diff --git a/scripts/powershell/create_user.ps1 b/scripts/powershell/create_user.ps1
new file mode 100644
index 0000000..ee2216c
--- /dev/null
+++ b/scripts/powershell/create_user.ps1
@@ -0,0 +1,86 @@
+param(
+ [Parameter(Mandatory=$true)]
+ [string]$InputFile
+)
+
+# Read input JSON
+try {
+ $json = Get-Content -Raw -Path $InputFile -ErrorAction Stop
+ $payload = $json | ConvertFrom-Json
+} catch {
+ $err = $_.Exception.Message
+ Write-Output (@{ success = $false; message = "Failed to read/parse input JSON: $err" } | ConvertTo-Json -Compress)
+ exit 1
+}
+
+# Default result
+$result = @{ success = $false; message = "Unspecified error" }
+
+# Validate
+if (-not $payload.samaccountname -or -not $payload.password) {
+ $result.message = "Required fields: samaccountname and password"
+ Write-Output ($result | ConvertTo-Json -Compress)
+ exit 1
+}
+
+# Convert to strings
+$sam = [string]$payload.samaccountname
+$display = [string]($payload.displayname)
+$mail = [string]($payload.mail)
+$pass = [string]$payload.password
+$ou = [string]($payload.ou)
+$groups = [string]($payload.groups)
+$dryRun = [bool]($payload.dry_run -as [bool])
+
+# Ensure ActiveDirectory module available
+try {
+ Import-Module ActiveDirectory -ErrorAction Stop
+} catch {
+ $result.message = "ActiveDirectory PowerShell module not available: $($_.Exception.Message)"
+ Write-Output ($result | ConvertTo-Json -Compress)
+ exit 1
+}
+
+# Build New-ADUser parameters
+$props = @{
+ Name = if ($display -and $display -ne '') { $display } else { $sam }
+ SamAccountName = $sam
+ Enabled = $true
+}
+
+if ($mail -and $mail -ne '') { $props['EmailAddress'] = $mail }
+if ($ou -and $ou -ne '') { $props['Path'] = $ou }
+
+# Build secure password
+$securePass = ConvertTo-SecureString $pass -AsPlainText -Force
+$props['AccountPassword'] = $securePass
+
+# Execute
+if ($dryRun) {
+ $result.success = $true
+ $result.message = "DRY RUN: would create user $sam"
+ Write-Output ($result | ConvertTo-Json -Compress)
+ exit 0
+}
+
+try {
+ # Create the AD user
+ New-ADUser @props -ErrorAction Stop
+
+ # Add to groups, if provided
+ if ($groups -and $groups -ne '') {
+ $groupList = $groups -split ',' | ForEach-Object { $_.Trim() } | Where-Object { $_ -ne '' }
+ foreach ($g in $groupList) {
+ Add-ADGroupMember -Identity $g -Members $sam -ErrorAction Stop
+ }
+ }
+
+ $result.success = $true
+ $result.message = "User $sam created successfully"
+ Write-Output ($result | ConvertTo-Json -Compress)
+ exit 0
+} catch {
+ $result.message = "Error creating user $sam: $($_.Exception.Message)"
+ Write-Output ($result | ConvertTo-Json -Compress)
+ exit 1
+}
diff --git a/scripts/powershell/create_users_csv.ps1 b/scripts/powershell/create_users_csv.ps1
new file mode 100644
index 0000000..66912c7
--- /dev/null
+++ b/scripts/powershell/create_users_csv.ps1
@@ -0,0 +1,97 @@
+param(
+ [Parameter(Mandatory=$true)]
+ [string]$InputFile
+)
+
+# Read meta JSON
+try {
+ $json = Get-Content -Raw -Path $InputFile -ErrorAction Stop
+ $meta = $json | ConvertFrom-Json
+} catch {
+ Write-Output (@{ success = $false; message = "Failed to read/parse meta JSON: $($_.Exception.Message)" } | ConvertTo-Json -Compress)
+ exit 1
+}
+
+$csvFile = [string]$meta.input_file
+$delimiter = [string]($meta.delimiter ?? ',')
+$hasHeader = [bool]($meta.has_header -as [bool])
+$dryRun = [bool]($meta.dry_run -as [bool])
+
+if (-not (Test-Path -Path $csvFile)) {
+ Write-Output (@{ success = $false; message = "CSV file not found: $csvFile" } | ConvertTo-Json -Compress)
+ exit 1
+}
+
+# Ensure ActiveDirectory module is available
+try {
+ Import-Module ActiveDirectory -ErrorAction Stop
+} catch {
+ Write-Output (@{ success = $false; message = "ActiveDirectory PowerShell module not available: $($_.Exception.Message)" } | ConvertTo-Json -Compress)
+ exit 1
+}
+
+# Read CSV
+try {
+ if ($hasHeader) {
+ $items = Import-Csv -Path $csvFile -Delimiter $delimiter -ErrorAction Stop
+ } else {
+ # Use default headers
+ $headers = 'samaccountname','displayname','mail','password','ou','groups'
+ $items = Import-Csv -Path $csvFile -Delimiter $delimiter -Header $headers -ErrorAction Stop
+ }
+} catch {
+ Write-Output (@{ success = $false; message = "Failed to parse CSV: $($_.Exception.Message)" } | ConvertTo-Json -Compress)
+ exit 1
+}
+
+$results = @()
+$successCount = 0
+$failCount = 0
+
+foreach ($row in $items) {
+ $sam = $row.samaccountname
+ $display = $row.displayname
+ $mail = $row.mail
+ $pass = $row.password
+ $ou = $row.ou
+ $groups = $row.groups
+
+ if ([string]::IsNullOrWhiteSpace($sam) -or [string]::IsNullOrWhiteSpace($pass)) {
+ $results += @{ sam = $sam; success = $false; message = 'Missing samaccountname or password' }
+ $failCount++
+ continue
+ }
+
+ if ($dryRun) {
+ $results += @{ sam = $sam; success = $true; message = 'DRY RUN: would create' }
+ $successCount++
+ continue
+ }
+
+ try {
+ $props = @{ Name = if ($display -and $display -ne '') { $display } else { $sam }; SamAccountName = $sam; Enabled = $true }
+ if ($mail -and $mail -ne '') { $props['EmailAddress'] = $mail }
+ if ($ou -and $ou -ne '') { $props['Path'] = $ou }
+ $securePass = ConvertTo-SecureString $pass -AsPlainText -Force
+ $props['AccountPassword'] = $securePass
+
+ New-ADUser @props -ErrorAction Stop
+
+ if ($groups -and $groups -ne '') {
+ $groupList = $groups -split ',' | ForEach-Object { $_.Trim() } | Where-Object { $_ -ne '' }
+ foreach ($g in $groupList) {
+ Add-ADGroupMember -Identity $g -Members $sam -ErrorAction Stop
+ }
+ }
+
+ $results += @{ sam = $sam; success = $true; message = 'Created' }
+ $successCount++
+ } catch {
+ $results += @{ sam = $sam; success = $false; message = $_.Exception.Message }
+ $failCount++
+ }
+}
+
+$output = @{ success = $failCount -eq 0; message = "Created $successCount users, $failCount failures"; details = $results }
+Write-Output ($output | ConvertTo-Json -Compress)
+exit 0