Powershell script for Soon-to-expire AD users

Question 1

So I finally decided to revisit this script, after many, many months. I'm get a little better at PowerShell and while I'm sure this isn't the most effective way to do it, this is something that works for me.

I've also changed the input method; it pulls the information directly from AD, instead of using a CSV file that used to be generated from an application called 'AD Manager Plus' (Hate it).

Remember, using Quest CMDlets here because we don't have a 2008 environment. (so using Get-QADUser instead of Get-ADuser)

FYI, I have only posted the code here which sorts out the data into separate tables - you can decide how you want to utilize those results. For our environment, I have it build an nice HTML table and body, then send it to the appropriate manager to deal with.

#user data input
$data = get-qaduser -SizeLimit 0 -includedproperties accountexpires | where {$_.AccountExpires -ne $null -and $_.AccountExpires -le ((Get-Date).AddDays(45)) }

#get a list of managers, unique.
$uniqueMan = $data | select Manager -Unique

#foreach manager from $uniqueman
Foreach ($manager in $uniqueman) {
    #create the array variable / clear it out for the next manager.
    $myarray = @()
            #foreach User found in in $data query
            Foreach ($user in $data) {

            #Search the $user's query for people with the same manager as that of the $uniqueman list.
            If ($user.Manager -eq $manager.Manager) {

                    #do what with the result.
                    #add the person to an array
                    $myarray += New-Object psobject -Property @{
                        Name = $user.'Name'
                        UserName = $user.'SAMAccountName'
                        AccountExpires = $user.'AccountExpires'
                        Manager = $user.Manager
                        }


            }


    #for testing, to output the results to an HTML file.
    #$myarray | ConvertTo-Html | Out-File ("C:\test\" + $manager.Manager + ".html")

        }


}

Question 2

For this you need to defer e-mail processing. Collect the users in a hashtable, e.g. by manager e-mail address:

...

$expiringUsers = @{}

foreach ($i in $datai) {
  If ($i.'Domain Name' -notmatch "RANDOM.DOMAIN") {
    ...
    if ($expiringUsers.Contains($emailAD)) {
      $expiringUsers[$emailAD]["dn"] += $dn
    } else {
      $expiringUsers[$emailAD] = @{
        "dn1" = $dn1
        "aet" = $aet
        "man" = $man
        "dn"  = @( $dn )
      }
    }
  }
}

and move the actual e-mail processing outside the loop:

foreach ($emailAD in $expiringUsers.Keys) {
  $dn1 = $expiringUsers[$emailAD]["dn1"]
  $man = $expiringUsers[$emailAD]["man"]
  $aet = $expiringUsers[$emailAD]["aet"]
  $subject = "Account about to expire: $($expiringUsers[$emailAD]["dn"])"
  $content = @"
Hi,
...
Technology Services
"@
  Send-MailMessage -from "Test Script - Powershell <email@test.com>" `
    -To "$emailAD" `
    -Subject $subject `
    -Body $content `
    -Priority high `
    -smtpServer servername
  Write-Host "Mail Sent to $man"
}

Note that for simplicity reasons the above code only records the expiry date of the first user. If you want the expiry date of each user recorded separately, you'll have to take additonal steps, e.g.

$expiringUsers[$emailAD]["expiry"] += @{
  "name" = $dn;
  "date" = $aet;
}

instead of

$expiringUsers[$emailAD]["dn"] += $dn