Building an Active Directory Environment for IT Administration

The PowerShell script reads a .csv file with employees information. Then it performs New-ADUser for each employee using firstname.lastname format for username, specified OU and SG based on the user's department, force password change at login with -ChangePasswordAtLogon and added their own remote home directory.

FirstName,LastName,Department,Title
Alice,Admin,IT,Systems Administrator
Bob,Network,IT,Network Engineer
Carol,Cash,Finance,Accountant
Dave,Desk,HR,Recruiter

File: employees.csv

$Users = Import-Csv -Path $CsvPath

foreach ($User in $Users) {
   $SamAccountName = "$($User.FirstName).$($User.LastName)".ToLower()
   $TargetOU = "OU=$($User.Department),$DCPath"
   $HomeDirectory = "\\lab-win-dc01\HomeDirectories$\$SamAccountName"
   $PhysicalPath = "$SharePath\$SamAccountName"

   try {
    # Create AD User
    New-ADUser -SamAccountName $SamAccountName -UserPrincipalName "$SamAccountName@ $Domain" `
	-Name "$($User.FirstName) $($User.LastName)" -GivenName $User.FirstName -Surname $User.LastName `
	-Department $User.Department -Title $User.Title -Path $TargetOU `
	-AccountPassword $Password -Enabled $true -ChangePasswordAtLogon $true `
	-HomeDrive "H:" -HomeDirectory $HomeDirectory

	# Map user to uniform Security Group based on Department
	$GroupName = "SG-$($User.Department)-Data"
	Add-ADGroupMember -Identity $GroupName -Members $SamAccountName -ErrorAction SilentlyContinue

	# Create Physical Home Directory and Assign NTFS Permissions
	New-Item -ItemType Directory -Path $PhysicalPath -Force | Out-Null
	$Acl = Get-Acl $PhysicalPath
	$AccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule("LAB\$SamAccountName", "Modify", "ContainerInherit,ObjectInherit", "None", "Allow")

	Write-Host "[SUCCESS] Provisioned $SamAccountName, added to $GroupName, and secured > H: drive." -ForegroundColor Green
	}
	
	catch {
	Write-Host "[FAILED] Could not provision $SamAccountName. Error: $_" -ForegroundColor Red
	}
}

File: provision_users.ps1

On Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Password Policy. I changed the password length from 7 to 12 to strengthen resistance to brute-force and other password-guessing attacks.

Then I created a new Group Policy Object "Endpoint Security Baseline" where I disabled local Administrator account on Computer Configuration > Preferences > Control Panel Settings > Local Users and Groups. Disabling the built-in local Administrator account to reduce exposure to attacks targeting the default admin account.

On the new GPO, I also enabled PowerShell Script Block Logging on Computer Configuration > Policies > Administrative Templates > Windows Components > Windows PowerShell to record executed PowerShell scripts on the Domain Controller. This aligned with the lab's detection infrastructure.

I also deployed Sysmon to capture detailed system activity such as file and process creations and Wazuh Agent for log collection, security monitoring, and system checks.

Because the existing <agent_config> on group lab is already configured to forward Sysmon and PowerShell script block logs on windows endpoints, agents in the lab group would automatically forward Sysmon and PS script block logs enhancing scalability.

  <agent_config os="Windows">

    <!-- Sysmon Telemetry -->
    <localfile>
      <location>Microsoft-Windows-Sysmon/Operational</location>
      <log_format>eventchannel</log_format>
    </localfile>
    
    <!-- PowerShell Script Block Logging -->
    <localfile>
      <location>Microsoft-Windows-PowerShell/Operational</location>
      <log_format>eventchannel</log_format>
    </localfile>
    
  </agent_config>

After running the script, I was able to login using LAB\alice.admin and after running whoami /groups, Result shows the user is member of SG-IT-data group.

On File Explorer, there is also a drive alice.admin located on \\lab-win-dc01\HomeDirectories$\alice.admin\

DC was used as file-server due to hardware and resource limitations

Files added by the user are stored on the domain controller.

*Password minimum length and disable local admin GPOs were verified to be working but not included here.

After deploying the Wazuh Agent and Sysmon on the DC, I opened the the Wazuh Dashboard and filtered for event 4104 and Symon keyword.

PowerShell Script Block Logging:

Sysmon: