Security-auditing

LastLogonDate can be up to two weeks stale. This PowerShell script queries the non-replicated LastLogon attribute on every domain controller directly and returns the real answer.

A PowerShell script to list Active Directory user accounts whose expiration date has already passed, flagging any that are still enabled.

A PowerShell script to list deleted Active Directory user accounts still sitting in the AD Recycle Bin — plus how to check whether the Recycle Bin is even enabled, and how to actually restore what you find.

A PowerShell script to export a group-level inventory of every group in Active Directory, with category, scope, manager, and member count, flagging empty groups.

A PowerShell script that resolves a user's complete Active Directory group membership, including groups they only belong to through nested membership — the thing MemberOf alone can't tell you.