Powershell to create admin users with RDP privileges (used in ignite23 for quick user adding )

add-users.ps1

function Check-UserExists {
    param([string]$username)
    net user | findstr $username
    $out=$?
    return $out
}

function CreateUser {
        param (
        [switch]$RDP,
        [switch]$LocalLogon,
        [switch]$Admin,
        [Parameter(Mandatory=$true)][string]$username="test-user",
        [string]$password="test-1234",
        [string]$fullname="Test User"
    )

    # Checking if user already exists
    if(Check-UserExists -username $username) {
        echo "[*] Username $username already exists! Skipping creation."
    }
    else {
        $ss_password = ConvertTo-SecureString $password -AsPlainText -Force
        echo "[+] Adding New User:"
        echo ">> Username: $username"
        echo ">> Password: $password"
        echo ">> FullName: $fullname"


        echo  "[*] Disabling Password Complexity..."
        # // Disable password complexity
        (secedit /export /cfg c:\secpol.cfg) | out-null
        (gc C:\secpol.cfg).replace("PasswordComplexity = 1", "PasswordComplexity = 0") | Out-File C:\secpol.cfg
        (secedit /configure /db c:\windows\security\local.sdb /cfg c:\secpol.cfg /areas SECURITYPOLICY) | out-null
        rm -force c:\secpol.cfg -confirm:$false
        # ==============================

        echo "[+] Adding user $username using New-LocalUser cmdlet"
        New-LocalUser $username -Password $ss_password -FullName $fullname
    }


    if($RDP) {
            Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -name "fDenyTSConnections" -value 0
            Enable-NetFirewallRule -DisplayGroup "Remote Desktop"
        echo "[+] Adding $username to RDP group"
        net localgroup "Remote Desktop Users" /add $username
        echo "[+] Completed."
    }

    if($LocalLogon) {
        echo "[+] Granting AllowLogonLocally permission to user $username"
        $tmp = [System.IO.Path]::GetTempFileName()
        (secedit.exe /export /cfg $tmp) | out-null
        $settings = Get-Content -Path $tmp
        $account = New-Object System.Security.Principal.NTAccount($username)  
        $sid = $account.Translate([System.Security.Principal.SecurityIdentifier])  
        for($i=0;$i -lt $settings.Count;$i++){  
            if($settings[$i] -match "SeInteractiveLogonRight")  
            {
                $settings[$i] += ",*$($sid.Value)"  
            }  
        }  
        $settings | Out-File $tmp  
        (secedit.exe /configure /db secedit.sdb /cfg $tmp  /areas User_RIGHTS) | out-null
        Remove-Item -Path $tmp
        (del secedit*) | out-null
        echo "[+] Completed."
    }

    if($Admin) {
        echo "[+] Granting Administrator privileges to user $username"
        net localgroup Administrators "$username" /add
    }
}

CreateUser -Username "abdullahzamir" -Password 'password' -FullName "AbdullahZamir" -LocalLogon -RDP -Admin
CreateUser -Username "mikivirus" -Password 'password' -FullName "Mikivirus" -LocalLogon -RDP -Admin
CreateUser -Username "theflash2k" -Password 'password' -FullName "TheFlash2k" -LocalLogon -RDP -Admin
CreateUser -Username "hash3lizer" -Password 'password' -FullName "Hash3lizer" -LocalLogon -RDP -Admin