Bulk Import Users into Active Directory from CSV

Bulk create users creates many Active Directory accounts at once from a CSV file, for example a new intake of staff or students, or accounts from an HR export.

Each row in the file becomes one account. You choose the OU, the password and the account options once for the whole file, and the file can set attributes, a manager and groups for each person.

To open it, go to Tools > Users > Bulk create. You need a role that can manage users.

To create a single account, or to also create a Microsoft 365 user, use Tools > Users > New user instead.

Tips

• Try a small file first. Create two or three accounts, check them in Active Directory, then run the rest.
• Read the review before you create. The page checks every row first and marks anything that would stop an account being created, such as a logon name already in use or an OU that doesn't exist.
• Watch for spreadsheet formatting. Excel can drop leading zeros from employee IDs and phone numbers. Format those columns as text before you save the CSV.
• To change accounts after they are created, use Tools > Users > Bulk update with the same file layout.

Step 1: Prepare and upload the CSV file

Get a starting file

• The template. On the Bulk create page, select Download template. It has every supported column and one example row. Delete the columns you don't need.
• An export from your HR system, renamed to match the supported columns.
• A file you used before with the desktop AD Pro Toolkit's Bulk import. It works here unchanged.

Fill it in

Open the file in Excel or any spreadsheet program.

1. Fill in the three required columns for every row: Logon Name (sAMAccountName), First Name and Last Name.
2. Add the columns you want to set, such as User Principal Name, Job Title, Department, E-mail, Manager and Member Of. Any column can be left blank on a row.
3. Add one row per new account.
4. Save it as CSV. In Excel, choose File > Save As and pick CSV UTF-8 (Comma delimited), which keeps accented names intact.

For example:

Logon Name (sAMAccountName),First Name,Last Name,User Principal Name,Job Title,Department,Manager,Member Of
jsmith,John,Smith,jsmith@contoso.com,Sales Representative,Sales,dreyes,Sales;All Staff
mlopez,Maria,Lopez,mlopez@contoso.com,Accountant,Finance,kchen,Finance;All Staff

Things to know when filling it in:

• Include User Principal Name. It is the name people sign in with, such as jsmith@contoso.com, and what Microsoft 365 matches on. Accounts created without it have no UPN.
• Display name: if the file has no Display Name column, it is built from the first and last name in the format you choose under Import defaults.
• Manager: the manager's logon name, UPN or distinguished name.
• Member Of: group names or distinguished names, separated by semicolons. Group names can also be separated by commas.
• OU: the full distinguished name of the OU for that row, such as OU=Sales,OU=Staff,DC=contoso,DC=com. Rows without it use the default OU.
• Password: only needed if you use passwords from the file. See Passwords.
• Profile Path, Logon Script and Home Folder (Path): %username% is replaced with each account's logon name, so one value works for the whole file. For example, \\fileserver\home\%username% becomes \\fileserver\home\jsmith.
• Several values in one cell: proxy addresses, other telephone numbers and other mobile numbers are separated by semicolons. Proxy addresses can also be separated by commas.

Column headings are matched without regard to case, and both the friendly names and the AD attribute names work. For example, Job Title, Title and title all set the job title.

Upload it

Select Choose CSV… and pick your file. The page checks every row against Active Directory straight away (see Step 3). Nothing is created until you select Create.

Columns the page doesn't recognize are ignored and listed above the preview. If a required column is missing, the page says which one.

Step 2: Import defaults

These apply to every account in the file. Changing one updates the review straight away.

Account setup

• Default OU: the OU new accounts are created in. Type to search for an OU, or select Browse to pick one from the tree. A row with its own OU value is created there instead. You must choose a default OU unless every row in the file has an OU value.
• Display name format: used to build the display name when the file has no Display Name column, as FirstName LastName (John Smith) or LastName, FirstName (Smith, John). The display name is also the account's name in Active Directory (its CN), so it must be unique within the OU.
• Enable accounts: on by default. Turn it off to create the accounts disabled.

Password setup

• Password source:
  • Use passwords from CSV: each account gets the password in its Password column. The file must have a Password column.
  • Generate random passwords: each account gets its own random password, using upper and lower case letters, numbers and symbols. Set the Length (8 to 64 characters, 12 by default).
• Require password change at next logon: on by default.
• User cannot change password: off by default. Usually for shared or service accounts. It works the same way as the checkbox in Active Directory Users and Computers.
• Password never expires: off by default.

Require password change at next logon is ignored when Password never expires or User cannot change password is on. With "never expires", Active Directory doesn't allow the two together. With "cannot change", the user would be told to change a password they aren't allowed to change, and could never sign in.

Passwords must meet your domain's password policy. A password that doesn't is reported as a warning on that row, and the account is created disabled. An account with no password is always created disabled, because Active Directory won't enable an account without one.

Home folders

Home folders come from the file's Home Folder (Path) column; there is no setting for them. When a row's path is a shared folder, such as \\fileserver\home\%username%, the folder is created and the user is given Full Control of it, the same as setting a home folder in Active Directory Users and Computers.

• A local path like D:\Home\jsmith is still written to the account, but no folder is created.
• The folders are created by the AD Pro Toolkit server's own Windows account, not by you. When AD Pro Toolkit runs as a service, that is the server's computer account, so it needs permission to create folders on the share. If it doesn't have permission, the account is still created and the result shows a home folder warning.

Step 3: Review and create

As soon as the file is loaded, the page checks every row against Active Directory. Nothing is created yet. The table lists each account with one line for everything it will be created with:

Problems (red) stop that account from being created. They are listed first under the account, and its Account line says Won't be created:

• the logon name, first name or last name is missing;
• the logon name is longer than 20 characters, or contains a character Active Directory doesn't allow;
• the logon name or UPN is already in use in the domain, or by an earlier row in the file;
• there is no OU, or the OU doesn't exist;
• an account with the same name already exists in that OU, or an earlier row creates one there.

Warnings (amber) don't stop the account, but part of the row won't apply as you might expect: a manager or group that doesn't exist, no UPN, no password (the account is created disabled), or a home folder path that isn't a shared folder.

The line above the table sums it up, for example "120 rows · 117 to create · 3 can't be created · 5 with warnings".

Fix problems in the file and upload it again, or create the accounts that are ready and deal with the rest afterwards.

Create the accounts

1. Select Create N users, then confirm. Rows with problems are skipped.
2. Accounts are created one at a time. Under each user's name, the result appears as it finishes:
   • Created (green): the account was created and everything in the row was applied.
   • Created with warnings (amber): the account was created, but a follow-up step had a problem, such as a password that didn't meet the policy, or a home folder that couldn't be created. The reasons are listed under it. The account exists, so fix the problem on the account rather than creating it again.
   • Failed (red): the account wasn't created, with the reason Active Directory gave.
3. A summary next to the button shows how many accounts were created, failed, had warnings or were skipped.

A failed row doesn't stop the others.

Save the results

When the run finishes, select Download results (with passwords). The file lists each account's logon name, whether it was created, its password, its distinguished name and any notes.

Download the results before you leave the page if you generated passwords. Generated passwords are not stored anywhere else and can't be shown again. Keep the file somewhere safe, and delete it once the passwords have been handed out.

Supported columns

Troubleshooting

• "Missing required column(s)": the file has no Logon Name (sAMAccountName), First Name or Last Name column. Add it, or rename the column so it matches.
• OU: "None": the row has no OU value and no default OU is chosen. Choose a Default OU, or fill in the OU column.
• OU: "OU not found": the OU value isn't the exact, full distinguished name of an existing OU, for example OU=Sales,OU=Staff,DC=contoso,DC=com.
• "...the CSV is missing the password column": you chose Use the password from the CSV but the file has no passwords. Add a Password column, or choose Generate a random password for each account.
• "Already in use in the domain" or "already exists in that OU": an account with that logon name or UPN already exists, or one with the same name is already in that OU. Change it in the file and upload it again.
• Created with warnings, and the account is disabled: the password didn't meet the domain's password policy. Reset the password on the account and enable it.
• "No account matches this manager" or "No group has this name": no account or group matches the name in the file. The account is still created, without that manager or group.
• Home folder warning: the folder couldn't be created, usually because the AD Pro Toolkit server's account doesn't have permission on the share. The account is created with the home folder path set. Create the folder by hand, or give the server's account permission and create it again.
• Cannot change password warning: the service account wasn't allowed to change the new account's permissions. The account is created, but the user can still change their password.
• "Insufficient access rights": the service account configured for the domain doesn't have permission to create accounts in that OU, or to change that group. AD Pro Toolkit does all directory work as the service account, not as you.