PowerShell 批量创建 AD 域的 OU、组、用户，并创建对应的共享文件夹

# 根目录路径，批量在此路径下添加OU和用户，我这里直接用了域的根目录
$OuRoot = Get-ADDomain | Select-Object -ExpandProperty "DistinguishedName"

# 域名
$DomainName = (Get-ADDomain).DNSRoot

# 导入整理好的csv
$UserList = Import-Csv "C:\Users\Administrator\Desktop\工号部门信息表.csv" -Encoding UTF8

foreach ( $User in $UserList ) {

    # 没有公司就创建公司
    # 获取根目录OU下面的公司OU的DistinguishedName，拿不到就是没有
    $OuRoot_Company = Get-ADOrganizationalUnit -Filter "Name -eq '$($User.公司)'" -SearchBase $OuRoot -SearchScope OneLevel | Select-Object -ExpandProperty "DistinguishedName"

    if ( -Not $OuRoot_Company ) {
        # 创建公司OU
        New-ADOrganizationalUnit -Name $User.公司 -Path $OuRoot # -ProtectedFromAccidentalDeletion $False
        # 获取公司OU 的DistinguishedName
        $OuRoot_Company = Get-ADOrganizationalUnit -Filter "Name -eq '$($User.公司)'" -SearchBase $OuRoot -SearchScope OneLevel | Select-Object -ExpandProperty "DistinguishedName"
        # 创建公司OU 的组
        New-ADGroup -Name $User.公司 -Path $OuRoot_Company -GroupScope Global
    }


    # 公司下面没有部门就创建部门
    # 获取公司下面的部门OU的DistinguishedName，拿不到就是没有
    $OuRoot_Company_Department = Get-ADOrganizationalUnit -Filter "Name -eq '$($User.部门)'" -SearchBase $OuRoot_Company -SearchScope OneLevel | Select-Object -ExpandProperty "DistinguishedName"

    if ( -Not $OuRoot_Company_Department ) {
        # 创建公司下的部门OU
        New-ADOrganizationalUnit -Name $User.部门 -Path $OuRoot_Company # -ProtectedFromAccidentalDeletion $False
        # 获取公司下的部门OU 的DistinguishedName
        $OuRoot_Company_Department = Get-ADOrganizationalUnit -Filter "Name -eq '$($User.部门)'" -SearchBase $OuRoot_Company -SearchScope OneLevel | Select-Object -ExpandProperty "DistinguishedName"
        # 创建公司下的部门OU 的组，为什么这里要用“公司_部门”？因为可能有两个子公司，两个子公司都有财务部，只有一个公司可以去掉公司前缀
        New-ADGroup -Name $($($User.公司) + "_" + $($User.部门) ) -Path $OuRoot_Company_Department -GroupScope Global
    }


    # 创建用户，相关属性自行增减，这里为了登陆的时候直接使用工号当账号密码，域服务器的本地组策略的密码复杂度是关掉的了。
    New-ADUser `
        -Name $User.姓名 `
        -DisplayName $User.姓名 `
        -EmployeeNumber $User.工号 `
        -SamAccountName $User.工号 `
        -UserPrincipalName "$($User.工号)@$DomainName" `
        -Department $User.部门 `
        -OtherAttributes @{EmployeeType=$($User.员工类型)} `
        -AccountPassword $(ConvertTo-SecureString $User.工号 -AsPlainText -Force) `
        -ChangePasswordAtLogon $True `
        -Enabled $True `
        -Path $OuRoot_Company_Department

    # 获取用户的 DistinguishedName
    $User_DN = Get-ADUser -identity $User.工号 | Select-Object -ExpandProperty "DistinguishedName"

    # 把用户添加进公司_部门的组
    $Company_Department_Group_DN = Get-ADGroup -identity $($($User.公司) + "_" + $($User.部门) ) | Select-Object -ExpandProperty "DistinguishedName"
    Add-ADGroupMember -Identity $Company_Department_Group_DN -Members $User_DN

    # 把部门添加进公司的组
    $Company_Group_DN = Get-ADGroup -identity $User.公司 | Select-Object -ExpandProperty "DistinguishedName"
    Add-ADGroupMember -Identity $Company_Group_DN -Members $Company_Department_Group_DN

}

# 要远程的共享文件服务器的名字（已加域）
$InvokeServerName = "SHARING-SERVER"

# 要在共享服务器上面的创建的共享文件夹的路径
$SharedFolderPath = "D:\Shares\广州番禺加班有限公司" 

# 获取域
$Domain = (Get-ADDomain).Name

# 获取公司 OU
$Company_OU = Get-ADOrganizationalUnit -Filter "Name -eq '广州番禺加班有限公司'"

# 获取公司 组
$Company_Group = Get-ADGroup -Filter * -SearchBase $Company_OU -SearchScope OneLevel

# 获取公司下面的所有部门
$Department_OU_List = Get-ADOrganizationalUnit -Filter * -SearchBase $Company_OU  | Where-Object {$_.Name -ne "广州番禺加班有限公司"}

# 获取公司下所有员工属性为老板和总监的员工
$Boss_User_List = Get-ADUser -Filter "(employeeType -eq '老板') -or ( employeeType -eq '总监')" -SearchBase $Company_OU


# 创建最顶层共享文件夹
$InvokeScriptBlock1 = {
        # 新建公司共享文件夹路径
        New-Item -Path "$Using:SharedFolderPath" -ItemType Directory

        # 设置公司共享文件夹，隐藏共享，共享路径是 \\服务器\GZ$
        New-SmbShare -Name "GZ$" -Path "$Using:SharedFolderPath" -FullAccess "$Using:Domain\$($Using:Company_Group.Name)"

        # 准备修改文件夹权限
        $FolderPath = $Using:SharedFolderPath
        $FolderAcl = Get-Acl -Path $FolderPath
        
        # 设置 域 Administrator 的权限
        $AccessRule = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule("$Using:Domain\administrator", "FullControl", "ContainerInherit,ObjectInherit", "None", "Allow")
        $FolderAcl.SetAccessRule($AccessRule)

        # 设置 公司 组的权限
        $AccessRule = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule("$Using:Domain\$($Using:Company_Group.Name)", "ListDirectory", "None", "None", "Allow")
        $FolderAcl.SetAccessRule($AccessRule)

        # 设置 老板、总监的权限
        if( ($Using:Boss_User_List.SamAccountName).Count -gt 0 ){
            foreach ($Boss_User in $Using:Boss_User_List){
                $AccessRule = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule("$Using:Domain\$($Boss_User.SamAccountName)", "Read", "ContainerInherit,ObjectInherit", "None", "Allow")
                $FolderAcl.SetAccessRule($AccessRule)
            }
        }

        # 禁用继承权限
        $FolderAcl.SetAccessRuleProtection($true,$false)
		
		# 应用到文件夹
        Set-Acl -Path $FolderPath -AclObject $FolderAcl
}

Invoke-Command -ComputerName $InvokeServerName -ScriptBlock $InvokeScriptBlock1



# 以部门进行循环
foreach ($Department_OU in $Department_OU_List) {

    # 获取部门下的所有用户
    $Department_User_List = Get-ADUser -Filter * -SearchBase $Department_OU

    # 获取部门下所有员工属性为主管的员工
    $Director_User_List = Get-ADUser -Filter "employeeType -eq '主管'" -SearchBase $Department_OU

    # 远程执行的代码块2
    $InvokeScriptBlock2 = {

        # 新建部门文件夹
        New-Item -Path "$Using:SharedFolderPath\$($Using:Department_OU.Name)" -ItemType Directory

        # 准备修改文件夹权限
        $FolderPath1 = "$Using:SharedFolderPath\$($Using:Department_OU.Name)"
        $FolderAcl = Get-Acl -Path $FolderPath1

        # 设置 部门 组的权限
        $AccessRule = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule("$Using:Domain\$($Using:Company_OU.Name)_$($Using:Department_OU.Name)", "ListDirectory", "None", "None", "Allow")
        $FolderAcl.SetAccessRule($AccessRule)

        if( ($Using:Director_User_List.SamAccountName).Count -gt 0 ){
            # 设置 主管的权限
            foreach ($Director_User in $Using:Director_User_List){
                $AccessRule = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule("$Using:Domain\$($Director_User.SamAccountName)", "Read", "ContainerInherit,ObjectInherit", "None", "Allow")
                $FolderAcl.SetAccessRule($AccessRule)
            }
        }

        # 应用到文件夹
        Set-Acl -Path $FolderPath1 -AclObject $FolderAcl

        # 新建部门内“部门共享”文件夹
        New-Item -Path "$Using:SharedFolderPath\$($Using:Department_OU.Name)\部门共享" -ItemType Directory

        # 准备修改文件夹权限
        $FolderPath2 = "$Using:SharedFolderPath\$($Using:Department_OU.Name)\部门共享"
        $FolderAcl = Get-Acl -Path $FolderPath2

        # 设置 部门\部门共享 组的权限
        $AccessRule = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule("$Using:Domain\$($Using:Company_OU.Name)_$($Using:Department_OU.Name)", "Modify,ReadAndExecute,Write", "ContainerInherit,ObjectInherit", "None", "Allow")
        $FolderAcl.SetAccessRule($AccessRule)
        
        # 应用到文件夹
        Set-Acl -Path $FolderPath2 -AclObject $FolderAcl

		# 循环创建用户文件夹
        foreach ($Department_User in $Using:Department_User_List ) {

            # 新建用户文件夹
            New-Item -Path "$Using:SharedFolderPath\$($Using:Department_OU.Name)\$($Department_User.Name)" -ItemType Directory
    
            # 准备修改文件夹权限
            $FolderPath3 = "$Using:SharedFolderPath\$($Using:Department_OU.Name)\$($Department_User.Name)"
            $FolderAcl = Get-Acl -Path $FolderPath3

            # 设置用户权限
            $AccessRule = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule("$Using:Domain\$($Department_User.SamAccountName)", "Modify,ReadAndExecute,Write", "ContainerInherit,ObjectInherit", "None", "Allow")
            $FolderAcl.SetAccessRule($AccessRule)
            
            # 应用到文件夹
            Set-Acl -Path $FolderPath3 -AclObject $FolderAcl

        }
    }

    Invoke-Command -ComputerName $InvokeServerName -ScriptBlock $InvokeScriptBlock2

}