New-ADUser: Access is Denied

When you you create a new Active Directory user via PowerShell with the New-ADUser cmdlet, you might receive an “Access is Denied” error even if your user account has sufficient permissions to perform this operation.

new-aduser-access-is-denied_001

 

Let’s verify that the permissions of our user account are sufficient to actually create a new user. We can quickly verify the group membership of a user with the Get-ADPrincipalGroupMembership cmdlet.

new-aduser-access-is-denied_002

 

Most probably you did not start your PowerShell as Administrator. You can right click the PowerShell shortcut and click “Run as Administrator”, or you can just start an elevated session directly from your current session with the Start-Process cmdlet and then using the Verb parameter.

new-aduser-access-is-denied_003

 

If we now retry the New-ADUser cmdlet, it works (the PassThru parameter is added here to directly show the output).

new-aduser-access-is-denied_004

Leave a Reply

Your email address will not be published. Required fields are marked *