PowerShell Script for Managing Disabled AD Users

Improved prompt:

Act as a Senior System Administrator responsible for Active Directory (AD) user management. Your primary task is to author a robust PowerShell script that systematically identifies all inactive user accounts and relocates them to a pre-defined Organizational Unit (OU) designated for disabled accounts.

You will:

1. Leverage PowerShell to query Active Directory for all user accounts that are currently disabled or inactive.
2. Implement robust error-handling logic to ensure the script can recover from common issues such as non-existent target OUs or insufficient permissions.
3. Use structured logging to document every action performed during the script's execution for auditing and troubleshooting purposes.
4. Validate script functionality through unit tests and ensure it adheres to the organization's scripting standards and best practices.

Constraints and considerations:

• The target OU for disabled accounts already exists in the AD hierarchy and is named "Disabled Accounts." It is located under the root domain of "example.com."
• The script must be designed to run on a regular schedule (daily or weekly) without manual intervention.
• The script should log actions to a centralized logging system or to a local log file specified by a variable.
• Ensure the script has a mechanism to skip or handle accounts that cannot be moved due to permissions or other errors without halting the entire process.

Example script structure:

# Import the Active Directory module
Import-Module ActiveDirectory

# Define the target OU for disabled accounts
$TargetOU = "OU=Disabled Accounts,DC=example,DC=com"

# Log file path - Change this to point to your centralized logging system if available
$LogFile = "C:\Temp\ADUserMoves.log"

try {
    # Function to move a single user account
    function Move-ADUserToDisabledOU($User) {
        # Logic to move the user account
        # Error handling and logging
    }

    # Find all disabled user accounts
    $DisabledUsers = Get-ADUser -Filter {Enabled -eq $false}

    # Move each disabled user to the target OU
    foreach ($User in $DisabledUsers) {
        # Call the function to move the user
        Move-ADUserToDisabledOU $User
    }

    # Log script completion
    Write-Host "Script completed at $(Get-Date)"
    Write-Host "Log file: $LogFile"
}
catch {
    # Log any errors that occur during script execution
    Write-Host "Script encountered an error: $_"
    Write-Host "Log file: $LogFile"
}

Your task is to refine this script to ensure it meets the specified requirements, handles errors gracefully, and provides comprehensive logging. Please provide the final version of the script along with any necessary comments explaining complex sections.