You want to create a user object.
Open the Active Directory Users and Computers (ADUC) snap-in.
If you need to change domains, right-click on "Active Directory Users and Computers" in the left pane, select Connect to Domain, enter the domain name, and click OK.
In the left pane, browse to the parent container of the new user, right-click on it, and select New User.
Enter the values for the first name, last name, full name, and user logon name fields as appropriate and click Next.
Enter and confirm password, set any of the password flags, and click Next.
> dsadd user "<UserDN>" -upn <UserUPN> -fn "<UserFirstName>" -ln "<UserLastName>"[RETURN] -display "<UserDisplayName>" -pwd <UserPasswd>
' Taken from ADS_USER_FLAG_ENUM Const ADS_UF_NORMAL_ACCOUNT = 512 set objParent = GetObject("LDAP://<ParentDN>") set objUser = objParent.Create("user", "cn=<UserName>") ' e.g. joes objUser.Put "sAMAccountName", "<UserName>" ' e.g. joes objUser.Put "userPrincipalName", "<UserUPN>" ' e.g. email@example.com objUser.Put "givenName", "<UserFirstName>" ' e.g. Joe objUser.Put "sn", "<UserLastName>" ' e.g. Smith objUser.Put "displayName", "<UserFirstName> <UserLastName>" ' e.g. Joe Smith objUser.Put "userAccountControl", ADS_UF_NORMAL_ACCOUNT objUser.SetInfo objUser.SetPassword("<Password>") objUser.AccountDisabled = FALSE objUser.SetInfo
The only mandatory attribute that must be set when creating a user is sAMAccountName, which is the account name that is used to interoperate with down-level domains. To make the account immediately available for a user to use, you'll need to make sure the account is enabled, which is accomplished by setting userAccountControl to 512, and setting a password (see Recipe 6.17). If you allow UPN logons, you'll want to make sure the userPrincipalName attribute is set.
With Windows Server 2003, you can also create user accounts using the inetOrgPerson class, which is described in Recipe 6.3. inetOrgPerson objects can be used for user authentication and restricting access to resources in much the same way as user objects.
To set additional attributes, double-click on the user account after it has been created. There are several tabs to choose from that contain attributes that are grouped together based on function (e.g., Profile).
Several additional attributes can be set with the dsadd user command. Run dsadd user /? for the complete list.
Take a look at Recipe 6.24 for more information on the userAccountControl attribute and the various flags that can be set for it.
Recipe 6.2 for creating users in bulk, Recipe 6.3 for creating an inetOrgPerson user, and MSDN: ADS_USER_FLAG_ENUM