Automation Lab 1: PowerShell User Account Audit

PowerShell User Account Audit

This lab is a PowerShell script that checks Active Directory for old or risky user accounts and saves a CSV report for IT and security to review.

Automation Scripts

← Back to Automation Scripts

Automation Lab 1: PowerShell User Account Audit

This lab is a PowerShell script that checks Active Directory for old or risky user accounts and saves a CSV report for IT and security to review.

Overview

Checking accounts by hand gets slow and uneven as the number of users grows. This script does the check the same way every time and saves the results in a clean report.

Real world relevance: Regular account checks help find old accounts and weak password settings before they become a problem. It also supports least privilege.

Objective

  • Identify user accounts that have not logged in within the last 90 days
  • Flag accounts where the password is set to never expire, or has already expired
  • Capture account status, last logon date, and password policy flags
  • Export findings to a CSV for IT and compliance team review

Script Walkthrough

  1. I loaded the Active Directory module and set the limit to 90 days.
  2. I used Get-ADUser to pull the enabled accounts and the fields I needed.
  3. I compared each last logon date to the limit.
  4. I kept the accounts that were inactive or had a password setting that needed attention.
  5. I saved the results to a CSV named with the date.

Script Preview

# Automation Lab 1 - PowerShell User Account Audit
# Queries Active Directory for inactive or non-compliant user accounts

Import-Module ActiveDirectory

$DaysInactive = 90
$CutoffDate   = (Get-Date).AddDays(-$DaysInactive)
$Timestamp    = Get-Date -Format "yyyy-MM-dd"
$OutputFile   = ".\UserAuditReport_$Timestamp.csv"

$Results = Get-ADUser -Filter {Enabled -eq $true} -Properties `
    DisplayName, SamAccountName, LastLogonDate, `
    PasswordNeverExpires, PasswordLastSet, PasswordExpired |
Where-Object {
    ($_.LastLogonDate -lt $CutoffDate -or $_.LastLogonDate -eq $null) -or
    $_.PasswordNeverExpires -eq $true -or
    $_.PasswordExpired -eq $true
} |
Select-Object DisplayName, SamAccountName, LastLogonDate,
    PasswordNeverExpires, PasswordLastSet, PasswordExpired

$Results | Export-Csv -Path $OutputFile -NoTypeInformation -Encoding UTF8

Write-Host "Audit complete. $($Results.Count) accounts flagged."
Write-Host "Report saved to: $OutputFile"

Key Skills Demonstrated

Active Directory PowerShell Account Auditing Access Governance Automated Reporting

Tools & Technologies

  • PowerShell 5.1+
  • Active Directory PowerShell Module (RSAT)
  • Windows Server and Active Directory Domain Services
  • CSV output for reporting and compliance handoff

Results & Outcomes

  • The script turns a manual review into one command.
  • It saves a report that shows which accounts need action.
  • It makes old accounts and password exceptions easier to see.
  • It is ready to run on a schedule.
↑ Top