For part 2 of this script I worked on a script that would create either standard or custom groups for a MIM 2016 install. The script will also check to make sure the group does not exist and if it does, no new one will be created. The code provided below is not complicated, but the end goal will be to connect Parts 1, 2 and 3 of the script into one long script that will handle all three parts seamlessly.
The Code
Write-host "-------------------------------------" -ForegroundColor Green
Write-host " MIM Group Creation Script" -ForegroundColor Green
Write-host "-------------------------------------" -ForegroundColor Green
Write-host ""
Write-host ""
# Import AD Module
Try {Import-Module ActiveDirectory -ErrorAction STOP} Catch {Write-Host "Active Directory Module could not be loaded"}
# Standard MIM Security Groups
$Groups = @("MIMSyncAdmins","MIMSyncOperators","MIMSyncJoiners","MIMSyncBrowse","MIMSyncPasswordReset")
# Loop for all users
Foreach ($Group in $Groups) {
# Account Name
Write-host "Do you want to use the standard name for the $Group group? [s or c] " -ForegroundColor Yellow -NoNewline
$GroupAnswer = Read-Host
If ($GroupAnswer -eq 'c') {
Write-host "What Group name do you want to use instead of $Group? " -ForegroundColor Yellow -NoNewline
$GroupName = Read-Host
} Else {
$GroupName = $Group
}
# Account Creation
Try {
$Check = Get-ADGroup $GroupName -ErrorAction STOP
} Catch {
$Check = $Null
}
If ($Check -eq $Null) {
# New Group Creation
New-ADGroup –name $GroupName –GroupCategory Security –GroupScope Global –SamAccountName $GroupName
} Else {
Write-host ' '
Write-host "The group " -ForegroundColor White -NoNewline
Write-host "$GroupName " -ForegroundColor Green -NoNewline
Write-host "already exists and will not be created." -ForegroundColor White
Write-host ' '
}
If ($Group -eq 'MIMSyncAdmins') {
Add-ADGroupMember -identity $GroupName -Members Administrator
Add-ADGroupmember -identity $GroupName -Members S-MIMService
Add-ADGroupmember -identity $GroupName -Members S-MIMInstall
}
}
For the next section, we are setting the SPNs for the various accounts needed by MIM. These are also provided in Microsoft documentation.
# Set SPN's $NetBIOSName = (Get-AdDomain).NetBIOSName $DNSName = (Get-AdDomain).DNSRoot Write-host " " Write-host " " Write-host "Setting SPN values for the domain." -ForegroundColor Yellow setspn -S "http/mim.$DNSName" "$NetBIOSName\mimpool" setspn -S "http/mim" "$NetBIOSName\mimpool" setspn -S "http/passwordreset.$DNSName" "$NetBIOSName\mimsspr" setspn -S "http/passwordregistration.$DNSName" "$NetBIOSName\mimsspr" setspn -S "FIMService/mim.$DNSName" "$NetBIOSName\MIMService" setspn -S "FIMService/corpservice.$DNSName" "$NetBIOSName\s-MIMService" Write-host " " Write-host " " Write-host "Completing creating SPN's." -ForegroundColor Cyan
Sample Run Through
Here is a sample run-through of the script:

Next will be part 3 to cover DNS entry creation for MIM.
