Safe script to move disabled directory accounts

You are an experienced systems administrator who writes cautious, readable automation. Write a script that finds disabled user accounts in a directory service and moves them to a designated holding location. Inputs: - Scripting language and directory platform: {{platform}} - Target holding location (path or identifier): {{target_location}} - Accounts or locations to exclude (service accounts, protected groups): {{exclusions}} - Where logs should be written and how long to keep them: {{logging_notes}} Steps: 1. Restate the task in two sentences and list any assumptions (permissions, module or tool availability, size of the directory). If the platform or target location is missing, ask at most 3 questions; otherwise proceed. 2. Design the script so that it runs in preview mode by default (shows what would move, changes nothing) and only acts when an explicit apply switch is passed. 3. Write the script with: input validation (does the target exist?), an exclusion list, per-account error handling so one failure does not stop the run, and a log line for every account examined and moved. 4. Add a final summary: total found, moved, skipped, failed. 5. Review your own script for risks: moving the wrong accounts, partial runs, accounts that cannot be reversed. Explain how to undo a run using the log. Output format: - Short description of how the script works (under 120 words) - The complete script in one code block, with comments - "How to run": preview command, apply command, required permissions - "Risks and rollback": 3 to 5 bullet points Quality bar: - Never delete accounts; only move them. - No hard-coded credentials or secrets; use the current signed-in identity. - Tell the user to test in a non-production environment first. - If you are unsure of exact command names for the platform, say so rather than guessing.

You are an experienced systems administrator who writes cautious, readable automation. Write a script that finds disabled user accounts in a directory service and moves them to a designated holding location. Inputs: - Scripting language and directory platform: {{platform}} - Target holding location (path or identifier): {{target_location}} - Accounts or locations to exclude (service accounts, protected groups): {{exclusions}} - Where logs should be written and how long to keep them: {{logging_notes}} Steps: 1. Restate the task in two sentences and list any assumptions (permissions, module or tool availability, size of the directory). If the platform or target location is missing, ask at most 3 questions; otherwise proceed. 2. Design the script so that it runs in preview mode by default (shows what would move, changes nothing) and only acts when an explicit apply switch is passed. 3. Write the script with: input validation (does the target exist?), an exclusion list, per-account error handling so one failure does not stop the run, and a log line for every account examined and moved. 4. Add a final summary: total found, moved, skipped, failed. 5. Review your own script for risks: moving the wrong accounts, partial runs, accounts that cannot be reversed. Explain how to undo a run using the log. Output format: - Short description of how the script works (under 120 words) - The complete script in one code block, with comments - "How to run": preview command, apply command, required permissions - "Risks and rollback": 3 to 5 bullet points Quality bar: - Never delete accounts; only move them. - No hard-coded credentials or secrets; use the current signed-in identity. - Tell the user to test in a non-production environment first. - If you are unsure of exact command names for the platform, say so rather than guessing.

This script lists every user account marked disabled, skips anything in the exclusion list, and moves the rest to the holding location. By default it only prints what it would do. Run preview: .\Move-DisabledUsers -Target "Disabled Accounts" Run for real: add -Apply Excerpt: # Preview by default; changes require -Apply foreach ($u in $disabled) { try { ... Write-Log "Moved $($u.Name)" } catch { Write-Log "FAILED $($u.Name): $_" } } Risks and rollback: - Accounts used by services may be disabled on purpose; add them to exclusions. - Each move is logged with its original location so it can be reversed.