Active Directory - Create user

Declaration

<AMACTIVEDIRECTORY AUTHTYPE="text (options)" USERNAME="text" PASSWORD="text (encrypted)" LDAPPATH="text" FIRSTNAME="text" INITIALS="text" LASTNAME="text" FULLNAME="text" USER="text" PREWINDOWLOGONUSERNAME="text" NEWPASSWORD="text (encrypted)" EMAIL="text" USERCANNOTCHANGEPASSWORD="yes/no" PASSWORDNEVEREXPIRES="yes/no" DISABLEACCOUNT="yes/no" />

Related Topics    

Description

Creates a new user at the specified Active Directory location.

IMPORTANT: Automate's Active Directory activities require a basic understanding of Active Directory and related components (for example, Domain Controllers, Trust Relationships, Forests, LDAPs, etc.). Also, to ensure that these activities function appropriately, the target system must be part of a domain.

Practical Usage

Commonly used to automate the normally tedious process of creating new Active Directory users. Use the Active Directory - Create group activity to create a group in which to add users to.

Parameters

User

Property Type Required Default Markup Description
Parent path Text Yes (Empty) LDAPPATH="LDAP://
DC=netauto,DC=com" 		The Lightweight Directory Access Protocol (LDAP) path of the parent Active Directory container. This is usually the top most container or rootDSE path, the root of the directory data tree on a directory server. Click the Select Container button to launch a standard Windows Active Directory dialog box that allows for the selection an Active Directory container.
First name Text Yes (Empty) FIRSTNAME="Mike" The first name of the Active Directory user to be created.
Initials Text No (Empty) INITIALS="R" The initials of the Active Directory user to be created.
Last name Text No (Empty) LASTNAME="Rogers" The last name of the Active Directory user to be created.
Full name Text Yes First, Middle Initial & Last Name parameters combined FULLNAME="Mike R. Rogers" The full name of the Active Directory user to be created. This property defaults to the data entered in the First name, Initials and Last name parameters combined.

Login

Property Type Required Default Markup Description
User logon name (@domain is allowed) Text Yes (Empty) USER="MRogers@netauto.com" The logon name of the Active Directory user to be created.
User logon name (Pre-Windows 2000) Text Yes (Empty) PREWINDOWLOGONUSERNAME="MRogers" The pre-Windows 2000 logon name of the Active Directory user to be created. This defaults to the data entered in the User Logon Name (@domain is allowed) property minus the @domain parameter (if applicable).
Password Text Yes (Empty) NEWPASSWORD="password" The logon password of the Active Directory user to be created.
Email Text No (Empty) EMAIL="mike@netauto.com" The email address of the Active Directory user to be created.
User must change password at next login Yes/No No No MUSTCHANGEPASSWORD="YES" If set to Yes, specifies that the user must modify their password at next login session. If set to No, the user must use the password specified in the Password parameter. The default value is No.
User cannot change password Yes/No No No USERCANNOTCHANGEPASSWORD="YES" If set to Yes, specifies that the user cannot change the assigned password. The default value is No. This parameter is available only if the User must change password at next login parameter is set to No.
Password never expires Yes/No No No PASSWORDNEVEREXPIRES="YES" If set to Yes, indicates that the assigned password never expires. The default value is No.
Account is disabled Yes/No No No DISABLEACCOUNT="YES" If set to Yes, indicates that the account to be created is in a disabled state. The default value is No.

Credentials

Property Type Required Default Markup Description
Authentication type Text (options) No Default
  • AUTHTYPE="Secure"
  • AUTHTYPE="Encryption"
  • AUTHTYPE="SecureSocketLayer"
  • AUTHTYPE="ReadonlyServer"
  • AUTHTYPE="Anonymous"
  • AUTHTYPE="FastBin
  • AUTHTYPE="Signing"
  • AUTHTYPE="Sealing"
  • AUTHTYPE="Delegation"
  • AUTHTYPE="ServerBind"
 Specifies the types of authentication used. The available options are:
  • Default - Use default authentication type.
  • None - Equates to zero, which means to use basic authentication (simple bind) in the LDAP provider.
  • Secure - Requests secure authentication. When this flag is set, the WinNT provider uses NTLM to authenticate the client.
  • Encryption - Attaches a cryptographic signature to the message that both identifies the sender and ensures that the message has not been modified in transit.
  • SecureSocketLayer - Attaches a cryptographic signature to the message that both identifies the sender and ensures that the message has not been modified in transit.
  • ReadonlyServer - For a WinNT provider, ADSI tries to connect to a domain controller. For Active Directory Domain Services, this flag indicates that a writable server is not required for a serverless binding.
  • Anonymous - No authentication is performed.
  • FastBind - Specifies that ADSI will not attempt to query the Active Directory Domain Services objectClass property. Therefore, only the base interfaces that are supported by all ADSI objects will be exposed. Other interfaces that the object supports will not be available.
  • Signing - Verifies data integrity to ensure that the data received is the same as the data sent. The Secure flag must also be set to use signing.
  • Sealing - Encrypts data using Kerberos. The Secure flag must also be set to use sealing.
  • Delegation - Enables Active Directory Services Interface (ADSI) to delegate the user's security context, which is necessary for moving objects across domains.
  • ServerBind - If your ADsPath includes a server name, specify this flag when using the LDAP provider. Do not use this flag for paths that include a domain name or for serverless paths. Specifying a server name without also specifying this flag results in unnecessary network traffic.
Username Text No (Empty) USERNAME="username" The username context that this activity will execute under. Leave the Username and Password parameters blank in order to use the logon user's credentials
NOTE: A Domain User has permission to access Active Directory information. However, only a Domain Administrator has permission to perform Active Directory modifications.
Password Text No (Empty) PASSWORD="password" The password associated to the Username context that this activity will execute under. Leave the Username and Password parameters blank in order to use the logon user's credentials.

Description

Error Causes

On Error

Example

NOTE:
  • The sample AML code below can be copied and pasted directly into the Steps Panel of the Task Builder.
  • Parameters containing user credentials, files, file paths, and/or other information specific to the task must be customized before the sample code can run successfully.

Description

Create user "PParker" (full name: Peter Parker) at location "LDAP://mycompanyserver.com."

Copy 
<AMACTIVEDIRECTORY AUTHTYPE="Secure" USERNAME="Administrator" PASSWORD="AM55zesvyNfRkAb9EVB+iFTmemf37ZQh3ZRk59dLlxNyDE=aME" LDAPPATH="LDAP://servername.com" FIRSTNAME="Dave" LASTNAME="Jones" FULLNAME="Dave Jones" USER="dave.jones@helpsystems.com" PREWINDOWLOGONUSERNAME="dave.jones" NEWPASSWORD="AM5Y2WZRrZEmD1HqhgZq759LISNVoPQ7eDPVp0aYMWJhGw=aME" EMAIL="dave.jones@helpsystems.com" MUSTCHANGEPASSWORD="yes" />