PowerShell IT Automation: Building a 9-Module Healthcare Toolkit

Healthcare IT environments have a particular set of challenges: strict compliance requirements, a mix of legacy and modern systems, high turnover in clinical roles, and an IT team that's constantly stretched thin. Repetitive tasks — onboarding new hires, resetting passwords, provisioning devices, managing licenses — consume hours that should go toward higher-value work.

The HC Systems Toolkit v2.0.0 is a PowerShell-based automation suite I built and maintained that addresses exactly these pain points. What started as a few one-off scripts grew into a structured, menu-driven toolset spanning 9 modules.

Module Breakdown

• ›User Lifecycle: AD account creation, modification, and offboarding with automated group assignment
• ›Password Management: bulk resets, expiry reporting, and self-service unlock workflows
• ›Device Provisioning: workstation naming convention enforcement, domain join automation
• ›License Auditing: Microsoft 365 license inventory and unused-seat reporting
• ›VPN Diagnostics: automated connectivity tests and certificate validation checks
• ›Software Deployment: silent installs via scheduled tasks with rollback capability
• ›Group Policy Audit: drift detection comparing policy states across OUs
• ›Network Utilities: port scanning, DNS resolution testing, share connectivity checks
• ›Reporting: scheduled HTML reports for management on account status and license utilization

Design Decisions

The toolkit uses a central menu launcher (`Launch-Toolkit.ps1`) that imports modules on demand. This keeps startup time fast — you don't load the device provisioning module if you're just doing a password reset. Each module exports a single entry-point function that handles its own input validation and error handling.

1# Module entry pattern used across all 9 modules
2function Invoke-UserLifecycle {
3    param(
4        [ValidateSet('Create','Modify','Offboard')]
5        [string]$Action,
6        [string]$SamAccountName
7    )
8    
9    # Validate AD connectivity before proceeding
10    if (-not (Test-ADConnection)) {
11        Write-Error "Cannot reach domain controller. Check network connectivity."
12        return
13    }
14    
15    switch ($Action) {
16        'Create'    { New-ManagedADUser -SamAccountName $SamAccountName }
17        'Modify'    { Set-ManagedADUser -SamAccountName $SamAccountName }
18        'Offboard'  { Remove-ManagedADUser -SamAccountName $SamAccountName }
19    }
20}

Working in a Regulated Environment

Healthcare IT adds compliance constraints that general IT environments don't have. HIPAA requires audit trails for account access changes. Every automation that touches user accounts logs the operator, timestamp, action taken, and before/after state to a centralized log share. This also proved invaluable during internal audits — instead of manually reconstructing change history, we could query the logs directly.