Scripting & Automation, Safety-First

Kavitha is a sysadmin at a Hyderabad GCC — nine years in, AD, Entra, Intune, comfortable in PowerShell but never with time to write it. On a Wednesday afternoon HR hands her a list of 43 leavers from a divested business unit, due for offboarding by Friday. She does what any of us would do in 2026: asks her AI assistant for a bulk-offboarding script. Thirty seconds later she has 60 clean-looking lines: disable accounts, revoke sessions, remove group memberships, set out-of-office, move to the disabled OU. It reads well. It would have run.

Because her team had adopted the review protocol this module teaches, she ran the checklist instead of the script. Finding one: the disable step filtered on department -eq "Logistics" — the department, not the CSV list. Nineteen Logistics employees who were staying would have been disabled with the 43 leavers, including two service accounts that run the warehouse integration. Finding two: the script authenticated with a plaintext app secret pasted into line 4 — which the model had helpfully invented as a placeholder, and which the intern who reused the script next quarter would have replaced with a real one. Twenty minutes of review, two findings, either of which would have made Friday memorable.

Neither finding means the AI is bad at PowerShell. The script's logic was 90% right and the 30 seconds saved her an hour. The point is harsher and more useful: AI-generated admin scripts are competent-looking by construction and safe only by verification. In this module, the review protocol is not a suggestion attached to the skill. It is the skill.

The Founding Evidence

This module's rule is built on the strongest single finding in this track's research base. A Dakota State (Beacom College) study examined automation scripts generated by ChatGPT, Copilot and Gemini for common admin tasks, and found that every script studied — 100% — contained exploitable vulnerabilities, running 13–14 findings per platform across 17 vulnerability classes: hardcoded credentials, missing input validation, unscoped operations, absent error handling, injection-prone string construction, over-broad permissions.

Sit with what that number means operationally. It does not mean AI scripts are unusable — the same scripts were mostly functionally correct, which is exactly what makes them dangerous: they work in the demo, so they ship. It means that generation and hardening are two different jobs, the model does the first, and nobody is doing the second unless you are. A support engineer who can run the hardening pass on AI output is worth more than one who can write the script from scratch slowly — and measurably more than one who runs AI output raw.

The Mandatory Safety Review

Every AI-generated script that touches real systems runs this checklist before execution. No exceptions for "small" scripts — Kavitha's was 60 lines.

• -WhatIf first, alwaysthe script must support and be first executed in dry-run mode (-WhatIf in PowerShell, --dry-run or an echo-only pass in Bash). If the AI didn't build the dry-run path, that is your first change request to it.
• Scope every filterthe exact bug that nearly took out Logistics: destructive operations must be driven by an explicit input list, never by a broad attribute query. Get-ADUser -Filter feeding a Disable- or Remove- verb is guilty until proven scoped.
• Least privilegethe script requests the narrowest role and scopes that accomplish the task. AI drafts default to whatever permission makes the code shortest, which is routinely Global-Admin-shaped.
• No hardcoded secretsno credentials, tokens, app secrets or API keys in the script body. Managed identities, secret stores or at minimum prompted credentials. Grep for password, secret, key, token before anything else.
• Error handling that stops the blasta bulk loop that continues silently past failures produces half-applied states nobody can reason about. Fail fast, log every action taken, count successes and failures.
• PSScriptAnalyzer cleanthe free linter catches a startling share of the study's vulnerability classes mechanically. A script that has not passed the analyzer has not been reviewed, only read.

Then — and only then — the graduation sequence: dry-run against production data and read every line of the output; live run against a test scope (one OU, five accounts); full run with logging on. Kavitha's Friday deadline survived all three stages with hours to spare, which is the quiet argument for the protocol: it is faster than the incident.

Inherited-Automation Archaeology

Every desk has them: the 400-line script the last admin left, running nightly, undocumented, load-bearing. AI has made reading them cheap. Paste the script (sanitized of any embedded secrets — and finding those is itself finding one) and ask for three artifacts:

• Annotated explanationwhat each block does, in plain language, with the parts the AI is unsure about explicitly flagged rather than smoothed over.
• Risk flag listdestructive operations, external calls, assumptions about environment state, credential handling: everything that could hurt if the script's assumptions have drifted since it was written.
• Modernization suggestionsdeprecated cmdlets, missing error handling, hardcoded values that should be parameters — the roadmap for the rewrite you will eventually do.

Then verify the explanation the only way that counts — in a sandbox VM or test tenant, watching what the script actually does against what the AI said it does. The explanation is a hypothesis about the code; the sandbox is the check. Lab 6 hands you a 300-line legacy script with two planted dangers — an unscoped Remove- operation and a plaintext credential — and the artifact is a risk report that names both.

Bulk Operations: The Dry-Run Discipline

Bulk changes to AD, Entra or M365 are where one bad script destroys a tenant, so bulk work carries three non-negotiable conventions beyond the standard review:

1. 1CSV-driven input with validation. The change list is an explicit file, and the script validates it before acting: expected columns present, identifiers resolve to real objects, no blank or duplicate rows, and a hard stop with a report if any row fails. Lab 7's CSV contains two malformed rows and one entry that would strand a user's access — the script's validation, not your eyeballs, must catch them.
2. 2Dry-run output reviewed as a document. The dry run produces a human-readable statement of every change it would make. You read all of it — not the first ten lines — because the anomaly is always in the rows you assumed were boring.
3. 3Rollback generated before execution. Before changing anything, the script writes the current state of every object it will touch, in a format its companion rollback script can consume. Rollback that exists only as an intention is not rollback; it is regret with extra steps.

AI in the Shell: The Execution Boundary

Terminal copilots — Microsoft AI Shell, Warp-class terminals, Claude Code and its peers — move AI from "drafts scripts elsewhere" to "sits inside your session, suggesting and sometimes executing commands." That is genuinely useful for command recall and error remediation, and it collapses the review gap to zero unless you rebuild it deliberately: when suggestion and execution live one keystroke apart, the checklist must become a written execution policy — decided in daylight, not at the prompt.

Write it, share it with the team, and treat a violation as a process failure even when nothing broke. The boundary's value is that it exists before the 2 a.m. incident where "just let the AI fix it" feels reasonable.

Automations That Fail Loudly, Fixes That Ship Safely

Three more surfaces complete the safety-first toolkit:

Scheduled-automation documentation and smoke tests. Silent failure of a scheduled job is a classic outage precursor — the cleanup task that stopped running in March is why the disk filled in July. AI-generate two artifacts for every scheduled job and RMM automation you own: documentation (what it does, what it touches, what depends on it, who owns it) and a smoke test — a lightweight check that the job ran and produced its expected effect, wired to alert someone when it did not. An afternoon of AI-assisted work converts a folder of mystery jobs into a monitored, documented estate.

Self-service remediations. Proven fixes — clear the cache, re-register the app, reset the VPN adapter — packaged as one-click user-runnable tools or Intune proactive remediations / RMM-pushed scripts. AI drafts the remediation; you harden it with the full protocol plus the self-service extras: it must be safe when run twice, safe on the wrong machine, and silent-failure-proof, because no engineer is watching when it runs. Done well, these are the most honest deflection there is — the user's problem is actually fixed, not deflected into a chatbot loop. Module 7 will insist you count them that way.

Report automation against console truth. AI writes the Graph-API and RMM-API reporting scripts for asset, license and patch-compliance reports in minutes. The habit that keeps them from becoming confidently-wrong PDFs: before any report leaves you, verify a sample of its numbers against the admin console directly. A reporting script with a subtly wrong filter — counting all devices where it should count active ones — produces plausible numbers forever, and plausible-but-wrong compliance figures surface at the worst possible moment: during an audit. Spot-check three numbers, every report, every time.

Try It Now

1. 1Review one AI script. Generate a script you actually need — a user report, a cleanup task — then run the full checklist against it before any execution: dry-run path, filter scoping, privilege, secrets grep, error handling, PSScriptAnalyzer. Log every finding; count them against the study's 13–14 average.
2. 2Excavate one inherited script. Pick the oldest unexplained scheduled script in your estate. Get an AI explanation with risk flags, then verify its behavior in a sandbox or read-only against production. File the annotated version where the next admin will find it.
3. 3Write your execution policy. Draft the four-class boundary table for your own terminal-AI use, adapted to your environment. One page. Share it with one colleague and adopt it for a week.