The Code
Write-host "-------------------------------------" -ForegroundColor Green Write-host " MIM Group Creation Script" -ForegroundColor Green Write-host "-------------------------------------" -ForegroundColor Green Write-host "" Write-host "" # Import AD Module Try {Import-Module ActiveDirectory -ErrorAction STOP} Catch {Write-Host "Active Directory Module could not be loaded"} # Standard MIM Security Groups $Groups = @("MIMSyncAdmins","MIMSyncOperators","MIMSyncJoiners","MIMSyncBrowse","MIMSyncPasswordReset") # Loop for all users Foreach ($Group in $Groups) { # Account Name Write-host "Do you want to use the standard name for the $Group group? [s or c] " -ForegroundColor Yellow -NoNewline $GroupAnswer = Read-Host If ($GroupAnswer -eq 'c') { Write-host "What Group name do you want to use instead of $Group? " -ForegroundColor Yellow -NoNewline $GroupName = Read-Host } Else { $GroupName = $Group } # Account Creation Try { $Check = Get-ADGroup $GroupName -ErrorAction STOP } Catch { $Check = $Null } If ($Check -eq $Null) { # New Group Creation New-ADGroup –name $GroupName –GroupCategory Security –GroupScope Global –SamAccountName $GroupName } Else { Write-host ' ' Write-host "The group " -ForegroundColor White -NoNewline Write-host "$GroupName " -ForegroundColor Green -NoNewline Write-host "already exists and will not be created." -ForegroundColor White Write-host ' ' } If ($Group -eq 'MIMSyncAdmins') { Add-ADGroupMember -identity $GroupName -Members Administrator Add-ADGroupmember -identity $GroupName -Members S-MIMService Add-ADGroupmember -identity $GroupName -Members S-MIMInstall } }
For the next section, we are setting the SPNs for the various accounts needed by MIM. These are also provided in Microsoft documentation.
# Set SPN's $NetBIOSName = (Get-AdDomain).NetBIOSName $DNSName = (Get-AdDomain).DNSRoot Write-host " " Write-host " " Write-host "Setting SPN values for the domain." -ForegroundColor Yellow setspn -S "http/mim.$DNSName" "$NetBIOSName\mimpool" setspn -S "http/mim" "$NetBIOSName\mimpool" setspn -S "http/passwordreset.$DNSName" "$NetBIOSName\mimsspr" setspn -S "http/passwordregistration.$DNSName" "$NetBIOSName\mimsspr" setspn -S "FIMService/mim.$DNSName" "$NetBIOSName\MIMService" setspn -S "FIMService/corpservice.$DNSName" "$NetBIOSName\s-MIMService" Write-host " " Write-host " " Write-host "Completing creating SPN's." -ForegroundColor Cyan
Sample Run Through
Here is a sample run-through of the script:
Next will be part 3 to cover DNS entry creation for MIM.