A collection of scattered PowerShell scripts, replaced by a single, audited desktop application. Every write to Active Directory or Exchange passes through a mandatory confirmation dialog — nothing happens silently.
The problem with PowerShell scripts
Before AdminSuite, onboarding a new employee meant opening several PowerShell consoles, running scripts from shared network drives and manually pasting the generated password into a helpdesk ticket. Steps got skipped. Accounts landed in the wrong OU. Mailboxes were forgotten.
Main risk: writes to Active Directory happened without any confirmation gate. A typo in the username, choosing the wrong OU or running the wrong version of a script had immediate, hard-to-undo consequences.
AdminSuite solves this with a mandatory confirmation dialog before every write, a structured audit log and a single executable that any member of the IT team can run — no PowerShell knowledge required.
Security and audit model
Every module follows the same four-step write pattern. There are no shortcuts — even changing a single field goes through the full confirmation flow.
Credentials are stored in Windows Credential Manager via P/Invoke to advapi32.dll. On first launch the standard Windows credential dialog appears; subsequent launches silently verify the stored credential against the AD administrators group. If the account loses membership, the credential is cleared automatically.
Audit files land in %APPDATA%\AdminSuite\Audit\audit_YYYY-MM-DD.log — one file per day, human-readable, one entry per operation.
Full automation? Yes — but not with sensitive data
This entire flow — from account creation through the mailbox to group assignment — could be wired up entirely in n8n and run without any human involvement, e.g. triggered by a new record in Personio. Technically nothing stands in the way, and for many processes that's exactly what I do.
For writes to Active Directory and Exchange I deliberately did not do that. These are operations on sensitive data and hard to undo — a typo in a name, the wrong OU or a mismatch in the Personio ↔ AD mapping can cause damage that no log will reverse. So instead of full automation AdminSuite keeps a human in the loop: the live preview shows exactly what will happen, and a single click on “Apply” is the boundary between intent and write.
Principle: automation simplifies what is repetitive — but for irreversible operations it's worth keeping an extra pair of eyes. That's a design decision, not a limitation of the tool.
Modules
Creating an AD account with an Exchange remote mailbox
A three-tab flow: personal and organisational data, group assignment, and then a full summary before execution. The username is generated live from the first initial + surname, with umlaut replacement and conflict resolution via suffix.
The live preview on tab 1 shows the generated username, UPN and automatic password before anything is written to AD. The password is copied to the clipboard immediately after the account is created successfully.
UPN : [email protected]
Display Name : Thomas Müller
Department : IT Infrastructure
Title : System Administrator
Manager : Schmidt, Anna
Phone : +49 89 / … - 142
SELECTED GROUPS
- VPN Access
- Microsoft 365 E3
- All Staff DL
Provisioning an Exchange shared mailbox
Creates a shared mailbox in a hybrid Exchange / Exchange Online environment via PowerShell Remoting. The live preview card updates as you type, showing the final SMTP address, the routing address and the GAL visibility state before a remote session is opened.
Automatic diff between Personio HR and Active Directory
Fetches all employees from Personio API v2 and compares position, department and manager for each matched AD user. The result is a difference table where each row can be selected independently for applying.
Department name resolution works in two stages: first a bulk fetch of organisational units is attempted; if unavailable, the tool falls back to per-user fetches — transparently and without operator intervention.
Mock mode: when no API credentials are configured, the module works on static test employees — the interface and diff logic can be tested without a live Personio tenant.
| USER | FIELD | AD CURRENT | PERSONIO NEW | STATUS | |
|---|---|---|---|---|---|
| k.braun | Title | Junior Developer | Software Engineer | Pending | |
| k.braun | Description | Junior Developer | Software Engineer | Pending | |
| m.weber | Department | Sales | Key Account | Pending | |
| s.hoffmann | Manager | r.klein | a.schmidt | Pending | |
| l.fischer | Title | Werkstudent | Working Student | Applied |
A structured employee deactivation flow
A search-based form — type a name or email to locate an employee, review their AD card (groups, department, manager), choose how the mailbox is handled. A mandatory confirmation checkbox and the standard audit dialog prevent accidental runs.
Technology stack
Distributed as a single standalone .exe file (win-x64), so no .NET runtime needs to be installed on admin machines. Configuration lives in appsettings.json next to the executable and never enters the repository.
| Layer | Technology | Notes |
|---|---|---|
| Application | .NET 9 / WPF | Standalone exe file (single-file), win-x64; published via dotnet publish |
| Active Directory | System.DirectoryServices | AccountManagement for account operations + raw DirectorySearcher for bulk reads |
| Exchange | PowerShell Remoting | Microsoft.PowerShell.SDK; PSSession to on-prem Exchange via Invoke-Command |
| HR integration | Personio API v2 | HttpClient + System.Text.Json; pagination; mock mode without credentials |
| Authentication | Windows Credential Manager | P/Invoke to advapi32.dll (CredReadW / CredWriteW); silent auto-login |
| Secrets | 1Password CLI | API keys and other sensitive data injected at runtime; no secrets in configuration files |
| DI / Config | Microsoft.Extensions.DI | Typed options; appsettings.json in gitignore, example in repo |
| Audit | IAuditLogger | Daily log file in %APPDATA%\AdminSuite\Audit\; structured entries |
| CI / Build | GitHub Actions + xUnit | Build + tests on every push to master; artifact as single-file exe |
Result
AdminSuite eliminated the most common onboarding mistakes — wrong OU, missing mailbox, forgotten group assignments — by making every step visible and requiring an explicit confirmation. The audit log gives an instant answer to “who changed what and when”, without digging through the Windows event log.
The Personio sync module cut the time to synchronise HR data with Active Directory from a monthly, manual export to an on-demand operation that completes in under two minutes for more than 170 employees.
Secrets such as API keys are injected at runtime via the 1Password CLI — they are not kept in configuration files or in the repository. The project is in active development; the next planned step is expanded test coverage of the AD service layer.