PowerShell批量创建AD域的OU、组、用户，并创建对应的共享文件夹

 1# 根目录路径，批量在此路径下添加OU和用户，我这里直接用了域的根目录
 2$OuRoot = Get-ADDomain | Select-Object -ExpandProperty "DistinguishedName"
 3
 4# 域名
 5$DomainName = (Get-ADDomain).DNSRoot
 6
 7# 导入整理好的csv
 8$UserList = Import-Csv "C:\Users\Administrator\Desktop\工号部门信息表.csv" -Encoding UTF8
 9
10foreach ( $User in $UserList ) {
11
12    # 没有公司就创建公司
13    # 获取根目录OU下面的公司OU的DistinguishedName，拿不到就是没有
14    $OuRoot_Company = Get-ADOrganizationalUnit -Filter "Name -eq '$($User.公司)'" -SearchBase $OuRoot -SearchScope OneLevel | Select-Object -ExpandProperty "DistinguishedName"
15
16    if ( -Not $OuRoot_Company ) {
17        # 创建公司OU
18        New-ADOrganizationalUnit -Name $User.公司 -Path $OuRoot # -ProtectedFromAccidentalDeletion $False
19        # 获取公司OU 的DistinguishedName
20        $OuRoot_Company = Get-ADOrganizationalUnit -Filter "Name -eq '$($User.公司)'" -SearchBase $OuRoot -SearchScope OneLevel | Select-Object -ExpandProperty "DistinguishedName"
21        # 创建公司OU 的组
22        New-ADGroup -Name $User.公司 -Path $OuRoot_Company -GroupScope Global
23    }
24
25
26    # 公司下面没有部门就创建部门
27    # 获取公司下面的部门OU的DistinguishedName，拿不到就是没有
28    $OuRoot_Company_Department = Get-ADOrganizationalUnit -Filter "Name -eq '$($User.部门)'" -SearchBase $OuRoot_Company -SearchScope OneLevel | Select-Object -ExpandProperty "DistinguishedName"
29
30    if ( -Not $OuRoot_Company_Department ) {
31        # 创建公司下的部门OU
32        New-ADOrganizationalUnit -Name $User.部门 -Path $OuRoot_Company # -ProtectedFromAccidentalDeletion $False
33        # 获取公司下的部门OU 的DistinguishedName
34        $OuRoot_Company_Department = Get-ADOrganizationalUnit -Filter "Name -eq '$($User.部门)'" -SearchBase $OuRoot_Company -SearchScope OneLevel | Select-Object -ExpandProperty "DistinguishedName"
35        # 创建公司下的部门OU 的组，为什么这里要用“公司_部门”？因为可能有两个子公司，两个子公司都有财务部，只有一个公司可以去掉公司前缀
36        New-ADGroup -Name $($($User.公司) + "_" + $($User.部门) ) -Path $OuRoot_Company_Department -GroupScope Global
37    }
38
39
40    # 创建用户，相关属性自行增减，这里为了登陆的时候直接使用工号当账号密码，域服务器的本地组策略的密码复杂度是关掉的了。
41    New-ADUser `
42        -Name $User.姓名 `
43        -DisplayName $User.姓名 `
44        -EmployeeNumber $User.工号 `
45        -SamAccountName $User.工号 `
46        -UserPrincipalName "$($User.工号)@$DomainName" `
47        -Department $User.部门 `
48        -OtherAttributes @{EmployeeType=$($User.员工类型)} `
49        -AccountPassword $(ConvertTo-SecureString $User.工号 -AsPlainText -Force) `
50        -ChangePasswordAtLogon $True `
51        -Enabled $True `
52        -Path $OuRoot_Company_Department
53
54    # 获取用户的 DistinguishedName
55    $User_DN = Get-ADUser -identity $User.工号 | Select-Object -ExpandProperty "DistinguishedName"
56
57    # 把用户添加进公司_部门的组
58    $Company_Department_Group_DN = Get-ADGroup -identity $($($User.公司) + "_" + $($User.部门) ) | Select-Object -ExpandProperty "DistinguishedName"
59    Add-ADGroupMember -Identity $Company_Department_Group_DN -Members $User_DN
60
61    # 把部门添加进公司的组
62    $Company_Group_DN = Get-ADGroup -identity $User.公司 | Select-Object -ExpandProperty "DistinguishedName"
63    Add-ADGroupMember -Identity $Company_Group_DN -Members $Company_Department_Group_DN
64
65}

  1# 要远程的共享文件服务器的名字（已加域）
  2$InvokeServerName = "SHARING-SERVER"
  3
  4# 要在共享服务器上面的创建的共享文件夹的路径
  5$SharedFolderPath = "D:\Shares\广州番禺加班有限公司" 
  6
  7# 获取域
  8$Domain = (Get-ADDomain).Name
  9
 10# 获取公司 OU
 11$Company_OU = Get-ADOrganizationalUnit -Filter "Name -eq '广州番禺加班有限公司'"
 12
 13# 获取公司 组
 14$Company_Group = Get-ADGroup -Filter * -SearchBase $Company_OU -SearchScope OneLevel
 15
 16# 获取公司下面的所有部门
 17$Department_OU_List = Get-ADOrganizationalUnit -Filter * -SearchBase $Company_OU  | Where-Object {$_.Name -ne "广州番禺加班有限公司"}
 18
 19# 获取公司下所有员工属性为老板和总监的员工
 20$Boss_User_List = Get-ADUser -Filter "(employeeType -eq '老板') -or ( employeeType -eq '总监')" -SearchBase $Company_OU
 21
 22
 23# 创建最顶层共享文件夹
 24$InvokeScriptBlock1 = {
 25        # 新建公司共享文件夹路径
 26        New-Item -Path "$Using:SharedFolderPath" -ItemType Directory
 27
 28        # 设置公司共享文件夹，隐藏共享，共享路径是 \\服务器\GZ$
 29        New-SmbShare -Name "GZ$" -Path "$Using:SharedFolderPath" -FullAccess "$Using:Domain\$($Using:Company_Group.Name)"
 30
 31        # 准备修改文件夹权限
 32        $FolderPath = $Using:SharedFolderPath
 33        $FolderAcl = Get-Acl -Path $FolderPath
 34        
 35        # 设置 域 Administrator 的权限
 36        $AccessRule = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule("$Using:Domain\administrator", "FullControl", "ContainerInherit,ObjectInherit", "None", "Allow")
 37        $FolderAcl.SetAccessRule($AccessRule)
 38
 39        # 设置 公司 组的权限
 40        $AccessRule = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule("$Using:Domain\$($Using:Company_Group.Name)", "ListDirectory", "None", "None", "Allow")
 41        $FolderAcl.SetAccessRule($AccessRule)
 42
 43        # 设置 老板、总监的权限
 44        if( ($Using:Boss_User_List.SamAccountName).Count -gt 0 ){
 45            foreach ($Boss_User in $Using:Boss_User_List){
 46                $AccessRule = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule("$Using:Domain\$($Boss_User.SamAccountName)", "Read", "ContainerInherit,ObjectInherit", "None", "Allow")
 47                $FolderAcl.SetAccessRule($AccessRule)
 48            }
 49        }
 50
 51        # 禁用继承权限
 52        $FolderAcl.SetAccessRuleProtection($true,$false)
 53		
 54		# 应用到文件夹
 55        Set-Acl -Path $FolderPath -AclObject $FolderAcl
 56}
 57
 58Invoke-Command -ComputerName $InvokeServerName -ScriptBlock $InvokeScriptBlock1
 59
 60
 61
 62# 以部门进行循环
 63foreach ($Department_OU in $Department_OU_List) {
 64
 65    # 获取部门下的所有用户
 66    $Department_User_List = Get-ADUser -Filter * -SearchBase $Department_OU
 67
 68    # 获取部门下所有员工属性为主管的员工
 69    $Director_User_List = Get-ADUser -Filter "employeeType -eq '主管'" -SearchBase $Department_OU
 70
 71    # 远程执行的代码块2
 72    $InvokeScriptBlock2 = {
 73
 74        # 新建部门文件夹
 75        New-Item -Path "$Using:SharedFolderPath\$($Using:Department_OU.Name)" -ItemType Directory
 76
 77        # 准备修改文件夹权限
 78        $FolderPath1 = "$Using:SharedFolderPath\$($Using:Department_OU.Name)"
 79        $FolderAcl = Get-Acl -Path $FolderPath1
 80
 81        # 设置 部门 组的权限
 82        $AccessRule = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule("$Using:Domain\$($Using:Company_OU.Name)_$($Using:Department_OU.Name)", "ListDirectory", "None", "None", "Allow")
 83        $FolderAcl.SetAccessRule($AccessRule)
 84
 85        if( ($Using:Director_User_List.SamAccountName).Count -gt 0 ){
 86            # 设置 主管的权限
 87            foreach ($Director_User in $Using:Director_User_List){
 88                $AccessRule = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule("$Using:Domain\$($Director_User.SamAccountName)", "Read", "ContainerInherit,ObjectInherit", "None", "Allow")
 89                $FolderAcl.SetAccessRule($AccessRule)
 90            }
 91        }
 92
 93        # 应用到文件夹
 94        Set-Acl -Path $FolderPath1 -AclObject $FolderAcl
 95
 96        # 新建部门内“部门共享”文件夹
 97        New-Item -Path "$Using:SharedFolderPath\$($Using:Department_OU.Name)\部门共享" -ItemType Directory
 98
 99        # 准备修改文件夹权限
100        $FolderPath2 = "$Using:SharedFolderPath\$($Using:Department_OU.Name)\部门共享"
101        $FolderAcl = Get-Acl -Path $FolderPath2
102
103        # 设置 部门\部门共享 组的权限
104        $AccessRule = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule("$Using:Domain\$($Using:Company_OU.Name)_$($Using:Department_OU.Name)", "Modify,ReadAndExecute,Write", "ContainerInherit,ObjectInherit", "None", "Allow")
105        $FolderAcl.SetAccessRule($AccessRule)
106        
107        # 应用到文件夹
108        Set-Acl -Path $FolderPath2 -AclObject $FolderAcl
109
110		# 循环创建用户文件夹
111        foreach ($Department_User in $Using:Department_User_List ) {
112
113            # 新建用户文件夹
114            New-Item -Path "$Using:SharedFolderPath\$($Using:Department_OU.Name)\$($Department_User.Name)" -ItemType Directory
115    
116            # 准备修改文件夹权限
117            $FolderPath3 = "$Using:SharedFolderPath\$($Using:Department_OU.Name)\$($Department_User.Name)"
118            $FolderAcl = Get-Acl -Path $FolderPath3
119
120            # 设置用户权限
121            $AccessRule = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule("$Using:Domain\$($Department_User.SamAccountName)", "Modify,ReadAndExecute,Write", "ContainerInherit,ObjectInherit", "None", "Allow")
122            $FolderAcl.SetAccessRule($AccessRule)
123            
124            # 应用到文件夹
125            Set-Acl -Path $FolderPath3 -AclObject $FolderAcl
126
127        }
128    }
129
130    Invoke-Command -ComputerName $InvokeServerName -ScriptBlock $InvokeScriptBlock2
131
132}