I want to execute a run command as a domain user belonging to Active Directory

Question

I use AWS-RunPowerShellScript in system manager.

At that time, we would like to add an AD user using the dsadd-user command. But this will result in an error because I don't have access permissions.

Because I believe that the command is executed as a local user named ssm-user .

I want to run the command as a user belonging to Active Directory - is it possible?

Answer 1

• Yes, it is possible to run the command as a user belonging to Active Directory for adding an AD user using the 'dsadd-user' command. For that purpose, you will have to ensure that this command is executed with elevated (domain administrator or local administrator) privileges . Also, ensure that the system from which the command is executed is a domain joint system . Most probably, I would suggest you to execute the below commands on a domain controller .

Command for adding a user to Active Directory : -

 ‘ dsadd user <UserDN> [-samid <SAMName>] [-upn <UPN>] [-fn <FirstName>] [-mi <Initial>] [-ln <LastName>] [-display <DisplayName>] [-empid <EmployeeID>] [-pwd {<Password> | *}] [-desc <Description>] [-memberof <Group> ...] [-office <Office>] [-tel <PhoneNumber>] [-email <Email>] [-hometel <HomePhoneNumber>] [-pager <PagerNumber>] [-mobile <CellPhoneNumber>] [-fax <FaxNumber>] [-iptel <IPPhoneNumber>] [-webpg <WebPage>] [-title <Title>] [-dept <Department>] [-company <Company>] [-mgr <Manager>] [-hmdir <HomeDirectory>] [-hmdrv <DriveLetter>:][-profile <ProfilePath>] [-loscr <ScriptPath>] [-mustchpwd {yes | no}] [-canchpwd {yes | no}] [-reversiblepwd {yes | no}] [-pwdneverexpires {yes | no}] [-acctexpires <NumberOfDays>] [-disabled {yes | no}] [{-s <Server> | -d <Domain>}] [-u <UserName>] [-p {<Password> | *}] [-q] [{-uc | -uco | -uci}] ’

Example command : -

‘ dsadd user “cn=John Smith,ou=SouthEmployees,dc=northwindtraders,dc=com” -disabled no –pwd C^h3Bdo9# -mustchpwd yes -memberof cn=janitors,ou=SouthEmployees,dc=northwindtraders,dc=com -acctexpires never ‘

• For executing the above command through AWS Systems manager console , please refer to the AWS documentation link below for more details: -

https://docs.aws.amazon.com/systems-manager/latest/userguide/integration-S3-PowerShell.html