It’s been a bit of a journey getting these admin accounts set up properly. I went through a fair amount of frustration and trial-and-error, but I finally landed on a solid, auditable configuration.

## The Human Reality Check

Big lesson today: automation is only as good as the data you feed it. My first few PowerShell scripts kept failing—not because the logic was bad, but because of dumb stuff like a typo in the account name and getting the OU path wrong in Active Directory.

Before you start blaming the code, here’s the troubleshooting order I wish I’d followed sooner:

* **Check for Typos**: Double-check the SamAccountName, OU paths, and group names. Computers are brutally literal. I spent way too long debugging before realizing I had `asm-` instead of `adm-`.

* **Verify Permissions**: Just because you’re an Administrator on the machine doesn’t mean you have the rights to create objects or modify ACLs in specific OUs.

* **Read the Errors**: Things like `IdentityNotMappedException` or “Object Not Found” usually mean your script is fine — the thing you’re trying to reference just doesn’t exist yet.

## What Finally Worked

These are the scripts that eventually got the job done. I’ve left the placeholder values so you can swap in your own domain and names.

### 1. The Provisioning Script

This creates the user accounts cleanly.

```powershell
# Create the accounts cleanly
$adminAccounts = @(
@{ Name = "adm-sv-yourname"; OU = "OU=Tier1,DC=yourdomain,DC=local" }
@{ Name = "adm-wk-yourname"; OU = "OU=Tier2,DC=yourdomain,DC=local" }
)
foreach ($account in $adminAccounts) {
New-ADUser -Name $account.Name -SamAccountName $account.Name -Path $account.OU -Enabled $true
Set-ADUser -Identity $account.Name -PasswordNeverExpires $true
Write-Host "Account $($account.Name) created." -ForegroundColor Green
}
```

### 2. The Delegation Script

This sets up the least-privilege access using dsacls (which avoided some of the mapping headaches I was getting with pure PowerShell).

```powershell
# Tier 1 Delegation - Reset Password only
dsacls "OU=Tier1,DC=yourdomain,DC=local" /I:S /G "yourdomain\adm-sv-yourname:CA;Reset Password;user"

# Tier 2 Delegation - Reset Password only
dsacls "OU=Tier2,DC=yourdomain,DC=local" /I:S /G "yourdomain\adm-wk-yourname:CA;Reset Password;user"
```

### 3. Hardening & Verification

Locking things down and checking the work.

```powershell
# Apply hardening
Set-ADUser -Identity "adm-sv-yourname" -LogonWorkstations "YOUR-JUMP-HOST" -AccountExpirationDate (Get-Date).AddDays(90)
Set-ADUser -Identity "adm-wk-yourname" -LogonWorkstations "YOUR-JUMP-HOST" -AccountExpirationDate (Get-Date).AddDays(90)

# Verify the ACL entries
(Get-Acl -Path "AD:\OU=Tier1,DC=yourdomain,DC=local").Access | Where-Object { $_.IdentityReference -like "*yourname*" }
```

## Why this matters (to me)

It’s a pretty small task in the grand scheme of things, but I’m learning all this on the fly and trying to document it properly as I go. The real win wasn’t just getting the accounts created — it was understanding where I screwed up, fixing the typos, verifying the OU paths, and then applying the permissions the right way instead of just brute-forcing it.

Now the accounts are properly restricted to what they actually need, and I have a repeatable process I can trust (and improve on next time). There might be a much better way, and a much better model however I am doing this to the best of my ability, and when the time comes I will have it analyzed somewhat formally by myself and others in terms of a full security audit once everything is in place. If you are following along, Thank You.