WinAdmin Kit
A PowerShell module for the help desk tasks that come up every week: onboarding a new hire in
Active Directory, resetting a password, giving a team access to a shared folder and checking the network
when someone says "the internet is slow". Every change supports -WhatIf, refuses risky cases
and writes a line to an action log. Passwords are never logged.
New-OnboardingUser
Creates the account from HR's list: first.last without accents, a number added when the name is taken, random temporary password that must be changed at first logon, groups added one by one so a missing group does not stop the rest.
# check first, then run Import-Csv .\samples\new-hires.csv -Encoding UTF8 | New-OnboardingUser -UpnSuffix corp.example -WhatIf SamAccountName UserPrincipalName Groups -------------- ----------------- ------ ana.ribeiro ana.ribeiro@corp.example {GG-Finance, GG-VPN} joao.pereira joao.pereira@corp.example {GG-IT, GG-VPN, GG-RemoteDesktop} mariana.alves mariana.alves@corp.example {GG-Sales, GG-CRM} carlos.lima carlos.lima@corp.example {GG-Operations} beatriz.goncalves beatriz.goncalves@corp.example {GG-Finance} ana.ribeiro2 ana.ribeiro2@corp.example {GG-Sales}
Reset-UserPassword
Resets the password, unlocks the account if it was locked and sets "change at next logon". Refuses
disabled accounts and privileged ones (adminCount = 1) unless -AllowPrivileged is given, so a
help desk run cannot reset an administrator by mistake.
Reset-UserPassword -Identity ana.ribeiro SamAccountName Unlocked MustChangeAtLogon TemporaryPassword -------------- -------- ----------------- ----------------- ana.ribeiro True True System.Security.SecureString Reset-UserPassword -Identity adm.helpdesk Reset-UserPassword : adm.helpdesk is a privileged account. Use -AllowPrivileged if this reset is approved.
Grant-FolderAccess
Adds an NTFS allow rule for a group (or user) on a folder, for the folder only or for everything below it. Running it again changes nothing, so the same CSV can be applied after every new share.
Import-Csv .\samples\folder-access.csv | Grant-FolderAccess
Path Identity Rights Result
---- -------- ------ ------
\\fs01\Finance\Reports CORP\GG-Finance-Read ReadAndExecute Added
\\fs01\Finance\Reports CORP\GG-Finance-Write Modify Added
\\fs01\Sales\Proposals CORP\GG-Sales Modify AlreadyPresent
\\fs01\Public CORP\Domain Users ReadAndExecute Added
Get-NetworkReport
Reads a list of hosts and ports, then checks name resolution, ping and the TCP port of each one. Writes
an HTML page for the ticket and a CSV. gateway and dns stand for this machine's
own gateway and DNS server.
Get-NetworkReport -TargetFile .\samples\network-targets.csv `
-OutputDirectory .\reports
OK 4 · Warning 2 · Fail 1
Label printer 192.0.2.25 port 9100 closed or filtered
Email ... 33% ping loss; slow: 168.4 ms
Intranet ... ping blocked, port open
Export-NetworkSnapshot
Collects the state of the whole network into one JSON file for the dashboard: machines that do not answer, ports open that are not on the list (Telnet, RDP, VNC...) or listed and closed, disk space over CIM, locked accounts and passwords that expire in the next 14 days. The page only reads the file; it never connects to the network.
Export-NetworkSnapshot -MachineFile .\samples\machines.csv -IncludeAD `
-Path .\network-snapshot.json
27 machines · 24 online · 3 disks above 85% · 5 ports not on the list
2 locked accounts · 4 passwords expiring (1 already expired)
Sample network report
Made from the sample results in samples/network-results.json, which use
documentation addresses.
What the tests check
- Account names from the sample new hires, including accents, two-word surnames, long names and a name already taken.
- Every new user is created enabled, in the right OU, with "change password at logon"; the temporary password is returned but never written to the log.
- A group that cannot be added gives a warning and the account is kept; a failed creation skips the groups.
- Password reset unlocks locked accounts, keeps a given password, and refuses privileged, disabled and unknown accounts.
- Folder access is tested on real folders: rule added once, inheritance flags, new files inherit it, CSV input,
-WhatIfchanges nothing. - Network report against a real listening and a closed port on this machine, plus every status rule with stand-in probes, and HTML escaping.
- Snapshot: machines from the CSV and AD merged once, listed and unlisted ports, ping blocked but a port open, disks that cannot be read, locked accounts, passwords about to expire, JSON without a BOM and with the same fields as the sample. The dashboard's numbers are checked with node tests.
The Active Directory cmdlets are replaced by test stand-ins, so the suite runs on any Windows machine without a domain.