ADDomain = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
    $ADDomainName = $ADDomain.Name
    $ADServer = ($ADDomain.InfrastructureRoleOwner.Name.Split(".")[0])
    $FQDN = "DC=" + $ADDomain.Name -Replace("\.",",DC=")
    $ADDomain = [ADSI] "LDAP://$ADServer/$FQDN"
    $CustomerOU = [ADSI] "LDAP://$CustomerOU,$FQDN"
    $User = [ADSI] "LDAP://CN=$FTPUsername,$CustomerOU,$FQDN"
    $PrincipalName = $FTPUsername + "@" + $ADDomainName
    $AddADUser = $CustomerOU.Create("User","CN=$FTPUsername")
    $AddADUser.Put("Description", "$FTPUsername")
    $AddADUser.Put("sAMAccountName", "$FTPUsername")
    $AddADUser.Put("userPrincipalName", "$PrincipalName")
    $AddADUser.Put("DisplayName", "$FTPUsername")
    $AddADUser.SetInfo()
    $AddADUser.SetPassword($FTPPassword)
    $AddADUser.SetInfo()
    $AddADUser.Psbase.Invokeset("AccountDisabled", "False")
    $AddADUser.SetInfo()
    $AddADUser.Put("userAccountControl", "65536")
    $AddADUser.SetInfo()
}

I didn’t change Primary Group of my FTP user. Because I don’t need for ACL.

Creating New IIS User on Active Directory with Powershell

admin — Tue, 02 Mar 2010 09:40:02 +0000

Creates a new user on Active Directory, sets “Password never expires” and changes primary group of user.

Function Add-IISUser
{
Param ($Username, $Password)
 
    $ADDomain = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
    $ADDomainName = $ADDomain.Name
    $ADServer = ($ADDomain.InfrastructureRoleOwner.Name.Split(".")[0])
    $FQDN = "DC=" + $ADDomain.Name -Replace("\.",",DC=")
    $ADDomain = [ADSI] "LDAP://$ADServer/$FQDN"
    $CustomerOU = [ADSI] "LDAP://$CustomerOU,$FQDN"
    $User = [ADSI] "LDAP://CN=$Username,$CustomerOU,$FQDN"
    $PrincipalName = $Username + "@" + $ADDomainName
    $AddADUser = $CustomerOU.Create("User","CN=$Username")
    $AddADUser.Put("Description", "$Username")
    $AddADUser.Put("sAMAccountName", "$Username")
    $AddADUser.Put("userPrincipalName", "$PrincipalName")
    $AddADUser.Put("DisplayName", "$Username")
    $AddADUser.SetInfo()
    $AddADUser.SetPassword($Password)
    $AddADUser.SetInfo()
    $AddADUser.Psbase.Invokeset("AccountDisabled", "False")
    $AddADUser.SetInfo()
    $AddADUser.Put("userAccountControl", "65536")
    $AddADUser.SetInfo()
    $DomainNC = ([ADSI]"LDAP://RootDSE").DefaultNamingContext
    $DomainUsers = [ADSI]"LDAP://CN=Domain Users,CN=Users,$DomainNC"
    $DomainUsers.GetInfoEx(@("primaryGroupToken"), 0)
    $OldGroupToken = $DomainUsers.Get("primaryGroupToken")
    $DomainGuests = [ADSI]"LDAP://CN=IIS_USERS,CN=Users,$DomainNC"
    $DomainGuests.GetInfoEx(@("primaryGroupToken"), 0)
    $NewGroupToken = $DomainGuests.Get("primaryGroupToken")
    $DomainGuests.Add([String]($AddADUser.AdsPath))
    $AddADUser.Put("primaryGroupId", $NewGroupToken)
    $AddADUser.SetInfo()
    $DomainUsers.Remove([String]($AddADUser.AdsPath))
}

Our new Primary Group is IIS_USERS as you see. You can change that group name.

Getting Active Directory Information with Powershell

admin — Tue, 02 Mar 2010 09:35:28 +0000

My script works on all Active Directory Infrastructures without any change on script.

Function Get-ADInfo
{
    $ADDomain = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
    $ADDomainName = $ADDomain.Name
    $Netbios = $ADDomain.Name.Split(".")[0].ToUpper()
    $ADServer = ($ADDomain.InfrastructureRoleOwner.Name.Split(".")[0])
    $FQDN = "DC=" + $ADDomain.Name -Replace("\.",",DC=")
 
    $Results = New-Object Psobject
    $Results | Add-Member Noteproperty Domain $ADDomainName
    $Results | Add-Member Noteproperty FQDN $FQDN
    $Results | Add-Member Noteproperty Server $ADServer
    $Results | Add-Member Noteproperty Netbios $Netbios
    Write-Output $Results
}

Usage is pretty simple:

Get-ADInfo

Thats all! :)

Getting Netbios name:

(Get-ADInfo).Netbios

Getting FQDN:

(Get-ADInfo).FQDN

Getting Active Directory Domain Name:

(Get-ADInfo).$ADDomainName

Getting Active Directory Primary Server Name:

(Get-ADInfo).$ADServer

You can use this in your all scripts. You no longer need any active directory information.

Removing Active Directory User with Powershell

admin — Tue, 02 Mar 2010 09:26:20 +0000

It’s very easy to remove an Active Directory user with Powershell.

1 2	$CustomerOU = [ADSI] "LDAP://$CustomerOU,$FQDN" $RemoveADUser = $CustomerOU.Delete("User", "CN=$Username")

Again and again, please be sure about your LDAP path.

Changing Active Directory User Password with Powershell

admin — Tue, 02 Mar 2010 09:23:19 +0000

You see how easy to change ad user password with Powershell.

1
2
3

$ADUser = [ADSI] "LDAP://CN=$Username,$CustomerOU,$FQDN"
$ADUser.SetPassword($Password)
$ADUser.SetInfo()

Again, be careful to LDAP name. Have fun!

Setting Primary Groups of Active Directory Users with Powershell

admin — Tue, 02 Mar 2010 09:19:45 +0000

As you know, changing Primary Group of Active Directory users is a difficult job for system administrators.
You need to set a new one, then assign that as a primary, after all you can remove old group.
But that’s easy if you know Powershell.

$User = [ADSI] "LDAP://CN=$Username,$CustomerOU,$FQDN"
$DomainNC = ([ADSI]"LDAP://RootDSE").DefaultNamingContext
$DomainUsers = [ADSI]"LDAP://CN=Domain Users,CN=Users,$DomainNC"
$DomainUsers.GetInfoEx(@("primaryGroupToken"), 0)
$OldGroupToken = $DomainUsers.Get("primaryGroupToken")
$DomainGuests = [ADSI]"LDAP://CN=IIS_USERS,CN=Users,$DomainNC"
$DomainGuests.GetInfoEx(@("primaryGroupToken"), 0)
$NewGroupToken = $DomainGuests.Get("primaryGroupToken")
$DomainGuests.Add([String]($User.AdsPath))
$User.Put("primaryGroupId", $NewGroupToken)
$User.SetInfo()
$DomainUsers.Remove([String]($User.AdsPath))

This script simply set IIS_USERS as a primary group of Active Directory users.

Setting “Password never expires” for Active Directory Users with Powershell

admin — Tue, 02 Mar 2010 09:13:49 +0000

You have to set “Password never expires” for some active directory users like IIS or SCVMM users. To do this with Powershell, we’ll simply use “userAccountControl” property with Powershell.

1
2
3

$User = [ADSI] "LDAP://CN=$Username,$CustomerOU,$FQDN"
$User.Put("userAccountControl", "65536")
$User.SetInfo()

65536 means “Password never expires”. Be careful with LDAP name.

Checking Active Directory User with Powershell

admin — Tue, 02 Mar 2010 09:06:51 +0000

This is another way to check active directory user with Powershell. I made a function.

Function Check-ADUser
{
Param ($Username)
 
    $ADRoot = [ADSI]''
    $ADSearch = New-Object System.DirectoryServices.DirectorySearcher($ADRoot) 
    $SAMAccountName = "$Username"
    $ADSearch.Filter = "(&(objectClass=user)(sAMAccountName=$SAMAccountName))"
    $Result = $ADSearch.FindAll()
 
    If($Result.Count -eq 0)
    {
        Write-Host "No such user on the Server" | Out-Null
        $Status = "0"
    }
    Else
    {
        Write-Host "User exist on the Server" | Out-Null
        $Status = "1"
    }
 
    $Results = New-Object Psobject
    $Results | Add-Member Noteproperty Status $Status
    Write-Output $Results    
}

Usage:

Check-ADUser -Username "yusufozturk"

You can use this function with Status property. It’s useful.

Creating a Quota Limit for IIS7.5 FTP Sites with Powershell

admin — Sat, 27 Feb 2010 13:40:43 +0000

You should install Windows File Services to use DirQuota cmdlet in Powershell.

DirQuota Quota Add /Path:"$LogDir" /Limit:$FTPQuota

Usage of $FTPQuota is like “100mb”. You can use help to find out more.

Clearing Default Security Settings of FTP on IIS7.5 with Powershell

admin — Sat, 27 Feb 2010 13:30:57 +0000

First you need to clear default security settings to create your own settings.

Clear-WebConfiguration -Filter /System.FtpServer/Security/Authorization -PSPath IIS: -Location "Default FTP Site/$FTPUserDir"

As I said in earlier posts, $FTPUserDir is the name of the FTP Virtual Site.