Session log: Howard caregiver reconciliation and new account provisioning 2026-05-18
Cascades of Tucson — created 4 new caregiver accounts, Alma Montt admin account, terminated Niel Castro, reclassified Celia Lassey and Patricia Sandoval-Beck from SG-Caregivers. Entra sync run; Alma Montt M365 license pending background task. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
@@ -0,0 +1,106 @@
|
||||
# Cascades of Tucson -- Add 4 new caregiver accounts (2026-05-18)
|
||||
# Run on: CS-SERVER as a domain admin
|
||||
# OU: OU=Caregivers,OU=Departments,DC=cascades,DC=local
|
||||
#
|
||||
# Net-new hires identified from updated HR roster (employees.xlsx, 2026-05-18).
|
||||
# Creates accounts and immediately adds to SG-Caregivers.
|
||||
#
|
||||
# Name notes:
|
||||
# t.lassey-assiakoley -- "Tele Sepopo Lassey Assiakoley". Compound first AND last name.
|
||||
# t.lassey was unavailable (Celia Lassey). Hyphenated form chosen.
|
||||
# Personal email: sepopolassey@gmail.com
|
||||
|
||||
$OU = "OU=Caregivers,OU=Departments,DC=cascades,DC=local"
|
||||
$Domain = "cascadestucson.com"
|
||||
$Group = "SG-Caregivers"
|
||||
$TempPassword = ConvertTo-SecureString "Cascades2026!" -AsPlainText -Force
|
||||
|
||||
$NewCaregivers = @(
|
||||
@{ First="Luriz"; Last="Fuster"; Sam="l.fuster"; Title="AL Caregiver" },
|
||||
@{ First="Tele Sepopo"; Last="Lassey Assiakoley"; Sam="t.lassey-assiakoley"; Title="AL Caregiver" },
|
||||
@{ First="Shontiel"; Last="Nunn"; Sam="s.nunn"; Title="AL Caregiver" },
|
||||
@{ First="Diana"; Last="Fierros"; Sam="d.fierros"; Title="MC Caregiver" }
|
||||
)
|
||||
|
||||
$created = 0
|
||||
$failed = 0
|
||||
$skipped = 0
|
||||
|
||||
Write-Host "=== Creating accounts ==="
|
||||
foreach ($c in $NewCaregivers) {
|
||||
$displayName = "$($c.First) $($c.Last)"
|
||||
$upn = "$($c.Sam)@$Domain"
|
||||
|
||||
if (Get-ADUser -Filter "SamAccountName -eq '$($c.Sam)'" -ErrorAction SilentlyContinue) {
|
||||
Write-Host "[SKIP] $displayName already exists ($($c.Sam))"
|
||||
$skipped++
|
||||
continue
|
||||
}
|
||||
|
||||
try {
|
||||
New-ADUser `
|
||||
-Name $displayName `
|
||||
-GivenName $c.First `
|
||||
-Surname $c.Last `
|
||||
-SamAccountName $c.Sam `
|
||||
-UserPrincipalName $upn `
|
||||
-Path $OU `
|
||||
-AccountPassword $TempPassword `
|
||||
-Enabled $true `
|
||||
-ChangePasswordAtLogon $false `
|
||||
-PasswordNeverExpires $true
|
||||
|
||||
Write-Host "[OK] $displayName -- $upn"
|
||||
$created++
|
||||
}
|
||||
catch {
|
||||
Write-Host "[ERROR] $displayName -- $_"
|
||||
$failed++
|
||||
}
|
||||
}
|
||||
|
||||
Write-Host ""
|
||||
Write-Host ("Accounts: {0} created, {1} failed, {2} skipped" -f $created, $failed, $skipped)
|
||||
|
||||
Write-Host ""
|
||||
Write-Host "=== Adding to $Group ==="
|
||||
|
||||
$added = 0
|
||||
$sgFailed = 0
|
||||
$sgSkipped = 0
|
||||
|
||||
foreach ($c in $NewCaregivers) {
|
||||
$user = Get-ADUser -Filter "SamAccountName -eq '$($c.Sam)'" -ErrorAction SilentlyContinue
|
||||
if (-not $user) {
|
||||
Write-Host "[SKIP] $($c.Sam) -- not found in AD (account creation may have failed)"
|
||||
$sgSkipped++
|
||||
continue
|
||||
}
|
||||
|
||||
$inGroup = Get-ADGroupMember -Identity $Group -ErrorAction SilentlyContinue |
|
||||
Where-Object { $_.SamAccountName -eq $c.Sam }
|
||||
|
||||
if ($inGroup) {
|
||||
Write-Host "[SKIP] $($c.Sam) -- already in $Group"
|
||||
$sgSkipped++
|
||||
continue
|
||||
}
|
||||
|
||||
try {
|
||||
Add-ADGroupMember -Identity $Group -Members $c.Sam
|
||||
Write-Host "[OK] $($c.Sam) -- added to $Group"
|
||||
$added++
|
||||
}
|
||||
catch {
|
||||
Write-Host "[ERROR] $($c.Sam) -- $_"
|
||||
$sgFailed++
|
||||
}
|
||||
}
|
||||
|
||||
Write-Host ""
|
||||
Write-Host ("SG-Caregivers: {0} added, {1} failed, {2} skipped" -f $added, $sgFailed, $sgSkipped)
|
||||
Write-Host ""
|
||||
Write-Host "Next: force Entra Connect delta sync on CS-SERVER:"
|
||||
Write-Host " Start-ADSyncSyncCycle -PolicyType Delta"
|
||||
Write-Host ""
|
||||
Write-Host "After sync (~30 min), M365 will provision Exchange mailboxes for all 4 accounts."
|
||||
@@ -0,0 +1,58 @@
|
||||
# Cascades of Tucson -- Create Alma Montt AD account
|
||||
# Date: 2026-05-18 Ticket: #109316879
|
||||
# Run on: CS-SERVER as a domain admin
|
||||
#
|
||||
# Alma Montt -- Administrative staff (role TBD on ticket)
|
||||
# SamAccountName follows non-caregiver convention: FirstName.LastName
|
||||
# Force password change at next logon -- admin staff set their own passwords.
|
||||
#
|
||||
# After account is created and Entra Connect syncs (~30 min), assign a
|
||||
# Business Standard license in M365 Admin to activate the mailbox.
|
||||
# Credential delivery to Meredith/Alma is a manual step.
|
||||
|
||||
$OU = "OU=Administrative,OU=Departments,DC=cascades,DC=local"
|
||||
$Domain = "cascadestucson.com"
|
||||
$TempPassword = ConvertTo-SecureString "Cascades2026!" -AsPlainText -Force
|
||||
|
||||
$Sam = "Alma.Montt"
|
||||
$First = "Alma"
|
||||
$Last = "Montt"
|
||||
$DisplayName = "Alma Montt"
|
||||
$UPN = "$Sam@$Domain"
|
||||
|
||||
if (Get-ADUser -Filter "SamAccountName -eq '$Sam'" -ErrorAction SilentlyContinue) {
|
||||
Write-Host "[SKIP] $DisplayName already exists ($Sam)"
|
||||
exit 0
|
||||
}
|
||||
|
||||
try {
|
||||
New-ADUser `
|
||||
-Name $DisplayName `
|
||||
-GivenName $First `
|
||||
-Surname $Last `
|
||||
-SamAccountName $Sam `
|
||||
-UserPrincipalName $UPN `
|
||||
-Path $OU `
|
||||
-AccountPassword $TempPassword `
|
||||
-Enabled $true `
|
||||
-ChangePasswordAtLogon $true `
|
||||
-PasswordNeverExpires $false
|
||||
|
||||
Write-Host "[OK] $DisplayName created"
|
||||
Write-Host " SamAccountName : $Sam"
|
||||
Write-Host " UPN : $UPN"
|
||||
Write-Host " OU : $OU"
|
||||
Write-Host " Temp password : Cascades2026!"
|
||||
}
|
||||
catch {
|
||||
Write-Host "[ERROR] $_"
|
||||
exit 1
|
||||
}
|
||||
|
||||
Write-Host ""
|
||||
Write-Host "Next steps:"
|
||||
Write-Host " 1. Force Entra Connect delta sync: Start-ADSyncSyncCycle -PolicyType Delta"
|
||||
Write-Host " 2. Confirm account appears in M365 admin (~30 min after sync)"
|
||||
Write-Host " 3. Assign Business Standard license in M365 admin"
|
||||
Write-Host " 4. Deliver credentials to Alma / Meredith"
|
||||
Write-Host " 5. Close ticket #109316879"
|
||||
@@ -0,0 +1,80 @@
|
||||
# Cascades of Tucson -- Terminate Niel Castro (n.castro)
|
||||
# Date: 2026-05-18
|
||||
# Run on: CS-SERVER as a domain admin
|
||||
# Run M365 steps separately via Graph / Exchange Online
|
||||
#
|
||||
# Reason: confirmed departed per updated HR roster (employees.xlsx, 2026-05-18)
|
||||
# Account was created 2026-05-16 -- no M365 license was assigned, but account
|
||||
# may have synced to Entra via Entra Connect. Block sign-in on both layers.
|
||||
#
|
||||
# Follows: docs/security/termination-procedures.md
|
||||
|
||||
$Sam = "n.castro"
|
||||
$UPN = "n.castro@cascadestucson.com"
|
||||
$Group = "SG-Caregivers"
|
||||
|
||||
Write-Host "=== AD: Disable $Sam ==="
|
||||
|
||||
$user = Get-ADUser -Filter "SamAccountName -eq '$Sam'" -ErrorAction SilentlyContinue
|
||||
if (-not $user) {
|
||||
Write-Host "[ERROR] $Sam not found in AD -- nothing to do"
|
||||
exit 1
|
||||
}
|
||||
|
||||
# Disable account
|
||||
try {
|
||||
Disable-ADAccount -Identity $Sam
|
||||
Write-Host "[OK] $Sam disabled"
|
||||
}
|
||||
catch {
|
||||
Write-Host "[ERROR] Disable-ADAccount: $_"
|
||||
}
|
||||
|
||||
# Remove from SG-Caregivers
|
||||
$inGroup = Get-ADGroupMember -Identity $Group -ErrorAction SilentlyContinue |
|
||||
Where-Object { $_.SamAccountName -eq $Sam }
|
||||
|
||||
if ($inGroup) {
|
||||
try {
|
||||
Remove-ADGroupMember -Identity $Group -Members $Sam -Confirm:$false
|
||||
Write-Host "[OK] $Sam removed from $Group"
|
||||
}
|
||||
catch {
|
||||
Write-Host "[ERROR] Remove-ADGroupMember: $_"
|
||||
}
|
||||
}
|
||||
else {
|
||||
Write-Host "[SKIP] $Sam was not in $Group"
|
||||
}
|
||||
|
||||
# Update description
|
||||
try {
|
||||
Set-ADUser -Identity $Sam -Description "TERMINATED 2026-05-18"
|
||||
Write-Host "[OK] Description updated"
|
||||
}
|
||||
catch {
|
||||
Write-Host "[ERROR] Set-ADUser description: $_"
|
||||
}
|
||||
|
||||
Write-Host ""
|
||||
Write-Host "=== M365 steps (run separately in Exchange Online / Graph) ==="
|
||||
Write-Host ""
|
||||
Write-Host "1. Block sign-in:"
|
||||
Write-Host " Update-MgUser -UserId '$UPN' -AccountEnabled:`$false"
|
||||
Write-Host ""
|
||||
Write-Host "2. Revoke active sessions:"
|
||||
Write-Host " Invoke-MgInvalidateAllUserRefreshToken -UserId '$UPN'"
|
||||
Write-Host " -- or --"
|
||||
Write-Host " Revoke-MgUserSignInSession -UserId '$UPN'"
|
||||
Write-Host ""
|
||||
Write-Host "3. If mailbox exists -- check first:"
|
||||
Write-Host " Get-Mailbox -Identity '$UPN' -ErrorAction SilentlyContinue"
|
||||
Write-Host " If found:"
|
||||
Write-Host " Set-Mailbox -Identity '$UPN' -Type Shared"
|
||||
Write-Host " Set-Mailbox -Identity '$UPN' -HiddenFromAddressListsEnabled `$true"
|
||||
Write-Host " (License already unlicensed -- no license removal step needed)"
|
||||
Write-Host ""
|
||||
Write-Host "4. Force Entra Connect delta sync so the disable propagates to cloud:"
|
||||
Write-Host " Start-ADSyncSyncCycle -PolicyType Delta"
|
||||
Write-Host ""
|
||||
Write-Host "5. Log in docs/issues/log.md -- termination date 2026-05-18, performed by Howard"
|
||||
Reference in New Issue
Block a user