Sorry I have been trying to figure this out for a bit and forget sometimes that it’s out of context on a forum. I will first explain my end goal then let you know what this script is doing currently with a detailed breakdown.
I would like to test User account “User Principal Name” uniqueness for the Forest before creating the user.
Or policy is to test the middle initial first then if that’s not unique add a 2... until its unique.
sn.givenName@domain.com, sn.initials.givenName@domain.com, firstname.lastname@example.org...
The script below only adds the number currently. I was going to start with this then add the middle initial when the number was working.
I would also like to rename the Distinguished Name of the account if it’s not unique in case the duplicate account is in the same OU or eventually gets moved there. I do not wish to test every time the account is moved.
The script below only test the current Domain for UPN uniqueness and works except for renaming the DN. Which I assume is done by renaming the "Name" attribute before the user is created.
I am using Quest PowerShell snippets because "Get-AdmUser" did not seem to like using the "userPrincipalName" attribute.
The function is from your tutorial Validate/Modify User Input Using a Script
Half of the code is from "Example 2: Automatically add a digit to the username if it is not unique"
$user = Get-QADUser -Identity $userLogonName -erroraction silentlycontinue
return $user -eq $Null
Here I need to collect information entered from the new user form to reconstruct user account attributes.
$username = $Context.GetModifiedPropertyValue("samAccountName")
Since we use a Property Pattern for the User Logon Name to assign a static UPN Suffix I need to collect these 2 attributes.
Instead of manipulating the UPN string I chose to recreate it.
$sn = $Context.GetModifiedPropertyValue("sn")
$givenName = $Context.GetModifiedPropertyValue("givenName")
What I am test for here is current domain uniqueness. A later version of the script will test a crossed the forest.
$userLogonName = $Context.GetModifiedPropertyValue("userPrincipalName")
We are not using our default domain UPN Suffix so I assign it statically here.
$upnSuffix = "domain.com"
I have several of these throughout the script to debug most will be removed. I have removed most in this description for clarity.
$Context.LogMessage("The username entered was " + $username `
+ ".", "Information")
The other half of the code is from "Example 3: Rename the user if the Full Name is not unique within the OU"
Here I am getting the DN for testing purposes. I do not think I need most of this since if the UPN is not unique I am going to just rename the "Name" attribute anyway.
This is in case the duplicate user account is in the same OU or later gets moved to the same OU. I do not wish to test every time.
$objectDN = $Context.TargetObject.ObjectInfo.DN;
Calling the function to test UPM
Continuing on if UPN is not unique.
$uniqueUsername = $Null
$uniqueUserLogonName = $Null
$uniqueName = $Null
Generating new user attributes to make them unique. Here I am just adding a number.
I would like to try the middle initial first then add a number but was planning on adding that when this was working.
for ($i = 2; $True; $i++)
$uniqueUsername = $username + $i
# Build new UPN
$uniqueUserLogonName = $givenName + "." + $sn + $i + "@" + $upnSuffix
I do not think this part is needed either. It seems to be constructing a new DN for testing purposes only. I assume this since the script on your site just renames the "Name" attribute if not unique.
Please let me know if that's the case. I have included it here for testing.
objectLeaf = $objectDN.Leaf;
$objectName = $objectLeaf.Value + $i;
$objectRdn = New-Object "Softerra.Adaxes.Ldap.Rdn" $objectLeaf.Type,$objectName;
$objectDN = $objectDN.Parent;
Updating all the account properties that need to be unique.
Update User Logon Name (pre-Windows 2000)
# Update User Logon Name
#Update name for Unique DN