Overview

Manual account audits can become slow and inconsistent as user volume grows. This script automates account review by collecting core identity fields, applying audit checks, and exporting a clean report for follow up.

Real-world relevance: Routine identity audits help reduce risk from stale credentials, weak account hygiene, and policy drift. This process supports least privilege and audit readiness.

Objective

• Identify user accounts that have not logged in within the last 90 days
• Flag accounts with passwords that have never been set or have expired
• Capture account status, last logon date, and password policy flags
• Export findings to a CSV for IT and compliance team review

Script Walkthrough

1. Imported the Active Directory PowerShell module and defined a 90 day inactivity threshold.
2. Queried enabled user accounts with Get-ADUser and requested relevant identity properties.
3. Calculated days since last logon for each account and compared results against the threshold.
4. Collected accounts that matched inactivity or password policy exceptions.
5. Exported results to a timestamped CSV for review, documentation, and remediation tracking.

Script Preview

# Automation Lab 1 - PowerShell User Account Audit
# Queries Active Directory for inactive or non-compliant user accounts

Import-Module ActiveDirectory

$DaysInactive = 90
$CutoffDate   = (Get-Date).AddDays(-$DaysInactive)
$Timestamp    = Get-Date -Format "yyyy-MM-dd"
$OutputFile   = ".\UserAuditReport_$Timestamp.csv"

$Results = Get-ADUser -Filter {Enabled -eq $true} -Properties `
    DisplayName, SamAccountName, LastLogonDate, `
    PasswordNeverExpires, PasswordLastSet, PasswordExpired |
Where-Object {
    ($_.LastLogonDate -lt $CutoffDate -or $_.LastLogonDate -eq $null) -or
    $_.PasswordNeverExpires -eq $true -or
    $_.PasswordExpired -eq $true
} |
Select-Object DisplayName, SamAccountName, LastLogonDate,
    PasswordNeverExpires, PasswordLastSet, PasswordExpired

$Results | Export-Csv -Path $OutputFile -NoTypeInformation -Encoding UTF8

Write-Host "Audit complete. $($Results.Count) accounts flagged."
Write-Host "Report saved to: $OutputFile"