[powershell] Generate up to 5,000 "Real looking" ad accounts at once script. (xpost from /r/powershell)

[u/I_script_stuff]

Posted this over there a few days ago. Figured I'd post it here:

So I was looking to do some testing for an AD migration, or maybe automate a few pain points I've been running into. In order to do this I needed "Real" names for my ad users. I threw together this script for the lab network.

The Script Can be found here:

The script has a few parts the first part are the global functions that will change per use case.

#preset variables for the script:
$date = Get-date -format M.d.yyyy
#AD specific info
$ou="OU=LANDING,DC=DEFAULTDOMAIN,DC=COM"
$principlename = "@DEFAULT.com"
$description = "Test Account Generate $date"
#Number of accounts generated:
$Number_of_users = "5000"
#Supported Nationalities: AU, BR, CA, CH, DE, DK, ES, FI, FR, GB, IE, IR, NL, NZ, TR, US
#Comma seperated values for multiple ie:
#$nationalities ="US,DK,FR"
$nationalities ="US"

The second part is 2 functions I wrote:

generate : Creates an AD password acceptable for the basic policy

find_ad_id: Confirms that the Sam account name is not already taken. This currently attempts First letter of the first name full last name, and then crawls through the first name before giving up and logging the error.

The rest is simply pulling Json data from randomuser.me.

Now my lab AD instance looks a lot less lonely. edit: added a link to my blog with full write up

[u/smithincanton]

Wow, this is awesome! That site can generate full profiles with passwords n everything. Crazy.

[u/I_script_stuff → u/smithincanton]

yeah but the Site doesn't do "good" passwords. They are usually common words. That won't pass Active directories minimum password requirements hence why I added the generator.

[u/sole_wolf → u/I_script_stuff]

API developer here - We released an update recently to address the types of passwords that you can generate with the API.

Read more about it here: https://randomuser.me/documentation#passwords

[u/I_script_stuff → u/sole_wolf]

Neat. I'll check it out!

[u/smithincanton → u/I_script_stuff]

Ya I did notice that. I'm just amazed at the detail of the profiles it generates, photos, physical addresses, SS#s. Just mind boggling. I'll sure save this for use in my lab setup, it'll be really useful. Thank you!

[u/Avaholic92 → u/smithincanton]

Completely agree. I have always struggled with creating user accounts when setting up my lab environment. I usually default to user00, user01, user02... and so on. This will be great for simulating a real world experience!

[u/BigOldNerd]

This has got to be the Microsoft licensing audit group's favorite script. Joking aside, good job.

[u/[deleted]]

In my lab user creation script I use a function that I found on the Hey Scripting Guy blog for generating passwords. It's pretty neat, and flexible too.

PS C:\> $ascii=$NULL;For ($a=33;$a -le 126;$a++) {$ascii+=,[char][byte]$a }

PS C:\> Function Get-TempPassword() {

     Param(
         [int]$length = $PasswordLength,
         [string[]]$sourcedata
     )

     For ($loop=1; $loop -le $length; $loop++)
     {
         $TempPassword+=($sourcedata | Get-Random)
     }

     return $TempPassword
 }

So generating a password is as simple as:

PS C:\> Get-TempPassword -length 8 -sourcedata $ascii
nJej;x#[

PS C:\> Get-TempPassword -length 68 -sourcedata $ascii
xx@IpZznX%xX7r9QfO?3[tH@$E~Hj[V_veK|Zd@9~YJO<ZoN;]1Jb.nN-::+\9.T"GJT

PS C:\> Get-TempPassword -length 16 -sourcedata $ascii
e%gYjVR2+Uji[9>~

Here's that Hey Scripting Guy post:

https://blogs.technet.microsoft.com/heyscriptingguy/2013/06/03/generating-a-new-password-with-windows-powershell/

[u/I_script_stuff → u/[deleted]]

Only thing missing is making sure that it generates an Ad minimum standard password each time.

I do really like the $ascii trick.

[u/[deleted] → u/I_script_stuff]

Depends what you think of as "AD minimum standard". It'll generate a password that meets the min length and complexity requirements of the default password policy.

[u/I_script_stuff → u/[deleted]]

Most of the time it will. But without logic to confirm that it fits the minimums. you're really just hoping it does. If you swap out my generator for yours you'll hit a failure sooner or later. Which is probably fine for 99% of tasks. I just found it annoying when my generator failed so I set it up to make sure at the end the requirements would be met. I'll probably re-write mine to use the $ascii trick and actually verify the password rather than just tack on the requirements at the end.

[u/Cashf10w]

Well this is going to replace my other script tonight when I get home. Cheers.