Sysadmin Toolkit

Native scripts for Windows (PowerShell), Linux (Bash), and macOS (Zsh), covering system health, user management, disk cleanup, network diagnostics, and Active Directory / domain tools.

Most write/change actions default to a safe mode (dry run, or require an explicit flag) — read the header comment in each script before running. Run destructive actions (delete, reset password, cleanup) with care and test in a non-production environment first.

Windows (windows/) — run in PowerShell as Administrator

Script	Purpose
System-Health-Check.ps1	CPU, memory, disk, services, event log, pending reboot
User-Account-Management.ps1	List/create/disable/unlock/reset local users
Disk-Cleanup.ps1	Clears temp/update cache, empties Recycle Bin (dry-run by default; use -Run)
Network-Diagnostics.ps1	Adapter status, DNS, ping, traceroute, port test, listening ports
AD-Domain-Tools.ps1	Domain health, locked/disabled users, stale computers, replication (requires RSAT ActiveDirectory module)
Firewall-Management.ps1	Status, enable/disable, list/add/remove rules, audit for risky open rules
Malware-Scan.ps1	Windows Defender: update definitions, quick/full/custom scan, list & remove threats
Disk-Management.ps1	List disks/volumes, initialize, partition, format (NTFS/ReFS/FAT32/exFAT)

Example:

.\System-Health-Check.ps1
.\Disk-Cleanup.ps1 -Run
.\AD-Domain-Tools.ps1 -Action LockedOutUsers
.\Disk-Management.ps1 -Action ListDisks
.\Disk-Management.ps1 -Action WipeAndFormat -DiskNumber 1 -PartitionStyle GPT -FileSystem NTFS -Label "Data" -DriveLetter E

You may need to allow script execution:

Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass

Linux (linux/) — Bash, most actions need sudo

Script	Purpose
system-health-check.sh	CPU, memory, disk, failed systemd services, journal errors
user-account-management.sh	List/create/lock/unlock/reset/delete local users, security audit
disk-cleanup.sh	Package cache, /tmp, old logs, journal vacuum (dry-run by default; use --run)
network-diagnostics.sh	Interfaces, routing, DNS, ping, traceroute, port test
domain-tools.sh	realmd/sssd AD join, status, user lookup, Kerberos, cache clear
firewall-management.sh	ufw/firewalld/iptables status, enable/disable, allow/block ports, audit
malware-scan.sh	ClamAV install/update/scan, rootkit check via rkhunter/chkrootkit
disk-management.sh	List disks, create partition table (GPT/MBR), create partitions, format (ext4/xfs/btrfs/vfat/ntfs), mount/unmount

Example:

chmod +x *.sh
./system-health-check.sh
sudo ./disk-cleanup.sh --run
sudo ./domain-tools.sh join CONTOSO.COM adminuser
sudo ./firewall-management.sh audit
sudo ./malware-scan.sh install && sudo ./malware-scan.sh full-scan
sudo ./disk-management.sh list-disks
sudo ./disk-management.sh wipe-and-format /dev/sdb gpt ext4 mydata

macOS (macos/) — Zsh, most actions need sudo

Script	Purpose
system-health-check.zsh	CPU, memory, disk, launchd failures, system log errors, SMART status
user-account-management.zsh	List/create/disable/enable/reset/delete local users via dscl
disk-cleanup.zsh	Caches, logs, Trash, Xcode/dev caches, Homebrew cleanup (dry-run by default; use --run)
network-diagnostics.zsh	Interfaces, DNS, ping, traceroute, port test
domain-tools.zsh	AD binding via dsconfigad, status, user lookup, Kerberos, cache flush
firewall-management.zsh	Application Firewall status, enable/disable, allow/block apps, stealth mode, audit
malware-scan.zsh	XProtect/Gatekeeper/SIP status, ClamAV scan (via Homebrew), LaunchAgent/login item review
disk-management.zsh	List disks/volumes, partition (GPT/MBR), erase/format (APFS/HFS+/ExFAT/FAT32), mount/unmount

Example:

chmod +x *.zsh
./system-health-check.zsh
sudo ./disk-cleanup.zsh --run
sudo ./domain-tools.zsh join CONTOSO.COM adminuser
sudo ./firewall-management.zsh audit
./malware-scan.zsh xprotect-status
./malware-scan.zsh check-launch-agents
sudo ./disk-management.zsh list-disks
sudo ./disk-management.zsh erase-disk /dev/disk2 GPT APFS "Data"

A note on the disk management scripts

These are the most destructive scripts in this toolkit. Formatting or partitioning a disk permanently erases everything on it. All three scripts:

• Refuse to touch the disk the OS is currently booted from.
• Require you to type the exact disk/device identifier back as confirmation before any partition/format/erase action runs — there is no -Force/--yes bypass.
• Let you choose the partition scheme (GPT/MBR/APFS scheme) and filesystem type (e.g. NTFS/ReFS/FAT32/exFAT on Windows; ext4/xfs/btrfs/ vfat/ntfs on Linux; APFS/HFS+/ExFAT/FAT32 on macOS) via arguments.

Double-check the disk identifier with the list-disks/ListDisks action before running any partition or format command — there's no undo.

A note on the cyber scripts

• Firewall scripts wrap the OS's own firewall manager (Windows Firewall, ufw/firewalld/iptables, macOS Application Firewall) — no third-party agent required.
• Malware scan scripts use trusted, well-known scanners: Windows Defender (Malware-Scan.ps1), ClamAV on Linux/macOS, and rkhunter/ chkrootkit for Linux rootkit checks. macOS also reports built-in XProtect/Gatekeeper/SIP status and lists LaunchAgents/login items, since those are the most common macOS persistence points for unwanted software.
• "Remove" actions in the scan scripts (--remove, RemoveThreats) will delete or quarantine matched files — review scan output first, especially on production systems, since AV heuristics can occasionally flag legitimate files (false positives).

Notes

• AD/domain tools: the Windows script manages AD itself (run from a DC or RSAT-equipped machine); the Linux and macOS scripts manage those machines' membership in an AD domain (realmd/sssd and dsconfigad, respectively).
• Scripts are written to be broadly compatible (Ubuntu/Debian/RHEL-family for Linux) but package manager commands may need adjusting for your distro.
• Review and test in a lab/VM before running in production, especially cleanup and account-deletion actions.