WIN-014 · Script

Directory User Lifecycle Automation

Creates, updates, disables, or moves directory user accounts from a CSV file, with a report-first default.

What it does

Reads one CSV row per account change and runs it against Active Directory with the built-in ActiveDirectory PowerShell module. Run it from a domain-joined server or admin workstation with the RSAT Active Directory tools installed, under an account that has rights to manage the users and OUs involved.

CSV columns (header names are not case sensitive):

• Action: Create, Update, Disable or Move (required)

SamAccountName Sign-in name, for example jsmith (required) GivenName, Surname, DisplayName, UserPrincipalName, Email, Department, Title,

• Description, EmployeeID: Optional account details used by Create and Update
• OU: Distinguished name of the OU for Create, for example OU=Staff,DC=school,DC=local
• TargetOU: Distinguished name of the destination OU for Move (and Disable with a move)
• Groups: Group names to add on Create or Update, separated by semicolons

Report mode (default) checks every row (does the user exist, do the OUs and groups exist) and logs exactly what Apply would do. Apply makes the changes and writes a rollback CSV with each account's previous OU, enabled state, description and group list.

Create sets a random password from a cryptographic source and saves new passwords only to a CSV under C:\ProgramData\Runbookia\Secure, a folder that only SYSTEM and Administrators can read. Passwords are never written to the log. New users must change the password at first sign-in unless -NoChangePasswordAtLogon is used. Disable turns the account off and adds the date to the description, and with -RemoveGroups also removes group memberships (recorded for rollback). Nothing is ever deleted. Runs silently with no prompts.

Requirements

Windows PowerShell 5.1 and the ActiveDirectory module (RSAT). Rights to create, edit, disable and move the users involved.

How to run it

• Run as: SYSTEM or a local administrator
• Run from: any RMM or MDM, Intune, a Group Policy startup script, a scheduled task, or an elevated PowerShell window
• Script type: PowerShell, 64-bit
• User interaction: none; the script never prompts
• Timeout: 10 minutes (30 for Windows Update installs)

Settings

Exit codes

• 0 = All rows valid (Report) or all changes done (Apply)
• 1 = One or more rows have problems or failed
• 2 = Script error

Testing steps

1. Run it first with the mode set to Report on one test device. Nothing is changed in that mode.
2. Read the log and confirm the planned changes are what you expect.
3. Run your chosen settings on the same test target and confirm the result.
4. Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
5. Roll out to a small group next, then everyone.

Rollback steps

Apply writes a rollback CSV with each account's previous OU, enabled state, description and groups. Re-enable with Enable-ADAccount, restore the description, add the groups back and move the account to PreviousOU. New accounts can be disabled or deleted in Active Directory Users and Computers. Nothing is deleted by the script.

Version and change log