From 73cd6337f6e83f96b3fe1713addaaa941c648672 Mon Sep 17 00:00:00 2001
From: David Yoder <dyoder@emberkom.com>
Date: Thu, 17 Mar 2022 16:24:15 -0400
Subject: [PATCH] renamed from Create-LocalAdmin.ps1

---
 Create-LocalUser.ps1 | 43 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)
 create mode 100644 Create-LocalUser.ps1

diff --git a/Create-LocalUser.ps1 b/Create-LocalUser.ps1
new file mode 100644
index 0000000..92e9ec4
--- /dev/null
+++ b/Create-LocalUser.ps1
@@ -0,0 +1,43 @@
+#Requires -Version 5.1
+
+param(
+    [Parameter(Mandatory=$true)][string]$Username,
+    [Parameter(Mandatory=$true)][string]$Password,
+    [Parameter(Mandatory=$true)][string]$FullName,
+    [Parameter(Mandatory=$true)][string]$Description,
+    [Parameter(Mandatory=$false)][bool]$MakeAdmin=$false,
+    [Parameter(Mandatory=$false)][bool]$Hide=$false
+)
+
+## Secure supplied password
+Try { $SecurePassword = ConvertTo-SecureString $Password -AsPlainText -Force ; $Password = $null }
+Catch { LogErr $_.Exception.Message ; Exit }
+If ( IsAdmin )
+{
+    If ( $(Get-CimInstance -ClassName Win32_OperatingSystem -Property ProductType | Select-Object -ExpandProperty ProductType) -ne "2" )
+    {
+        If ( $(Get-LocalUser -Name $Username -ErrorAction SilentlyContinue) )
+        {
+            LogMsg "Updating user: ${Username}"
+            Try { Set-LocalUser -Name $Username -Password $SecurePassword -FullName $FullName -Description $Description -AccountNeverExpires -PasswordNeverExpires $true }
+            Catch { LogErr $_.Exception.Message ; Exit }
+        }
+        Else
+        {
+            LogMsg "Creating user: ${Username}"
+            Try { New-LocalUser -Name $Username -Password $SecurePassword -FullName $FullName -Description $Description -AccountNeverExpires -PasswordNeverExpires $true }
+            Catch { LogErr $_.Exception.Message ; Exit }
+        }
+        If ( (-not($(Get-LocalGroupMember -Group "Administrators" -Member $Username -ErrorAction SilentlyContinue))) -and ($MakeAdmin) )
+        {
+            LogMsg "Adding ""${Username}"" to local Administrators group"
+            Try { Add-LocalGroupMember -Group "Administrators" -Member $Username }
+            Catch { LogErr $_.Exception.Message ; Exit }
+        }
+    }
+    Else { LogMsg "The local user account ""${Username}"" cannot be created on a domain controller" }
+}
+Else { LogMsg "Cannot create a local administrator account without administrative privileges" }
+
+## TODO: Hide account from logon screen
+#Get-ChildItem "HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList"