SERVER-017 · Script

Automate Employee Lifecycle

Processes a single CSV of new hires, role changes and departures in one run.

What it does

Each row has an Action column:

• Onboard: creates the account, sets details, adds groups, saves a random password (must change at sign-in)
• Change: updates title, department and manager, moves to a new OU, adds and removes groups

Offboard disables the account, records its groups, removes them (except the primary group), notes the date in the description and moves it to -DisabledOU Columns (leave cells blank to skip them): Action, SamAccountName, GivenName, Surname, TargetOU, Title, Department, Manager, Groups, RemoveGroups Groups and RemoveGroups hold one or more group names separated by semicolons. Preview mode (default) logs every step it would take. Apply makes the changes. New passwords go to the protected Runbookia Secure folder. A rollback CSV records each account's OU, groups, title, department and manager from before the run.

Requirements

Windows PowerShell 5.1 and the ActiveDirectory module (RSAT). Rights to create, change, move and disable users and change group membership.

How to run it

• Run as: a service account with the directory rights the script lists, or SYSTEM on a domain controller or the server being checked
• Run from: a domain-joined management server or admin workstation with the RSAT tools, as a scheduled task or from your management tool
• Script type: PowerShell 5.1, 64-bit
• User interaction: none; the script never prompts
• Timeout: 30 minutes for large directories or many servers

Settings

Exit codes

• 0 = All rows processed
• 1 = Some rows failed or had missing details
• 2 = Script error (see log)

Testing steps

1. Run it first with the mode set to Preview on one test OU, test account or test server. Nothing is changed in that mode.
2. Read the log and confirm the planned changes are what you expect.
3. Run your chosen settings on the same test target and confirm the result.
4. Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
5. Roll out to a small group next, then everyone.

Rollback steps

Preview mode changes nothing. The rollback CSV records each changed account's OU, groups, title, department and manager from before the run. New accounts can be deleted; offboarded accounts can be enabled, moved back and re-added to the listed groups.

Version and change log