AD Lifecycle Automation
Turning a 45-minute manual slog into a 5-minute automated workflow
The Problem
Every new hire meant 45 minutes of clicking through AD, Exchange, and file server consoles. The manual checklist:
- Create AD account with correct OU placement
- Generate username following HR naming conventions
- Set up Exchange mailbox
- Copy group memberships from a "model user" in the same department
- Create home directory with proper NTFS permissions
- Configure login scripts and drive mappings
- Document everything in the ticketing system
Results varied by technician. Missed steps created security gaps. Offboarding was worse: accounts weren't fully disabled, group memberships weren't documented before removal, and home directories sat orphaned on file servers for months.
Solution Architecture
WinForms GUI
Tabbed interface for data entry, model user selection, and pre-execution review. Real-time validation prevents common errors before they reach AD.
Modular Classes
Separate PowerShell classes for AD operations, Exchange integration, home directory management, and logging. Each module independently testable.
Test Mode
Full dry-run capability. Walks through every operation without committing changes and produces a report showing exactly what would be created.
JSON Logging
Structured logs with timestamps, operation types, success/failure status, and rollback information. Supports file output and real-time console display.
System Architecture
Onboarding Sequence
Username Generation
Generates usernames following HR naming conventions. Handles employee and contractor patterns separately, checks for collisions against existing AD accounts, and suggests alternatives when conflicts occur.
Key Features
Model User Copying
Select an existing employee in the same department as a template. The tool copies security group memberships, distribution lists, shared mailbox permissions, and calendar delegate access (excluding restricted groups like VPN and 401K). Before copying, the GUI displays exactly what will be replicated.
Pre-Flight Validation
- Checks for duplicate usernames before creation
- Validates Exchange connectivity and target mail server
- Confirms home directory path is accessible
- Verifies technician has required permissions
Offboarding Workflow
- Disables account (doesn't delete)
- Resets password to random value
- Documents all group memberships before removal
- Moves to "Disabled Users" OU with date-stamped username
- Archives home directory to retention share
- Updates description field with termination date and reason
Results
| Metric | Before | After |
|---|---|---|
| Onboarding time | 45-60 min | 3-5 min |
| Configuration errors | ~15% of accounts | <1% |
| Offboarding compliance | Inconsistent | 100% documented |
| Audit trail | Manual notes | Structured JSON |
Technologies
Lessons Learned
Query, don't hardcode
Pulling departments and OUs from AD dynamically meant zero maintenance when org structure changed.
Dry runs build trust
Showing exactly what will happen before it happens got buy-in from skeptical technicians and caught edge cases early.
Copy the good example
Letting techs pick a known-good "model user" from each department handled 90% of permission cases automatically.
Fail gracefully
Making Exchange integration optional meant the tool stayed useful during mail server maintenance windows.