SERVER-025 · Script

Generate User Audit Report

Builds a readable HTML report of directory user accounts, with summary counts, for audits and leadership.

What it does

Collects every user account in -SearchBase and writes two files to the Runbookia Reports folder: an HTML page you can open in any browser, print, or attach to an audit request a CSV with the same rows, for sorting and filtering The page starts with summary counts (total, enabled, disabled, never signed in, inactive, password never expires, locked out) followed by a table of accounts. Inactive accounts and accounts whose password never expires are highlighted. Optionally the HTML is also copied to -CopyTo, for example a share that leadership can read. Read-only; changes nothing in the directory.

Requirements

Windows PowerShell 5.1 and the ActiveDirectory module (RSAT). Any domain account can usually read these details.

How to run it

• Run as: a service account with the directory rights the script lists, or SYSTEM on a domain controller or the server being checked
• Run from: a domain-joined management server or admin workstation with the RSAT tools, as a scheduled task or from your management tool
• Script type: PowerShell 5.1, 64-bit
• User interaction: none; the script never prompts
• Timeout: 30 minutes for large directories or many servers

Settings

Exit codes

• 0 = Report written
• 2 = Script error (see log)

Testing steps

1. Run it on one test OU, test account or test server and check the output and log.
2. Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
3. Roll out to a small group next, then everyone.

Rollback steps

Report only. Nothing is changed, so nothing needs to be rolled back.

Version and change log