https://sysflint.com/blog SysFlint builds cybersecurity and Active Directory administration tools, starting with a SysFlint AD. en-us undefined (SysFlint) undefined (SysFlint) Fri, 28 Aug 2026 00:00:00 GMT https://sysflint.com/blog/user-manager-report-active-directory https://sysflint.com/blog/user-manager-report-active-directory A PowerShell script to report each Active Directory user's assigned manager, resolved to a readable name, flagging anyone with no manager set. Fri, 28 Aug 2026 00:00:00 GMT undefined (SysFlint) active-directorypowershelldirectory-management https://sysflint.com/blog/find-user-last-logon-active-directory https://sysflint.com/blog/find-user-last-logon-active-directory LastLogonDate can be up to two weeks stale. This PowerShell script queries the non-replicated LastLogon attribute on every domain controller directly and returns the real answer. Thu, 27 Aug 2026 00:00:00 GMT undefined (SysFlint) active-directorypowershellsecurity-auditing https://sysflint.com/blog/users-in-ou-active-directory https://sysflint.com/blog/users-in-ou-active-directory A PowerShell script to list every user in a specific Active Directory OU, including sub-OUs by default, before applying a GPO or handing the OU off to a delegated admin. Thu, 27 Aug 2026 00:00:00 GMT undefined (SysFlint) active-directorypowershelldirectory-management https://sysflint.com/blog/find-expired-accounts-active-directory https://sysflint.com/blog/find-expired-accounts-active-directory A PowerShell script to list Active Directory user accounts whose expiration date has already passed, flagging any that are still enabled. Wed, 26 Aug 2026 00:00:00 GMT undefined (SysFlint) active-directorypowershellsecurity-auditing https://sysflint.com/blog/find-deleted-users-active-directory https://sysflint.com/blog/find-deleted-users-active-directory A PowerShell script to list deleted Active Directory user accounts still sitting in the AD Recycle Bin — plus how to check whether the Recycle Bin is even enabled, and how to actually restore what you find. Tue, 25 Aug 2026 00:00:00 GMT undefined (SysFlint) active-directorypowershellsecurity-auditing https://sysflint.com/blog/groups-inventory-export-active-directory https://sysflint.com/blog/groups-inventory-export-active-directory A PowerShell script to export a group-level inventory of every group in Active Directory, with category, scope, manager, and member count, flagging empty groups. Tue, 25 Aug 2026 00:00:00 GMT undefined (SysFlint) active-directorypowershellsecurity-auditing https://sysflint.com/blog/domain-controllers-report-active-directory https://sysflint.com/blog/domain-controllers-report-active-directory A PowerShell script to report every domain controller with site, global catalog status, and FSMO roles held. Mon, 24 Aug 2026 00:00:00 GMT undefined (SysFlint) active-directorypowershelldirectory-management https://sysflint.com/blog/distribution-group-members-active-directory https://sysflint.com/blog/distribution-group-members-active-directory A PowerShell script to list a distribution group's members with their email addresses, including contacts, and flag members who have no email set. Sun, 23 Aug 2026 00:00:00 GMT undefined (SysFlint) active-directorypowershelldirectory-management https://sysflint.com/blog/nested-group-membership-active-directory https://sysflint.com/blog/nested-group-membership-active-directory A PowerShell script that resolves a user's complete Active Directory group membership, including groups they only belong to through nested membership — the thing MemberOf alone can't tell you. Sun, 23 Aug 2026 00:00:00 GMT undefined (SysFlint) active-directorypowershellsecurity-auditing https://sysflint.com/blog/computer-last-logon-active-directory https://sysflint.com/blog/computer-last-logon-active-directory A PowerShell script to find a computer account's true last logon time by checking the non-replicated LastLogon attribute on every domain controller. Sat, 22 Aug 2026 00:00:00 GMT undefined (SysFlint) active-directorypowershellsecurity-auditing https://sysflint.com/blog/domain-admins-report-active-directory https://sysflint.com/blog/domain-admins-report-active-directory A PowerShell script that recursively lists every member of Domain Admins, Enterprise Admins, and Schema Admins — including nested group membership — and flags the stale ones nobody has looked at in months. Fri, 21 Aug 2026 00:00:00 GMT undefined (SysFlint) active-directorypowershellsecurity-auditing https://sysflint.com/blog/group-membership-change-audit-active-directory https://sysflint.com/blog/group-membership-change-audit-active-directory A PowerShell script to audit who added or removed members from Active Directory groups, pulled from the Security event log across every domain controller. Fri, 21 Aug 2026 00:00:00 GMT undefined (SysFlint) active-directorypowershellsecurity-auditing https://sysflint.com/blog/bad-password-attempts-active-directory https://sysflint.com/blog/bad-password-attempts-active-directory A PowerShell script to list Active Directory users with recent bad password attempts and current lockout status, for spotting brute-force attempts or stale saved credentials. Thu, 20 Aug 2026 00:00:00 GMT undefined (SysFlint) active-directorypowershellsecurity-auditing https://sysflint.com/blog/find-inactive-computers-active-directory https://sysflint.com/blog/find-inactive-computers-active-directory A PowerShell script to list stale Active Directory computer accounts — the decommissioned machines nobody cleaned up, still bloating GPO processing and inventory counts. Wed, 19 Aug 2026 00:00:00 GMT undefined (SysFlint) active-directorypowershellsecurity-auditing https://sysflint.com/blog/find-server-computers-active-directory https://sysflint.com/blog/find-server-computers-active-directory A PowerShell script to list every server computer account in Active Directory, flagging which ones are domain controllers. Wed, 19 Aug 2026 00:00:00 GMT undefined (SysFlint) active-directorypowershelldirectory-management https://sysflint.com/blog/computer-inventory-report-active-directory https://sysflint.com/blog/computer-inventory-report-active-directory A PowerShell script to report every computer account in Active Directory with OS, enabled status, last logon date, and IP address. Tue, 18 Aug 2026 00:00:00 GMT undefined (SysFlint) active-directorypowershelldirectory-management https://sysflint.com/blog/contacts-report-active-directory https://sysflint.com/blog/contacts-report-active-directory A PowerShell script to report every contact object in Active Directory, flagging any with no email address set. Mon, 17 Aug 2026 00:00:00 GMT undefined (SysFlint) active-directorypowershelldirectory-management https://sysflint.com/blog/find-inactive-users-active-directory https://sysflint.com/blog/find-inactive-users-active-directory A PowerShell script to list every enabled Active Directory user who has not logged on in 90+ days (configurable) — the accounts still enabled, still a live attack surface, and nobody watching them. Mon, 17 Aug 2026 00:00:00 GMT undefined (SysFlint) active-directorypowershellsecurity-auditing https://sysflint.com/blog/group-membership-report-active-directory https://sysflint.com/blog/group-membership-report-active-directory A PowerShell script to bulk-export a group-to-member report for every group in Active Directory at once, for a full access-control review. Sun, 16 Aug 2026 00:00:00 GMT undefined (SysFlint) active-directorypowershellsecurity-auditing https://sysflint.com/blog/find-expiring-passwords-active-directory https://sysflint.com/blog/find-expiring-passwords-active-directory There is no PasswordExpiryDate attribute to filter on — this PowerShell script calculates it from PasswordLastSet and your domain (or fine-grained) password policy, and lists everyone expiring soon. Sat, 15 Aug 2026 00:00:00 GMT undefined (SysFlint) active-directorypowershellsecurity-auditing https://sysflint.com/blog/user-logon-history-active-directory https://sysflint.com/blog/user-logon-history-active-directory A PowerShell script to pull a user logon history from the Security event log across every domain controller, with logon type translated into plain English. Sat, 15 Aug 2026 00:00:00 GMT undefined (SysFlint) active-directorypowershellsecurity-auditing https://sysflint.com/blog/organizational-units-report-active-directory https://sysflint.com/blog/organizational-units-report-active-directory A PowerShell script to report every Organizational Unit in Active Directory with object counts, GPO links, and delete-protection status, for finding empty or unprotected OUs. Fri, 14 Aug 2026 00:00:00 GMT undefined (SysFlint) active-directorypowershelldirectory-management https://sysflint.com/blog/find-password-never-expires-users-active-directory https://sysflint.com/blog/find-password-never-expires-users-active-directory A PowerShell script to list every Active Directory account with the PasswordNeverExpires flag set — a near-universal finding in security audits, and worth reviewing on a schedule, not just once. Thu, 13 Aug 2026 00:00:00 GMT undefined (SysFlint) active-directorypowershellsecurity-auditing https://sysflint.com/blog/security-group-members-active-directory https://sysflint.com/blog/security-group-members-active-directory A PowerShell script to list every member of an Active Directory security group, including contacts that Get-ADGroupMember silently skips. Thu, 13 Aug 2026 00:00:00 GMT undefined (SysFlint) active-directorypowershellsecurity-auditing https://sysflint.com/blog/password-last-set-report-active-directory https://sysflint.com/blog/password-last-set-report-active-directory A PowerShell script to report when every Active Directory user last changed their password, with calculated age in days and flags for accounts that have never had one set. Wed, 12 Aug 2026 00:00:00 GMT undefined (SysFlint) active-directorypowershellsecurity-auditingpassword-policy https://sysflint.com/blog/account-expiry-report-active-directory https://sysflint.com/blog/account-expiry-report-active-directory A PowerShell script to report every Active Directory account with an expiration date set, flagging which ones have already expired. Tue, 11 Aug 2026 00:00:00 GMT undefined (SysFlint) active-directorypowershellsecurity-auditing https://sysflint.com/blog/find-account-lockout-source-active-directory https://sysflint.com/blog/find-account-lockout-source-active-directory Knowing an account is locked out is only half the answer — this PowerShell script checks Event ID 4740 across every domain controller to find the computer that actually caused it. Tue, 11 Aug 2026 00:00:00 GMT undefined (SysFlint) active-directorypowershellsecurity-auditing https://sysflint.com/blog/find-enabled-users-active-directory https://sysflint.com/blog/find-enabled-users-active-directory A PowerShell one-liner and a full reporting script to list every enabled user account in Active Directory, plus the GUI method. Mon, 10 Aug 2026 00:00:00 GMT undefined (SysFlint) active-directorypowershellsecurity-auditing https://sysflint.com/blog/find-locked-out-users-active-directory https://sysflint.com/blog/find-locked-out-users-active-directory A PowerShell script to list every currently locked-out user account in Active Directory, with bad-password counts and timestamps — plus why Search-ADAccount, not Get-ADUser -Filter, is the cmdlet you actually need. Sun, 09 Aug 2026 00:00:00 GMT undefined (SysFlint) active-directorypowershellsecurity-auditing https://sysflint.com/blog/ou-delegated-permissions-active-directory https://sysflint.com/blog/ou-delegated-permissions-active-directory A PowerShell script to report exactly who has been delegated permissions on an Active Directory OU, filtering out the built-in defaults so only real delegations show up. Sun, 09 Aug 2026 00:00:00 GMT undefined (SysFlint) active-directorypowershellsecurity-auditingaccess-control https://sysflint.com/blog/find-disabled-users-active-directory https://sysflint.com/blog/find-disabled-users-active-directory A PowerShell one-liner and a full reporting script to list every disabled user account in Active Directory, plus the GUI method — and where the manual approach starts to break down. Tue, 28 Jul 2026 00:00:00 GMT undefined (SysFlint) active-directorypowershellsecurity-auditing