AD Security Assessment

# Create Assessment Service Account (Run as Domain Admin - one time by client)

$AccountName = "svc-iamsec-audit"
$DisplayName = "Identity Bytes - Security Assessment"
$OUPath = "OU=Service Accounts,DC=contoso,DC=com"  # Adjust to your OU
$EngagementEnd = (Get-Date).AddDays(21)  # 3-week engagement

# Generate secure password
Add-Type -AssemblyName System.Web
$Password = [System.Web.Security.Membership]::GeneratePassword(25, 5)
$SecurePass = ConvertTo-SecureString $Password -AsPlainText -Force

# Create account
New-ADUser -Name $AccountName -SamAccountName $AccountName `
    -UserPrincipalName "$AccountName@$((Get-ADDomain).DNSRoot)" `
    -DisplayName $DisplayName -Path $OUPath `
    -AccountPassword $SecurePass -Enabled $true `
    -PasswordNeverExpires $false -CannotChangePassword $true `
    -AccountExpirationDate $EngagementEnd

# Add to required groups (least privilege)
Add-ADGroupMember -Identity "Event Log Readers" -Members $AccountName
Add-ADGroupMember -Identity "Remote Management Users" -Members $AccountName

Write-Host "`nAccount Created: $AccountName" -ForegroundColor Green
Write-Host "Password: $Password" -ForegroundColor Yellow
Write-Host "Expires: $($EngagementEnd.ToString('yyyy-MM-dd'))"
Write-Host "`n[!] Share password via secure channel only!" -ForegroundColor Red

# Decommission Assessment Account (Run within 24 hours of engagement end)

$AccountName = "svc-iamsec-audit"

# Step 1: Disable immediately
Disable-ADAccount -Identity $AccountName
Write-Host "[+] Account disabled" -ForegroundColor Green

# Step 2: Remove from all groups
$Account = Get-ADUser $AccountName -Properties MemberOf
foreach ($Group in $Account.MemberOf) {
    Remove-ADGroupMember -Identity $Group -Members $AccountName -Confirm:$false
}
Write-Host "[+] Removed from all groups" -ForegroundColor Green

# Step 3: Move to Disabled Users OU (optional)
# Move-ADObject -Identity (Get-ADUser $AccountName).DistinguishedName `
#     -TargetPath "OU=Disabled Users,DC=contoso,DC=com"

Write-Host "[COMPLETE] Account decommissioned" -ForegroundColor Cyan