How to Bulk Import Active Directory Users from CSV Using PowerShell

First, ensure you have the Active Directory PowerShell module installed. On Windows Server, this comes pre-installed. On client machines, you need RSAT (Remote Server Administration Tools).

For Windows 10/11, install RSAT through Settings:

# Open Settings > Apps > Optional Features > Add a feature
# Search for "RSAT: Active Directory Domain Services and Lightweight Directory Services Tools"
# Or install via PowerShell (run as Administrator):
Get-WindowsCapability -Name RSAT* -Online | Add-WindowsCapability -Online

Once installed, open PowerShell as Administrator and import the module:

Import-Module ActiveDirectory

Verify the module loaded successfully:

Get-Module ActiveDirectory

You should see the ActiveDirectory module listed with version information. If you get an error, restart PowerShell and try again.

Create a properly formatted CSV file with all required user attributes. The column headers must match exactly what your PowerShell script expects.

Create a file called users.csv with this structure:

FirstName,LastName,SamAccountName,Password,OU,Email,Description,Department,Title
John,Doe,jdoe,TempPass123!,"OU=Users,DC=contoso,DC=com",jdoe@contoso.com,Marketing Manager,Marketing,Manager
Jane,Smith,jsmith,TempPass456!,"OU=Users,DC=contoso,DC=com",jsmith@contoso.com,IT Specialist,IT,Specialist
Mike,Johnson,mjohnson,TempPass789!,"OU=IT,OU=Users,DC=contoso,DC=com",mjohnson@contoso.com,System Administrator,IT,Administrator

Save the file as UTF-8 encoding to avoid character issues. In Notepad, use Save As and select "UTF-8" from the encoding dropdown.

Verify your CSV structure:

Import-Csv -Path "C:\users.csv" | Format-Table

Test that your OU paths exist:

Get-ADOrganizationalUnit -Filter "Name -eq 'Users'"

Before running the bulk import, verify your environment is properly configured and you have the necessary permissions.

Test your domain connectivity:

# Test domain controller connectivity
Test-ComputerSecureChannel -Verbose

# Verify you can query Active Directory
Get-ADDomain

Check your current user permissions:

# Get your current user context
whoami

# Test if you can create users (try creating a test user)
$TestPassword = ConvertTo-SecureString "TempTest123!" -AsPlainText -Force
New-ADUser -Name "TestUser" -SamAccountName "testuser" -AccountPassword $TestPassword -WhatIf

The -WhatIf parameter shows what would happen without actually creating the user. If you see no errors, you have the required permissions.

Verify your target OUs exist and are accessible:

# List all OUs to verify paths
Get-ADOrganizationalUnit -Filter * | Select-Object Name, DistinguishedName | Sort-Object Name

Create a comprehensive PowerShell script that handles errors, checks for duplicates, and provides detailed logging. Save this as Import-ADUsers.ps1:

# Import-ADUsers.ps1
# Bulk import Active Directory users from CSV

param(
    [Parameter(Mandatory=$true)]
    [string]$CSVPath,
    [string]$LogPath = "C:\ADImport.log"
)

# Import required module
Import-Module ActiveDirectory -ErrorAction Stop

# Initialize counters
$SuccessCount = 0
$FailureCount = 0
$SkippedCount = 0

# Start logging
Start-Transcript -Path $LogPath -Append
Write-Host "Starting AD user import from: $CSVPath" -ForegroundColor Green
Write-Host "Log file: $LogPath" -ForegroundColor Yellow

try {
    # Import CSV file
    $ADUsers = Import-Csv -Path $CSVPath -ErrorAction Stop
    Write-Host "Found $($ADUsers.Count) users in CSV file" -ForegroundColor Cyan
    
    # Process each user
    foreach ($User in $ADUsers) {
        $Username = $User.SamAccountName
        
        try {
            # Check if user already exists
            $ExistingUser = Get-ADUser -Filter {SamAccountName -eq $Username} -ErrorAction SilentlyContinue
            
            if ($ExistingUser) {
                Write-Warning "User $Username already exists. Skipping..."
                $SkippedCount++
                continue
            }
            
            # Prepare user attributes
            $UserParams = @{
                SamAccountName = $Username
                UserPrincipalName = "$Username@$((Get-ADDomain).DNSRoot)"
                Name = "$($User.FirstName) $($User.LastName)"
                GivenName = $User.FirstName
                Surname = $User.LastName
                EmailAddress = $User.Email
                Path = $User.OU
                AccountPassword = (ConvertTo-SecureString $User.Password -AsPlainText -Force)
                Enabled = $true
                ChangePasswordAtLogon = $true
                Description = $User.Description
                Department = $User.Department
                Title = $User.Title
            }
            
            # Create the user
            New-ADUser @UserParams -ErrorAction Stop
            Write-Host "✓ Successfully created user: $Username" -ForegroundColor Green
            $SuccessCount++
            
        } catch {
            Write-Error "✗ Failed to create user $Username`: $($_.Exception.Message)"
            $FailureCount++
        }
    }
    
} catch {
    Write-Error "Critical error: $($_.Exception.Message)"
    exit 1
}

# Display summary
Write-Host "`n=== IMPORT SUMMARY ===" -ForegroundColor Magenta
Write-Host "Successful: $SuccessCount" -ForegroundColor Green
Write-Host "Failed: $FailureCount" -ForegroundColor Red
Write-Host "Skipped: $SkippedCount" -ForegroundColor Yellow
Write-Host "Total processed: $($SuccessCount + $FailureCount + $SkippedCount)" -ForegroundColor Cyan

Stop-Transcript

Make the script executable and test it:

# Test the script with WhatIf (dry run)
.\Import-ADUsers.ps1 -CSVPath "C:\users.csv" -WhatIf

Run the import script with proper error handling and monitoring. Always start with a small test batch before importing hundreds of users.

First, create a test CSV with just 2-3 users:

# Create a test subset
$TestUsers = Import-Csv -Path "C:\users.csv" | Select-Object -First 3
$TestUsers | Export-Csv -Path "C:\users-test.csv" -NoTypeInformation

Execute the test import:

# Run the import script
.\Import-ADUsers.ps1 -CSVPath "C:\users-test.csv" -LogPath "C:\ADImport-test.log"

Monitor the output carefully. You should see real-time feedback for each user creation attempt. Check the log file for detailed information:

# Review the log file
Get-Content "C:\ADImport-test.log" | Select-Object -Last 20

If the test import succeeds, proceed with the full import:

# Full import
.\Import-ADUsers.ps1 -CSVPath "C:\users.csv" -LogPath "C:\ADImport-full.log"

For very large imports, process in batches:

# Process in batches of 100
$AllUsers = Import-Csv -Path "C:\users.csv"
$BatchSize = 100

for ($i = 0; $i -lt $AllUsers.Count; $i += $BatchSize) {
    $Batch = $AllUsers | Select-Object -Skip $i -First $BatchSize
    $BatchFile = "C:\users-batch-$($i/$BatchSize + 1).csv"
    $Batch | Export-Csv -Path $BatchFile -NoTypeInformation
    
    Write-Host "Processing batch $($i/$BatchSize + 1)..."
    .\Import-ADUsers.ps1 -CSVPath $BatchFile
    
    Start-Sleep -Seconds 10  # Brief pause between batches
}

After the import completes, thoroughly verify that all users were created correctly with the proper attributes and settings.

Check the total number of users created:

# Count users in your target OU
$TargetOU = "OU=Users,DC=contoso,DC=com"
$ImportedUsers = Get-ADUser -Filter * -SearchBase $TargetOU
Write-Host "Total users in OU: $($ImportedUsers.Count)" -ForegroundColor Cyan

Verify specific user attributes match your CSV data:

# Detailed verification of imported users
$CSVData = Import-Csv -Path "C:\users.csv"

foreach ($CSVUser in $CSVData) {
    $ADUser = Get-ADUser -Identity $CSVUser.SamAccountName -Properties EmailAddress, Department, Title, Description -ErrorAction SilentlyContinue
    
    if ($ADUser) {
        Write-Host "✓ User: $($ADUser.SamAccountName)" -ForegroundColor Green
        Write-Host "  Email: $($ADUser.EmailAddress)" -ForegroundColor Gray
        Write-Host "  Department: $($ADUser.Department)" -ForegroundColor Gray
        Write-Host "  Title: $($ADUser.Title)" -ForegroundColor Gray
        Write-Host "  Enabled: $($ADUser.Enabled)" -ForegroundColor Gray
    } else {
        Write-Host "✗ User not found: $($CSVUser.SamAccountName)" -ForegroundColor Red
    }
}

Test user authentication (optional, but recommended for a few test accounts):

# Test authentication for a specific user
$TestUser = "jdoe"
$TestPassword = "TempPass123!"

try {
    $SecurePassword = ConvertTo-SecureString $TestPassword -AsPlainText -Force
    $Credential = New-Object System.Management.Automation.PSCredential($TestUser, $SecurePassword)
    
    # This will succeed if the user can authenticate
    Get-ADUser -Identity $TestUser -Credential $Credential -ErrorAction Stop
    Write-Host "✓ Authentication test passed for $TestUser" -ForegroundColor Green
} catch {
    Write-Host "✗ Authentication test failed for $TestUser`: $($_.Exception.Message)" -ForegroundColor Red
}

Generate a summary report:

# Create verification report
$ReportPath = "C:\ADImport-Report.csv"
$ImportedUsers | Select-Object Name, SamAccountName, EmailAddress, Department, Title, Enabled, Created | 
    Export-Csv -Path $ReportPath -NoTypeInformation

Write-Host "Verification report saved to: $ReportPath" -ForegroundColor Yellow

After successful user creation, you may need to configure additional settings like group memberships, home directories, or profile paths. This step handles post-creation configuration.

Add users to security groups based on their department or role:

# Add users to groups based on CSV data
$CSVData = Import-Csv -Path "C:\users.csv"

foreach ($User in $CSVData) {
    $Username = $User.SamAccountName
    $Department = $User.Department
    
    try {
        # Add to department-specific group
        $GroupName = "$Department-Users"
        
        # Check if group exists
        $Group = Get-ADGroup -Filter "Name -eq '$GroupName'" -ErrorAction SilentlyContinue
        
        if ($Group) {
            Add-ADGroupMember -Identity $GroupName -Members $Username -ErrorAction Stop
            Write-Host "✓ Added $Username to group $GroupName" -ForegroundColor Green
        } else {
            Write-Warning "Group $GroupName does not exist. Skipping group assignment for $Username"
        }
        
        # Add all users to a common group
        Add-ADGroupMember -Identity "All-Users" -Members $Username -ErrorAction SilentlyContinue
        
    } catch {
        Write-Error "Failed to add $Username to groups: $($_.Exception.Message)"
    }
}

Configure home directories (if required):

# Set home directories
$HomeDirectoryBase = "\\fileserver\home$"

foreach ($User in $CSVData) {
    $Username = $User.SamAccountName
    $HomeDirectory = "$HomeDirectoryBase\$Username"
    
    try {
        # Set home directory path
        Set-ADUser -Identity $Username -HomeDirectory $HomeDirectory -HomeDrive "H:"
        Write-Host "✓ Set home directory for $Username`: $HomeDirectory" -ForegroundColor Green
        
        # Create the directory (requires appropriate permissions)
        if (!(Test-Path $HomeDirectory)) {
            New-Item -Path $HomeDirectory -ItemType Directory -Force
            # Set permissions (example - adjust for your environment)
            icacls $HomeDirectory /grant "$Username:(OI)(CI)F" /T
        }
        
    } catch {
        Write-Error "Failed to configure home directory for $Username`: $($_.Exception.Message)"
    }
}

Set password policies and account expiration if needed:

# Configure account policies
foreach ($User in $CSVData) {
    $Username = $User.SamAccountName
    
    try {
        # Set account to expire in 90 days (example)
        $ExpirationDate = (Get-Date).AddDays(90)
        Set-ADUser -Identity $Username -AccountExpirationDate $ExpirationDate
        
        # Require password change at next logon
        Set-ADUser -Identity $Username -ChangePasswordAtLogon $true
        
        Write-Host "✓ Configured account policies for $Username" -ForegroundColor Green
        
    } catch {
        Write-Error "Failed to set account policies for $Username`: $($_.Exception.Message)"
    }
}

Final verification of all configurations:

# Comprehensive verification
$VerificationResults = @()

foreach ($User in $CSVData) {
    $Username = $User.SamAccountName
    $ADUser = Get-ADUser -Identity $Username -Properties MemberOf, HomeDirectory, AccountExpirationDate -ErrorAction SilentlyContinue
    
    $Result = [PSCustomObject]@{
        Username = $Username
        Exists = ($ADUser -ne $null)
        GroupCount = ($ADUser.MemberOf | Measure-Object).Count
        HomeDirectory = $ADUser.HomeDirectory
        ExpirationDate = $ADUser.AccountExpirationDate
        Enabled = $ADUser.Enabled
    }
    
    $VerificationResults += $Result
}

# Display results
$VerificationResults | Format-Table -AutoSize

# Export final report
$VerificationResults | Export-Csv -Path "C:\ADImport-Final-Report.csv" -NoTypeInformation