How to Add Users in Active Directory: ADUC, PowerShell New-ADUser and dsadd

Applies to: Active Directory Domain Services on Windows Server 2016 to 2025, managed from a domain controller or from Windows 10 and 11 Pro or Enterprise with RSAT; steps from Microsoft documentation (not testable in our Linux lab); the bulk-import script was checked with PowerShell 7.6.6

You can create a user in Active Directory in three ways: with the Active Directory Users and Computers console (dsa.msc), with the PowerShell cmdlet New-ADUser, or with the older command-line tool dsadd user. All three need an account with the right permissions: according to Microsoft, members of Domain Admins and Enterprise Admins can manage users, and Account Operators can create, change and delete users but not manage groups.

Where to run the tools

On a domain controller the tools are already installed. On another computer you need the AD DS and AD LDS tools from the Remote Server Administration Tools (RSAT), and the computer must be joined to the domain:

• Windows Server: Install-WindowsFeature -Name RSAT-AD-Tools -IncludeAllSubFeature in an administrator PowerShell, or Server Manager, Manage, Add Roles and Features.
• Windows 11 or 10 (Pro or Enterprise only): Start, type Optional Features, add RSAT: Active Directory Domain Services and Lightweight Directory Services Tools, or in PowerShell: Add-WindowsCapability -Online -Name Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0.

Method 1: Active Directory Users and Computers

1. Open the console: press Win + R, type dsa.msc and press Enter, or in Server Manager choose Tools, Active Directory Users and Computers.
2. Expand the domain and select the organisational unit (OU) or container for the user. Without a choice of your own, users go into the default Users container.
3. On the Action menu, choose New, User.
4. Fill in First name, Last name, Full name (required) and User logon name (required), then click Next.
5. Enter the Password and Confirm it. Tick User must change password at next logon when you hand out a temporary password. The other boxes are User cannot change password, Password never expires and Account is disabled. Click Next.
6. Check the summary and click Finish.

To add the new user to a group, open the user’s Properties, go to the Member Of tab, click Add, type the group name, use Check Names and click OK.

Method 2: PowerShell with New-ADUser

The cmdlet is in the ActiveDirectory module, which comes with the RSAT tools above. Run it in Windows PowerShell as a domain administrator:

$params = @{
    Name                  = 'Anna Mathew'
    GivenName             = 'Anna'
    Surname               = 'Mathew'
    SamAccountName        = 'amathew'
    UserPrincipalName     = 'amathew@example.local'
    Path                  = 'OU=Staff,DC=example,DC=local'
    AccountPassword       = (Read-Host -AsSecureString 'Password')
    ChangePasswordAtLogon = $true
    Enabled               = $true
}
New-ADUser @params
Add-ADGroupMember -Identity 'Sales' -Members amathew

Two things Microsoft’s reference points out:

• Accounts are created disabled unless you ask for them to be enabled, and never enabled without a valid password. That is why the example sets both AccountPassword and Enabled.
• If the password doesn’t meet the domain’s password policy, the account is still created, but without the password. Set it afterwards with Set-ADAccountPassword, then enable the account with Enable-ADAccount.

Without Path, the user goes into the domain’s default user container. Keep SamAccountName to 20 characters or fewer, which Microsoft recommends for compatibility with older systems. Check the result with Get-ADUser amathew.

Create many users from a CSV file

Microsoft’s reference also describes piping Import-Csv into New-ADUser. With a file users.csv:

FirstName,LastName,Username,Password
Anna,Mathew,amathew,Temp-Pass-2941!
Rahul,Nair,rnair,Temp-Pass-7730!

Import-Csv .\users.csv | ForEach-Object {
    $params = @{
        Name                  = "$($_.FirstName) $($_.LastName)"
        GivenName             = $_.FirstName
        Surname               = $_.LastName
        SamAccountName        = $_.Username
        UserPrincipalName     = "$($_.Username)@example.local"
        Path                  = 'OU=Staff,DC=example,DC=local'
        AccountPassword       = ConvertTo-SecureString $_.Password -AsPlainText -Force
        ChangePasswordAtLogon = $true
        Enabled               = $true
    }
    New-ADUser @params
}

We checked the loop with PowerShell 7.6.6 and a test stand-in for New-ADUser: it built the name, logon name, UPN and a secure password for each line. Use temporary passwords only, keep must change at next logon on, and delete the CSV file afterwards, because it contains passwords in plain text.

Method 3: dsadd from the Command Prompt

Microsoft documents dsadd as available when the AD DS server role is installed, so run it on a domain controller, in an elevated Command Prompt. This example, adapted from Microsoft’s reference, creates an enabled user in an OU, asks for the password (-pwd *) and forces a change at first logon:

dsadd user "CN=Anna Mathew,OU=Staff,DC=example,DC=local" -samid amathew -upn amathew@example.local -fn Anna -ln Mathew -pwd * -mustchpwd yes -disabled no

Without -disabled no, dsadd creates the account disabled. Add -memberof "CN=Sales,OU=Groups,DC=example,DC=local" to put the user in a group at the same time.

After creating the user

• The user signs in with EXAMPLE\amathew or amathew@example.local on any domain-joined computer.
• If a new account can’t log in, check that it is enabled and not locked out: Reset Password in the console has an Unlock the user account box.
• Linux servers can use the same accounts: see join Linux to Active Directory with realmd and SSSD.

Running your domain controller on a Windows VPS? The Windows Server licence is included.

Official documentation: Manage user accounts in Active Directory Users and Computers, New-ADUser and Install RSAT.