Automation 2024

AD Lifecycle Automation

Turning a 45-minute manual slog into a 5-minute automated workflow

90% Time Saved
<1% Error Rate
100% Audit Compliance

The Problem

Every new hire meant 45 minutes of clicking through AD, Exchange, and file server consoles. The manual checklist:

  • Create AD account with correct OU placement
  • Generate username following HR naming conventions
  • Set up Exchange mailbox
  • Copy group memberships from a "model user" in the same department
  • Create home directory with proper NTFS permissions
  • Configure login scripts and drive mappings
  • Document everything in the ticketing system

Results varied by technician. Missed steps created security gaps. Offboarding was worse: accounts weren't fully disabled, group memberships weren't documented before removal, and home directories sat orphaned on file servers for months.

Solution Architecture

WinForms GUI

Tabbed interface for data entry, model user selection, and pre-execution review. Real-time validation prevents common errors before they reach AD.

Modular Classes

Separate PowerShell classes for AD operations, Exchange integration, home directory management, and logging. Each module independently testable.

Test Mode

Full dry-run capability. Walks through every operation without committing changes and produces a report showing exactly what would be created.

JSON Logging

Structured logs with timestamps, operation types, success/failure status, and rollback information. Supports file output and real-time console display.

System Architecture

Diagram: AD Lifecycle Tool architecture showing GUI layer, validation engine, AD/Exchange/FileSystem modules, and logging infrastructure PRESENTATION VALIDATION SERVICES INFRASTRUCTURE WinForms GUI Tabbed Interface Model User Picker Preview Panel Test Mode Duplicate Check? Perms OK? Exchange Ready? ADManager CreateUser() CopyGroups() DisableUser() ExchangeMgr CreateMailbox() SetQuota() AddDelegates() FileSystemMgr CreateHomeDir() SetNTFS() Archive() UsernameMgr Generate() Validate() Suggest() Logger Info() Error() Rollback() AD DS Exchange File Server JSON Logs Console Dry run option

Onboarding Sequence

Diagram: Onboarding workflow with validation gates, parallel operations, error handling, and rollback capability Start Collect User Data + Model User Valid? Pre-flight Show Errors No Yes Generate Username + Collision Create AD User Set attrs Parallel Exchange Mailbox Optional Home Directory + NTFS Copy Groups From model Log Result JSON Rollback on failure Total: 3-5 minutes (vs 45+ manual)

Username Generation

Generates usernames following HR naming conventions. Handles employee and contractor patterns separately, checks for collisions against existing AD accounts, and suggests alternatives when conflicts occur.

Key Features

Model User Copying

Select an existing employee in the same department as a template. The tool copies security group memberships, distribution lists, shared mailbox permissions, and calendar delegate access (excluding restricted groups like VPN and 401K). Before copying, the GUI displays exactly what will be replicated.

Pre-Flight Validation

  • Checks for duplicate usernames before creation
  • Validates Exchange connectivity and target mail server
  • Confirms home directory path is accessible
  • Verifies technician has required permissions

Offboarding Workflow

  • Disables account (doesn't delete)
  • Resets password to random value
  • Documents all group memberships before removal
  • Moves to "Disabled Users" OU with date-stamped username
  • Archives home directory to retention share
  • Updates description field with termination date and reason

Results

Metric Before After
Onboarding time 45-60 min 3-5 min
Configuration errors ~15% of accounts <1%
Offboarding compliance Inconsistent 100% documented
Audit trail Manual notes Structured JSON

Technologies

PowerShell 5.1+ Windows Forms Active Directory Exchange Management Shell JSON NTFS Permissions

Lessons Learned

Query, don't hardcode

Pulling departments and OUs from AD dynamically meant zero maintenance when org structure changed.

Dry runs build trust

Showing exactly what will happen before it happens got buy-in from skeptical technicians and caught edge cases early.

Copy the good example

Letting techs pick a known-good "model user" from each department handled 90% of permission cases automatically.

Fail gracefully

Making Exchange integration optional meant the tool stayed useful during mail server maintenance windows.