Active Directory

Get-EmptySecurityGroups.ps1

View in Gitea

Synopsis: Lists all Active Directory security groups that have no members.

Uses Active Directory cmdlets to retrieve every security group and checks whether each one has any members. Groups with no members are returned as objects (GroupName, CanonicalName, DistinguishedName). By default the whole domain is searched; optionally the search can be limited to one or more Organizational Units, searched recursively.

Parameters:

Parameter	Description
SearchBase	One or more OU distinguished names to search recursively for security groups. Optional - if omitted, the entire domain is searched.

Examples:

.\Get-EmptySecurityGroups.ps1
Displays all empty security groups in Active Directory.

.\Get-EmptySecurityGroups.ps1 | Export-Csv -Path .\Export_EmptySecurityGroups.csv -NoTypeInformation -Encoding UTF8
Exports all empty security groups in Active Directory to a CSV file.

.\Get-EmptySecurityGroups.ps1 -SearchBase "OU=Sales,DC=contoso,DC=com"
Searches recursively only within the Sales OU.

.\Get-EmptySecurityGroups.ps1 -SearchBase "OU=Sales,DC=contoso,DC=com","OU=IT,DC=contoso,DC=com"
Searches recursively within multiple OUs.

Notes

Author: Petr Štěpán Created: 2024-10-20 Version: 1.1.0 Changelog: 1.1.0 - Added optional -SearchBase parameter for recursive search within specific OUs. 1.0.0 - Initial version

---

Get-InactiveUsers.ps1

View in Gitea

Synopsis: Lists all Active Directory users who have not logged on for more than 90 days (default) and are not disabled.

Uses Active Directory cmdlets to find all users and checks their last logon date. Users who have had no active logon for longer than the configured number of days (default 90) are returned.

Parameters:

Parameter	Description
Days	Number of days after which a user is considered inactive. Defaults to 90.
IncludeDisabled	If set, the script also includes DISABLED users in the results.
SearchBase	If set, the script searches for users only within the specified OU(s). This is an array, so multiple OUs can be supplied; each one is searched recursively and the results are combined.

Examples:

.\Get-InactiveUsers.ps1
Displays users who have not been active for more than 90 days.

.\Get-InactiveUsers.ps1 | Sort-Object LastLogonDate | Format-Table -AutoSize
Displays users who have not been active for more than 90 days, sorted by
last logon date.

.\Get-InactiveUsers.ps1 -Days 180
Displays users who have not been active for more than 180 days.

.\Get-InactiveUsers.ps1 -Days 365 -IncludeDisabled
Displays users who have not been active for more than 365 days, including
DISABLED users.

.\Get-InactiveUsers.ps1 -SearchBase "OU=Users,DC=example,DC=com"
Displays users who have not been active for more than 90 days, searching
only within the specified OU.

.\Get-InactiveUsers.ps1 | Export-Csv -Path .\Export_InactiveUsers.csv -NoTypeInformation -Encoding UTF8
Exports all inactive users in Active Directory to a CSV file.

.\Get-InactiveUsers.ps1 | Set-ADUser -Enabled $false
Disables all inactive users in Active Directory.

Notes

Author: Petr Štěpán Created: 2024-10-20 Version: 1.1.0 Changelog: 1.1.0 - Fixed -SearchBase to correctly support multiple OUs (Get-ADUser's own -SearchBase only accepts one); added standard header, Set-StrictMode/$ErrorActionPreference, error handling, exit codes. 1.0.0 - Initial version

---

Get-PasswordChangeHistory.ps1

View in Gitea

Synopsis: Displays the password change history for the specified Active Directory account.

Searches the Security event log on all reachable domain controllers and returns password change records (Event ID 4723, 4724) for the specified account.

Event ID 4723 - user changed their own password Event ID 4724 - administrator reset the user's password

Parameters:

Parameter	Description
SamAccountName	SamAccountName of the target account (e.g. "jnovak").
DomainController	Optional specific domain controller(s). Default = all DCs in the domain.
StartTime	Lower bound of the time range (default: last 90 days).
EndTime	Upper bound of the time range (default: now).
MaxEvents	Maximum number of events searched per DC (default: 10000).
ExportPath	Path to the CSV export file. Defaults to ".\PasswordHistory__.csv" in the current directory.

Examples:

.\Get-PasswordChangeHistory.ps1 -SamAccountName "jnovak"

.\Get-PasswordChangeHistory.ps1 -SamAccountName "jnovak" -StartTime (Get-Date).AddDays(-180)

.\Get-PasswordChangeHistory.ps1 -SamAccountName "jnovak" -DomainController "DC01"

.\Get-PasswordChangeHistory.ps1 -SamAccountName "jnovak" -ExportPath "C:\reports\jnovak.csv" -WhatIf

Notes

Author: Petr Štěpán Created: 2026-07-21 Version: 1.0.0 Changelog: 1.0.0 - Initial version

Requires permission to read the Security event log on the DC (Domain Admins or Event Log Readers).

Auditing must be enabled via GPO: Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy > Account Management > Audit User Account Management = Success

---