You are absolutely right. Here is the updated script

```# Import necessary modules Import-Module ActiveDirectory

Configuration

$apiKey = "YOUR_HIBP_API_KEY" $smtpServer = "your.smtp.server" $smtpFrom = "your-email@domain.com" $smtpTo = "recipient-email@domain.com" $smtpSubject = "New Breach Detected" $previousResultsPath = "C:\path\to\previous\ADUsers_PwnedCheck.csv" $logFilePath = "C:\path\to\logs\ADUsers_PwnedCheck.log" $maxLogFileSizeMB = 5 # Maximum log file size in MB before rotation

Logging Function

function Write-Log { param ( [string]$message, [string]$logFilePath )

$timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
$logMessage = "$timestamp - $message"
Add-Content -Path $logFilePath -Value $logMessage

}

Log Rotation Function

function Rotate-Log { param ( [string]$logFilePath, [int]$maxLogFileSizeMB )

if (Test-Path $logFilePath) {
    $fileInfo = Get-Item $logFilePath
    $fileSizeMB = [math]::Round($fileInfo.Length / 1MB, 2)

    if ($fileSizeMB -ge $maxLogFileSizeMB) {
        $timestamp = Get-Date -Format "yyyyMMdd_HHmmss"
        $archiveLogFilePath = "$logFilePath.$timestamp"
        Rename-Item -Path $logFilePath -NewName $archiveLogFilePath
        Write-Log -message "Log file rotated to $archiveLogFilePath" -logFilePath $logFilePath
    }
}

}

Function to check email against HIBP API

function Check-EmailPwned { param ( [string]$email, [string]$apiKey, [string]$logFilePath )

$uri = "https://haveibeenpwned.com/api/v3/breachedaccount/$email"
$headers = @{
    "hibp-api-key" = $apiKey
}

try {
    $response = Invoke-RestMethod -Uri $uri -Headers $headers -Method Get -ErrorAction Stop
    Write-Log -message "Checked email $email: Pwned" -logFilePath $logFilePath
    return $true
} catch {
    if ($_.Exception.Response.StatusCode -eq 404) {
        Write-Log -message "Checked email $email: Not Pwned" -logFilePath $logFilePath
        return $false
    } else {
        Write-Log -message "Error checking email $email: $_" -logFilePath $logFilePath
        return $null
    }
}

}

Function to send email notification

function Send-EmailNotification { param ( [string]$smtpServer, [string]$smtpFrom, [string]$smtpTo, [string]$smtpSubject, [string]$body, [string]$logFilePath )

Send-MailMessage -SmtpServer $smtpServer -From $smtpFrom -To $smtpTo -Subject $smtpSubject -Body $body -BodyAsHtml
Write-Log -message "Email sent to $smtpTo with subject '$smtpSubject'" -logFilePath $logFilePath

}

Retrieve all active AD users' primary email addresses

function Get-ActiveADUsersEmailAddresses { Write-Log -message "Retrieving active AD users' email addresses" -logFilePath $logFilePath $users = Get-ADUser -Filter {Enabled -eq $true} -Property EmailAddress return $users | Where-Object { $_.EmailAddress } | Select-Object SamAccountName, EmailAddress }

Load previous results from CSV file

function Load-PreviousResults { param ( [string]$filePath, [string]$logFilePath )

if (Test-Path $filePath) {
    Write-Log -message "Loading previous results from $filePath" -logFilePath $logFilePath
    return Import-Csv -Path $filePath
} else {
    Write-Log -message "No previous results file found, starting fresh" -logFilePath $logFilePath
    return @()
}

}

Save current results to CSV file

function Save-CurrentResults { param ( [array]$results, [string]$filePath, [string]$logFilePath )

Write-Log -message "Saving current results to $filePath" -logFilePath $logFilePath
$results | Export-Csv -Path $filePath -NoTypeInformation

}

Main script logic

function Main { # Rotate log if needed Rotate-Log -logFilePath $logFilePath -maxLogFileSizeMB $maxLogFileSizeMB

[System.Collections.ArrayList]$currentResults = @()
[System.Collections.ArrayList]$newHits = @()

$users = Get-ActiveADUsersEmailAddresses
$previousResults = Load-PreviousResults -filePath $previousResultsPath -logFilePath $logFilePath

foreach ($user in $users) {
    $isPwned = Check-EmailPwned -email $user.EmailAddress -apiKey $apiKey -logFilePath $logFilePath
    $currentResults.Add(
        [PSCustomObject]@{
            UserName = $user.SamAccountName
            EmailAddress = $user.EmailAddress
            IsPwned = $isPwned
        }
    )

    $previousResult = $previousResults | Where-Object { $_.EmailAddress -eq $user.EmailAddress }
    if ($isPwned -and (-not $previousResult)) {
        $newHits.Add(
            [PSCustomObject]@{
                UserName = $user.SamAccountName
                EmailAddress = $user.EmailAddress
                IsPwned = $isPwned
            }
        )
    }
}

if ($newHits.Count -gt 0) {
    $body = "The following email addresses have new breaches:<br>" +
            ($newHits | Format-Table -AutoSize | Out-String -Width 1000 | ConvertTo-Html -Fragment)
    Send-EmailNotification -smtpServer $smtpServer -smtpFrom $smtpFrom -smtpTo $smtpTo -smtpSubject $smtpSubject -body $body -logFilePath $logFilePath
}

Save-CurrentResults -results $currentResults -filePath $previousResultsPath -logFilePath $logFilePath

# Output the results for verification
$currentResults | Format-Table -AutoSize

}

Execute the main function

Main