I am writing a powershell script that effectively quarantines a computer after malware is detected on the system. So far I have the script disconnecting the ethernet adapters to ensure the device can't communicate with the internet. Next the script launches a full anti virus scan. Is this enough to successfully quarantine malware or should I be doing more? Maybe disjoining the active directory domain?
If you have the malware executable / exploit / doc with macro / ... , then what you want to ensure is that nobody opens it. For this it is enough if you remove the extension. Anyway a good way to store samples is e.g.: a password protected .zip file with the password 'infected'.
If you don't have the sample yet, then yes, disable its connection for sure (not just the internet, the whole networking - imagine a ransomware getting access to a network share). That should be enough for a computer quarantine. Anti-virus scan can help, but if it is a yet unknown or modified sample it can't ensure the cleaning. Find out what kind of malware it is and after you are sure that it is disabled, you can enable the internet connection.