The Inflatable Dinghy

Preface: Don’t do this on prod gear. This is a bad idea!

I’ve long been a fan of automated deployment.

During the fourth semester technical project at Fanshawe, I had a wonderful domain tree with OUs and global groups, group policies and delegated permissions. It was truly a nice domain. It just…. Felt a little lonely.

Enter PowerShell. Using a fairly simple script, I was able to cozy up the domains with the right users in the right places.

This table shows the imaginary organization we were presented with. By simply pasting this into a CSV file, we can easily bring it into the script:

$csvStructure = Import-Csv -Delimiter ',' -Path .\OrganizationalStructure.csv

This assumes the following about this domain:

There is an OU in the root of all your domains called ‘Accounts’
This script will be done as the Administrator in the domain that holds the InfrastructureMaster role.
We’re crazy enough to let a script written by a stranger on the Internet run on one of the most important servers in the organization

Okay. Let’s try it out..!


[System.Collections.ArrayList]$Departments = (($csvStructure | gm -MemberType NoteProperty).Name)

foreach ($Unit in $csvStructure) {

  Write-Verbose $Unit.BusinessName -Verbose

  $UnitDN = "ou=Accounts"
  Write-Output $UnitDN
  $UnitDNFullyQualifiedPath = $Unit.domain.split('.')
  $UnitDNFullyQualifiedPath | foreach { $UnitDN += ",dc=$_" }

Starting off, let’s establish the base DN of the business unit. In the case of HealthUnit this is "ou=HealthUnit,ou=Accounts,DC=sub,DC=domain,DC=ca"

Let’s create a container there, as well as a security group for all objects in that Unit:


  New-ADOrganizationalUnit `
    -name $Unit.BusinessName `
    -Path $UnitDN `
    -server $Unit.DomainControllerFQDN

  $UnitDN = "ou=$($Unit.businessName),$UnitDN"

  New-ADGroup -Name "$($Unit.BusinessName)" 
    -Path $businessUnitDN `
    -GroupCategory Security `
    -GroupScope DomainLocal ` 
    -Server $Unit.DomainControllerFQDN

Next, we iterate through each department and create sub containers for only occupied departments. We then create a User and Computer container within that Unit’s Department.

  Foreach ($Department in $Departments ) {

    if($Unit.$Department -eq 0) { Continue; }

    # Create business unit OU
    $DepartmentDN = "ou=$Department,$UnitDN"
    Write-Verbose "`t$DepartmentDN "
    New-ADOrganizationalUnit -name $Department ` 
      -Path $businessUnitDN `
      -Server $Unit.DomainControllerFQDN

    # Create a User container in that Unit's Department:
    Write-Verbose "`t`tou=UserAccounts,$DepartmentDN"
    New-ADOrganizationalUnit `
      -name "UserAccounts" `
      -path $DepartmentDN `
      -server $Unit.DomainControllerFQDN
    
    # Create a Workstation container in that Unit's Department:
    Write-Verbose "`t`tou=Workstations,$DepartmentDN"
    New-ADOrganizationalUnit `
      -name "Workstations" `
      -path $DepartmentDN `
      -server $Unit.DomainControllerFQDN

Finally, let’s create an AD group for that Unit’s Department, and add it to the Unit’s security group:

    New-ADGroup `
      -name "$($Unit.BusinessName)-$Department" `
      -path "$DepartmentDN" `
      -GroupCategory Security -GroupScope DomainLocal `
      -server $Unit.DomainControllerFQDN
    
    Add-ADGroupMember `
      -Identity "cn=$($Unit.BusinessName),$UnitDN" `
      -Members "cn=$($Unit.BusinessName)-$Department,$DepartmentDN" `
      -Server $Unit.DomainControllerFQDN
  }
}

Nice! Now we have a fully laid out and standardized AD domain!

…We still have a problem though. We’ve built all the rooms and hallways, but we’re still horribly lonely in here!

For this part, I found a list of the top 10K first names and last names on the internet. These aren’t too hard to find and import, so I will leave that part to the reader. They exist in my script as the lists $Top10kFirstNames and $Top10kLastNames.

Let’s start by re-using some of the control code from the last script:

foreach ($Unit in $csvStructure) {
  $UnitDN = "ou=Accounts"
  $UnitDNFullyQualifiedPath = $Unit.domain.split('.')
  $UnitDNFullyQualifiedPath | foreach { $UnitDN += ",dc=$_" }

  $UnitDN = "ou=$($Unit.businessName),$UnitDN"

  Foreach ($Department in $Departments ) {
    if($Unit.$Department -eq 0) { Continue; }
    $DepartmentDN = "ou=$Department,$UnitDN"

And right about here we’ll drop in some new code to add users. We will iterate through the Departments in that Unit, and for each one generate a random username. Passwords are generated using the New-Guid command. We will then add this user to the correct security group for that Department.


    $usersPath = "ou=UserAccounts,$DepartmentDN"
    
    1..$Unit.$Department | Foreach {

      $FirstName = ($Top10kFirstNames | Get-Random)
      $LastName = ($Top10kLastNames | Get-Random)
      $UPN = "$FirstName.$LastName@$($Unit.Domain)"
      $SamAccountName = (($FirstName[0..10] -join '') `
          + ($LastName[0..1] -join '')).ToLower()
      $GroupName = "cn=$($Unit.BusinessName)-$Department"

      New-ADUser -GivenName "$FirstName" `
        -Surname "$LastName" ` 
        -Name "$FirstName $LastName" `
        -AccountPassword:$(New-Guid) `
        -Path $usersPath 
        -UPN $UPN 
        -SamAccountName $SamAccountName
        -Server $Unit.DomainControllerFQDN

      $userID = Get-ADUser "cn=$FirstName $LastName,$usersPath" `
        -Server $Unit.DomainControllerFQDN

      $groupID = Get-ADGroup "$GroupName,$DepartmentDN" `
        -Server $Unit.DomainControllerFQDN

      Add-ADGroupMember -Identity $groupID  `
        -Members $userID `
        -Server $Unit.domainControllerFQDN
    }
  }
}

…And that’s it! After a couple minutes, our domain controllers are toasty hot, our replication is going nuts, and most importantly, we’re a little less lonely here in the testing environment.

推荐订阅源

Posts on Noah Bailey