Find member of based on job title

Here one I have no clue why I wrote it, in any event I thought I would share.  This script looks up all users with similar titles and documents every group they are a member of.  In environments where access is granted by a person’s job role this may come in handy to validate like job roles are in the same group, have the same access especially after adds/changes.

Start of script

Get-ADUser -filter { title -like "*Manager*" } | Select-Object samAccountName | foreach { (Get-ADUser $_.samAccountname –Properties MemberOf | Select-Object MemberOf).MemberOf | Out-File c:\temp\Member_of_Manager.txt }

End of script

Find all accounts that have their password set to never expire

This guy was written to address accounts that are in violation of policy.  Password set to never expire is an easy dig on an audit for auditors.  I run this every 90 days and investigate where needed.  Once the investigation is complete and all exceptions are approved any object leftover gets its password set to (PasswordNeverExpires -eq $False).

Get-ADUser -filter { Enabled -eq $True -and PasswordNeverExpires -eq $True } –Properties * |Select-Object Name, SAMAccountName, Title, Enabled, WhenCreated, WhenChanged, PasswordNeverExpires, Description | Export-Csv 'C:\temp\Pass_Never_Expires.csv' -NoTypeInformation –NoClobber

You can always run this as a scheduled task and email it to yourself.  That info can be found here: http://mytechnicalsolution.blogspot.com/search/label/send-MailMessage

Ensure all accounts in the Disabled Accounts OU are Disabled

I noticed the help desk was enabling accounts and leaving them in the disabled accounts OU.  We have user based policies that get applied based on your departmental OU.  By not moving the account to the correct departmental OU these policies don’t get applied.  Causes user issues like drive mappings and printer mappings don’t get applied.  After talking with the manager of the help desk who discussed it with their team nothing changed.  This laziness caused un-necessary calls to the help desk where the help desk technician manually mapped drives and printers.  This extra work circumvented our standard process and needed to be fixed so I wrote this.

This script runs multiple times a day and disables every account in the disabled accounts OU.  Once I put this in place and communicated this was happening and should be zero impact to our customers as long as the help desk preformed their job correctly my standards were now being followed.

Start of script

###############################################################################

#  Script Name:   Disable_User_Accounts_in_Disabled_Accounts_OU.ps1

#  Created On:    02/26/2014

#  Author:        Joshua

#  Purpose:       Ensure all accounts in the Disabled Accounts OU are Disabled                                               

#  Last Modified: 04/28/2016

#  Last Modifier: Joshua

###############################################################################

Get-ADUser -Filter 'name -like "*"' -SearchBase "OU=Disabled Accounts,DC=YourDomain,DC=com" | Disable-ADAccount

End of script