Using PowerShell to generate a unique username in AD

Question

I'm writing a script to be used by help desk staff to quickly (and accurately) create AD user accounts by inputting basic employee information. We use portions of a persons name in order to create the samAccountName. Which I've achieve by the following.

$GivenName = "Joe"
$Surname = "Smith"
$SamAccountName = $Surname.substring(0, [System.Math]::Min(5, $Surname.Length)) + $GivenName.Substring(0,1)

This works great as long as there isn't already a "Joe Smith" (or John or Jennifer Smithers, etc). The solution would be to add a number to the end. When manually creating accounts the help desk would search AD look at what number suffix to use if necessary. I'm trying to figure out how PowerShell can do that for us. I've gone through several ideas with help from what I've found online but so far I've been unsuccessful.

My first thought was to do something like this.

$SamSuffix = 2
If ((Get-ADUser -LDAPFilter "(SamAccountName=$samAccountName)")-eq $Null)
    {
        "$SamAccountName does not exist in AD" #out result for testing. 
    }
Else{
    do 
      {
      Get-ADUser -LDAPFilter "(SamAccountName=$SamAccountName + $SamSuffix++)"
      }
    until (Get-ADUser -LDAPFilter "(SamAccountName=$SamAccountName + $SamSuffix)")-eq $Null)
    }

This obviously doesn't work. Even if it did I don't know how I'd get to the 'next step' to create the account.

I also tried pulling the existing names into a list

$SamExist = (Get-ADUser -LDAPFilter "(SamAccountName=$SamAccountName*)" | Select SamAccountName)

    do  {$SamAccountName + $SamSuffix++}
    until ($SamExist -notcontains $SamAccountName -or $SamAccountName + $SamSuffix)

This also doesn't work but if it did I can see that it would automatically add the suffix even if it wasn't needed.

Do you care about gaps in numbers? Do you want just next one in the series? So if you had 1,2,4,5 are you looking for 3 or 6? — Matt
– Matt, Commented Apr 13, 2017 at 18:28
Hi. Yeah it should be the lowest available number starting with 2 (we don't use 1). We have a lot of users who rotate in and out so when their accounts get deleted we would reuse them. Thanks. — Echo5Mike
– Echo5Mike, Commented Apr 13, 2017 at 21:11
I got ansy and couldn't wait so I wrote both scenarios in my answer. — Matt
– Matt, Commented Apr 13, 2017 at 21:28
In most cases there is practical catch in AD queries like this: replication time. In a larger environment, the (helpdesk) agents might be connected different DCs. If two of those agents create a smithj# using the same script algorithm you will likely end up with a replication error and rolling out the same name for two different smithj’s users… — iRon
– iRon, Commented Apr 18, 2017 at 12:01

Matt · Accepted Answer · 2017-04-14 15:03:37Z

1

You approach where you get all the existing matches first would be where I would start. Lets assume $SamAccountName is smithj

$existingAccounts = Get-ADUser -Filter "samaccountname -like '$SamAccountName*'" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty samaccountname

So $existingaccounts that have a samaccountname's starting with smithj. If there are not any then $existingAccounts would be null and we can test for that.

if($existingAccounts){
    # Figure out what the suffix will be
    $highestValue = $existingAccounts -replace "^$SamAccountName" | 
        ForEach-Object{[int]$_} | 
        Measure-Object -Maximum | 
        Select-Object -ExpandProperty Maximum
} else {
    # Create the user as normal.
}

Pretending there are some accounts that exist we trim the leading characters from the samaccountname, convert the remaining to an integer and select the highest from that. So $highestValue is the last number used in a conflicting account.

Add one to that and you have a guaranteed username you can create assuming nothing changes in those moments i.e. two users making to smithj accounts.

If you are looking to fill gaps where a user might have left and you want to use the next available after 1 then you could do this.

$existingAccounts = "smithj1", "smithj5", "smithj10", "smithj2", "smithj3"
# Figure out what the next unused suffix will be
$existingSuffixes = $existingAccounts -replace "^$SamAccountName" | ForEach-Object{[int]$_}
# Once again determine the maximum one in use
$highestValue = $existingSuffixes |  Measure-Object -Maximum | Select-Object -ExpandProperty Maximum
# Find the first gap between 1 and the max suffix
$nextAvailableSuffix = 1..($highestValue + 1) | Where-Object{$existingSuffixes -notcontains $_} | Sort-Object desc | Select -First 1

$nextAvailableSuffix would contain 4 using the above example. We add 1 to highest value in case the only other one is 2 so that way there will only be an answer to $nextAvailableSuffix

edited Apr 14, 2017 at 15:03

answered Apr 13, 2017 at 18:38

Matt

47k9 gold badges90 silver badges125 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

Echo5Mike Over a year ago

I'll give it a shot when back at work tomorrow and let you know how it goes. Thanks!

Echo5Mike Over a year ago

Ok, it took me a bit but it looks like I've got it. For next available to begin at 2 I changed to

$nextAvailableSuffix = 2..$highestValue | Where-Object{$existingSuffixes -notcontains $_} | Sort-Object | Select -First 1

Echo5Mike Over a year ago

To account for next available being null where $existingAccounts = "smithj", "smithj2" I used if ($highestValue -eq 2){$nextAvailableSuffix = 3}

Matt Over a year ago

Ahh yes that could happen. Easier just to add 1 to highest value

Echo5Mike Over a year ago

Oh, ok. Well I really appreciate the help. I've been working on this off and on for some time and just could not get this.

Collectives™ on Stack Overflow

Using PowerShell to generate a unique username in AD

1 Answer 1

5 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

5 Comments

Your Answer

Sign up or log in

Post as a guest

Related