Everyone loves an audit right? We have to deal with audits quite a bit and that requires remedial tasks like “We need a list of AD user accounts that have been locked out”, “We need a list of all inactive user accounts”, “We need a list of inactive computer accounts”, “We need a list of all members of Domain Admins group” as well as “We need a list of all AD accounts”. All of these requirements can easily be scripted with PowerShell. Since I love to automate things and I would rather not run these commands separately, I figured I would just create an Ansible script to run all request at the same time. that way I could logon once, select my Ansible playbook and let it run and I don’t even need to logon to the DC to run theses tasks. I can sit back and let Ansible deal with this.
This simple Ansible playbook uses 3 PowerShell commands and 2 PowerShell scripts that I’m sure most Windows Administrators are familiar with.
---
- hosts: pdc
gather_facts: no
tasks:
- name: copy audit_AD_inactive_users.ps1 to Windows
win_copy:
src: files/audit_AD_inactive_users.ps1
dest: c:\cit\audit_AD_inactive_users.ps1
- name: copy audit_AD_inactive_computers.ps1 to Windows
win_copy:
src: files/audit_AD_inactive_computers.ps1
dest: c:\cit\audit_AD_inactive_computers.ps1
- name: Run Audit for Locked-Out Accounts
win_shell: Search-AdAccount -LockedOut | select Name, LockedOut,LastLogonDate,distinguishedName
register: lockedoutaccounts
- debug: var=lockedoutaccounts.stdout_lines
- name: Run Audit of inactive users - 90 days
win_shell: c:\cit\audit_AD_inactive_users.ps1
register: inactive_users
- debug: var=inactive_users.stdout_lines
- name: Run Audit of inactive computers - 90 days
win_shell: c:\cit\audit_AD_inactive_computers.ps1
register: inactive_computers
- debug: var=inactive_computers.stdout_lines
- name: Run Audit for members of Domain Admins group
win_shell: Get-ADGroupMember -Identity 'Domain Admins' | Select-Object name, objectClass,distinguishedName
register: dom_admin_users
- debug: var=dom_admin_users.stdout_lines
- name: Run Audit for all domain users
win_shell: Get-ADUser -Filter * -SearchBase "dc=contoso,dc=com" | select Name, objectClass,distinguishedName
register: all_dom_users
- debug: var=all_dom_users.stdout_lines
Not bad right? Ansible Rocks! The only complaint I may see is I’m not outputting the results to a CSV file, but if you run this script often, you shouldn’t need the fancy format.
Below is the first PowerShell script “audit_AD_inactive_users.ps1”
$date = (get-date).AddDays(-90)
Get-ADUser -Filter {LastLogonDate -lt $date} -Property Enabled | Where-Object {$_.Enabled -like “true”} | Select Name, SamAccountName, DistinguishedName
Below is the second PowerShell script “audit_AD_inactive_computers.ps1”
# Specify inactivity range value below
$DaysInactive = 90
# $time variable converts $DaysInactive to LastLogonTimeStamp property format for the -Filter switch to work
$time = (Get-Date).Adddays(-($DaysInactive))
# Identify inactive computer accounts
Get-ADComputer -Filter {LastLogonTimeStamp -lt $time} -ResultPageSize 2000 -resultSetSize $null -Properties Name, OperatingSystem, SamAccountName, DistinguishedName, LastLogonDate | Select DNSHostName, LastLogonDate, DistinguishedName