Check User Account State

This is an interactive task that allows the user to check the state of an Active Directory user account.

The user will also have the option to view the account's group memberships.

Playbook Files

This playbook was built for PPA version 3.3

# The task was built to work with these plugin versions.
plugins:
  active_directory: ^13.0
  hashicorp_vault: ^8.0
  ppa: ^11.4
  ppa_tools: ^11.0


steps:


  - name: Greeting
    actions:

      - ppa.ui.output_markdown:
          doc: >
            {{ globals.icons.active_directory.full }}


            #### Active Directory - User Status Check


            Use this task to view the details of an Active Directory user.


            You will need to:


            - Search for the Active Directory user


            - Choose whether to view the user's group memberships


      - ppa.ui.input_accept:
          text: Start


  - name: Get Secrets
    actions:

      - hashicorp_vault.key_value.read_secret_keys:
          secret: active_directory
          reason: Getting Active Directory details
          keys:
            - name: address
            - name: domain
            - name: username
            - name: password
              sensitive: true
          create_missing: true
        save: domain_controller


  - name: Search for Active Directory User
    actions:

      - active_directory.users.get_interactive:
        load:
          domain_controller: domain_controller
        save: active_directory_user


  - name: Get Extra Properties
    actions:

      - active_directory.users.password_has_expired:
        load:
          distinguishedName: active_directory_user.distinguishedName
          domain_controller: domain_controller
        save: password_has_expired

      - active_directory.users.password_will_expire:
        load:
          distinguishedName: active_directory_user.distinguishedName
          domain_controller: domain_controller
        save: password_will_expire


  - name: Display User State
    actions:

      - ppa.ui.output_markdown:
          doc: >

            ## Information


            **SAM Account Name:** {{ active_directory_user.sAMAccountName }}


            **Email Address:** {{ active_directory_user.mail }}


            **Account Expires:** {{ active_directory_user.accountExpires or "Never" }}


            **Last Logon:** {{ active_directory_user.lastLogonTimestamp }}


            ## Account State


            **Enabled:** {{ active_directory_user.is_enabled }}


            **Locked:** {{ active_directory_user.is_locked }}


            **Expired:** {{ active_directory_user.is_expired }}


            ## Password State


            **Expired:** {{ password_has_expired }}


            **Will Expire:** {{ password_will_expire }}

            {% if active_directory_user.password_age is not none %}

            **Age:**

            - Days: {{ active_directory_user.password_age.days }}

            - Hours: {{ active_directory_user.password_age.hours }}

            - Minutes: {{ active_directory_user.password_age.minutes }}

            {% else %}

            _The user does not have a password age in Active Directory, has their password been set?_

            {% endif %}


  - name: Ask To Check Group Memberships
    actions:

      - ppa.ui.input_confirm:
          text: View Group Memberships?
          confirm: Yes
          cancel: No
        save: view_groups


  - name: Exit If Not Auditing Group Memberships
    when: not view_groups
    actions:

      - ppa.ui.output_info:
          text: The group memberships will not be audited, goodbye!

      - exit:
          exit_code: 0


  - name: Get Direct Memberships
    actions:

      - ppa.ui.output_progress:
          text: Auditing group memberships...
          percent: null
          element_id: audit_memberships

      - active_directory.users.group_memberships:
          nested: false
        load:
          distinguishedName: active_directory_user.distinguishedName
          domain_controller: domain_controller
        save: direct_memberships

      - active_directory.users.group_memberships:
          nested: true
        load:
          distinguishedName: active_directory_user.distinguishedName
          domain_controller: domain_controller
        save: nested_memberships

      # All groups that don't exist in direct memberships will be nested memberships.
      - ppa_tools.lists.difference:
        load:
          first: nested_memberships
          second: direct_memberships
        save: nested_memberships

      # All groups that don't exist in nested memberships will be direct memberships.
      - ppa_tools.lists.difference:
        load:
          first: direct_memberships
          second: nested_memberships
        save: direct_memberships

      # Create the "Direct Memberships" tab
      - ppa_tools.dictionaries.create:
        load:
          Direct: direct_memberships
          Nested: nested_memberships
        save: tabs

      - ppa.ui.output_progress:
          text: Audited group memberships
          percent: 100
          element_id: audit_memberships


  - name: Display Group Memberships
    actions:

      - active_directory.groups.display_tabbed:
          text: All group memberships for {{ active_directory_user.sAMAccountName }}
        load:
          tabs: tabs

      - ppa.ui.input_accept:
          text: Done

Running this Playbook

Click download playbook
Import the playbook on the Playbooks page in PPA
Build the playbook from the Edit & Build tab
Run the playbook from the Preview & Deploy tab

Integrations

PPA User Interface
Hashicorp Vault Key-Value engine
Active Directory Users
PPA Tools Dictionaries

Required Vault Details

Active Directory

IP/DNS address of a Domain Controller
Domain FQDN
Username
Password

The Active Directory credentials require permission to read user account information.

Vault Configuration Wizard

The first time you run a task built from this playbook, PPA will check the required Vault details exist.

If they don't exist, PPA will ask you to supply the details at the start of the task.

Below you can see a user providing details the first time they run an Active Directory task.

vault-config-wizard

Once the details are added to Vault, the task won't ask for them again.

If you don't know the required details, ask an administrator to run the task or configure Vault manually.

What the Task Does

Once started, this task allows the operator to:

Search for and select an Active Directory user
View various account attributes & statistics
Optionally view the account's direct & nested group memberships

See our other playbooks

Get PPA for free!

Start automating your estate with a free 30 day trial today. No signup required!

Get PPA Express

Documentation

Installation Guide
See how easy it is to get started with our installation guide
Playbooks
View our task writing reference guide
Plugins
See how to integrate with different systems using our plugins reference guide.