PowerShell Script

---

Hi All,

I have a PowerShell script that creates a new local power user.

I just need help on updating it so it removes any spaces at the end of the usernames and passwords, as had a few users having issues logging in due to credentials being incorrect and noticed there were spaces at the end of the p/words or Usernames. Also need the option for the user to change password at logon?

Current script setup;

**$Account = New-LocalUser
$Password

if ($existing -eq $null) {
Write-Host "Creating new local user $Account."

Write-Host "Adding local user $Username to $group."
& net localgroup "Power Users" "$Account" /add
& net localgroup "Remote Desktop Users" "$Account" /add
}
else {
Write-Host "Setting password for existing local user $Username."
$existing.SetPassword($Password)
}
Write-Host "Ensuring password for $Account never expires."
& WMIC USERACCOUNT WHERE "Name='$Account'" SET PasswordExpires=FALSE**

Thanks

Have you tried using the Trim() command?
$string = $string.Trim()
That's what I used to use to trim leading/trailing spaces.

@brian-carson Where would I input the cmdlet using my script?

I just need to trim any spaces at the end of Usernames and Passwords.

Also, need the users to change password at logon.

Thanks.

Hi All,

Just wanted to get an update if there was anything I can input on my script to get this working?

Hey @Waqkas-Ahmed ,

One solution would be to prompt them for the name first. Then you can trim the name before you pass it to the New-LocalUser cmdlet.

$NewLocalUserName = Read-Host -Prompt "Enter a name for the new user"
$TrimmedUserName = $NewLocalUsername.TrimEnd()


$Account = New-LocalUser -Name $TrimmedUserName

$Password

if ($existing -eq $null) {
Write-Host "Creating new local user $Account."

Write-Host "Adding local user $Username to $group."
& net localgroup "Power Users" "$Account" /add
& net localgroup "Remote Desktop Users" "$Account" /add
}
else {
Write-Host "Setting password for existing local user $Username."
$existing.SetPassword($Password)
}
Write-Host "Ensuring password for $Account never expires."
& WMIC USERACCOUNT WHERE "Name='$Account'" SET PasswordExpires=FALSE

I'm not sure what you are trying to do with the password. Since you are not providing a password when running New-LocalUser, it is prompting them to enter a password. It is stored as a secure string, which doesn't have a trim method. You want them to change it again?

Let me know and we can fix that too. Hope this helps.

@Waqkas-Ahmed ,

What are you trying to do with the If ($existing -eq $null) statement? In this script, I believe it will always be null, since the variable $existing is never set to anything.

Also, the account is created, or fails, when you run the New-LocalUser cmdlet
$Account = New-LocalUser -Name $TrimmedUserName
before the if statement is run. We would need to move this command inside the if statement.

We can use the Get-LocalUser cmdlet to test if a username exists. Then we can use that boolean to control our if statement. Something like this

$NewLocalUserName = Read-Host -Prompt "Enter a name for the new user"
$TrimmedUserName = $NewLocalUsername.TrimEnd()
$group1 = "Power Users"
$group2 = "Remote Desktop Users"
# $Password
$exists = Get-LocalUser -Name $TrimmedUserName -ErrorAction SilentlyContinue

if (!$exists) {
    $Account = New-LocalUser -Name $TrimmedUserName
    Write-Host "Creating new local user $Account. `n"
    Write-Host "Adding $Account to the $group1 group."
    net localgroup "Power Users" "$Account" /add
    Write-Host "Adding $Account to the $group2 group."
    net localgroup "Remote Desktop Users" "$Account" /add
    Write-Host "Ensuring password for $Account never expires."
    WMIC USERACCOUNT WHERE "Name='$Account'" SET PasswordExpires=FALSE
}
else {
    Write-Host "Username already exists"
   # Write-Host "Setting password for existing local user $Username."
   # $existing.SetPassword($Password)
}

@mike-rodrick Thanks for this.

Basically running the script I created prompts to enter a username and password, only thing is the user themselves will not have access to this script as someone else will be setting up the user and password, reason why I want the users to have the prompt screen to change their p/word when they first login.

We have had issues where user's can't login because of a blank space at the end of a username or password as it looks like the person setting up the accounts are copy and pasting the credentials.

Thanks

@mike-rodrick Thanks for setting that script up. Just need it now to trim passwords and prompt 'user must change password at next logon'.

Thanks

I have tried the following to no avail;

WMIC USERACCOUNT WHERE "Name= '$Account' " SET PasswordExpires=TRUE

This does not prompt user to change password at logon.

Waqkas,

I hope all is well. I see that you and Mike have been very busy... :)

Perhaps the following will help you get the last remaining items ironed out?

I am uploading a picture of the script for you, as I cannot seem to get it to set up properly in my reply, even with the backticks to offset the script and highlight it, due to the # comment blocks I used to notate the script for you.


Please feel free to e-mail directly, and I can send you a copy of the script if that makes it easier.

adam@itpro.tv

Cheers,

Adam

Waqkas,

My apologies, as apparently our image upload does not actually put the picture into the reply, but rather, appears to insert a text string placeholder for the image... :(

Let's see if we can make this work for you below:

# The default password for the new accounts $password = ConvertTo-SecureString "P@ssword1" -AsPlainText -Force

# Group new users are added to (default is Users) $group = "Users"

# PowerShell array containing the users to be created $users = @( # List users here to be created "user1" "user2" "user3" )

# Creates a new users for each entry in the $users array foreach ($user in $users) {

# Create and add user to Users group
New-LocalUser -Name "$user" -Password $Password
Add-LocalGroupMember -Group "$group" -Member "$user"

# Set users password to be changed at next logon
$expUser = [ADSI]"WinNT://localhost/$user,user"
$expUser.passwordExpired = 1
$expUser.setinfo()

}

E-mail me as I suggested in prior post if you need a clean copy of the script, and I will send it to you directly.

:)

@adam-gordon Thanks. I have sent you an email with the script attached, so when you get the chance let me know.

Thanks

Hi,

I have managed to sort out the script to change password at logon.

The only issue I am now facing is, the users will be logging onto a Terminal Server using RDP. Currently the message we are reciving is;

"You must change your password before logging on the first time. Please update your password or contact your system administrator"

But then nothing happens.

What I have found is that if you uncheck NLA it then works, but was wondering if there was another way without unchecking NLA in remote settings?

Thanks