Focus: Microsoft Infrastructure Administration, Active Directory, PowerShell, User Administration, Identity Automation
Technology: Windows Server 2025 Standard Evaluation | Oracle VirtualBox | Windows PowerShell 5.1 | Active Directory Domain Services (AD DS)
Domain: Microsoft Infrastructure Administration | Identity and Access Management | Enterprise Security Foundations
Objective
Following the deployment of Active Directory Domain Services in the previous laboratory, this exercise moved from directory infrastructure deployment into practical identity administration.
The laboratory focused on managing Active Directory user accounts through PowerShell and then translating those administrative operations into a controlled automation workflow.
The objectives were to:
- Create and manage Active Directory user accounts.
- Reset and validate user passwords.
- Configure password-change requirements.
- Enable and disable user accounts.
- Validate identity state through PowerShell.
- Develop a repeatable PowerShell automation workflow.
- Implement precondition checks and error handling.
- Use secure password input.
- Validate administrative actions through post-operation checks.
- Independently verify the resulting Active Directory state.
This laboratory therefore represents the transition from building the identity infrastructure to managing identities within that infrastructure.
Environment Overview
Platform: Oracle VirtualBox
Operating System: Windows Server 2025 Standard Evaluation
Administration Method: Windows PowerShell 5.1
Active Directory Domain: corp.lab
Phase: Phase 2 — Microsoft Infrastructure Administration Foundations
Active Directory User Administration
The laboratory began with manual PowerShell administration of an Active Directory user account.
The workflow covered:
- Password administration.
- Password-change requirements.
- Account enablement.
- Account disablement.
- Account-state validation.
An initial password attempt also demonstrated Active Directory password policy enforcement when the supplied password failed to satisfy the domain’s configured requirements.
This reinforced an important identity administration principle: administrative actions are constrained by security policy and should always be validated rather than assumed to have succeeded.
PowerShell Automation
After establishing the manual workflow, a separate laboratory account was used to test automation.
The PowerShell workflow implemented:
Environment validation
↓
Target-account existence check
↓
Secure password collection
↓
User creation
↓
Initial-state validation
↓
Account disablement
↓
Disabled-state validation
↓
Account re-enablement
↓
Final independent validation
The automation was deliberately designed to stop if the target account already existed, reducing the risk of unintentionally modifying an existing identity.
PowerShell error handling and post-operation validation were also incorporated so that failed administrative actions would not silently pass through the workflow.
Validation Findings
The automated workflow successfully demonstrated:
- Active Directory domain validation.
- Controlled user creation.
- Secure password input.
- Password-change-at-logon configuration.
- Initial account-state validation.
- Account disablement.
- Disabled-state validation.
- Account re-enablement.
- Enabled-state validation.
- Independent final verification.
- PowerShell syntax validation.
The final test account was independently confirmed as:
- Present in Active Directory.
- Enabled.
- Configured to require a password change.
- Not configured with a non-expiring password.
All passwords and credentials were deliberately excluded from the repository.
Automation Safety
A key focus of the laboratory was that automation should not simply execute administrative commands automatically.
The workflow incorporated several safeguards:
- Expected-domain validation.
- Existing-account detection.
- Secure password collection.
-ErrorAction Stoperror handling.- Explicit post-operation validation.
- Independent final-state verification.
This creates a basic administrative control model:
Precondition
↓
Administrative action
↓
Post-condition
↓
Independent verification
The approach is directly applicable to larger identity-management workflows, where automation can increase both operational efficiency and the potential impact of an error.
Evidence
The complete PowerShell commands, automation workflow, validation logic and relevant execution evidence are documented in the laboratory repository.
GitHub laboratory documentation:
2.4 Active Directory User Administration & Automation — GitHub
The repository is intentionally kept concise, with the PowerShell implementation and evidence contained directly within the laboratory documentation rather than distributed across separate evidence files.
Operational Interpretation
This laboratory represents an important progression in identity administration.
The previous exercise established the Active Directory infrastructure.
This exercise demonstrated how identities can subsequently be managed, validated and automated within that infrastructure.
The progression can therefore be viewed as:
Windows Server
↓
Active Directory Domain Services
↓
Active Directory User Administration
↓
Identity Automation
↓
Microsoft Entra ID
↓
Hybrid Identity
↓
Identity Security
PowerShell provides an important bridge between traditional Windows infrastructure administration and modern identity automation.
The same principles demonstrated here can later be applied to Microsoft Entra ID, Microsoft Graph, identity lifecycle management, privileged access workflows and security remediation.
Key Takeaway
The main lesson from this laboratory was that effective identity automation requires more than knowing the correct PowerShell cmdlets.
A robust administrative workflow should establish:
- What environment is being modified.
- What state must exist before execution.
- What action should be performed.
- What should happen when an unexpected condition occurs.
- What state should exist afterwards.
- How the final state will be independently verified.
This approach transforms PowerShell from a command-line administration tool into a mechanism for repeatable and controlled identity operations.
It also introduces an important security principle:
The greater the scale of automation, the greater the importance of validation and safeguards.
Skills Demonstrated
- Active Directory user administration
- Windows PowerShell 5.1
- User account creation
- Password administration
- Password policy interaction
- Account enablement and disablement
- Secure credential handling
- PowerShell conditional logic
- PowerShell error handling
- PowerShell syntax validation
- Identity automation
- State-based validation
- Independent verification
- Controlled testing
- Evidence-based technical documentation
Portfolio Context
This laboratory forms part of:
Phase 2 — Microsoft Infrastructure Administration Foundations
Learning progression:
2.1 Windows Server Administration Foundations
↓
2.2 Windows Server Administration Fundamentals
↓
2.3 Active Directory Administration Fundamentals
↓
2.4 Active Directory User Administration Fundamentals
↓
2.5 Windows Server Security Fundamentals
This phase progressively develops the infrastructure and identity knowledge required for:
- Windows Server administration.
- Active Directory administration.
- Identity lifecycle management.
- Hybrid identity.
- Microsoft Entra ID.
- Microsoft 365 administration.
- Azure administration.
- Identity security.
- Detection Engineering.
This laboratory establishes the practical identity-administration layer between Active Directory infrastructure deployment and future work involving hybrid identity, cloud identity and identity-focused security automation.