# 0) Załaduj moduł i pobierz info o domenie
Import-Module ActiveDirectory
$Domain    = Get-ADDomain
$DomainDN  = $Domain.DistinguishedName      # np. DC=rol00,DC=edu,DC=pl
$DNSRoot   = $Domain.DNSRoot                # np. rol00.edu.pl
$Forest    = Get-ADForest
$UPNSuffix = if ($Forest.UPNSuffixes.Count -gt 0) { $Forest.UPNSuffixes[0] } else { $DNSRoot }

# 1) Ścieżki i serwer udziału (DOPASUJ do swojej nazwy serwera)
$OUName      = "Uczniowie"
$OUPath      = "OU=$OUName,$DomainDN"
$ServerShare = "\\rol\Profiles$"   # <-- zmień na właściwy

# 2) OU + grupa
if (-not (Get-ADOrganizationalUnit -Filter "Name -eq '$OUName'" -SearchBase $DomainDN -ErrorAction SilentlyContinue)) {
    New-ADOrganizationalUnit -Name $OUName -Path $DomainDN -ProtectedFromAccidentalDeletion $false -ErrorAction Stop
}
if (-not (Get-ADGroup -Filter "Name -eq '$OUName'" -SearchBase $OUPath -ErrorAction SilentlyContinue)) {
    New-ADGroup -Name $OUName -GroupScope Global -GroupCategory Security -Path $OUPath -Description "Grupa uczniów do ćwiczenia profilu wędrującego" -ErrorAction Stop
}

# 3) Użytkownicy (UPN z domeny)
$User1 = "klient10"; $UPN1 = "$User1@$UPNSuffix"; $Pass1 = ConvertTo-SecureString "zaq1@WSX" -AsPlainText -Force
if (-not (Get-ADUser -Filter "SamAccountName -eq '$User1'" -SearchBase $OUPath -ErrorAction SilentlyContinue)) {
    New-ADUser -Name $User1 -SamAccountName $User1 -UserPrincipalName $UPN1 -Path $OUPath -Enabled $true -AccountPassword $Pass1 -GivenName "Klient" -Surname "10" -DisplayName $User1 -ErrorAction Stop
}
Add-ADGroupMember -Identity $OUName -Members $User1 -ErrorAction SilentlyContinue

$User2 = "klient11"; $UPN2 = "$User2@$UPNSuffix"; $Pass2 = ConvertTo-SecureString "zaq1@WSX" -AsPlainText -Force
if (-not (Get-ADUser -Filter "SamAccountName -eq '$User2'" -SearchBase $OUPath -ErrorAction SilentlyContinue)) {
    New-ADUser -Name $User2 -SamAccountName $User2 -UserPrincipalName $UPN2 -Path $OUPath -Enabled $true -AccountPassword $Pass2 -GivenName "Klient" -Surname "11" -DisplayName $User2 -ErrorAction Stop
}
Add-ADGroupMember -Identity $OUName -Members $User2 -ErrorAction SilentlyContinue

# 4) (opcjonalnie) Home Folder dla klient10
Set-ADUser -Identity $User1 -HomeDirectory (Join-Path $ServerShare $User1) -HomeDrive "H:" -ErrorAction SilentlyContinue

# 5) Weryfikacja
Get-ADUser -Identity $User1 -Properties * | Select SamAccountName,Enabled,HomeDirectory,HomeDrive,UserPrincipalName,CanonicalName
Get-ADUser -Identity $User2 -Properties * | Select SamAccountName,Enabled,UserPrincipalName,CanonicalName
Get-ADGroupMember -Identity $OUName | Select Name,SamAccountName,objectClass
Get-ADGroup -Identity Uczniowie | Select Name,GroupScope,GroupCategory,DistinguishedName