PowerShell Active Directory User Management: Create and Modify
─□✕

PowerShell Active Directory User Management: Create and Modify

PowerShell Tips Editor 4 min read
PowerShell Active Directory User Management: Create and Modify

New employee onboarding in 30 seconds instead of 30 minutes: create the AD account, set the password, assign the OU, add them to the right groups, and enable the account — all from one script. PowerShell create AD user workflows using New-ADUser, Set-ADUser, and related cmdlets let you automate every step of the user lifecycle from provisioning through deprovisioning. This post covers creation, modification, moves, and bulk operations from CSV with production-ready examples.

Create a Single AD User

New-ADUser creates a user account. The account is disabled by default until you add -Enabled $true with a valid password. Supply the minimum required attributes for your domain schema — most domains require at minimum -Name and -SamAccountName.

New-ADUser `
    -Name            "Jane Doe" `
    -GivenName       "Jane" `
    -Surname         "Doe" `
    -SamAccountName  "jdoe" `
    -UserPrincipalName "[email protected]" `
    -Path            "OU=Staff,DC=corp,DC=example,DC=com" `
    -Department      "Marketing" `
    -Title           "Marketing Manager" `
    -EmailAddress    "[email protected]" `
    -Enabled         $true

Set Password on Creation

The -AccountPassword parameter requires a SecureString. Set -ChangePasswordAtLogon $true so the user sets their own password on first login — a security best practice.

$securePassword = ConvertTo-SecureString "TempP@ss2026!" -AsPlainText -Force

New-ADUser `
    -Name             "Jane Doe" `
    -SamAccountName   "jdoe" `
    -UserPrincipalName "[email protected]" `
    -Path             "OU=Staff,DC=corp,DC=example,DC=com" `
    -AccountPassword  $securePassword `
    -ChangePasswordAtLogon $true `
    -Enabled          $true

Write-Output "User jdoe created successfully."

Modify User Attributes with Set-ADUser

Use Set-ADUser to update any attribute on an existing account. You can pipe from Get-ADUser or specify the user with -Identity. Use -Replace, -Add, or -Clear for multi-valued attributes.

# Update common attributes
Set-ADUser -Identity "jdoe" `
    -Title       "Senior Marketing Manager" `
    -Department  "Marketing" `
    -Manager     "asmith" `
    -Description "Promoted 2026-05"

# Update phone number using -Replace for extensionAttribute
Set-ADUser -Identity "jdoe" -Replace @{ telephoneNumber = "+1-555-0100" }

# Clear an attribute
Set-ADUser -Identity "jdoe" -Clear description

Move User to Different OU

Moving a user to a new OU (for example, during a department transfer) uses Move-ADObject. Supply the user’s distinguished name and the target OU path.

$user  = Get-ADUser -Identity "jdoe"
$newOU = "OU=Managers,OU=Staff,DC=corp,DC=example,DC=com"

Move-ADObject -Identity $user.DistinguishedName -TargetPath $newOU
Write-Output "Moved $($user.Name) to $newOU"

Disable and Delete User

Disabling the account first (rather than immediately deleting) is best practice — it preserves the account in case of error or HR reversal. Delete after a retention period.

# Disable account
Disable-ADAccount -Identity "jdoe"

# Move to a Disabled Users OU
$disabledOU = "OU=Disabled,DC=corp,DC=example,DC=com"
Move-ADObject -Identity (Get-ADUser "jdoe").DistinguishedName -TargetPath $disabledOU

# After retention period — permanently delete
Remove-ADUser -Identity "jdoe" -Confirm:$false

Bulk Create Users from CSV

Onboarding a new team or creating lab accounts becomes a single script run when users are defined in a CSV. The CSV should match the attributes your domain schema requires.

# CSV columns: FirstName,LastName,SamAccount,UPN,Department,Title,OU
# Example row: Jane,Doe,jdoe,[email protected],Marketing,Manager,"OU=Staff,DC=corp,DC=example,DC=com"

$defaultPassword = ConvertTo-SecureString "Welcome2026!" -AsPlainText -Force
$users = Import-Csv -Path "C:\Logs\new-users.csv"

foreach ($u in $users) {
    try {
        New-ADUser `
            -Name             "$($u.FirstName) $($u.LastName)" `
            -GivenName        $u.FirstName `
            -Surname          $u.LastName `
            -SamAccountName   $u.SamAccount `
            -UserPrincipalName $u.UPN `
            -Path             $u.OU `
            -Department       $u.Department `
            -Title            $u.Title `
            -AccountPassword  $defaultPassword `
            -ChangePasswordAtLogon $true `
            -Enabled          $true `
            -ErrorAction Stop

        Write-Output "Created: $($u.SamAccount)"
    } catch {
        Write-Warning "Failed: $($u.SamAccount) — $_"
    }
}

Write-Output "Bulk creation complete. $($users.Count) users processed."

Common Errors and Fixes

  • Password must meet complexity policy: If your domain enforces password complexity (uppercase, lowercase, digit, symbol, minimum length), New-ADUser fails with “The password does not meet the length, complexity, or history requirement.” Choose a temporary password that meets your domain policy, or disable complexity checking for the OU if that’s appropriate for your environment.
  • SamAccountName uniqueness required: Active Directory requires every SamAccountName to be unique across the domain. If a user with the same SAM name already exists, New-ADUser throws a duplicate error. Build a SAM-generation function that appends a number if the first-name/last-name combination is already taken: jsmith → jsmith2.

Related Cmdlets / See Also

Wrapping Up

New-ADUser and Set-ADUser combined with a CSV input turn onboarding from a 30-minute manual task into a 30-second script run. As a next step, extend the bulk creation script to also add each new user to the correct security groups based on their department column — completing the full provisioning workflow in one pass.

#accounts#active-directory#create#new-aduser
Send-Item -To