128 lines
4.4 KiB
PowerShell
128 lines
4.4 KiB
PowerShell
# Update-StaffAD.ps1
|
|
# Reads Staff_Extract.csv and updates AD email addresses and account status.
|
|
# Previews all changes before applying them.
|
|
|
|
# --- Configuration ---
|
|
$CsvPath = "C:\Scripts\Staff_Extract.csv" # Update if needed
|
|
|
|
# --- Import ---
|
|
if (-not (Test-Path $CsvPath)) {
|
|
Write-Error "CSV not found: $CsvPath"
|
|
exit 1
|
|
}
|
|
|
|
$Staff = Import-Csv -Path $CsvPath
|
|
$DisableStatuses = @("INAC", "LEFT")
|
|
|
|
# --- Preview Phase ---
|
|
$Changes = [System.Collections.Generic.List[PSCustomObject]]::new()
|
|
|
|
Write-Host "`n=============================" -ForegroundColor Cyan
|
|
Write-Host " PREVIEW OF PLANNED CHANGES" -ForegroundColor Cyan
|
|
Write-Host "=============================" -ForegroundColor Cyan
|
|
|
|
foreach ($entry in $Staff) {
|
|
$payrollNo = $entry.PAYROLL_REC_NO.Trim()
|
|
$status = $entry.STAFF_STATUS.Trim()
|
|
$email = $entry.E_MAIL.Trim()
|
|
|
|
# Find user in AD by EmployeeID
|
|
try {
|
|
$adUser = Get-ADUser -Filter "EmployeeID -eq '$payrollNo'" `
|
|
-Properties EmployeeID, EmailAddress, Enabled, SamAccountName, DisplayName `
|
|
-ErrorAction Stop
|
|
} catch {
|
|
continue
|
|
}
|
|
|
|
if (-not $adUser) {
|
|
continue
|
|
}
|
|
|
|
$planned = [PSCustomObject]@{
|
|
DisplayName = $adUser.DisplayName
|
|
SamAccountName = $adUser.SamAccountName
|
|
PayrollNo = $payrollNo
|
|
Status = $status
|
|
CurrentEmail = $adUser.EmailAddress
|
|
NewEmail = $email
|
|
CurrentEnabled = $adUser.Enabled
|
|
WillDisable = ($status -in $DisableStatuses) -and $adUser.Enabled
|
|
WillUpdateEmail = ($adUser.EmailAddress -ne $email)
|
|
}
|
|
|
|
$Changes.Add($planned)
|
|
|
|
# Display the planned change
|
|
Write-Host "`n User : $($planned.DisplayName) ($($planned.SamAccountName))" -ForegroundColor White
|
|
Write-Host " Payroll No : $payrollNo"
|
|
Write-Host " Status : $status"
|
|
|
|
if ($planned.WillUpdateEmail) {
|
|
Write-Host " Email : $($planned.CurrentEmail) --> $($planned.NewEmail)" -ForegroundColor Yellow
|
|
} else {
|
|
Write-Host " Email : No change ($email)"
|
|
}
|
|
|
|
if ($planned.WillDisable) {
|
|
Write-Host " Account : WILL BE DISABLED (status is $status)" -ForegroundColor Red
|
|
} elseif (-not $adUser.Enabled) {
|
|
Write-Host " Account : Already disabled - no change" -ForegroundColor DarkGray
|
|
} else {
|
|
Write-Host " Account : No change (active)"
|
|
}
|
|
}
|
|
|
|
# --- Summary ---
|
|
$emailUpdates = ($Changes | Where-Object { $_.WillUpdateEmail }).Count
|
|
$disables = ($Changes | Where-Object { $_.WillDisable }).Count
|
|
$noChanges = ($Changes | Where-Object { -not $_.WillUpdateEmail -and -not $_.WillDisable }).Count
|
|
|
|
Write-Host "`n=============================" -ForegroundColor Cyan
|
|
Write-Host " SUMMARY" -ForegroundColor Cyan
|
|
Write-Host "=============================" -ForegroundColor Cyan
|
|
Write-Host " Users matched in AD : $($Changes.Count)"
|
|
Write-Host " Email updates : $emailUpdates" -ForegroundColor Yellow
|
|
Write-Host " Accounts to disable : $disables" -ForegroundColor Red
|
|
Write-Host " No changes needed : $noChanges"
|
|
Write-Host ""
|
|
|
|
if ($Changes.Count -eq 0) {
|
|
Write-Host "No matching AD users found. Exiting." -ForegroundColor Yellow
|
|
exit 0
|
|
}
|
|
|
|
# --- Confirmation ---
|
|
$confirm = Read-Host "Do you want to apply these changes? (yes/no)"
|
|
|
|
if ($confirm -ne "yes") {
|
|
Write-Host "`nAborted. No changes were made." -ForegroundColor Yellow
|
|
exit 0
|
|
}
|
|
|
|
# --- Apply Changes ---
|
|
Write-Host "`n=============================" -ForegroundColor Cyan
|
|
Write-Host " APPLYING CHANGES" -ForegroundColor Cyan
|
|
Write-Host "=============================" -ForegroundColor Cyan
|
|
|
|
foreach ($change in $Changes) {
|
|
try {
|
|
$adUser = Get-ADUser -Identity $change.SamAccountName -Properties EmailAddress, Enabled
|
|
|
|
if ($change.WillUpdateEmail) {
|
|
Set-ADUser -Identity $change.SamAccountName -EmailAddress $change.NewEmail
|
|
Write-Host " [OK] Updated email for $($change.DisplayName): $($change.NewEmail)" -ForegroundColor Green
|
|
}
|
|
|
|
if ($change.WillDisable) {
|
|
Disable-ADAccount -Identity $change.SamAccountName
|
|
Write-Host " [OK] Disabled account for $($change.DisplayName) ($($change.Status))" -ForegroundColor Green
|
|
}
|
|
|
|
} catch {
|
|
Write-Host " [ERROR] Failed to update $($change.DisplayName): $_" -ForegroundColor Red
|
|
}
|
|
}
|
|
|
|
Write-Host "`nDone." -ForegroundColor Cyan
|