New-ADUser : Access is denied

Question

I am trying to create a new AD users in Powershell from an Existing User.
I am using the command below:

$newuserattributes = Get-ADUser -Identity 111111 -Properties StreetAddress,City,Title,PostalCode,Office,Department,Manager

New-ADUser -UserPrincipalName "101010" -GivenName Jon -Surname Ford -SAMAccount Name "101010" -Instance $newuserattributes -DisplayName "Jon Ford" -AccountPassword (ConvertTo-SecureString Pas$W0rd!!12 -AsPlainText -Force) -ChangePasswordAtLogon $true -Enabled $false -EmployeeID 101010

Although I am part of the admin group I am getting the error " Access is denied" :

New-ADUser : Access is denied
At line:2 char:1

• New-ADUser -SAMAccountName "101010" -Instance $userInstance -Name " ...

What elevate credentials do i need to run this command? How can I double check them?

Thanks

Answer 1

Hi @Marc

Please try to elevate PowerShell by running as Administrator:

----------------------------

If this is helpful please accept answer.

Answer 2

Hi @Marc ,

if you use New-AdUser the user will be created in Active Directory (AD). For this the user who is executing the script needs the permissions in AD to create the user object.
For instance, the user needs the membership in the Domain Admin or Account Operators group.
Delegating the permission to create users in AD is an option as well.

----------

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards
Andreas Baumgarten

Answer 3

I have realised (Get-ADPrincipalGroupMembership username) I am part of "user operators" and not "account operators".

Answer 4

It seems the problem is related with the code: "$newuserattributes = Get-ADUser" because if I create a simple new user (below) the command works. So I have the permissions.

New-ADUser -Name "User Test" -GivenName User -Surname Test -SamAccountName usertest -UserPrincipalName usertest@test .it -path "OU=Users, DC=test, DC=it"

I am doing something wrong with the code this is why I am receiving the error " Access is denied".
How can I create a New AD Users from an Existing User?