# CS-SERVER G1 AD Audit

**Command ID:** e83befb7-4c8c-4f24-9b24-56cb641e6464
**Run:** 2026-04-23T02:55:50.634848Z
**Exit:** 0

## STDOUT

```
G1 AD Audit - 2026-04-22 19:55:51 -07:00

Host: CS-SERVER



============================================================================

== 1. Forest / Domain / Schema

============================================================================

Forest FQDN:           cascades.local

Forest mode:           Windows2016Forest

Domain mode:           Windows2016Domain

Domain DN:             DC=cascades,DC=local

NetBIOS:               CASCADES

UPN suffixes (forest):

   - cascadestucson.com

Schema objectVersion:  88



FSMO roles:

   Schema Master:           CS-SERVER.cascades.local

   Domain Naming Master:    CS-SERVER.cascades.local

   PDC Emulator:            CS-SERVER.cascades.local

   RID Master:              CS-SERVER.cascades.local

   Infrastructure Master:   CS-SERVER.cascades.local



============================================================================

== 2. OU structure

============================================================================

Total OUs: 18



   OU=Administrative,OU=Departments,DC=cascades,DC=local                            users=5 groups=0 computers=0

   OU=Care-Assisted Living,OU=Departments,DC=cascades,DC=local                      users=4 groups=0 computers=0

   OU=Care-Memorycare,OU=Departments,DC=cascades,DC=local                           users=2 groups=0 computers=0

   OU=Culinary,OU=Departments,DC=cascades,DC=local                                  users=4 groups=0 computers=0

   OU=Departments,DC=cascades,DC=local                                              users=0 groups=0 computers=0

   OU=Domain Controllers,DC=cascades,DC=local                                       users=0 groups=0 computers=1

   OU=Groups,DC=cascades,DC=local                                                   users=0 groups=1 computers=0

   OU=Housekeeping,OU=Departments,DC=cascades,DC=local                              users=1 groups=0 computers=0

   OU=Life Enrichment,OU=Departments,DC=cascades,DC=local                           users=2 groups=0 computers=0

   OU=Maintenance,OU=Departments,DC=cascades,DC=local                               users=2 groups=0 computers=0

   OU=Marketing,OU=Departments,DC=cascades,DC=local                                 users=4 groups=0 computers=0

   OU=Nurses,OU=Care-Assisted Living,OU=Departments,DC=cascades,DC=local            users=0 groups=0 computers=0

   OU=Resident Services,OU=Departments,DC=cascades,DC=local                         users=8 groups=0 computers=0

   OU=ServiceAccounts,DC=cascades,DC=local                                          users=1 groups=0 computers=0

   OU=Shared PCs,OU=Workstations,DC=cascades,DC=local                               users=0 groups=0 computers=0

   OU=Staff PCs,OU=Workstations,DC=cascades,DC=local                                users=0 groups=0 computers=6

   OU=Transportation,OU=Departments,DC=cascades,DC=local                            users=3 groups=0 computers=0

   OU=Workstations,DC=cascades,DC=local                                             users=0 groups=0 computers=0



Users in default CN=Users container (not ideal - should be in an OU for sync scope):

   Count: 8

   - Administrator (Administrator)

   - directoryshare (directoryshare)

   - Guest (Guest)

   - krbtgt (krbtgt)

   - localadmin (localadmin)

   - QBDataServiceUser34 (QBDataServiceUser34)

   - Receptionist (RECEPTIONIST)

   - sysadmin (Sysadmin)



============================================================================

== 3. All AD users - identity attributes for sync match

============================================================================

Total users: 44

Enabled:     42

Disabled:    2



Per-user identity dump (focus: anything that affects soft-match):



SAM | UPN | Mail | ProxyAddrs | PwdLastSet | PwdNeverExp | Enabled | OU

---

Administrator |  |  |  | 2024-08-04 | True | True | CN=Users

Allison.Reibschied | Allison.Reibschied@cascadestucson.com |  |  | 2026-03-13 | False | True | OU=Administrative,OU=Departments

Alyssa.Brooks | Alyssa.Brooks@cascadestucson.com |  |  | 2025-12-12 | False | True | OU=Culinary,OU=Departments

Ashley.Jensen | Ashley.Jensen@cascadestucson.com |  |  | NULL | False | True | OU=Administrative,OU=Departments

britney.thompson | britney.thompson@cascadestucson.com |  |  | NULL | False | True | OU=Care-Assisted Living,OU=Departments

Cathy.Kingston | Cathy.Kingston@cascadestucson.com |  |  | 2025-12-12 | False | True | OU=Resident Services,OU=Departments

Christina.DuPras | Christina.DuPras@cascadestucson.com |  |  | 2026-01-06 | False | True | OU=Resident Services,OU=Departments

Christine.Nyanzunda | Christine.Nyanzunda@cascadestucson.com |  |  | NULL | False | True | OU=Care-Memorycare,OU=Departments

Christopher.Holick | Christopher.Holick@cascadestucson.com |  |  | 2025-12-12 | False | True | OU=Transportation,OU=Departments

Crystal.Rodriguez | Crystal.Rodriguez@cascadestucson.com |  |  | 2026-04-20 | False | True | OU=Marketing,OU=Departments

Culinary | Culinary@cascades.local |  |  | 2024-12-27 | True | True | OU=Culinary,OU=Departments

directoryshare | directoryshare@cascades.local |  |  | 2025-12-01 | True | True | CN=Users

Guest |  |  |  | NULL | True | False | CN=Users

howard | howard@cascadestucson.com |  |  | 2025-08-11 | True | True | OU=Administrative,OU=Departments

JD.Martin | JD.Martin@cascadestucson.com |  |  | NULL | False | True | OU=Culinary,OU=Departments

John.Trozzi | John.Trozzi@cascadestucson.com |  |  | NULL | False | True | OU=Maintenance,OU=Departments

Julian.Crim | Julian.Crim@cascadestucson.com |  |  | 2025-12-12 | False | True | OU=Transportation,OU=Departments

karen.rossini | karen.rossini@cascadestucson.com |  |  | 2025-12-12 | False | True | OU=Care-Assisted Living,OU=Departments

krbtgt |  |  |  | 2024-08-28 | False | False | CN=Users

Kyla.QuickTiffany | Kyla.QuickTiffany@cascadestucson.com |  |  | 2026-04-13 | False | True | OU=Resident Services,OU=Departments

lauren.hasselman | lauren.hasselman@cascadestucson.com |  |  | 2026-04-01 | False | True | OU=Administrative,OU=Departments

localadmin |  |  |  | 2024-12-03 | True | True | CN=Users

Lois.Lane | Lois.Lane@cascadestucson.com |  |  | 2025-12-22 | True | True | OU=Care-Assisted Living,OU=Departments

Lupe.Sanchez | Lupe.Sanchez@cascadestucson.com |  |  | 2025-12-12 | False | True | OU=Housekeeping,OU=Departments

Matt.Brooks | Matt.Brooks@cascadestucson.com |  |  | NULL | False | True | OU=Maintenance,OU=Departments

Megan.Hiatt | Megan.Hiatt@cascadestucson.com |  |  | NULL | False | True | OU=Marketing,OU=Departments

Meredith.Kuhn | Meredith.Kuhn@cascadestucson.com |  |  | NULL | False | True | OU=Administrative,OU=Departments

Michelle.Shestko | Michelle.Shestko@cascadestucson.com |  |  | NULL | False | True | OU=Resident Services,OU=Departments

QBDataServiceUser34 |  |  |  | 2024-10-02 | True | True | CN=Users

Ramon.Castaneda | Ramon.Castaneda@cascadestucson.com |  |  | NULL | False | True | OU=Culinary,OU=Departments

Ray.Rai | Ray.Rai@cascadestucson.com |  |  | 2025-12-12 | False | True | OU=Resident Services,OU=Departments

Receptionist | RECEPTIONIST@cascades.local |  |  | 2026-04-07 | True | True | CN=Users

Richard.Adams | Richard.Adams@cascadestucson.com |  |  | 2025-12-12 | False | True | OU=Transportation,OU=Departments

saleshare |  |  |  | 2025-10-27 | False | True | OU=Marketing,OU=Departments

Sebastian.Leon | Sebastian.Leon@cascadestucson.com |  |  | NULL | False | True | OU=Resident Services,OU=Departments

Sharon.Edwards | Sharon.Edwards@cascadestucson.com |  |  | 2026-04-13 | False | True | OU=Life Enrichment,OU=Departments

Shelby.Trozzi | Shelby.Trozzi@cascadestucson.com |  |  | 2025-12-11 | True | True | OU=Care-Memorycare,OU=Departments

Sheldon.Gardfrey | Sheldon.Gardfrey@cascadestucson.com |  |  | 2025-12-12 | False | True | OU=Resident Services,OU=Departments

Shontiel.Nunn | Shontiel.Nunn@cascadestucson.com |  |  | 2025-12-12 | False | True | OU=Resident Services,OU=Departments

Susan.Hicks | Susan.Hicks@cascadestucson.com |  |  | 2026-04-13 | False | True | OU=Life Enrichment,OU=Departments

svc-audit-upload |  |  |  | 2026-04-17 | True | True | OU=ServiceAccounts

sysadmin | sysadmin@cascadestucson.com |  |  | 2024-09-29 | True | True | CN=Users

Tamra.Matthews | Tamra.Matthews@cascadestucson.com |  |  | NULL | False | True | OU=Marketing,OU=Departments

Veronica.Feller | Veronica.Feller@cascadestucson.com |  |  | NULL | False | True | OU=Care-Assisted Living,OU=Departments



============================================================================

== 4. Soft-match risk scan - accounts likely to duplicate in Entra

============================================================================

--- Users with NO proxyAddresses and NO mail (soft-match engine has nothing to work with):

   - Administrator (UPN: )

   - localadmin (UPN: )

   - Meredith.Kuhn (UPN: Meredith.Kuhn@cascadestucson.com)

   - John.Trozzi (UPN: John.Trozzi@cascadestucson.com)

   - Megan.Hiatt (UPN: Megan.Hiatt@cascadestucson.com)

   - Crystal.Rodriguez (UPN: Crystal.Rodriguez@cascadestucson.com)

   - Tamra.Matthews (UPN: Tamra.Matthews@cascadestucson.com)

   - Lois.Lane (UPN: Lois.Lane@cascadestucson.com)

   - Christina.DuPras (UPN: Christina.DuPras@cascadestucson.com)

   - Christine.Nyanzunda (UPN: Christine.Nyanzunda@cascadestucson.com)

   - Susan.Hicks (UPN: Susan.Hicks@cascadestucson.com)

   - Ashley.Jensen (UPN: Ashley.Jensen@cascadestucson.com)

   - Veronica.Feller (UPN: Veronica.Feller@cascadestucson.com)

   - Sebastian.Leon (UPN: Sebastian.Leon@cascadestucson.com)

   - JD.Martin (UPN: JD.Martin@cascadestucson.com)

   - Matt.Brooks (UPN: Matt.Brooks@cascadestucson.com)

   - Ramon.Castaneda (UPN: Ramon.Castaneda@cascadestucson.com)

   - Michelle.Shestko (UPN: Michelle.Shestko@cascadestucson.com)

   - Sharon.Edwards (UPN: Sharon.Edwards@cascadestucson.com)

   - sysadmin (UPN: sysadmin@cascadestucson.com)

   - QBDataServiceUser34 (UPN: )

   - Culinary (UPN: Culinary@cascades.local)

   - Receptionist (UPN: RECEPTIONIST@cascades.local)

   - britney.thompson (UPN: britney.thompson@cascadestucson.com)

   - howard (UPN: howard@cascadestucson.com)

   - saleshare (UPN: )

   - directoryshare (UPN: directoryshare@cascades.local)

   - Shelby.Trozzi (UPN: Shelby.Trozzi@cascadestucson.com)

   - karen.rossini (UPN: karen.rossini@cascadestucson.com)

   - Alyssa.Brooks (UPN: Alyssa.Brooks@cascadestucson.com)

   - Lupe.Sanchez (UPN: Lupe.Sanchez@cascadestucson.com)

   - Sheldon.Gardfrey (UPN: Sheldon.Gardfrey@cascadestucson.com)

   - Cathy.Kingston (UPN: Cathy.Kingston@cascadestucson.com)

   - Shontiel.Nunn (UPN: Shontiel.Nunn@cascadestucson.com)

   - Ray.Rai (UPN: Ray.Rai@cascadestucson.com)

   - Richard.Adams (UPN: Richard.Adams@cascadestucson.com)

   - Julian.Crim (UPN: Julian.Crim@cascadestucson.com)

   - Christopher.Holick (UPN: Christopher.Holick@cascadestucson.com)

   - lauren.hasselman (UPN: lauren.hasselman@cascadestucson.com)

   - Allison.Reibschied (UPN: Allison.Reibschied@cascadestucson.com)

   - Kyla.QuickTiffany (UPN: Kyla.QuickTiffany@cascadestucson.com)

   - svc-audit-upload (UPN: )



--- Users whose UPN suffix is NOT cascadestucson.com (will mismatch M365 target unless renamed):

   - Culinary UPN=Culinary@cascades.local

   - Receptionist UPN=RECEPTIONIST@cascades.local

   - directoryshare UPN=directoryshare@cascades.local



--- Users whose SAM does not match their UPN prefix (name mismatch candidates):



--- Users with DisplayName different from Given+Surname (may cause display oddities post-sync):

   - SAM=Crystal.Rodriguez display='Crystal  Rodriguez' expected='Crystal Rodriguez'

   - SAM=howard display='howard' expected='Howard Dax'

   - SAM=Cathy.Kingston display='Cathy.Kingston' expected='Cathy Kingston'



============================================================================

== 5. Password hygiene (affects whether sync-derived sign-in will work)

============================================================================

--- Enabled users with null PasswordLastSet (never set a password):

   - Meredith.Kuhn whenCreated=2024-08-28

   - John.Trozzi whenCreated=2024-08-28

   - Megan.Hiatt whenCreated=2024-08-28

   - Tamra.Matthews whenCreated=2024-08-28

   - Christine.Nyanzunda whenCreated=2024-08-28

   - Ashley.Jensen whenCreated=2024-08-28

   - Veronica.Feller whenCreated=2024-08-28

   - Sebastian.Leon whenCreated=2024-08-28

   - JD.Martin whenCreated=2024-08-28

   - Matt.Brooks whenCreated=2024-08-28

   - Ramon.Castaneda whenCreated=2024-08-28

   - Michelle.Shestko whenCreated=2024-08-28

   - britney.thompson whenCreated=2025-06-12



--- Users with PasswordNotRequired=True:

   - Guest enabled=False



--- Users with PasswordNeverExpires=True:

   - Administrator PwdLastSet=08/04/2024 18:39:34 Description='Built-in account for administering the computer/domain'

   - localadmin PwdLastSet=12/03/2024 15:22:15 Description=''

   - Lois.Lane PwdLastSet=12/22/2025 09:52:55 Description=''

   - sysadmin PwdLastSet=09/29/2024 21:23:28 Description=''

   - QBDataServiceUser34 PwdLastSet=10/02/2024 12:22:12 Description='This account has been established to run the QuickBooks database system.'

   - Culinary PwdLastSet=12/27/2024 10:17:03 Description=''

   - Receptionist PwdLastSet=04/07/2026 12:54:47 Description=''

   - howard PwdLastSet=08/11/2025 13:18:03 Description='Home Offie'

   - directoryshare PwdLastSet=12/01/2025 10:02:12 Description=''

   - Shelby.Trozzi PwdLastSet=12/11/2025 14:03:27 Description=''

   - svc-audit-upload PwdLastSet=04/17/2026 15:21:13 Description='Write-only access to \\CS-SERVER\AuditDrop$. Used by Syncro audit upload script. Do not use interactively.'



--- Currently locked-out accounts:



krbtgt password last set: 08/28/2024 10:02:37 (age: 602 days)

   (best practice: rotate every 180 days; > 180 is a known audit finding)



============================================================================

== 6. Role-based / shared accounts (should NOT sync)

============================================================================

Accounts whose SamAccountName looks role-based (should be EXCLUDED from sync scope):

   - Culinary enabled=True OU=CN=Culinary,OU=Culinary,OU=Departments,DC=cascades,DC=local

   - Receptionist enabled=True OU=CN=RECEPTIONIST,CN=Users,DC=cascades,DC=local

   - saleshare enabled=True OU=CN=saleshare,OU=Marketing,OU=Departments,DC=cascades,DC=local

   - directoryshare enabled=True OU=CN=directoryshare,CN=Users,DC=cascades,DC=local



Service / built-in accounts (context - usually excluded from sync):

   - Administrator enabled=True

   - Guest enabled=False

   - localadmin enabled=True

   - krbtgt enabled=False

   - sysadmin enabled=True

   - QBDataServiceUser34 enabled=True

   - howard enabled=True



============================================================================

== 7. Likely-departed accounts still enabled (HIPAA termination risk)

============================================================================

Enabled accounts with no logon activity in 90+ days:

   - britney.thompson lastLogon=never

   - karen.rossini lastLogon=never

   - Shelby.Trozzi lastLogon=never

   - Ramon.Castaneda lastLogon=never

   - Matt.Brooks lastLogon=never

   - Christopher.Holick lastLogon=never

   - Michelle.Shestko lastLogon=never

   - Ray.Rai lastLogon=never

   - Shontiel.Nunn lastLogon=never

   - Julian.Crim lastLogon=never

   - Richard.Adams lastLogon=never

   - Lupe.Sanchez lastLogon=never

   - Alyssa.Brooks lastLogon=never

   - Cathy.Kingston lastLogon=never

   - Sheldon.Gardfrey lastLogon=never

   - JD.Martin lastLogon=never

   - Tamra.Matthews lastLogon=never

   - Megan.Hiatt lastLogon=never

   - svc-audit-upload lastLogon=never

   - Lois.Lane lastLogon=never

   - John.Trozzi lastLogon=never

   - Kyla.QuickTiffany lastLogon=never

   - Meredith.Kuhn lastLogon=never

   - Ashley.Jensen lastLogon=never

   - Veronica.Feller lastLogon=never

   - Sebastian.Leon lastLogon=never

   - Christine.Nyanzunda lastLogon=never

   - saleshare lastLogon=2025-12-08

   - Christina.DuPras lastLogon=2026-01-06



============================================================================

== 8. AD groups inventory

============================================================================

Total groups: 55



Group name | Scope | Category | Members | Created | Description

---

Access Control Assistance Operators | DomainLocal | Security | 0 | 2024-08-28 | Members of this group can remotely query authorization attributes and permissions for resources on this computer.

Account Operators | DomainLocal | Security | 0 | 2024-08-28 | Members can administer domain user and group accounts

Administrators | DomainLocal | Security | 4 | 2024-08-28 | Administrators have complete and unrestricted access to the computer/domain

Allowed RODC Password Replication Group | DomainLocal | Security | 0 | 2024-08-28 | Members in this group can have their passwords replicated to all read-only domain controllers in the domain

AuditUploaders | Global | Security | 1 | 2026-04-17 | Members can WRITE-ONLY to \\CS-SERVER\AuditDrop$. No read/list.

Backup Operators | DomainLocal | Security | 0 | 2024-08-28 | Backup Operators can override security restrictions for the sole purpose of backing up or restoring files

Cert Publishers | DomainLocal | Security | 0 | 2024-08-28 | Members of this group are permitted to publish certificates to the directory

Certificate Service DCOM Access | DomainLocal | Security | 0 | 2024-08-28 | Members of this group are allowed to connect to Certification Authorities in the enterprise

Cloneable Domain Controllers | Global | Security | 0 | 2024-08-28 | Members of this group that are domain controllers may be cloned.

Cryptographic Operators | DomainLocal | Security | 0 | 2024-08-28 | Members are authorized to perform cryptographic operations.

Denied RODC Password Replication Group | DomainLocal | Security | 8 | 2024-08-28 | Members in this group cannot have their passwords replicated to any read-only domain controllers in the domain

DHCP Administrators | DomainLocal | Security | 0 | 2025-12-22 | Members who have administrative access to the DHCP Service

DHCP Users | DomainLocal | Security | 0 | 2025-12-22 | Members who have view-only access to the DHCP service

Distributed COM Users | DomainLocal | Security | 0 | 2024-08-28 | Members are allowed to launch, activate and use Distributed COM objects on this machine.

DnsAdmins | DomainLocal | Security | 0 | 2024-08-28 | DNS Administrators Group

DnsUpdateProxy | Global | Security | 0 | 2024-08-28 | DNS clients who are permitted to perform dynamic updates on behalf of some other clients (such as DHCP servers).

Domain Admins | Global | Security | 2 | 2024-08-28 | Designated administrators of the domain

Domain Computers | Global | Security | 0 | 2024-08-28 | All workstations and servers joined to the domain

Domain Controllers | Global | Security | 0 | 2024-08-28 | All domain controllers in the domain

Domain Guests | Global | Security | 0 | 2024-08-28 | All domain guests

Domain Users | Global | Security | 0 | 2024-08-28 | All domain users

Enterprise Admins | Universal | Security | 1 | 2024-08-28 | Designated administrators of the enterprise

Enterprise Key Admins | Universal | Security | 0 | 2024-08-28 | Members of this group can perform administrative actions on key objects within the forest.

Enterprise Read-only Domain Controllers | Universal | Security | 0 | 2024-08-28 | Members of this group are Read-Only Domain Controllers in the enterprise

Event Log Readers | DomainLocal | Security | 0 | 2024-08-28 | Members of this group can read event logs from local machine

Group Policy Creator Owners | Global | Security | 1 | 2024-08-28 | Members in this group can modify group policy for the domain

Guests | DomainLocal | Security | 2 | 2024-08-28 | Guests have the same access as members of the Users group by default, except for the Guest account which is further restricted

Hyper-V Administrators | DomainLocal | Security | 0 | 2024-08-28 | Members of this group have complete and unrestricted access to all features of Hyper-V.

IIS_IUSRS | DomainLocal | Security | 0 | 2024-08-28 | Built-in group used by Internet Information Services.

Incoming Forest Trust Builders | DomainLocal | Security | 0 | 2024-08-28 | Members of this group can create incoming, one-way trusts to this forest

Key Admins | Global | Security | 0 | 2024-08-28 | Members of this group can perform administrative actions on key objects within the domain.

KitchenAdmin | Global | Security | 0 | 2025-12-11 | 

MemoryCareDepartment | Global | Security | 0 | 2025-12-11 | 

Network Configuration Operators | DomainLocal | Security | 0 | 2024-08-28 | Members in this group can have some administrative privileges to manage configuration of networking features

Performance Log Users | DomainLocal | Security | 0 | 2024-08-28 | Members of this group may schedule logging of performance counters, enable trace providers, and collect event traces both locally and via remote access to this computer

Performance Monitor Users | DomainLocal | Security | 0 | 2024-08-28 | Members of this group can access performance counter data locally and remotely

Pre-Windows 2000 Compatible Access | DomainLocal | Security | 1 | 2024-08-28 | A backward compatibility group which allows read access on all users and groups in the domain

Print Operators | DomainLocal | Security | 0 | 2024-08-28 | Members can administer printers installed on domain controllers

Protected Users | Global | Security | 0 | 2024-08-28 | Members of this group are afforded additional protections against authentication security threats. See http://go.microsoft.com/fwlink/?LinkId=298939 for more information.

QuickBooks Access | DomainLocal | Security | 3 | 2024-10-25 | 

RAS and IAS Servers | DomainLocal | Security | 0 | 2024-08-28 | Servers in this group can access remote access properties of users

RDS Endpoint Servers | DomainLocal | Security | 2 | 2024-08-28 | Servers in this group run virtual machines and host sessions where users RemoteApp programs and personal virtual desktops run. This group needs to be populated on servers running RD Connection Broker. RD Session Host servers and RD Virtualization Host servers used in the deployment need to be in this group.

RDS Management Servers | DomainLocal | Security | 2 | 2024-08-28 | Servers in this group can perform routine administrative actions on servers running Remote Desktop Services. This group needs to be populated on all servers in a Remote Desktop Services deployment. The servers running the RDS Central Management service must be included in this group.

RDS Remote Access Servers | DomainLocal | Security | 1 | 2024-08-28 | Servers in this group enable users of RemoteApp programs and personal virtual desktops access to these resources. In Internet-facing deployments, these servers are typically deployed in an edge network. This group needs to be populated on servers running RD Connection Broker. RD Gateway servers and RD Web Access servers used in the deployment need to be in this group.

Read-only Domain Controllers | Global | Security | 0 | 2024-08-28 | Members of this group are Read-Only Domain Controllers in the domain

Remote Desktop Users | DomainLocal | Security | 1 | 2024-08-28 | Members in this group are granted the right to logon remotely

Remote Management Users | DomainLocal | Security | 0 | 2024-08-28 | Members of this group can access WMI resources over management protocols (such as WS-Management via the Windows Remote Management service). This applies only to WMI namespaces that grant access to the user.

Replicator | DomainLocal | Security | 0 | 2024-08-28 | Supports file replication in a domain

Roaming | Global | Security | 0 | 2025-03-18 | 

Schema Admins | Universal | Security | 1 | 2024-08-28 | Designated administrators of the schema

Server Operators | DomainLocal | Security | 0 | 2024-08-28 | Members can administer domain servers

Storage Replica Administrators | DomainLocal | Security | 0 | 2024-08-28 | Members of this group have complete and unrestricted access to all features of Storage Replica.

Terminal Server License Servers | DomainLocal | Security | 0 | 2024-08-28 | Members of this group can update user accounts in Active Directory with information about license issuance, for the purpose of tracking and reporting TS Per User CAL usage

Users | DomainLocal | Security | 6 | 2024-08-28 | Users are prevented from making accidental or intentional system-wide changes and can run most applications

Windows Authorization Access Group | DomainLocal | Security | 1 | 2024-08-28 | Members of this group have access to the computed tokenGroupsGlobalAndUniversal attribute on User objects



Security groups our rollout plan assumes (checking existence):

   [MISSING] SG-External-Signin-Allowed (needs creation)

   [MISSING] SG-Caregivers (needs creation)

   [MISSING] SG-FrontDesk (needs creation)

   [MISSING] SG-CourtesyPatrol (needs creation)

   [MISSING] SG-Drivers (needs creation)

   [MISSING] SG-Management-RW (needs creation)

   [MISSING] SG-Sales-RW (needs creation)

   [MISSING] SG-Culinary-RW (needs creation)

   [MISSING] SG-IT-RW (needs creation)

   [MISSING] SG-Receptionist-RW (needs creation)

   [MISSING] SG-Directory-RW (needs creation)

   [MISSING] SG-Server-RW (needs creation)

   [MISSING] SG-Chat-RW (needs creation)

   [MISSING] SG-Office-PHI-External (needs creation)

   [MISSING] SG-Office-PHI-Internal (needs creation)

   [MISSING] SG-CA-BreakGlass (needs creation)



============================================================================

== 9. Computers (for sync scope decision)

============================================================================

Total computer accounts: 8

Enabled:  8

Disabled: 0



Computer | OS | Enabled | LastLogon

---

ACCT2-PC | Windows 11 Pro for Workstations | True | 2026-04-22

CRYSTAL-PC | Windows 11 Pro | True | 2026-04-16

CS-QB | Windows 10 Pro | True | 2026-04-16

CS-SERVER | Windows Server 2019 Standard | True | 2026-04-22

DESKTOP-1ISF081 | Windows 10 Pro | True | 2025-03-22

DESKTOP-DLTAGOI | Windows 11 Pro for Workstations | True | 2026-04-13

DESKTOP-H6QHRR7 | Windows 11 Pro for Workstations | True | 2026-04-13

DESKTOP-ROK7VNM | Windows 11 Pro for Workstations | True | 2026-04-13



============================================================================

== 10. Existing Entra Connect / MSOL account check

============================================================================

[OK] No MSOL_* accounts in AD (clean install target)



============================================================================

== 11. Recycle Bin + deleted objects

============================================================================

AD Recycle Bin enabled: True

Deleted objects (sample of 10):

   - Deleted Objects deletedFrom=''

   - Lupe Sanchez
DEL:7234271e-68da-467e-aa9f-b505ec62e06f deletedFrom='CN=Users,DC=cascades,DC=local'

   - Anna Pitzlin
DEL:e0a3ddf4-a062-494a-9ca3-d4887acea4d9 deletedFrom='CN=Users,DC=cascades,DC=local'

   - Nela Durut-Azizi
DEL:744b63c4-c4d0-4740-b5b9-a864ac4a6e64 deletedFrom='CN=Users,DC=cascades,DC=local'

   - Haris Durut
DEL:7b8e8152-2f9b-481f-8776-33a1949c95b5 deletedFrom='CN=Users,DC=cascades,DC=local'

   - Jodi Ramstack
DEL:831930f5-0d71-403a-8360-7ffcc6ec3a62 deletedFrom='CN=Users,DC=cascades,DC=local'

   - Monica Ramirez
DEL:23bbc7b2-43c2-4db8-a8f7-97a93f48272e deletedFrom='CN=Users,DC=cascades,DC=local'

   - Nuria Diaz
DEL:11f586e9-ea83-4db5-aa74-cca5696abbcf deletedFrom='CN=Users,DC=cascades,DC=local'

   - Cathy Reece
DEL:c10591da-72ee-4074-9b50-1d004bc46eb2 deletedFrom='CN=Users,DC=cascades,DC=local'

   - Kelly Wallace
DEL:1940c00c-6382-449b-be19-8460e74b8317 deletedFrom='CN=Users,DC=cascades,DC=local'



============================================================================

== 12. DNS / DC connectivity (sync path)

============================================================================

--- Key outbound hostnames (already verified clean in readiness check, re-verify):

   [OK] login.microsoftonline.com -> 

   [OK] login.windows.net -> 

   [OK] adminwebservice.microsoftonline.com -> 



============================================================================

== 13. DC health quick recheck

============================================================================

(Any entries above mean a dcdiag warning/failure; otherwise silent = all pass.)



============================================================================

== 14. NTP time sync (re-verify)

============================================================================

Source: time.nist.gov,0x8 

System.Object[]



============================================================================

== Done

============================================================================

Completed at 04/22/2026 19:55:54


```
