User Creation, Dry Run and OU Moves

Date: 2026-05-20 Project: Staff-AD-email-disabler Status: resolved Tags: powershell, active-directory, new-aduser, dry-run, ou, staff

Context

The Feb version of Update-StaffAD.ps1 only updated or disabled existing accounts; new staff in the ASM export who had no AD account were just logged as "not found". Jess extended it to create accounts for new active staff, to move accounts between active and inactive OUs, and to add a safe preview mode.

Key Decisions

Create accounts only for ACTV rows not found in AD — INAC/LEFT rows with no account are logged as skipped (with their status) rather than created.
-DryRun switch — logs exactly what would happen (in magenta, [WOULD ...]) without touching AD, including creations and OU moves. Chosen over relying on -WhatIf because it needs to cover several cmdlets consistently and produce a readable log.
OU placement driven by status — active staff to $ActiveOU, inactive/left to $InactiveOU; current OU is derived from the DN and only moved if different.
Never move Domain Admin accounts — privileged accounts are excluded from OU moves so IT admin accounts that happen to appear in the export aren't relocated.
New accounts built from the email — first/last name parsed from Firstname.Lastname@, UPN and mail set to the email, placed in $NewUserOU, initial password from a script variable (not stored here).

Technical Details

Lookup: Get-ADUser -Identity <payroll no.> -Properties EmailAddress, Enabled, DisplayName, DistinguishedName.
Creation: New-ADUser -SamAccountName -UserPrincipalName -GivenName -Surname -DisplayName -Name -EmailAddress -AccountPassword -Enabled $true -Path $NewUserOU.
Current OU: $adUser.DistinguishedName -replace '^CN=[^,]+,', ''.
Config variables at the top of the script: $ActiveOU, $InactiveOU, $NewUserOU, $DefaultPassword (value <redacted>).
Counters tracked: created, email updates, disabled, moved, no-change, not-found.

Code Changes

Update-StaffAD.ps1 — ACTV user creation; -DryRun; OU moves for active/inactive; Domain Admin exclusion from moves.
README.md — updated for new behaviour.

Open Questions / Next Steps

A $created++ was double-incremented in one draft path (inside the success branch and again after it) — verify the final script counts creations once.
The initial password is a shared script variable; consider forcing change at next logon (-ChangePasswordAtLogon $true) if not already set.
Consider emailing the log to IT after each scheduled run.

Artifacts

432d3d5 — Skip OU move for Domain Admin accounts
9cfe3c8 — Add OU moves for active/inactive staff, included in dry run output
ba9a9b9 — Add -DryRun switch
8de674c — Add ACTV user creation for accounts not found in AD
Repo: https://gitea.hideawaygaming.com.au/jessikitty/Staff-AD-email-disabler

2.9 KiB Raw Blame History