Bulk Active Directory User Creation From CSV

What This Script Is For

Onboarding in bulk — a new site opening, a seasonal intake, a merger dumping a spreadsheet of new employees onto your desk — turns single-user account creation into something that has to run unattended against dozens or hundreds of rows. New-ADUser handles one account cleanly. The problem is what happens on row 40 when a SamAccountName is already taken, or the target OU string has a typo, or the CSV has a blank required field.

Think of the script as a foreman, not a machine: it does not just push every row through New-ADUser and hope. It checks each row before committing to it, records what happened whether that row succeeded or failed, and keeps going instead of stopping the whole batch because of one bad row.

Why Bother With Per-Row Error Handling?

The naive version of this script is a five-line foreach loop piping straight into New-ADUser. It works exactly once — on a CSV with no mistakes in it. Real onboarding spreadsheets always have at least one: a duplicate name, a missing OU, a password that fails the domain’s complexity policy.

Why Active Directory Cares

New-ADUser requires SamAccountName in practice, even though the parameter itself is not flagged mandatory — omit it and the cmdlet fails outright. Get it wrong in a way that collides with an existing account, and AD returns an error that a bare loop will either crash on or silently swallow, depending on how carelessly the script was written.

Passwords add a second failure mode. -AccountPassword takes a SecureString, and per Microsoft’s own documentation, an account is created without a password — and left disabled — if no password is supplied or if the password fails the domain’s password policy. That means a script with no error handling can leave a trail of disabled accounts with no explanation of why, unless it checks and reports on that outcome explicitly.

The CSV Format

The script expects one row per user with these columns. Password is optional — leave it blank to have the script generate one.

FirstName,LastName,SamAccountName,OUPath,Department,Title,EmailAddress,Password
Jane,Doe,jdoe,"OU=Sales,OU=Users,DC=corp,DC=example,DC=com",Sales,Account Manager,jane.doe@corp.example.com,
John,Smith,jsmith,"OU=IT,OU=Users,DC=corp,DC=example,DC=com",IT,Systems Engineer,john.smith@corp.example.com,

The Script

The script validates every row before it calls New-ADUser: it checks for missing required fields and for an existing account with the same SamAccountName using Get-ADUser -Filter, so duplicates are caught before AD ever rejects them. Every row — success or failure — produces a result object, and the whole run supports -WhatIf because New-ADUser itself implements ShouldProcess.

[CmdletBinding(SupportsShouldProcess = $true)]
param(
    [Parameter(Mandatory = $true)]
    [ValidateNotNullOrEmpty()]
    [string]$CsvPath,

    [Parameter(Mandatory = $false)]
    [string]$UpnSuffix = "corp.example.com"
)

Set-StrictMode -Version Latest
Import-Module ActiveDirectory -ErrorAction Stop

function New-RandomPassword {
    # Generates a 16-character password that satisfies typical AD complexity policy
    $upper = 65..90 | Get-Random -Count 4 | ForEach-Object { [char]$_ }
    $lower = 97..122 | Get-Random -Count 4 | ForEach-Object { [char]$_ }
    $digits = 48..57 | Get-Random -Count 4 | ForEach-Object { [char]$_ }
    $symbols = @('!','@','#','%','^','*') | Get-Random -Count 4
    -join (($upper + $lower + $digits + $symbols) | Sort-Object { Get-Random })
}

if (-not (Test-Path -LiteralPath $CsvPath)) {
    throw "CSV file not found: $CsvPath"
}

$rows = Import-Csv -LiteralPath $CsvPath
$results = [System.Collections.Generic.List[pscustomobject]]::new()

foreach ($row in $rows) {

    $result = [pscustomobject]@{
        SamAccountName = $row.SamAccountName
        Status         = 'Unknown'
        Detail         = ''
    }

    if ([string]::IsNullOrWhiteSpace($row.FirstName) -or
        [string]::IsNullOrWhiteSpace($row.LastName) -or
        [string]::IsNullOrWhiteSpace($row.SamAccountName) -or
        [string]::IsNullOrWhiteSpace($row.OUPath)) {
        $result.Status = 'Skipped'
        $result.Detail = 'Missing a required field (FirstName, LastName, SamAccountName, or OUPath)'
        $results.Add($result)
        continue
    }

    $existing = Get-ADUser -Filter "SamAccountName -eq '$($row.SamAccountName)'" -ErrorAction SilentlyContinue
    if ($existing) {
        $result.Status = 'Skipped'
        $result.Detail = 'An account with this SamAccountName already exists'
        $results.Add($result)
        continue
    }

    $plainPassword = if ([string]::IsNullOrWhiteSpace($row.Password)) { New-RandomPassword } else { $row.Password }
    $securePassword = ConvertTo-SecureString -String $plainPassword -AsPlainText -Force
    $displayName = "$($row.FirstName) $($row.LastName)"
    $upn = if ($row.EmailAddress) { $row.EmailAddress } else { "$($row.SamAccountName)@$UpnSuffix" }

    $newUserParams = @{
        Name                  = $displayName
        SamAccountName        = $row.SamAccountName
        UserPrincipalName     = $upn
        GivenName             = $row.FirstName
        Surname               = $row.LastName
        DisplayName           = $displayName
        Path                  = $row.OUPath
        AccountPassword       = $securePassword
        Enabled               = $true
        ChangePasswordAtLogon = $true
        PasswordNeverExpires  = $false
    }
    if ($row.Department) { $newUserParams['Department'] = $row.Department }
    if ($row.Title) { $newUserParams['Title'] = $row.Title }
    if ($row.EmailAddress) { $newUserParams['EmailAddress'] = $row.EmailAddress }

    if ($PSCmdlet.ShouldProcess($row.SamAccountName, 'Create AD user')) {
        try {
            New-ADUser @newUserParams -ErrorAction Stop
            $result.Status = 'Created'
            $result.Detail = if ([string]::IsNullOrWhiteSpace($row.Password)) { "Generated password: $plainPassword" } else { 'Password supplied via CSV' }
        }
        catch {
            $result.Status = 'Failed'
            $result.Detail = $_.Exception.Message
        }
    }
    else {
        $result.Status = 'Skipped'
        $result.Detail = 'WhatIf - no account created'
    }

    $results.Add($result)
}

$results | Format-Table -AutoSize
$summary = $results | Group-Object Status | Select-Object Name, Count
Write-Output "`nSummary:"
$summary | Format-Table -AutoSize

Run it like this:

# Preview what the script would do without creating anything
.\New-BulkADUser.ps1 -CsvPath "C:\Onboarding\new-starters.csv" -WhatIf

# Run it for real once the WhatIf output looks correct
.\New-BulkADUser.ps1 -CsvPath "C:\Onboarding\new-starters.csv"

Reading the Results

Troubleshooting Cheat Sheet

Final Thoughts

A bulk-creation script’s real job is not creating accounts — New-ADUser already does that in one line. Its job is surviving contact with a spreadsheet that was never going to be perfectly clean, and telling you afterward, row by row, exactly what happened.

Treat -WhatIf as mandatory before every real run, not optional. On a batch of any real size, it is the cheapest possible check against a typo in an OU path turning into fifty failed rows instead of one caught early.