New-ADUser: Access is Denied
When you you create a new Active Directory user via PowerShell with the New-ADUser cmdlet, you might receive an “Access is Denied” error even if your user account has sufficient permissions to perform this operation.
Let’s verify that the permissions of our user account are sufficient to actually create a new user. We can quickly verify the group membership of a user with the Get-ADPrincipalGroupMembership cmdlet.
Most probably you did not start your PowerShell as Administrator. You can right click the PowerShell shortcut and click “Run as Administrator”, or you can just start an elevated session directly from your current session with the Start-Process cmdlet and then using the Verb parameter.
If we now retry the New-ADUser cmdlet, it works (the PassThru parameter is added here to directly show the output).