Sharing three production-tested n8n workflows I built for Active Directory security auditing. These come up in every IAM engagement so I automated them.
What they do
Workflow 1: AD User Evidence Collection
LDAP query against all AD user objects. Outputs per-account: enabled/disabled status, last logon, password last set date, password never expires flag, no password required flag, primary group, all group memberships. Result exported to XLSX.
Use case: generating the user account inventory required by ISO 27001 A.9, NCA ECC, and SAMA CSF access review controls.
Nodes: LDAP (search), Code (Windows FileTime conversion), Set (field normalize), Merge, Spreadsheet File (XLSX), emailSend (SMTP alert on failure). 10 nodes total.
Workflow 2: Privileged Access Audit
Targeted scan of high-value AD groups: Domain Admins, Enterprise Admins, Schema Admins, Backup Operators. Per member: account type, last logon, password age, UAC flags. Flags three risk patterns:
- Stale accounts (inactive 90+ days) still holding privileged group membership
- Disabled accounts that were never removed from privileged groups
- Service accounts with password-never-expires in Domain Admins
Nodes: LDAP, Code (UAC flag parser + staleness logic), Set, Merge, Spreadsheet File, emailSend. 11 nodes total.
Workflow 3: Stale and Orphan Account Detector
Two-pass scan. Pass 1: all accounts inactive for 90+ days (threshold configurable via environment variable). Pass 2: accounts with zero group memberships (common pattern for orphaned contractor or service accounts). Combined output with a detection_type column distinguishing stale vs orphan vs both.
Nodes: LDAP x2, Code (date arithmetic, orphan detection), Merge, Set, Spreadsheet File, emailSend. 9 nodes total.
Technical notes
- LDAP node:
n8n-nodes-base.ldap, operationsearch,searchFor: customFilter, LDAP filter string passed as parameter - Windows FileTime to Unix ms:
(BigInt(ft) - 116444736000000000n) / 10000n - UAC flags decoded in a Code node using bitwise AND against known flag values (0x2 disabled, 0x10000 pwdNeverExpires, 0x20 noPwdRequired)
- All three workflows require: n8n LDAP credential (your DC IP, bind DN, bind password), SMTP credential for error alerts
Package
JSON exports, README, CONFIGURATION_GUIDE.md, and docker-compose.yml packaged at: IAM n8n Workflow Pack 1
If anyone wants the LDAP filter strings or UAC flag decoder logic posted here separately, let me know.
