Creating User Accounts and Groups the Easier Way

When you need to create a few user accounts for new hires, or create a group to allow access to a newly added network resource, you'll probably find the User Manager for Domains administration tool perfectly adequate. However, when your boss E-mails you a spreadsheet containing 1,500 employee names and asks you to create new user accounts for each of them, you may be dismayed at the prospect of doing the job manually with User Manager for Domains.

Fortunately, User Manager for Domains' New User option isn't the only way to create user accounts and groups. In this article, we'll explain three techniques that make it easier to add multiple new accounts and groups to a workstation, server, or your domain's Security Accounts Manager (SAM) database.

First, we'll show you how to create user account templates to use with User Manager for Domains. Then we'll explain NET USER (not to be confused with NET USE), a powerful NT command-line utility that lets you create user accounts with batch files. Finally, we'll tell you about ADDUSERS, a command-line utility from the Windows NT Server Resource Kit that lets you automate the creation of new user accounts and groups. Of course, you'll need Administrator privileges to implement these techniques.

You'll find that user account templates are most useful for occasionally adding new users to a department or user type requiring the same network privileges, as often occurs in the case of new hires. A user account template is simply a dummy account that you create for the sole purpose of copying to create new user accounts. When you copy a user account template (or any other account), the new account will inherit all the template's settings and properties except for the Full Name and the Account Disabled setting. Therefore, you'll want to create a template for each department or user type.

To create a user account template, open User Manager for Domains and access the SAM for the Primary Domain controller, member server, or workstation to which you want to add user accounts. Then select the New User option from the User menu and the New User dialog box will appear. Enter a name for the template in the User Name field. We recommend that you add an underscore (_) character to the beginning of the template's name. Because the underscore is a non-alphabetic character, the template will appear at or near the top of the Username list in the main User Manager for Domains dialog box. This placement allows you to readily identify the dummy account as a user account template.

Then complete the Description field and configure all other settings and properties that you want to copy to new user accounts. Add the dummy account to the appropriate global and local groups. Be sure to select the Account Disabled option as shown in Figure A. New accounts that you create by copying the template won't inherit this option selection, but selecting it in the template will prevent someone from using the dummy account to log on to the domain or local computer.

Figure A: When you create a user account template, be sure to select the  Account Disabled option to prevent someone from using the template to log on to a computer or domain.

After configuring the dummy account, click the Add button to add the account to the SAM. Then you're ready to create new accounts by opening User Manager for Domains, selecting the dummy account, and choosing Copy… from the User menu. In the resulting account, fill out the Username and Full Name fields, then click the Add button.

If you love the convenience, power, and speed of NT's command prompt, you'll want to learn how to use NT's NET USER command to create, delete, or modify user accounts. Because NET USER is a command-line utility, you can use it in simple batch files to perform administration tasks automatically. Listing A shows the syntax for the NET USER command. Tables A and B show the parameters and options respectively for the NET USER command. As you can see, the command

NET USER CHARLES /ADD /HOMEDIR:C: \USERS \CHARLES 

adds a new account to the local SAM database.  The username is Charles and the home directory is located in the path C:\USERS\CHARLES.

Listing A: The NET USER command's syntax

NET USER [username [password | *] [options]] [/DOMAIN]
                     username {password | *} /ADD [options] [/DOMAIN]
                     username [/DELETE] [/DOMAIN]

To use the NET USER command in a batch file, replace the username parameter with the batch file parameter %1, as shown in the NEWUSER.BAT file in Listing B. Using this parameter allows you specify the username as a command argument. Entering the command

NEWUSER RUTH

will add a new account to the local SAM database with the username Ruth and a home directory located in the path C:\USERS\RUTH.

Table A: NEW USER command parameters

Table B: NEW USER command options

Listing B: NEWUSER.BAT

NET USER %1 /ADD /HOMEDIR:C: \USERS \%1

The two previously described techniques require some manual input and are best suited for the occasional creation of accounts. If you need to create a large number of user accounts, or even groups, you'll want a way to fully automate the process. Fortunately, the Windows NT 4.0 Server Resource Kit's ADDUSERS command-line utility lets you create user accounts and groups from a comma-delimited file containing account and group information. You'll find ADDUSERS very useful when you want to create new accounts from information stored in a Microsoft Excel document. Listing C shows the command syntax for ADDUSERS, and Table C lists and describes the utility's command parameters.

Listing C: ADDUSERS command syntax

ADDUSERS [ \\computername ] [{ /c | /d | /e } filename] [/s:x] [/?]

Table C: ADDUSERS command parameters

The data file that you use with ADDUSERS must follow the format shown in Listing D. We've found that the best way to create the data file in the proper format is to first use ADDUSERS to dump a small SAM database into a comma-delimited file and then import that file into Microsoft Excel. To do so, open a command prompt or Run dialog box and enter the command

ADDUSERS /D addtemp.txt

to dump the local computer's SAM database into the comma-delimited file named addtemp.txt. Then open Microsoft Excel, choose Open from the File menu, and select addtemp.txt. The Text Import Wizard Step 1 of 3 dialog box will then appear. Click the Next button, and in the resulting Text Import Wizard Step 2 of 3 dialog box, select the Comma option in the Delimiters section. Then click the Next button, and click the Finish button in the resulting Text Import Wizard Step 3 of 3 dialog box (without making any additional changes to this dialog box).

Microsoft Excel will then display the addtemp.txt file in the correct data file format, as shown in Figure B. As you can see, Column C is blank—the ADDUSERS utility doesn't dump password information into data files. However, you can specify password information in this column when using the data file to create accounts with ADDUSERS. Make the necessary changes to the template and save it under another name as a tab-delimited text file (the same as comma-delimited in Microsoft Excel). You can then use this file to create new accounts and groups with ADDUSERS.   

Figure B: Importing an ADDUSERS data file will help you set up a properly formatted template for creating new ADDUSERS data files.

Listing D: The ADDUSERS data file format

[Users]
<User Name>,<Full Name>,<Password>,<Home Drive>,<Home Path>,<Profile>,<Script>
[Global]
<Global Group Name>,<Comment>,<UserName>, ...
[Local]
<Local Group Name>,<Comment>,<UserName>, ...

Why create several or a dozen or a thousand user accounts "by hand" in User Manager for Domains when you can use simple techniques and utilities to automate the process? In this article, we showed you three methods for creating user accounts. We discussed user account templates, the NET USER command, and the Windows NT Server Resource Kit's ADDUSERS utility. 

Copyright © 1998, ZD Inc. All rights reserved. ZD Journals and the ZD Journals logo are trademarks of ZD Inc. Reproduction in whole or in part in any form or medium without express written permission of ZD Inc. is prohibited. All other product names and logos are trademarks or registered trademarks of their respective owners.