PowerShell Create AD User from CSV

Import-Module ActiveDirectory

## create user function to call from if/else later.
function Create-User{
 ## Create array to store all needed values for user creation
    $splat = @{
        Name = $firstName + ' ' + $lastName
        SamAccountName = $username
        UserPrincipalName = $email
        GivenName = $firstName
        Surname = $lastName
        DisplayName = $lastname + ', ' + $firstName
        EmailAddress = $email
        Title = $jobTitle
        Department = $department
        Enabled = $true
        ChangePasswordAtLogon = $true
        HomeDirectory = "SANITIZED"
        HomeDrive = $homeDrive
        HomePhone = "SANITIZED"
        OtherAttributes = @{
            'ExtensionAttribute2' = $personalNumber;
        }

        AccountPassword = (ConvertTo-SecureString $password -AsPlainText -Force)
    }


    ## Create user in On Prem Active Directory
    New-ADUser @splat -path 'SANITIZED' -verbose
}

## Creates a random password for each user
# Randomize passwords
function Get-RandomPassword {
    Param(
        [Parameter(mandatory = $true)]
        [int]$Length
    )
    Begin {
        if ($Length -lt 4) {
            End
        }
        $Numbers = 1..9
        $LettersLower = 'abcdefghijklmnopqrstuvwxyz'.ToCharArray()
        $LettersUpper = 'ABCEDEFHIJKLMNOPQRSTUVWXYZ'.ToCharArray()
        $Special = '!@#$%^&*()=+[{}]/?<>'.ToCharArray()

        # For the 4 character types (upper, lower, numerical, and special)
        $N_Count = [math]::Round($Length * .2)
        $L_Count = [math]::Round($Length * .4)
        $U_Count = [math]::Round($Length * .2)
        $S_Count = [math]::Round($Length * .2)
    }
    Process {
        $Pswrd = $LettersLower | Get-Random -Count $L_Count
        $Pswrd += $Numbers | Get-Random -Count $N_Count
        $Pswrd += $LettersUpper | Get-Random -Count $U_Count
        $Pswrd += $Special | Get-Random -Count $S_Count

        # If the password length isn't long enough (due to rounding), add X special characters
        # Where X is the difference between the desired length and the current length.
        if ($Pswrd.length -lt $Length) {
            $Pswrd += $Special | Get-Random -Count ($Length - $Pswrd.length)
        }

        # Lastly, grab the $Pswrd string and randomize the order
        $Pswrd = ($Pswrd | Get-Random -Count $Length) -join ""
    }
    End {
        $Pswrd
    }
}

## Check to see if csv exist or is empty before continuing forward
if (-not(Test-Path C:\psScripts\Onboarding\createADUsers.csv)) {

    Write-Host "CSV is empty, stop script"
}
else {
    ##import csv values from sharepoint list
    $adUsers = Import-Csv C:\psScripts\Onboarding\createADUsers.csv -Delimiter ","

    foreach($user in $adUsers) {
        $firstName = $user.FirstName
        $lastName = $user.LastName
        $firstInitial = $firstName.ToLower()[0]
        $jobTitle = $user.Position
        $department = $user.Department
        $homeDrive = "SANITIZED"
        $securityGroups = $user.SecurityGroups
        $password = Get-RandomPassword -Length 10
        $username = $firstInitial + $lastName.ToLower()
        $email = $username + "@SANITIZED"
        $licenses = $user.licenses
        $personalNumber = $user.personalNumber
        $personalEmail = $user.personalEmail

        ## Set variable to prevent incrementing from adding onto instead of together, ie:  11 vs 1+1=2
        $ogusername = $username
        $i = 1
        $aduser = Get-ADUser -Filter {SamAccountName -eq $username}


        ## If user account already exists, increment name by 1 until one is found
        while ($adUser -ne $null) {
            Write-Host "Username is already in use. Incrementing by 1 to find a new one"
            $username = $ogusername + $i
            $email = $username + "@SANITIZED"
            $i++
            Write-Host "Trying new username of $username"
            $aduser = Get-ADUser -Filter {SamAccountName -eq $username}
        }


        if ($personalEmail = '') {
            $personalEmail = $email
        }

        create-User
        Start-Sleep -Seconds 5

        ## Split $securityGroupsVariable into usable format for foreach loop
        $securityGroups = $securityGroups.split(",")

        ## create correct identifiers for security groups. Loop through each per user and assign the user to the group
        foreach ($group in $securityGroups) {
            Switch($group) {
                "SANITIZED" {$group = "SANITIZED"}
                "SANITIZED" {$group = "SANITIZED"}
                "SANITIZED" {$group = "SANITIZED"}
                "SANITIZED" {$group = "SANITIZED"}
                "SANITIZED" {$group = "SANITIZED"}
                "SANITIZED" {$group = "SANITIZED"}
                "IT" {$group = "IT"}
                "SANITIZED" {$group = "SANITIZED"}
                "SANITIZED" {$group = "SANITIZED"}
            }

            Add-ADGroupMember -Identity $group -Members $username
        }

        ## Create correct identifiers for license groups. Loop through each per user and assign the user to the group.
        ## Valid Licenses:
            ## Outlook Mailbox, assigns license on the Azure side based on group membership
            ## Office 365, assigns license on the Azure side based on group membership
            ## Adobe Pro, assigns a task to IT. Until Adobe can become federated


        ## Split $licenses variable into usable format for foreach loop
        $licenses = $licenses.split(",")


        ## Values on left are string format from Forms. Values on right are AD Sec Group Names
        foreach ($license in $licenses) {
            switch($license) {
                "Outlook Mailbox" {$license = "OutlookOnly"}
                'Office 365' {$license = "Office365"}
                'SANITIZED' {$license = "SANITIZED"}
                'SANITIZED' {$license = "SANITIZED"}
                'Adobe Pro' {$license = "AdobePro"}
                'SANITIZED' {$license = "SANITIZED"}
            }

            Add-ADGroupMember -Identity $license -Members $username
        }

        ## Sets the password so it must be changed at first logon
        Set-ADUser $username -ChangePasswordAtLogon $True


        ## Send email to HR informing them that the account was created along with their temporary password.
        ## Passwords must be changed after logging in.

        $mailParam = @{
            To = 'SANITIZED@SANITIZED'
            From = 'SANITIZED@SANITIZED'
            Subject = 'New Active Directory User'
            Body = "<h2> A new user was created in AD </br>`
                User:  $firstName $lastname </br>`
                Username is: $username </br>`
                Password is: $password </br> </br> `
                </br>`
                Please have users login  to change their password during orientation.
                </h2>"
            SmtpServer = 'SANITIZED.mail.protection.outlook.com'
            Port = 25
        }

        Send-MailMessage @mailParam -BodyAsHtml

        ## Send email to IT Department informing that an account was created, what security groups were assigned, and what licenses were assigned.
        $mailParam2 = @{
          To = 'SANITIZED@SANITIZED'
          From = 'SANITIZED@SANITIZED'
          Subject = 'New Active Directory User'
          Body = "<h2> A new user was created in AD </br>`
            User:  $firstName $lastname </br>`
            Username: $username </br>`
            Security Groups Assigned:  $securityGroups </br>`
            Licenses Assigned:  $licenses </br>`
            </br>`
            Please verify that licenses exist for any groups that need them.
            </br>`
            </h2>"
          SmtpServer = 'SANITIZED.mail.protection.outlook.com'
          Port = 25
        }

        Send-MailMessage @mailParam2 -BodyAsHtml
    }

    ## Delete the createADUsers.csv file
  Remove-Item C:\psScripts\Onboarding\createADUsers.csv -Force
}