1# Windows 10/11 - Install RSAT
2Add-WindowsCapability -Online -Name Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0
3
4# Windows Server - Already installed
5Import-Module ActiveDirectory
6
7# Verify installation
8Get-Module -ListAvailable ActiveDirectory

1# Import the module
2Import-Module ActiveDirectory
3
4# Test connectivity
5Get-ADDomain
6
7# Set up credential (if managing remotely)
8$credential = Get-Credential

1# Check current policy
2Get-ExecutionPolicy
3
4# Set policy (run as Administrator)
5Set-ExecutionPolicy RemoteSigned -Scope CurrentUser

1function New-ADUserAccount {
2    <#
3    .SYNOPSIS
4        Create a new Active Directory user account with standard settings.
5    
6    .DESCRIPTION
7        Creates an AD user with proper naming conventions, group memberships,
8        and organizational unit placement.
9    
10    .PARAMETER FirstName
11        User's first name
12    
13    .PARAMETER LastName
14        User's last name
15    
16    .PARAMETER Department
17        Department name (used for OU placement and groups)
18    
19    .PARAMETER Title
20        Job title
21    
22    .PARAMETER Manager
23        Manager's username (samAccountName)
24    
25    .EXAMPLE
26        New-ADUserAccount -FirstName "John" -LastName "Smith" -Department "IT" -Title "System Administrator"
27    #>
28    
29    [CmdletBinding()]
30    param(
31        [Parameter(Mandatory=$true)]
32        [string]$FirstName,
33        
34        [Parameter(Mandatory=$true)]
35        [string]$LastName,
36        
37        [Parameter(Mandatory=$true)]
38        [string]$Department,
39        
40        [Parameter(Mandatory=$false)]
41        [string]$Title,
42        
43        [Parameter(Mandatory=$false)]
44        [string]$Manager
45    )
46    
47    # Generate username (first.last format)
48    $username = "$($FirstName.ToLower()).$($LastName.ToLower())"
49    
50    # Check if username exists, append number if needed
51    $counter = 1
52    $baseUsername = $username
53    while (Get-ADUser -Filter "samAccountName -eq '$username'" -ErrorAction SilentlyContinue) {
54        $counter++
55        $username = "$baseUsername$counter"
56    }
57    
58    # Generate email address
59    $domain = (Get-ADDomain).DNSRoot
60    $email = "$username@$domain"
61    
62    # Set display name
63    $displayName = "$FirstName $LastName"
64    
65    # Determine OU based on department
66    $departmentOU = "OU=$Department,OU=Users,DC=" + ($domain -replace '\.',',DC=')
67    
68    # Ensure OU exists
69    try {
70        Get-ADOrganizationalUnit -Identity $departmentOU -ErrorAction Stop | Out-Null
71    }
72    catch {
73        Write-Warning "Department OU doesn't exist: $departmentOU. Using default Users container."
74        $departmentOU = "CN=Users,DC=" + ($domain -replace '\.',',DC=')
75    }
76    
77    # Generate temporary password
78    $tempPassword = -join ((65..90) + (97..122) + (48..57) | Get-Random -Count 12 | ForEach-Object {[char]$_})
79    $securePassword = ConvertTo-SecureString $tempPassword -AsPlainText -Force
80    
81    # Create user account
82    try {
83        $params = @{
84            Name                  = $displayName
85            GivenName            = $FirstName
86            Surname              = $LastName
87            SamAccountName       = $username
88            UserPrincipalName    = $email
89            EmailAddress         = $email
90            DisplayName          = $displayName
91            Title                = $Title
92            Department           = $Department
93            Path                 = $departmentOU
94            AccountPassword      = $securePassword
95            Enabled              = $true
96            ChangePasswordAtLogon = $true
97        }
98        
99        # Add manager if specified
100        if ($Manager) {
101            $managerDN = (Get-ADUser -Identity $Manager).DistinguishedName
102            $params.Add('Manager', $managerDN)
103        }
104        
105        New-ADUser @params
106        
107        Write-Host "✓ User created successfully" -ForegroundColor Green
108        Write-Host "  Username: $username"
109        Write-Host "  Email: $email"
110        Write-Host "  Temporary Password: $tempPassword" -ForegroundColor Yellow
111        Write-Host "  (User must change password at first logon)"
112        
113        # Return user info
114        return @{
115            Username = $username
116            Email = $email
117            Password = $tempPassword
118            DisplayName = $displayName
119        }
120    }
121    catch {
122        Write-Error "Failed to create user: $_"
123        return $null
124    }
125}
126
127# Usage example
128New-ADUserAccount -FirstName "Jane" -LastName "Doe" -Department "Marketing" -Title "Marketing Manager"

1function Import-ADUsersFromCSV {
2    <#
3    .SYNOPSIS
4        Create multiple AD users from CSV file.
5    
6    .DESCRIPTION
7        Reads user data from CSV and creates AD accounts in bulk.
8        CSV should have columns: FirstName, LastName, Department, Title, Manager
9    
10    .PARAMETER CSVPath
11        Path to CSV file containing user data
12    
13    .PARAMETER LogPath
14        Path for log file with results (optional)
15    
16    .EXAMPLE
17        Import-ADUsersFromCSV -CSVPath "C:\NewUsers.csv" -LogPath "C:\UserCreation.log"
18    #>
19    
20    [CmdletBinding()]
21    param(
22        [Parameter(Mandatory=$true)]
23        [string]$CSVPath,
24        
25        [Parameter(Mandatory=$false)]
26        [string]$LogPath = ".\UserCreation_$(Get-Date -Format 'yyyyMMdd_HHmmss').log"
27    )
28    
29    # Verify CSV exists
30    if (-not (Test-Path $CSVPath)) {
31        Write-Error "CSV file not found: $CSVPath"
32        return
33    }
34    
35    # Import CSV
36    $users = Import-Csv -Path $CSVPath
37    
38    Write-Host "`nProcessing $($users.Count) user(s)..." -ForegroundColor Cyan
39    
40    $results = @()
41    
42    foreach ($user in $users) {
43        Write-Host "`nCreating user: $($user.FirstName) $($user.LastName)"
44        
45        $params = @{
46            FirstName  = $user.FirstName
47            LastName   = $user.LastName
48            Department = $user.Department
49            Title      = $user.Title
50        }
51        
52        if ($user.Manager) {
53            $params.Add('Manager', $user.Manager)
54        }
55        
56        $result = New-ADUserAccount @params
57        
58        if ($result) {
59            $results += [PSCustomObject]@{
60                Name     = "$($user.FirstName) $($user.LastName)"
61                Username = $result.Username
62                Email    = $result.Email
63                Password = $result.Password
64                Status   = "Success"
65            }
66        }
67        else {
68            $results += [PSCustomObject]@{
69                Name     = "$($user.FirstName) $($user.LastName)"
70                Username = "N/A"
71                Email    = "N/A"
72                Password = "N/A"
73                Status   = "Failed"
74            }
75        }
76    }
77    
78    # Export results
79    $results | Export-Csv -Path $LogPath -NoTypeInformation
80    
81    Write-Host "`n" + "="*50
82    Write-Host "SUMMARY" -ForegroundColor Cyan
83    Write-Host "="*50
84    Write-Host "Total Users: $($results.Count)"
85    Write-Host "Successful: $($results | Where-Object Status -eq 'Success' | Measure-Object | Select-Object -ExpandProperty Count)" -ForegroundColor Green
86    Write-Host "Failed: $($results | Where-Object Status -eq 'Failed' | Measure-Object | Select-Object -ExpandProperty Count)" -ForegroundColor Red
87    Write-Host "Log file: $LogPath"
88}
89
90# Usage
91Import-ADUsersFromCSV -CSVPath "C:\NewUsers.csv"

1FirstName,LastName,Department,Title,Manager
2John,Smith,IT,System Administrator,admin.user
3Jane,Doe,Marketing,Marketing Manager,marketing.director
4Bob,Johnson,Sales,Sales Representative,sales.manager

1function Disable-ADUserAccount {
2    <#
3    .SYNOPSIS
4        Disable user account and perform offboarding tasks.
5    
6    .DESCRIPTION
7        Disables AD account, removes group memberships (except Domain Users),
8        moves to disabled OU, and sets description with termination date.
9    
10    .PARAMETER Username
11        samAccountName of user to disable
12    
13    .PARAMETER RemoveGroups
14        Remove all group memberships except Domain Users
15    
16    .EXAMPLE
17        Disable-ADUserAccount -Username "john.smith" -RemoveGroups
18    #>
19    
20    [CmdletBinding()]
21    param(
22        [Parameter(Mandatory=$true)]
23        [string]$Username,
24        
25        [Parameter(Mandatory=$false)]
26        [switch]$RemoveGroups
27    )
28    
29    try {
30        # Get user
31        $user = Get-ADUser -Identity $Username -Properties MemberOf, Description
32        
33        Write-Host "`nOffboarding user: $($user.Name)" -ForegroundColor Yellow
34        
35        # Disable account
36        Disable-ADAccount -Identity $Username
37        Write-Host "  ✓ Account disabled" -ForegroundColor Green
38        
39        # Update description with termination date
40        $description = "Disabled on $(Get-Date -Format 'yyyy-MM-dd'). " + $user.Description
41        Set-ADUser -Identity $Username -Description $description
42        Write-Host "  ✓ Description updated" -ForegroundColor Green
43        
44        # Remove group memberships
45        if ($RemoveGroups) {
46            $groups = $user.MemberOf | Where-Object { $_ -notlike "*Domain Users*" }
47            
48            if ($groups) {
49                foreach ($group in $groups) {
50                    Remove-ADGroupMember -Identity $group -Members $Username -Confirm:$false
51                }
52                Write-Host "  ✓ Removed from $($groups.Count) group(s)" -ForegroundColor Green
53            }
54        }
55        
56        # Move to Disabled Users OU
57        $domain = (Get-ADDomain).DNSRoot
58        $disabledOU = "OU=Disabled Users,DC=" + ($domain -replace '\.',',DC=')
59        
60        # Create OU if it doesn't exist
61        try {
62            Get-ADOrganizationalUnit -Identity $disabledOU -ErrorAction Stop | Out-Null
63        }
64        catch {
65            # Create OU
66            $dcComponents = $domain -split '\.'
67            $parentDN = "DC=" + ($dcComponents -join ',DC=')
68            New-ADOrganizationalUnit -Name "Disabled Users" -Path $parentDN
69            Write-Host "  ✓ Created Disabled Users OU" -ForegroundColor Green
70        }
71        
72        Move-ADObject -Identity $user.DistinguishedName -TargetPath $disabledOU
73        Write-Host "  ✓ Moved to Disabled Users OU" -ForegroundColor Green
74        
75        Write-Host "`nOffboarding complete!" -ForegroundColor Green
76    }
77    catch {
78        Write-Error "Failed to offboard user: $_"
79    }
80}
81
82# Usage
83Disable-ADUserAccount -Username "john.smith" -RemoveGroups

1function Reset-ADUserPasswordSafe {
2    <#
3    .SYNOPSIS
4        Reset user password with secure random generation.
5    
6    .DESCRIPTION
7        Generates secure random password, resets user password,
8        and optionally emails user with new credentials.
9    
10    .PARAMETER Username
11        samAccountName of user
12    
13    .PARAMETER SendEmail
14        Email new password to user's email address
15    
16    .EXAMPLE
17        Reset-ADUserPasswordSafe -Username "john.smith" -SendEmail
18    #>
19    
20    [CmdletBinding()]
21    param(
22        [Parameter(Mandatory=$true)]
23        [string]$Username,
24        
25        [Parameter(Mandatory=$false)]
26        [switch]$SendEmail
27    )
28    
29    try {
30        # Get user
31        $user = Get-ADUser -Identity $Username -Properties EmailAddress
32        
33        # Generate secure password (12 characters, mixed case, numbers, symbols)
34        Add-Type -AssemblyName 'System.Web'
35        $newPassword = [System.Web.Security.Membership]::GeneratePassword(12, 3)
36        $securePassword = ConvertTo-SecureString $newPassword -AsPlainText -Force
37        
38        # Reset password
39        Set-ADAccountPassword -Identity $Username -NewPassword $securePassword -Reset
40        Set-ADUser -Identity $Username -ChangePasswordAtLogon $true
41        
42        # Unlock account if locked
43        Unlock-ADAccount -Identity $Username
44        
45        Write-Host "✓ Password reset successfully" -ForegroundColor Green
46        Write-Host "  Username: $Username"
47        Write-Host "  New Password: $newPassword" -ForegroundColor Yellow
48        Write-Host "  User must change password at next logon"
49        
50        # Optionally send email
51        if ($SendEmail -and $user.EmailAddress) {
52            # Email logic here (requires mail server configuration)
53            Write-Host "  ✓ Email sent to: $($user.EmailAddress)" -ForegroundColor Green
54        }
55        
56        return $newPassword
57    }
58    catch {
59        Write-Error "Failed to reset password: $_"
60        return $null
61    }
62}
63
64# Unlock account without resetting password
65function Unlock-ADUserAccount {
66    param([string]$Username)
67    
68    try {
69        Unlock-ADAccount -Identity $Username
70        Write-Host "✓ Account unlocked: $Username" -ForegroundColor Green
71    }
72    catch {
73        Write-Error "Failed to unlock account: $_"
74    }
75}
76
77# Usage
78Reset-ADUserPasswordSafe -Username "john.smith" -SendEmail

1function Add-ADUserToGroups {
2    <#
3    .SYNOPSIS
4        Add user to multiple AD groups.
5    
6    .PARAMETER Username
7        samAccountName of user
8    
9    .PARAMETER Groups
10        Array of group names
11    
12    .EXAMPLE
13        Add-ADUserToGroups -Username "john.smith" -Groups @("VPN Users", "Marketing Team", "Office 365 Users")
14    #>
15    
16    [CmdletBinding()]
17    param(
18        [Parameter(Mandatory=$true)]
19        [string]$Username,
20        
21        [Parameter(Mandatory=$true)]
22        [string[]]$Groups
23    )
24    
25    $user = Get-ADUser -Identity $Username
26    Write-Host "`nAdding $($user.Name) to groups..." -ForegroundColor Cyan
27    
28    foreach ($group in $Groups) {
29        try {
30            Add-ADGroupMember -Identity $group -Members $Username
31            Write-Host "  ✓ Added to: $group" -ForegroundColor Green
32        }
33        catch {
34            Write-Host "  ✗ Failed to add to: $group - $_" -ForegroundColor Red
35        }
36    }
37}
38
39function Get-ADUserGroupMembership {
40    <#
41    .SYNOPSIS
42        List all groups a user belongs to.
43    
44    .PARAMETER Username
45        samAccountName of user
46    
47    .EXAMPLE
48        Get-ADUserGroupMembership -Username "john.smith"
49    #>
50    
51    param([string]$Username)
52    
53    $user = Get-ADUser -Identity $Username -Properties MemberOf
54    $groups = $user.MemberOf | ForEach-Object {
55        (Get-ADGroup $_).Name
56    } | Sort-Object
57    
58    Write-Host "`nGroups for $($user.Name):" -ForegroundColor Cyan
59    $groups | ForEach-Object { Write-Host "  - $_" }
60    
61    return $groups
62}
63
64# Copy group memberships from one user to another
65function Copy-ADUserGroupMembership {
66    param(
67        [string]$SourceUser,
68        [string]$TargetUser
69    )
70    
71    $sourceGroups = Get-ADUser -Identity $SourceUser -Properties MemberOf | 
72                    Select-Object -ExpandProperty MemberOf
73    
74    Write-Host "Copying group memberships from $SourceUser to $TargetUser..." -ForegroundColor Cyan
75    
76    foreach ($group in $sourceGroups) {
77        try {
78            Add-ADGroupMember -Identity $group -Members $TargetUser
79            $groupName = (Get-ADGroup $group).Name
80            Write-Host "  ✓ Added to: $groupName" -ForegroundColor Green
81        }
82        catch {
83            Write-Host "  ✗ Failed: $group" -ForegroundColor Red
84        }
85    }
86}
87
88# Usage
89Add-ADUserToGroups -Username "john.smith" -Groups @("VPN Users", "Marketing Team")
90Get-ADUserGroupMembership -Username "john.smith"
91Copy-ADUserGroupMembership -SourceUser "existing.user" -TargetUser "new.user"

1function Get-ADInactiveUsers {
2    <#
3    .SYNOPSIS
4        Find inactive user accounts.
5    
6    .PARAMETER Days
7        Number of days of inactivity
8    
9    .EXAMPLE
10        Get-ADInactiveUsers -Days 90
11    #>
12    
13    param(
14        [int]$Days = 90
15    )
16    
17    $cutoffDate = (Get-Date).AddDays(-$Days)
18    
19    $inactiveUsers = Get-ADUser -Filter {
20        Enabled -eq $true -and LastLogonDate -lt $cutoffDate
21    } -Properties LastLogonDate, Department, Title, Manager |
22    Select-Object Name, SamAccountName, LastLogonDate, Department, Title, @{
23        Name='DaysInactive'
24        Expression={ ((Get-Date) - $_.LastLogonDate).Days }
25    } |
26    Sort-Object DaysInactive -Descending
27    
28    Write-Host "`nFound $($inactiveUsers.Count) inactive user(s) (no login in $Days days)" -ForegroundColor Yellow
29    
30    return $inactiveUsers
31}
32
33function Get-ADUsersPasswordExpiringSoon {
34    <#
35    .SYNOPSIS
36        Find users whose passwords are expiring soon.
37    
38    .PARAMETER Days
39        Number of days until expiration
40    #>
41    
42    param([int]$Days = 14)
43    
44    $maxPasswordAge = (Get-ADDefaultDomainPasswordPolicy).MaxPasswordAge.Days
45    $cutoffDate = (Get-Date).AddDays($Days)
46    
47    $users = Get-ADUser -Filter {Enabled -eq $true} -Properties PasswordLastSet, EmailAddress |
48    ForEach-Object {
49        $expiryDate = $_.PasswordLastSet.AddDays($maxPasswordAge)
50        
51        if ($expiryDate -lt $cutoffDate -and $expiryDate -gt (Get-Date)) {
52            [PSCustomObject]@{
53                Name           = $_.Name
54                Username       = $_.SamAccountName
55                Email          = $_.EmailAddress
56                ExpiryDate     = $expiryDate
57                DaysUntilExpiry = ($expiryDate - (Get-Date)).Days
58            }
59        }
60    } | Sort-Object DaysUntilExpiry
61    
62    Write-Host "`n$($users.Count) user(s) with passwords expiring in next $Days days:" -ForegroundColor Yellow
63    
64    return $users
65}
66
67function Get-ADAdminAccounts {
68    <#
69    .SYNOPSIS
70        List all administrative accounts.
71    #>
72    
73    $adminGroups = @(
74        'Domain Admins',
75        'Enterprise Admins',
76        'Schema Admins',
77        'Administrators'
78    )
79    
80    $admins = @()
81    
82    foreach ($group in $adminGroups) {
83        $members = Get-ADGroupMember -Identity $group -Recursive |
84                   Where-Object objectClass -eq 'user'
85        
86        foreach ($member in $members) {
87            $user = Get-ADUser -Identity $member -Properties LastLogonDate, PasswordLastSet
88            
89            $admins += [PSCustomObject]@{
90                GroupName        = $group
91                Name             = $user.Name
92                Username         = $user.SamAccountName
93                Enabled          = $user.Enabled
94                LastLogon        = $user.LastLogonDate
95                PasswordLastSet  = $user.PasswordLastSet
96            }
97        }
98    }
99    
100    return $admins | Sort-Object GroupName, Name
101}
102
103# Generate comprehensive security report
104function Export-ADSecurityReport {
105    param([string]$OutputPath = ".\AD_Security_Report_$(Get-Date -Format 'yyyyMMdd').csv")
106    
107    Write-Host "Generating AD Security Report..." -ForegroundColor Cyan
108    
109    Write-Host "  Checking inactive accounts..."
110    $inactive = Get-ADInactiveUsers -Days 90
111    
112    Write-Host "  Checking expiring passwords..."
113    $expiring = Get-ADUsersPasswordExpiringSoon -Days 14
114    
115    Write-Host "  Checking admin accounts..."
116    $admins = Get-ADAdminAccounts
117    
118    Write-Host "  Checking accounts with non-expiring passwords..."
119    $noExpiry = Get-ADUser -Filter {PasswordNeverExpires -eq $true -and Enabled -eq $true} |
120                Select-Object Name, SamAccountName
121    
122    # Compile report
123    $report = @{
124        'Inactive_Users' = $inactive
125        'Password_Expiring' = $expiring
126        'Admin_Accounts' = $admins
127        'Password_Never_Expires' = $noExpiry
128    }
129    
130    # Export each section
131    foreach ($section in $report.Keys) {
132        $sectionPath = $OutputPath -replace '\.csv$', "_$section.csv"
133        $report[$section] | Export-Csv -Path $sectionPath -NoTypeInformation
134        Write-Host "  ✓ Exported: $sectionPath" -ForegroundColor Green
135    }
136    
137    Write-Host "`nSecurity report complete!" -ForegroundColor Green
138}
139
140# Usage
141Get-ADInactiveUsers -Days 90 | Format-Table
142Get-ADUsersPasswordExpiringSoon -Days 14 | Format-Table
143Export-ADSecurityReport

1# Use -WhatIf parameter to preview changes
2New-ADUser -Name "Test User" -WhatIf
3
4# Use -Confirm to prompt before each action
5Remove-ADUser -Identity "test.user" -Confirm

1function Write-ADLog {
2    param(
3        [string]$Message,
4        [string]$LogPath = "C:\Logs\ADAutomation.log"
5    )
6    
7    $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
8    $logEntry = "[$timestamp] $Message"
9    Add-Content -Path $LogPath -Value $logEntry
10}
11
12# Usage in scripts
13Write-ADLog "Created user: john.smith"

1try {
2    New-ADUser -Name "John Smith" -SamAccountName "john.smith" -ErrorAction Stop
3    Write-ADLog "SUCCESS: Created user john.smith"
4}
5catch {
6    Write-ADLog "ERROR: Failed to create user - $_"
7    Send-AlertEmail -Subject "AD Automation Error" -Body $_.Exception.Message
8}

1function Remove-ADUserWithApproval {
2    param([string]$Username)
3    
4    Write-Host "WARNING: You are about to DELETE user: $Username" -ForegroundColor Red
5    $confirmation = Read-Host "Type 'DELETE' to confirm"
6    
7    if ($confirmation -eq 'DELETE') {
8        Remove-ADUser -Identity $Username -Confirm:$false
9        Write-ADLog "User deleted: $Username by $env:USERNAME"
10    }
11    else {
12        Write-Host "Operation cancelled" -ForegroundColor Yellow
13    }
14}

1# Create scheduled task for daily security report
2$action = New-ScheduledTaskAction -Execute 'PowerShell.exe' `
3    -Argument '-File "C:\Scripts\Export-ADSecurityReport.ps1"'
4
5$trigger = New-ScheduledTaskTrigger -Daily -At 8am
6
7$principal = New-ScheduledTaskPrincipal -UserId "DOMAIN\ServiceAccount" `
8    -LogonType Password -RunLevel Highest
9
10Register-ScheduledTask -TaskName "AD Security Report" `
11    -Action $action -Trigger $trigger -Principal $principal