Automating directory provisioning requires binding to the target container before instantiating new objects. PowerShell’s [ADSI] type accelerator provides direct access to LDAP paths, enabling programmatic manipulation of Active Directory entries without legacy console utilities.

The process initiates by establishing a connection to the organizational unit. An LDAP distinguished name must be supplied to the type adapter to bind to the specific directory node.

$targetContainer = [ADSI]"LDAP://OU=Employees,DC=enterprise,DC=net"

With the container bound, the Create method generates a new directory entry. This operation requires two arguments: the schema class identifier and the relative distinguished name (RDN). User accounts utilize the CN prefix followed by the full name.

$pendingAccount = $targetContainer.Create("user", "CN=Alex Chen")

Modifications remain staged locally until explicitly synchronized. Prior to committing, mandatory attributes must be populated. The sAMAccountName property represents the legacy logon identifier and must be defined using the Put method.

$pendingAccount.Put("sAMAccountName", "achen")

While domain controllers automatically generate system attributes like security identifiers upon creation, supplementary fields require explicit assignment. Multiple Put calls can be chained before the initial write operation.

$pendingAccount.Put("displayName", "Alex Chen")
$pendingAccount.Put("givenName", "Alex")
$pendingAccount.Put("sn", "Chen")
$pendingAccount.SetInfo()

Password configuration operates independently of standard attribute assignment due to Kerberos authentication requirements and directory replication constraints. The SetPassword method is only available after the account object physically exists in the partition, wich necessitates the prior SetInfo() call. Provitioned accounts default to a disabled state, maintaining security during the multi-stage setup.

$pendingAccount.SetPassword("S3cur3T0k3n!")

Activating the account requires modifying the underlying user account control flags. Direct property assignment is insufficient for composite security flags, so the .psbase.InvokeSet method must be utilized to toggle the disabled state. A final SetInfo execusion applies the status update.

$pendingAccount.psbase.InvokeSet("AccountDisabled", $false)
$pendingAccount.SetInfo()