Active Directory on Azure with PowerShell

Deploy Windows Server on Azure and automate AD user management with PowerShell.

Introduction

30 Second Summary

Every company with more than a handful of employees needs someone to manage who can log in, what they can access, and how new hires get set up on day one. That someone is a System Administrator, and their most important tool is Active Directory.

In this project, you will deploy a Windows Server 2022 Virtual Machine on Azure, configure it as a Domain Controller, and write a PowerShell script that automates bulk user onboarding from a CSV file.

What You'll Build

A fully functional Active Directory lab environment on Azure's free tier, complete with departmental structure and an automation script that onboards users at scale.

By the end of this project, you'll have:

  • A Windows Server 2022 VM running Active Directory Domain Services on Azure.
  • An organizational structure with Organizational Units and security groups for IT, HR, and Finance departments.
  • A PowerShell automation script that bulk-creates users from a CSV file, assigns them to groups, and sets their properties.
  • Secret Mission: Write a PowerShell script that generates a daily health report of disabled accounts, expired passwords, and inactive users.

Are there any prerequisites?

None. This project includes full setup instructions for every tool you need, including your Azure account and RDP client. All you need is a Mac with an internet connection.

Before We Start

In this project, you'll build a real Active Directory lab environment on Azure. To do that, you need a cloud platform to host a Windows Server and a way to connect to it from your Mac.

This step gets both of those things ready. You'll create a free Azure account and install the RDP client that lets you control your Windows Server remotely from macOS.

In this step, get ready to:
  • Create an Azure free account.
  • Install Windows App (RDP client) on your Mac.
  • Verify both tools are working.
Create an Azure free account

Azure is Microsoft's cloud platform. The free tier gives you enough resources to run a Windows Server VM at no cost for 12 months.

  • Open your browser and go to azure.microsoft.com/free.
  • Click Try Azure for free.
  • Sign in with your existing Microsoft account, or create a new one with your email address.
  • Complete the About you section with your name, country, phone number, and address.
  • Verify your identity by phone (you'll receive an SMS code).
  • Enter a credit or debit card for identity verification.
  • Review the Microsoft Customer Agreement and click Sign up.

Why do I need a credit card?

Azure uses your card for identity verification only. You will not be charged. A temporary $1 hold may appear and will be reversed within a few days.

Your free account includes $200 credit for 30 days and 750 hours per month of free Windows Server VM time for 12 months.

Having trouble signing up?

Make sure your billing address matches your bank records exactly. Prepaid and virtual cards are not accepted. If phone verification fails, try the Call me option instead of SMS.

Help me troubleshoot my Azure signup.

Install Windows App on your Mac

Windows App is Microsoft's free RDP client for macOS. It lets you connect to and control a remote Windows desktop from your Mac. It requires macOS 14.0 or later.

  • Press Cmd+Space (macOS) to open Spotlight search.
  • Type App Store and press Enter to open it.
  • In the App Store search bar, type Windows App and press Enter.
  • Find the result by Microsoft Corporation (it shows "Previously Remote Desktop" underneath the title).
  • Click Get, then click Install.
  • Wait for the download to complete.

What is Windows App?

Windows App (formerly called Microsoft Remote Desktop) is a free macOS app that uses the Remote Desktop Protocol (RDP) to connect to Windows machines. You'll use it to control your Azure-hosted Windows Server as if you were sitting right in front of it.

Verify your setup

Both tools should now be ready. Let's confirm they work before moving on.

  • Open your browser and go to portal.azure.com.
  • Sign in with the Microsoft account you used during signup.
  • Confirm you can see the Azure Portal dashboard (a page with a search bar at the top and service tiles below).
  • Press Cmd+Space (macOS) to open Spotlight search.
  • Type Windows App and press Enter to open it.
  • Confirm the app launches and shows the Connection Center (a mostly empty window where you'll later add your server connection).

✔️ Both tools are working

You're all set. The Azure Portal loads in your browser and Windows App opens on your Mac.

ⓧ Something isn't working

  • If the Azure Portal shows an error, try clearing your browser cache or using a private/incognito window.
  • If Windows App won't install, check that your Mac is running macOS 14.0 or later. Go to the Apple menu, click About This Mac, and check your macOS version.
  • If the App Store shows a different app name, look for the one labeled "Previously Remote Desktop" by Microsoft Corporation.

Help me troubleshoot my setup.

Your tools are ready. Next up, you'll deploy a Windows Server 2022 virtual machine on Azure and connect to it from your Mac.

Deploy a Windows Server 2022 VM on Azure

Your tools are ready. Now it's time to deploy the server that will become your Active Directory lab.

In this step, you'll create a Virtual Machine running Windows Server 2022 on Azure. Then you'll connect to it from your Mac using RDP (Remote Desktop Protocol) and configure a static IP address that the server needs before it can become a Domain Controller.

In this step, get ready to:
  • Create a Windows Server 2022 VM on Azure's free tier.
  • Connect to the VM from your Mac using Windows App.
  • Configure a static private IP address for the server.
Create the virtual machine

Azure's Free services page ensures you create resources that stay within your free tier. Starting from this page pre-selects the correct VM size so you don't accidentally incur charges.

  • In the Azure Portal, type Free services in the search bar at the top and select Free services from the results.
  • Find Windows Virtual Machines in the list and click Create.

Why start from Free services?

Creating VMs outside the Free services page often defaults to non-free sizes. The Free services page pre-selects a B1s size, which gives you 750 free hours per month for 12 months.

The Create a virtual machine page opens. Configure the following settings on the Basics tab:

  • Under Resource group, click Create new and enter a name like ad-lab-rg.
  • For Virtual machine name, enter a name like ad-server.
  • For Image, select Windows Server 2022 Datacenter.
  • For Size, confirm it shows Standard_B1s (free tier eligible). If it does not, click See all sizes and search for B1s.
  • Under Administrator account, set a Username and Password. Write these down. You will need them to connect via RDP.
  • Under Inbound port rules, select Allow selected ports and choose RDP (3389) from the dropdown.
  • Leave all other settings at their defaults.
  • Click Review + create at the bottom of the page.
  • Review the summary, then click Create to deploy your VM.

What is happening during deployment?

Azure is provisioning several resources for you: the VM itself, an OS disk, a Network Interface, a Public IP address, a Network Security Group, and a Virtual Network. This takes 2-5 minutes.

  • Wait for the deployment to complete. You will see a Your deployment is complete message.
  • Click Go to resource to open your VM's Overview page.

Size not available in your region?

If B1s is not available in your default region, go back to the Basics tab and change the Region to East US, West US, or North Europe where B-series VMs are commonly available.

help me find an Azure region where B1s VMs are available

Connect via RDP from your Mac

Your VM is now running in the cloud. To interact with its Windows desktop, you'll connect using Windows App on your Mac.

  • On your VM's Overview page in the Azure Portal, find the Public IP address field and copy the IP address.
  • Open Windows App on your Mac.
  • Click the + button in the top area.
  • Select Add PC.
  • In the PC name field, paste the Public IP address you copied from Azure.
  • Click Add.
  • Double-click the new PC entry to connect.
  • When prompted for credentials, enter the admin username and password you set during VM creation, then click Continue.

Certificate warning

You may see a certificate warning when connecting. This is expected for self-signed certificates on new VMs. Click Continue to proceed.

After a moment, the Windows Server 2022 desktop appears. You are now remotely controlling your Azure VM.

Connection timed out or refused?

Make sure port 3389 is allowed in your VM's inbound rules. Return to the Azure Portal, navigate to your VM, select Networking in the left menu, and verify an inbound rule exists for port 3389.

Also confirm you copied the Public IP (not the Private IP) from the VM's Overview page.

help me troubleshoot my RDP connection to an Azure VM

Configure a static IP for the domain controller

Before promoting this server to a Domain Controller in the next step, you need to give it a fixed (static) private IP address. A Domain Controller runs DNS, and every other machine on the network needs to find it at a consistent address.

  • Return to the Azure Portal in your browser.
  • Navigate to your VM's page (search for your VM name in the top search bar if needed).
  • In the left menu, under Networking, select Network settings.
  • On the Network settings page, click the name of the network interface next to Network interface.
  • On the Network interface page, under Settings, select IP configurations.
  • Click ipconfig1 in the list.
  • Under Assignment, change the selection from Dynamic to Static.
  • Click Save.

Why does a domain controller need a static IP?

A Domain Controller hosts the DNS service for your domain. Every machine that joins the domain points its DNS settings to the Domain Controller's IP address. If that address changed (dynamic allocation), all domain-joined machines would lose connectivity.

VM restarted after saving?

Changing the IP allocation to Static may cause Azure to restart your VM. This is normal. Wait a minute, then reconnect via Windows App using the same Public IP address.

help me reconnect to my Azure VM after an IP configuration change

Your Windows Server VM is deployed, accessible via RDP, and locked to a static private IP. Next up, you'll install Active Directory Domain Services and promote this server to a domain controller.

Install Active Directory Domain Services

Your Windows Server VM is deployed, connected via RDP, and locked to a static IP address. Now it's time to turn this plain server into the backbone of your network.

In this step, you'll install Active Directory Domain Services and promote your server to a Domain Controller. This is the central authority that manages all users, computers, and permissions on a network.

In this step, get ready to:
  • Install the AD DS server role using PowerShell.
  • Promote the server to a Domain Controller with a new forest.
  • Verify that all Active Directory services are running.
Install the AD DS role

Before you can create users and groups, your server needs the Active Directory software installed. The AD DS role is a Windows feature that provides all the directory services functionality.

  • In your RDP session on the Windows Server desktop, right-click the Start button in the bottom-left corner.
  • Click Windows PowerShell (Admin) from the menu that appears.
  • Install the AD DS role by running this command:
Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools

What does this command do?

  • Install-WindowsFeature is the PowerShell cmdlet that adds server roles and features to Windows Server.
  • -Name AD-Domain-Services specifies the Active Directory Domain Services role.
  • -IncludeManagementTools adds the admin tools (like the Active Directory PowerShell module) that you'll need to manage AD later.

Wait for the installation to finish. You should see a table with Success under the Exit Code column and True under Success.

Seeing an error or 'Failed' exit code?

  • Make sure you opened PowerShell as Administrator. A standard PowerShell window does not have permission to install features.
  • Check for typos in the feature name. It must be exactly AD-Domain-Services with hyphens.
  • If the VM has no internet access, check that the Network Security Group in Azure still allows outbound traffic.

Still stuck? Help me troubleshoot the Install-WindowsFeature command failing on my Windows Server 2022 VM.

Promote the server to a domain controller

Installing the role added the software, but your server isn't a Domain Controller yet. Promotion creates a brand new Active Directory forest and makes this server the authority for your domain.

  • Run the following command to create a new Active Directory forest:
Install-ADDSForest -DomainName "intechlab.local" -InstallDNS

What does this command do?

  • Install-ADDSForest creates an entirely new Active Directory forest from scratch.
  • -DomainName "intechlab.local" sets the domain name. The .local suffix is a common convention for isolated lab environments that avoids conflicts with real internet domains.
  • -InstallDNS installs a DNS server on this machine. A Domain Controller needs DNS so other machines can find it at a consistent address.

What will happen next?

After you press Enter, PowerShell will ask you to set a Safe Mode (DSRM) password. This is a recovery password used only if Active Directory breaks and you need to repair it.

Type a strong password, confirm it, then type Y when asked to proceed. The server will automatically reboot after promotion completes. Your RDP session will disconnect.

  • Press Enter to run the command.
  • Type a strong password when prompted for the Safe Mode password, then type it again to confirm.
  • Type Y and press Enter to proceed with the promotion.
  • Wait for the process to finish. Your RDP connection will drop when the server reboots automatically.

RDP disconnected and can't reconnect?

The server takes 2-5 minutes to finish rebooting after promotion. Wait a few minutes before attempting to reconnect.

When you reconnect, the login format changes. Use INTECHLAB\youradminusername as the username (replacing youradminusername with the admin username you set during VM creation). This is because the server now belongs to a domain.

Need more help? Help me reconnect to my Windows Server after domain controller promotion.

Verify AD DS is running

After the reboot, your server is now a Domain Controller. Let's confirm everything is working correctly.

  • Return to Windows App on your Mac and reconnect to your VM using the same PC entry from earlier.
  • Log in with INTECHLAB\youradminusername (your original admin username with the domain prefix) and your admin password.
  • Once on the desktop, right-click the Start button and click Windows PowerShell (Admin).
  • Check that the core Active Directory services are running:
Get-Service adws,kdc,netlogon,dns

All four services should show Running in the Status column.

  • Now confirm your domain is active by running:
Get-ADDomain

You should see output listing your domain name as intechlab and the forest as intechlab.local.

What are these services?

  • adws (Active Directory Web Services) lets tools communicate with AD over web protocols.
  • kdc (Key Distribution Center) handles authentication tickets for users and computers.
  • netlogon manages secure communication between machines and the domain controller.
  • dns translates domain names to IP addresses so machines can find each other.

One or more services not running?

  • If any service shows Stopped, try starting it manually with Start-Service followed by the service name (e.g. Start-Service dns).
  • If Get-ADDomain returns an error, the promotion may not have completed successfully. Re-run Install-ADDSForest -DomainName "intechlab.local" -InstallDNS and check for error messages.

Need help? Help me fix Active Directory services not starting after domain controller promotion.

Your server is now a fully operational Domain Controller. Next up, you'll build the organizational structure by creating departments and security groups that control who can access what.

Create Organizational Units and Security Groups

Your domain controller is live and all core services are running. Now it's time to build the internal structure that organizes users, computers, and policies inside your domain.

In a real organization, you wouldn't dump every employee into one flat list. You'd separate them by department so you can apply different permissions and policies to each group. That's exactly what Organizational Units (OUs) and Security Groups do in Active Directory.

In this step, get ready to:
  • Create three Organizational Units for departments (IT, HR, Finance).
  • Create three security groups and place them inside the correct OUs.
  • Verify the full structure with PowerShell commands.
Create Organizational Units (OUs)

Organizational Units are containers inside Active Directory that group objects by department, location, or function. Once users are placed inside an OU, you can apply group policies to everyone in that container at once.

  • In your PowerShell window on the Windows Server (the same session from the previous step), create three department OUs by running these commands:
New-ADOrganizationalUnit -Name "IT" -Path "DC=intechlab,DC=local"
New-ADOrganizationalUnit -Name "HR" -Path "DC=intechlab,DC=local"
New-ADOrganizationalUnit -Name "Finance" -Path "DC=intechlab,DC=local"

What do these commands do?

  • New-ADOrganizationalUnit creates a new container object in your Active Directory domain.
  • -Name sets the display name of the OU (IT, HR, or Finance).
  • -Path "DC=intechlab,DC=local" places the OU at the top level of your domain. This is the distinguished name format Active Directory uses to locate objects.

These commands produce no output on success. If you see no error messages, the OUs were created successfully. You'll confirm everything in the verification substep below.

Seeing an error about the path?

  • Double-check that you typed DC=intechlab,DC=local exactly. A missing comma or extra space will cause a "Directory object not found" error.
  • If you see "An attempt was made to add an object to the directory with a name that is already in use", the OU already exists from a previous attempt. You can safely move on.

Ask for help: Why is my New-ADOrganizationalUnit command failing with a path error?

Create security groups

Security groups control who gets access to shared resources like file servers, printers, and applications. By placing each group inside its matching OU, you keep the directory organized and easy to manage.

  • Create a security group for each department by running these commands:
New-ADGroup -Name "IT-Staff" -GroupScope Global -GroupCategory Security -Path "OU=IT,DC=intechlab,DC=local"
New-ADGroup -Name "HR-Staff" -GroupScope Global -GroupCategory Security -Path "OU=HR,DC=intechlab,DC=local"
New-ADGroup -Name "Finance-Staff" -GroupScope Global -GroupCategory Security -Path "OU=Finance,DC=intechlab,DC=local"

What do these parameters mean?

  • -GroupScope Global means this group can contain members from the same domain and be granted permissions in any domain within the forest.
  • -GroupCategory Security makes this a security group (used for permissions) rather than a distribution group (used for email lists).
  • -Path places each group inside its department's OU. For example, IT-Staff lives inside the IT OU you just created.

Again, no output means success. If no errors appeared, all three groups now exist inside their respective OUs.

Getting an OU path error on the group commands?

  • The -Path now includes the OU prefix: OU=IT,DC=intechlab,DC=local. Make sure you have OU= before the department name.
  • If the OU creation commands from the previous substep failed silently, the OUs may not exist. Re-run those commands first.

Ask for help: Why is my New-ADGroup command failing when specifying the OU path?

Verify the structure
  • Confirm all three OUs exist by running:
Get-ADOrganizationalUnit -Filter *

You should see your three new OUs (IT, HR, Finance) listed alongside the default Domain Controllers OU. Each entry shows a DistinguishedName confirming it lives at DC=intechlab,DC=local.

  • Confirm all three security groups exist by running:
Get-ADGroup -Filter *

You should see IT-Staff, HR-Staff, and Finance-Staff in the output, along with the built-in default groups that Active Directory creates automatically.

Don't see your OUs or groups?

  • If the OUs or groups are missing, re-run the creation commands from the substeps above. Look carefully at the error message for typos in the path.
  • Make sure you're running PowerShell as Administrator. Standard user sessions cannot query Active Directory objects.

Ask for help: Why aren't my OUs or security groups showing up in Get-ADOrganizationalUnit or Get-ADGroup?

Your Active Directory now has a clean departmental structure. Next up, you'll write a PowerShell script that automatically creates users from a CSV file and drops them into the correct OUs and groups.

Automate User Onboarding with PowerShell

Your Active Directory structure is ready with departments and security groups in place.

In a real organization, IT teams onboard multiple employees at once. Typing each user's details manually is slow and error-prone. Instead, you'll use a CSV file combined with a PowerShell script to automate the entire process.

In this step, get ready to:
  • Create a CSV file with employee data.
  • Write a PowerShell script to bulk-create AD users.
  • Run the script and verify user accounts exist.
Create the CSV file

CSV files store tabular data as plain text, with each row representing one record and commas separating the fields. Your script will read this file row by row to create each user account.

  • In your RDP session, open Notepad by right-clicking the Start menu and selecting Run, then typing notepad and pressing Enter.
  • Paste the following content into Notepad:
FirstName,LastName,Department,Title,Password
Ravi,Kumar,IT,Systems Engineer,P@ssw0rd2024!
Priya,Sharma,HR,HR Coordinator,P@ssw0rd2024!
Amit,Patel,Finance,Financial Analyst,P@ssw0rd2024!
Sneha,Reddy,IT,Network Administrator,P@ssw0rd2024!
Vikram,Singh,Finance,Accountant,P@ssw0rd2024!

What does this data represent?

Each row is one employee to onboard. The columns map directly to Active Directory user properties.

  • FirstName and LastName set the user's display identity.
  • Department determines which OU and security group the user is placed in.
  • Password is a temporary password the user must change at first login.
  • Click File > Save As.
  • In the Save as type dropdown, select All Files (*.*).
  • Navigate to C:\Users and name the file newusers.csv.
  • Click Save.
  • Confirm the file exists by running this in your PowerShell window:
Get-Content C:\Users\newusers.csv

You should see all six lines (the header row plus five employee rows) printed in your terminal.

Seeing a file not found error?

  • Make sure you saved to C:\Users\ and not a subfolder like C:\Users\YourAdminName\.
  • Check that you selected All Files (*.*) in Notepad's Save As dialog. Without this, Notepad may have saved it as newusers.csv.txt.

Help me troubleshoot my CSV file not being found in PowerShell.

✔️ Awesome, I've got everything!

Great. Make sure Notepad is closed so the file isn't locked.

ⓧ I'd like to double check the full code

FirstName,LastName,Department,Title,Password
Ravi,Kumar,IT,Systems Engineer,P@ssw0rd2024!
Priya,Sharma,HR,HR Coordinator,P@ssw0rd2024!
Amit,Patel,Finance,Financial Analyst,P@ssw0rd2024!
Sneha,Reddy,IT,Network Administrator,P@ssw0rd2024!
Vikram,Singh,Finance,Accountant,P@ssw0rd2024!
Write the bulk user creation script

This script reads each row from the CSV and performs three actions per user: create the AD account in the correct OU, set their properties, and add them to the matching security group.

  • Open a new Notepad window by right-clicking Start > Run, typing notepad, and pressing Enter.
  • Paste the following script into Notepad:
# Bulk AD User Creation Script
# This script reads from a CSV file and creates Active Directory users
# with appropriate OU placement and group membership

Import-Module ActiveDirectory

$csvPath = "C:\Users\newusers.csv"
$domain = "intechlab.local"
$users = Import-Csv -Path $csvPath

foreach ($user in $users) {
    $firstName = $user.FirstName
    $lastName = $user.LastName
    $department = $user.Department
    $title = $user.Title
    $password = ConvertTo-SecureString $user.Password -AsPlainText -Force

    $samAccountName = ($firstName.Substring(0,1) + $lastName).ToLower()
    $userPrincipalName = "$samAccountName@$domain"
    $displayName = "$firstName $lastName"
    $path = "OU=$department,DC=intechlab,DC=local"
    $groupName = "$department-Staff"

    try {
        New-ADUser `
            -Name $displayName `
            -GivenName $firstName `
            -Surname $lastName `
            -SamAccountName $samAccountName `
            -UserPrincipalName $userPrincipalName `
            -DisplayName $displayName `
            -Title $title `
            -Department $department `
            -Path $path `
            -AccountPassword $password `
            -Enabled $true `
            -ChangePasswordAtLogon $true

        Add-ADGroupMember -Identity $groupName -Members $samAccountName

        Write-Host "Created user: $displayName in $department" -ForegroundColor Green
    }
    catch {
        Write-Host "Error creating user $displayName : $_" -ForegroundColor Red
    }
}

Write-Host "`nUser creation complete!" -ForegroundColor Cyan
Write-Host "Total users processed: $($users.Count)" -ForegroundColor Cyan

What does this script do?

  • Import-Module ActiveDirectory loads the AD cmdlets so the script can create users and manage groups.
  • Import-Csv reads each row into a PowerShell object where column headers become property names (e.g. $user.FirstName).
  • $samAccountName builds a username from the first initial plus last name, all lowercase (e.g. Ravi Kumar becomes rkumar).
  • $path places the user in the correct Organizational Unit based on their department column.
  • New-ADUser creates the account with all properties set in one command.
  • Add-ADGroupMember adds the new user to their department's security group (e.g. IT-Staff).
  • The try/catch block handles errors gracefully so one failed user doesn't stop the entire batch.
  • Click File > Save As.
  • In the Save as type dropdown, select All Files (*.*).
  • Navigate to C:\Users and name the file Create-ADUsers.ps1.
  • Click Save.

You can close Notepad after saving.

Worried about typos in the script?

Copy and paste the entire script in one go rather than typing it out. Make sure you selected All Files (*.*) in the Save As dialog so the file extension is .ps1 and not .ps1.txt.

Help me verify my script file was saved correctly.

✔️ Awesome, I've got everything!

Great. Double check you saved the file in C:\Users so it sits alongside your CSV.

ⓧ I'd like to double check the full code

# Bulk AD User Creation Script
# This script reads from a CSV file and creates Active Directory users
# with appropriate OU placement and group membership

Import-Module ActiveDirectory

$csvPath = "C:\Users\newusers.csv"
$domain = "intechlab.local"
$users = Import-Csv -Path $csvPath

foreach ($user in $users) {
    $firstName = $user.FirstName
    $lastName = $user.LastName
    $department = $user.Department
    $title = $user.Title
    $password = ConvertTo-SecureString $user.Password -AsPlainText -Force

    $samAccountName = ($firstName.Substring(0,1) + $lastName).ToLower()
    $userPrincipalName = "$samAccountName@$domain"
    $displayName = "$firstName $lastName"
    $path = "OU=$department,DC=intechlab,DC=local"
    $groupName = "$department-Staff"

    try {
        New-ADUser `
            -Name $displayName `
            -GivenName $firstName `
            -Surname $lastName `
            -SamAccountName $samAccountName `
            -UserPrincipalName $userPrincipalName `
            -DisplayName $displayName `
            -Title $title `
            -Department $department `
            -Path $path `
            -AccountPassword $password `
            -Enabled $true `
            -ChangePasswordAtLogon $true

        Add-ADGroupMember -Identity $groupName -Members $samAccountName

        Write-Host "Created user: $displayName in $department" -ForegroundColor Green
    }
    catch {
        Write-Host "Error creating user $displayName : $_" -ForegroundColor Red
    }
}

Write-Host "`nUser creation complete!" -ForegroundColor Cyan
Write-Host "Total users processed: $($users.Count)" -ForegroundColor Cyan
Run and verify the script

With both files saved, you can now execute the script and watch it create all five users in seconds.

  • Before running scripts, you need to allow local script execution. Set the execution policy by running this command in your PowerShell window:
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope LocalMachine

What does this command do?

Windows Server blocks script execution by default as a safety measure. The RemoteSigned policy allows locally created scripts to run while still requiring downloaded scripts to be digitally signed.

  • When prompted to confirm the policy change, type Y and press Enter.
  • Navigate to the folder where your script is saved and run it:
cd C:\Users
.\Create-ADUsers.ps1

You should see five green lines, each saying "Created user:" followed by the person's name and department. The final line reads "User creation complete!" in cyan.

Seeing red error messages?

  • If you see "The term 'New-ADUser' is not recognized", your PowerShell session may not have the Active Directory module loaded. Run Import-Module ActiveDirectory manually, then try the script again.
  • If you see a path error mentioning an OU, confirm that the OU names you created earlier (IT, HR, Finance) match the Department column in your CSV exactly. The match is case-sensitive.
  • If you see a script execution error, make sure you ran the Set-ExecutionPolicy command above and confirmed with Y.

Help me debug errors when running my AD user creation script.

  • Verify the users were created by running:
Get-ADUser -Filter * -Properties Department,Title | Format-Table Name,Department,Title

You should see a table listing all five new users (Ravi Kumar, Priya Sharma, Amit Patel, Sneha Reddy, Vikram Singh) alongside the default Administrator and Guest accounts.

  • Verify group membership by checking one of the security groups:
Get-ADGroupMember -Identity "IT-Staff"

You should see rkumar and sreddy listed as members of the IT-Staff group.

Why is this automation valuable?

You just onboarded five users in seconds. In a production environment, the same script handles 50 or 500 users with no extra effort.

This is exactly what hiring managers mean by "automate user lifecycle management" in Junior SysAdmin job descriptions. The CSV-driven approach also creates a paper trail that HR and audit teams can review.

Secret mission

Build an AD Health Report Script

You've built the foundation. Now build a script that a real sysadmin would run every morning: an Active Directory health report that flags disabled accounts, expired passwords, and users who haven't logged in for 30+ days. This is the kind of proactive monitoring that separates a reactive admin from a proactive one.

Clean Up Your Resources

Clean Up Your Resources

This project uses Azure's free tier, which provides 750 hours per month of B1s VM compute at no charge for 12 months. Decide whether to keep your resources running, pause them to come back later, or delete them entirely.

Cost warning

If your 12-month Azure free tier benefit expires or you exceed 750 hours of B1s VM usage in a single month, pay-as-you-go charges will apply. Always monitor your billing at Cost Management + Billing in the Azure Portal.

Resources you used:

  • Azure Windows Server 2022 VM (B1s size).
  • Associated Azure resources: OS disk, Network Interface, Public IP, Network Security Group, Virtual Network.
  • Windows App on your Mac (RDP client).

Keep everything running

No action needed. Choose this if you are still actively building or practicing Active Directory management.

  • The B1s VM is covered by Azure's free tier for 750 hours per month. That is enough to run it 24/7 for a full month.
  • Monitor your usage by navigating to Cost Management + Billing in the Azure Portal.
  • Windows App stays installed on your Mac for future RDP sessions.

Pause - I'll come back to this later

Stop (deallocate) the VM to release compute resources and stop compute billing while keeping your disk and configuration intact.

  • In the Azure Portal, search for Virtual machines in the top search bar and select it.
  • Click on your Windows Server VM to open its Overview page.
  • Click Stop in the command bar at the top of the page.
  • Confirm by clicking Yes on the confirmation dialog.
  • Wait until the VM status shows Stopped (deallocated). This confirms compute charges have stopped.

Will I still be charged anything?

When a VM is deallocated, you stop paying for compute. A small storage cost may apply for the OS disk if your free tier storage allowance is consumed. To restart the VM later, return to the same Overview page and click Start.

Delete - I don't want to use this again

Remove all Azure resources permanently. This is irreversible and stops all charges.

  • In the Azure Portal, search for Resource groups in the top search bar and select it.
  • Click on the resource group that contains your Windows Server VM.
  • Click Delete resource group at the top of the page.
  • Type the resource group name to confirm deletion.
  • Click Delete. This removes the VM, OS disk, Network Interface, Public IP, Network Security Group, and Virtual Network.
  • To remove Windows App from your Mac, open Launchpad, find Windows App, press and hold the Option key, then click the X that appears on the icon to delete it.

What about my Azure account?

Deleting the resource group removes all project resources but does not close your Azure account. You can keep the account for future projects at no cost as long as no resources are running.

Nice Work!

Nice Work!

You just built a fully functional Active Directory lab environment on Azure and automated user management with PowerShell. These are the exact skills that Junior System Administrator roles demand every single day.

You've learned how to:

  • Deploy a Windows Server 2022 VM on Azure and promote it to a Domain Controller running Active Directory Domain Services.
  • Create an organizational structure with Organizational Units and Security Groups for department-based access control.
  • Write a PowerShell automation script that bulk-creates users from a CSV file, places them in the correct OU, and assigns group membership.
  • Built an AD health monitoring script that reports on disabled accounts, expired passwords, and inactive users for proactive system administration.

Ready to quiz yourself?