Accounts are created with the following default properties:

• Account is created in the “Users” container.
• Account is disabled.
• Account is a member of Domain Users group.
• No password is set.
• User must reset the password at the first logon.

Therefore, to make a new account that’s actually usable, we need to enable it using the Enable-ADAccount cmdlet and give it a password using the Set-ADAccountPassword cmdlet.

So let’s create a new account with the following attributes:

• Name – Jack Robinson
• Given Name – Jack
• Surname – Robinson
• Account Name – J.Robinson
• User Principal Name – J.Robinson@enterprise.com
• Path address – “OU=Managers,DC=enterprise,DC=com”
• Password Input
• Status – Enabled

Here’s the script we’ll use:

New-ADUser -Name "Jack Robinson" -GivenName "Jack" -Surname "Robinson" -SamAccountName "J.Robinson" -UserPrincipalName "J.Robinson@enterprise.com" -Path "OU=Managers,DC=enterprise,DC=com" -AccountPassword(Read-Host -AsSecureString "Input Password") -Enabled $true

The Read-Host parameter will ask you to input new password. Note that the password should meet the length, complexity and history requirements of your domain security policy.

Now let’s take a look at the results by running the following cmdlet:

Get-ADUser J.Robinson -Properties CanonicalName, Enabled, GivenName, Surname, Name, UserPrincipalName, samAccountName, whenCreated, PasswordLastSet  | Select CanonicalName, Enabled, GivenName, Surname, Name, UserPrincipalName, samAccountName, whenCreated, PasswordLastSet