Projects
Building, retiring and certifying servers across a Windows and RHEL estate, and auditing the identities that reach them. Ansible is where infrastructure changes; PowerShell is how an operator asks for it. Keeping those two apart is most of the design.
Three automation systems. Each one is many playbooks, roles, job and workflow templates deep; each is one system.
Builds a server end to end from one request: name, address, DNS, the directory object, the virtual machine, tagging, agents and patching. A security gate has to pass before the build is accepted, and Windows and Linux run as separate phase chains behind the same request.
Impact Operator inputs become repeatable builds, with every infrastructure change executing inside AAP.
Retires a server in stages rather than deleting it: the first phase powers it down, moves it to a decommission folder and stamps a retention date, and a later sweep removes only what is past that date. Anything the sweep cannot settle holds the server back instead of letting it through.
Impact Retirement stays reversible for the whole retention window.
Takes an issued certificate and produces every form its consumers need — key, certificate, completed chain, bundle and Java keystore — then publishes them to the artifact repository. Service playbooks install from there, so IIS, Tomcat, nginx, MuleSoft and the Java truststores all update from one pipeline.
Impact One rotation replaces the per-service manual certificate work.
Four products. Each one is a module with many commands in it; the commands are capabilities, not projects.
Operator interface to Server Provisioning
The operator-facing PowerShell layer for Server Provisioning: it reads the workflow’s live survey from AAP, validates a request against that contract, and submits one job per server. It builds nothing itself — placement, naming, addressing and the security gate stay in the Ansible workflow.
Operator interface to Server Deprovisioning
The operator-facing companion to Server Deprovisioning: it validates retirement intent, reports which servers are past their retention date, and launches only reviewed templates. It is a separate module with no final-destroy command — the destructive step belongs to AAP.
Find-ForestUsers
Read-only forest-wide identity auditing: it resolves identifiers — account name, UPN, mail address, distinguished name, SID or employee ID — across every domain in the forest, and reports account state with the evidence behind it. It separates a confirmed absence from an inconclusive one when part of the forest could not be searched.
CSV-driven removal of users from Active Directory groups, resolved forest-wide through a global catalog and written against an authoritative writable domain controller rather than whichever one answered first. It reports rather than changes unless told otherwise, refuses protected and privileged groups, and logs a row per decision.