This guide gives you a read-only PowerShell script that lists every enabled AD computer account and flags the ones whose DNS A record can't be resolved — the classic symptom of a machine that was renamed, rebuilt, or removed without cleaning up DNS, or a zone where scavenging has drifted out of sync with AD. It reads AD and queries DNS; it does not create, change, or delete anything.
This guide builds a scheduled PowerShell script that reads the Group Policy operational event log, collects the error events from the last 24 hours, and writes them to an HTML file (optionally emailed). It is a reporting tool: it never edits, links, or unlinks a GPO, and it makes no change to any policy or to the events themselves. The only thing it creates on the system is a report file and — if you follow the last section — a scheduled task.
This guide builds a read-only report. The script reaches each IIS server in your farm over PowerShell remoting, reads the HTTPS (SSL) bindings, looks up the bound certificate in the local machine store, and emails you a list of anything expiring within a threshold you set. It does not install, bind, delete, or renew any certificate, and it makes no change to IIS or the certificate store. The only thing that persists is a scheduled task, if you choose to create one — and I show you how to remove that at the end.
A disabled account is not a harmless account. If it still holds membership in security groups, it still carries the access rights those groups grant — file shares, application roles, delegated permissions. If that account is ever re-enabled (by mistake, or by an attacker who compromised a helpdesk process), it lights up with all its old access instantly. Periodically finding disabled users that still sit in security groups is a basic hygiene task, and it is easy to script.
This guide sets mailbox-level forwarding (the ForwardingSmtpAddress / ForwardingAddress and DeliverToMailboxAndForward properties) on many mailboxes at once, reading the target address for each mailbox from a CSV file. It uses Set-Mailbox in Exchange Online PowerShell. This is not the same as an Outlook inbox rule — it is the server-side forwarding an admin sets, and it applies regardless of whether the user's Outlook is open.
This guide creates a Windows scheduled task that runs a script non-interactively under NT AUTHORITY\SYSTEM with Run with highest privileges enabled. That combination gives the task the full rights of the local machine account and an unfiltered admin token — it is the most powerful context a local task can run in. Use it only for jobs that genuinely need it (patching, service restarts, disk maintenance), and keep the script it runs small and trusted, because anything that task does, it does with no guardrails.
This guide builds a PowerShell script that scans an SMB shared folder for files whose extensions are commonly used to carry malware ( .exe , .scr , .js , .vbs , .bat , and so on), and moves any it finds into a locked-down quarantine folder outside the share, writing every action to a log. It is a crude, extension-based screen — a tripwire, not an antivirus engine. It does not inspect file contents and will not catch a malicious .docm or a renamed payload. Treat it as one layer, not the layer.
This guide gives you a PowerShell script that walks a share tree, reads the NTFS access control list (ACL) on each folder, and reports every place where a broad identity — Everyone , Authenticated Users , Domain Users , BUILTIN\Users — has been granted Write, Modify, or Full Control. That combination is the classic definition of "oversharing," and this script's only job is to find it and write it to a CSV. It reads permissions. It does not change a single ACE.
This guide builds a read-only PowerShell script that pulls failed logon events (Security log Event ID 4625 ) from a list of servers, keeps the ones that look like RDP attempts, and writes them to a dated HTML/CSV report you can review each morning. It optionally emails that report. It creates nothing and deletes nothing on the target servers — it only reads their Security logs.
This guide builds two small PowerShell scripts. The first captures the current Windows Firewall ruleset to a CSV baseline . The second re-reads the live rules and reports which ones were added, removed, or changed since that baseline. Both scripts are read-only — they use Get-* cmdlets only and change no firewall rules, so running the audit cannot break connectivity.
An auditor asks the same question every year: who was in which distribution list on this date? Clicking through each group in the admin center does not scale past a handful of groups, and it produces nothing you can hand over. This guide scripts a clean, point-in-time CSV of every distribution group and its members.
Before I start, one honesty note that shapes this whole guide: Active Directory has no merge operation . There is no Merge-ADUser cmdlet, and there never was. When people say "merge duplicate accounts," what they actually need is a repeatable process to find the duplicates, decide which one survives , copy the things that matter (mainly group memberships) onto the survivor , and then retire the other . That is what this guide automates. The detection half is safe and read-only. The consolidation half changes and can delete accounts, so it is gated hard.
If you run an on-premises Microsoft stack, SharePoint usually isn't the box you think about first — it sits next to Exchange, shares the same Active Directory, and gets patched on whatever cadence the Windows team keeps. This one is worth pulling forward, and not for the reason the headline gives.
On a busy Remote Desktop Session Host, local profiles pile up fast — every user who ever logged in leaves a folder under C:\Users , and a system drive fills quietly until logons start failing. This guide sets up an unattended, standard-supported cleanup of profiles that haven't been used in N days.
This procedure reads a CSV of user accounts and their destination OUs, then moves each account to its target OU with PowerShell's Move-ADObject . Moving a user changes its distinguished name (DN). That matters because anything scoped by DN or OU — Group Policy links, delegated permissions, and OU-based filters — will start or stop applying to the account the moment it moves. The move itself does not delete the account or its group memberships, and it is reversible if you know where the account came from — which is why the script below records the original OU of every user before it touches anything.
Arctic Wolf Labs, via The Hacker News , has tied a run of June 2026 intrusions to CVE-2026-0257 , an authentication bypass (CVSS 7.8) in the portal and gateway components of PAN-OS. The affiliates behind Qilin (also called Agenda) used it as their way in, then deployed ransomware. BleepingComputer reported the same activity.
This script is a read-only audit . It reports PASS/FAIL for a small set of well-known hardening settings — SMBv1 status, firewall profiles, Defender real-time protection, RDP Network Level Authentication, and the local Guest account — and writes the results to the screen and a CSV. It changes nothing. There is nothing to roll back, which is exactly why an audit script is the safe place to start before you touch any actual configuration.
This script reads every enabled AD user's password-expiry date, works out who expires within a window you set (say, the next 14 days), and emails each of those users a reminder. It reads Active Directory and sends mail — it does not change a single account, reset a password, or alter a policy. That makes it low-risk, but it can still misfire loudly: point it at the whole domain with a bad window and you can email hundreds of people at once, so treat the first live run as the dangerous part.
This guide builds a small PowerShell script that connects to a list of remote Windows PCs, reads their hardware and OS details (make, model, serial, CPU, RAM, disk free space, OS version, last boot), and writes one row per machine into a single CSV file. It is read-only. It queries WMI/CIM classes and creates no files, users, or registry keys on the remote machines, so there is nothing to undo on the targets — the only thing it writes is the CSV on your own machine.
This guide sets the Automatic Replies (out-of-office) configuration on multiple mailboxes at once, using Set-MailboxAutoReplyConfiguration in Exchange Online PowerShell. It turns auto-reply on (or schedules it), and writes the internal and external message text. It does not delete mail, move anything, or change mailbox permissions — but it does overwrite whatever auto-reply text and state each affected mailbox currently has, and there is no built-in "undo" that restores the previous message. If a user had their own carefully worded reply set, this replaces it. So capture the current state first (I show how below) and treat the change list as production data.
This guide builds a read-only PowerShell script that enumerates your DHCP scopes, pulls the current IPv4 leases from each, writes them to a timestamped CSV, and (optionally) emails the file. It does not change any DHCP configuration — no scopes, reservations, options, or leases are created, modified, or deleted. The worst it can do is fill a disk with CSVs if you never prune them.
If you run N-able N-central yourself, or an MSP runs it on your behalf, stop and read this one properly. CISA put CVE-2026-18577 into the Known Exploited Vulnerabilities catalog on 3 August, then followed up the next day by adding CVE-2026-18556 alongside two unrelated bugs. Two CISA advisories, one day apart, both pointing at the same product. That ordering is the whole story.
This guide builds a scheduled PowerShell job that reads Event ID 4625 (failed logon) from the Windows Security log for the last 24 hours and writes them to a dated HTML report. It is read-only — it queries the event log and creates a report file. It does not change auditing policy, delete events, or touch accounts.
This guide builds a read-only report . The script enumerates the SMB shares on a Windows file server, then lists two things for each one: the share-level permissions (the "who can connect" layer) and the NTFS permissions on the folder behind it (the "who can touch the files" layer). It writes both to CSV so you can review access in a spreadsheet instead of clicking through the Security tab share by share.
IIS writes a fresh W3C log file on a schedule, but it never deletes the old ones. On a busy site that quietly eats the system drive until something breaks. This is the boring, reliable fix: a batch file that deletes logs older than N days, run daily by Task Scheduler.
This is a read-only audit. It pulls a list of computers from Active Directory, connects to each one over PowerShell Remoting (WinRM), reads the membership of the local Administrators group, and writes everything to a single CSV you can open in Excel. It creates nothing and changes nothing on the target machines, so there is no destructive step and nothing to roll back — the only thing produced is the report file on your own workstation.
This guide sets up a PowerShell script that backs up every Group Policy Object in your domain to a dated folder and, optionally, exports a human-readable HTML report of each one. Backing up GPOs is a read-only operation — Backup-GPO does not change, delete, or unlink anything in Active Directory. It copies the policy settings, security filtering, and WMI filter links into files on disk. The risky part is not the backup; it's the restore , which I cover at the end and which you should treat with real care.
Stuck print jobs are one of those recurring, low-glamour tickets: a queue jams, one document sits in "Error" or "Deleting" forever, and everything behind it stalls. This guide gives you two standard tools — a graceful per-job cleanup and the classic spooler reset — and shows how to run them safely on a schedule.
This guide reads a CSV of users and writes two attributes back to Active Directory for each one: Title and Department . Nothing is created or deleted — existing user objects have those two fields overwritten with the values in your file. That overwrite is a real change: if the CSV has a wrong value in a row, that user's title or department is now wrong until you fix it. There is no built-in "undo," so the safety step below is to export the current values first so you can put them back.
This guide builds a read-only report: it collects the BitLocker encryption status of every fixed volume on a set of domain computers and writes it to a CSV. It does not enable, disable, or change BitLocker on anything. The only thing it creates on your side is the output file.
This script reads the free space on the fixed local disks of the machine it runs on and emails you when any of them drops below a percentage you set. It is a lightweight stand-in for a monitoring platform — good for a handful of servers, not a replacement for one across a fleet.
This sets up a nightly one-way mirror of a local folder to a NAS SMB share using robocopy /MIR , followed by a second pass that lists any remaining differences as a verification step, all logged to a timestamped file and driven by a Scheduled Task.
This guide builds and deploys Windows Defender Firewall rules from a table (a CSV), using the NetSecurity PowerShell module, with netsh advfirewall shown as the older equivalent. The goal is a repeatable, idempotent way to push the same rule set to one host or many, instead of clicking through wf.msc on each box.
This guide builds a script that connects to a list of remote Windows machines over PowerShell remoting (WinRM), reads the "installed programs" data out of each machine's registry, and writes one combined CSV inventory. It is read-only : it queries registry keys and creates a CSV on your admin workstation. It does not install, uninstall, or change anything on the target machines.
This is a cmd.exe batch file that renames files in one folder by find-and-replace: it takes every file matching a mask (say *.txt ), swaps a substring in the filename (say draft → final ), and renames it. Its purpose is bulk cleanup of filenames — removing a stray word, fixing a prefix, changing a spelling — without you clicking through Explorer.
This guide builds a read-only audit of a Microsoft DNS server: it enumerates the zones, exports every resource record to CSV, and produces a short report of records that look stale (dynamic records whose aging timestamp is older than a threshold you set). The audit script itself creates nothing and deletes nothing — its worst case is a CSV file on disk.
This guide builds a read-only disk-space report. It uses PowerShell remoting ( Invoke-Command over WinRM) to query each server's local fixed disks and returns size, free space, and percent free as one combined table you can export to CSV or HTML. It does not write to, resize, or clean up any disk — it only reads WMI/CIM data.
This script offboards one leaving user in a single pass: it disables their AD account, records and removes their group memberships (except the primary group), and moves the account into a disabled-users OU. A separate, clearly marked step sets mail forwarding on their mailbox. The point is a consistent, logged procedure so nothing gets missed and you can reconstruct exactly what changed.
This guide builds a PowerShell script that onboards one new employee in four steps: it creates an Active Directory user account , adds them to security groups , provisions an on-premises Exchange mailbox , and creates their home folder on a file server and sets NTFS permissions . The purpose is to replace the error-prone click-through in Active Directory Users and Computers with one repeatable, reviewable run.
This guide finds Active Directory computer accounts that haven't logged in for a long time and retires them in three deliberate stages: report , disable and move to a holding OU , then delete . The purpose is to keep AD tidy and reduce the attack surface of forgotten machine accounts without accidentally killing a computer that's simply been powered off for a while.
This guide sets up an unattended nightly full database backup . A short PowerShell script calls Backup-SqlDatabase to write a .bak file to a folder, and Windows Task Scheduler runs that script on a schedule under a service account.
An expired TLS certificate is the kind of outage that is entirely preventable and still catches everyone. This guide builds a small PowerShell script that reads the certificates in a server's own store, flags any that expire soon, and then schedules it to run daily so you hear about it weeks in advance instead of from a monitoring alert at 2 a.m.
This guide builds a small PowerShell script that walks every address in a /24 subnet, sends one ICMP echo (a ping) to each, and — for the hosts that answer — tests a short list of TCP ports and does a reverse-DNS lookup. The output is a CSV inventory: IP, up/down, resolved name, and which ports were open. It is read-only. It does not log into, change, or write anything on the machines it probes.
This guide reads a CSV file and, for each row, creates a shared mailbox in Exchange Online and grants the people you list Full Access and Send As on it. The purpose is to onboard many shared mailboxes (team@, support@, invoices@) in one pass instead of clicking through the admin center dozens of times.
This guide gives you a PowerShell script that connects to a list of Windows machines over WinRM and sets a brand-new random password on the built-in local Administrator account of each one , then writes the results to a CSV so you have the new credentials. Its purpose is to kill shared, static, "same password everywhere" local admin accounts.
This guide uses the community PSWindowsUpdate module to check for, install, and log Windows updates on the machine it runs on. The end result is a scheduled job that patches a box unattended and drops a CSV report so you can see what happened.
This guide exports the members of one or more Active Directory groups to a CSV file so you can hand it to a manager or an auditor for a periodic access review. It only reads from AD and writes a file to disk — it does not add, remove, or change a single group membership.
This guide sets up a .bat logon script that runs net use to attach network shares to fixed drive letters (for example S: and H: ) every time a user signs in on a domain-joined Windows machine. Its purpose is consistent, hands-off drive mapping so users don't set them up manually.
This guide builds a small watchdog: a PowerShell script that checks one named Windows service, and if it is not running, tries to start it and writes the outcome to a log file and the Windows event log. You then schedule it with Task Scheduler so it runs every few minutes. The script starts a stopped service — that is its whole point — so run it only against a service you actually want kept running. It does not delete or reconfigure anything, and starting a service is reversible (you can stop it again), so there is no destructive, one-way step here.
This guide resets the passwords of a list of Active Directory user accounts, clears any lockout on them, and flags each account to require a new password at the next sign-in. The usual reason is a batch of expired or compromised accounts, or a group of seasonal staff coming back online.
This guide builds a Windows batch file that deletes old log files from a folder you name and temporary files from a temp folder, based on how many days ago each file was last modified. Its purpose is to reclaim disk space on a schedule without you having to remember to do it.
This guide builds a small PowerShell script that reads the last 24 hours of Critical and Error events from the System and Application logs, writes them to an HTML file, and emails that file to you. It's a read-only report: it does not clear, modify, or delete any event log. The only things it creates on the system are the HTML report files in a folder you choose and — in the last section — a scheduled task.
This guide sets up a nightly copy of one folder to a backup location using robocopy driven by a script, then schedules that script to run unattended with Windows Task Scheduler. The point is a low-fuss, repeatable file copy — not a full backup product with versioning or bare-metal restore.
This procedure finds enabled user accounts that have not logged on for a set number of days , disables them, stamps a note in the account's description, and moves them into a dedicated "archive" OU so they are out of your working OUs but not deleted. Its purpose is routine account hygiene: a disabled, quarantined account can't be used for a logon, which shrinks your attack surface, but nothing is destroyed and everything is reversible.
This guide gives you a PowerShell script that reads Active Directory and produces a report (on screen and as a CSV) of user accounts that have never authenticated against any domain controller. It changes nothing — it does not disable, delete, or edit a single account. Its purpose is to hand you a clean list of candidates for review before you decide what to do with them.
This guide builds a PowerShell script that reads a CSV file of people and creates a matching Active Directory user account for each row — name, logon name, OU placement, and an initial password. Its purpose is to save you from clicking through Active Directory Users and Computers a hundred times when you onboard a class, a department, or a new office.
This guide uses the Unlock-ADAccount cmdlet to clear the locked-out state on an Active Directory user account — the state a user lands in after too many bad password attempts trip your domain lockout policy. Unlocking lets them log in again immediately; it does not change or reset their password.
This guide walks the standard three-stage offboarding of a single Active Directory user account: disable it (so nobody can log in), move it to a holding OU, and — only after a retention period — delete it. That order is deliberate. Disabling is instant and fully reversible; deletion is not.
This guide gives you a PowerShell script that reads a CSV file of new employees and creates one Active Directory user account per row, with a per-row try/catch so that one bad line doesn't halt the whole batch. Its purpose is bulk onboarding — creating dozens or hundreds of accounts without clicking through the console each time.
This guide changes existing Active Directory user objects: it sets the email address, job title, and department on one account or a batch of accounts. It does not create or delete anything. But it overwrites whatever those attributes held before, and Active Directory keeps no built-in undo — if you set the wrong department on 200 people, the only way back is to set it again with the correct value. So treat the write as permanent unless you record the old values first (I show how below).
These commands add a user account to an Active Directory security or distribution group, or remove it from one, using the ActiveDirectory PowerShell module. Group membership is how most access is granted in AD, so getting it right matters: adding a user to the wrong group can hand out access it should not have, and removing a user from a group can cut off access to file shares, mailboxes, or applications immediately at their next logon or token refresh.
This guide resets the password on one Active Directory user account, and optionally unlocks the account and forces the user to change the password at next logon. That is the entire scope: a targeted, single-user reset — the kind of thing you do a dozen times a week at a help desk.
This guide creates one new user account in Active Directory using the New-ADUser cmdlet: it writes a new user object into an organizational unit you choose, sets a password, and enables the account for sign-in. That's a change to your live directory, so treat it as one.
Are you getting many spam requests from IP addresses? Do you want to block or allow IPs instantly? It’s been one hectic task for Email Administrators when they need to manage IP based whitelist and blacklist. Well here is the hassle free solution…!!! Check out my other Zimbra Batch files: Zimbra User Management Zimbra Group / Distribution Lists Management You will have to apply and modify some of the changes to get this work for you on your Zimbra Open Source Collaboration Server. Here is the guide that you need to follow first before going further below. Click HERE I believe you have changed your…
Everybody loves Zimbra. The best in class Zimbra Collaboration Open Source Email server with contacts, tasks and calendar management on your finger tips. I indeed love it and recommend it to small and medium businesses when they ask me how can we achieve best in-house Email server. Even many big data enterprises are also using this feature rich daemon. Find our more information about Zimbra here – Zimbra Collaboration Open Source Edition System / email administrators manages users from Zimbra Admin Panel where they can create / modify and delete users and do many things. However I find it quite lazy myself when administering users using Zimbra Admin Panel. Believe me, login on to Zimbra Admin panel, issuing…
