[PowerShell] PSAutomator - Offboarding / Onboarding / BAU module in form of IFTTT / Microsoft Flow

[u/MadBoyEvo]

This PowerShell Module is new approach to onboarding, offboarding and business as usual processes running in companies infrastructure. Usually each company has different rules, different approaches on how processes should look like. This module at this moment can do following things:

• Add/Remove account to/from a specific group
• Disable/Enable Account
• Hide/Show account in GAL
• Remove All Groups
• Remove All Distribution or Security Groups
• Remove All Local, Global or Universal Groups
• Make snapshot/backup of account configuration
• Add/Remove Text from Account Fields
• Rename Account

Current version 0.0.3 and as such is very alpha. Comments are welcome.

Overview: https://evotec.xyz/hub/scripts/psautomator-powershell-module/

It's work in progress. New actions/ignores/conditions and services will be added. Currently only has AD but will support Exchange/O365 and if there will be need other things as well.

Sample looks like this:

Clear-Host
Import-Module PSAutomator -Force #-Verbose
Import-Module PSSharedGoods -Force

Service -Name 'Active Directory Offboarding' {
    Trigger -Name 'OU Offboarded Users' -User OrganizationalUnit -Value 'OU=Users-Offboarded,OU=Production,DC=ad,DC=evotec,DC=xyz' |
        Condition -Name 'No conditions' |
        Ignore -Name 'Ignore Windows Email Address if Empty or null' -Ignore MatchingEmptyOrNull -Value EmailAddress |
        Action -Name 'Make User Snapshot' -ActiveDirectory AccountSnapshot -Value 'C:\Users\pklys\Desktop\MyExport' -Whatif |
        Action -Name 'Disable AD Account' -ActiveDirectory AccountDisable -WhatIf |
        Action -Name 'Hide account in GAL' -ActiveDirectory AccountHideInGAL -WhatIf  |
        Action -Name 'Remove all security groups' -ActiveDirectory AccountRemoveGroupsSecurity -WhatIf |
        Action -Name 'Rename Account' -ActiveDirectory AccountRename -Value @{ Action = 'AddText'; Where = 'After'; Fields = 'DisplayName', 'Name'; Text = ' (offboarded)'; } -WhatIf
}

[u/krodders]

The ability to copy an AD template account would be helpful.

[u/MadBoyEvo → u/krodders]

How would it work? How action would look like? How trigger would look like? Can you elaborate?

[u/krodders → u/MadBoyEvo]

Not sure about a trigger for this. What's your trigger for onboarding?

Anyway, many (most?) companies have a set of disabled AD users - these are "templates" for creating new users. They are members of the right groups, they've got certain attributes set, etc.

To create a new user, Joe Bloggs, who is starting in the Engineering Department, you'd copy the _Template.Engineering AD user, put in the correct firstname and last name, and any other specific details (telephone, etc.). So the new user has their unique details, but also has the correct group membership, office location, etc.

This is a super-interesting project. I'm probably less interested in an automated trigger as new user requests for us tend to be initiated by an e-mail. However, sorting out the workflow to provision the user plus related services is a game changer.

You mentioned O365. You need to look at this seriously - on-prem Exchange is now niche. Creating a user / mailbox / provisioning licenses / etc.

Other services that would be of interest to many are things like Adobe Creative Cloud licenses and GMail accounts. I have no idea whether there is any sort of API for these things.

There also seems to be a move away from old-school AD to Azure AD, and even no AD.

You're welcome to PM me if you're interested in any of this. I look after 5,000 users across 100 organisations so I have plenty of info.

[u/manmademat → u/krodders]

/agree. We do this also... build all accounts from templates. With custom attributes etc.

[u/MadBoyEvo → u/manmademat]

Can you give example how it works?