sync: auto-sync from HOWARD-HOME at 2026-04-22 21:40:31

Author: Howard Enos Machine: HOWARD-HOME Timestamp: 2026-04-22 21:40:31
2026-04-22 21:40:32 -07:00
parent 2b13299657
commit 5c6f7dca5e
11 changed files with 2236 additions and 3 deletions
--- a/clients/cascades-tucson/reports/2026-04-22-g1-ad-audit.md
+++ b/clients/cascades-tucson/reports/2026-04-22-g1-ad-audit.md
@@ -0,0 +1,426 @@
+# CS-SERVER G1 AD Audit
+
+**Command ID:** e83befb7-4c8c-4f24-9b24-56cb641e6464
+**Run:** 2026-04-23T02:55:50.634848Z
+**Exit:** 0
+
+## STDOUT
+
+```
+G1 AD Audit - 2026-04-22 19:55:51 -07:00
+
+Host: CS-SERVER
+
+
+
+============================================================================
+
+== 1. Forest / Domain / Schema
+
+============================================================================
+
+Forest FQDN:           cascades.local
+
+Forest mode:           Windows2016Forest
+
+Domain mode:           Windows2016Domain
+
+Domain DN:             DC=cascades,DC=local
+
+NetBIOS:               CASCADES
+
+UPN suffixes (forest):
+
+   - cascadestucson.com
+
+Schema objectVersion:  88
+
+
+
+FSMO roles:
+
+   Schema Master:           CS-SERVER.cascades.local
+
+   Domain Naming Master:    CS-SERVER.cascades.local
+
+   PDC Emulator:            CS-SERVER.cascades.local
+
+   RID Master:              CS-SERVER.cascades.local
+
+   Infrastructure Master:   CS-SERVER.cascades.local
+
+
+
+============================================================================
+
+== 2. OU structure
+
+============================================================================
+
+Total OUs: 18
+
+
+
+   OU=Administrative,OU=Departments,DC=cascades,DC=local                            users=5 groups=0 computers=0
+
+   OU=Care-Assisted Living,OU=Departments,DC=cascades,DC=local                      users=4 groups=0 computers=0
+
+   OU=Care-Memorycare,OU=Departments,DC=cascades,DC=local                           users=2 groups=0 computers=0
+
+   OU=Culinary,OU=Departments,DC=cascades,DC=local                                  users=4 groups=0 computers=0
+
+   OU=Departments,DC=cascades,DC=local                                              users=0 groups=0 computers=0
+
+   OU=Domain Controllers,DC=cascades,DC=local                                       users=0 groups=0 computers=1
+
+   OU=Groups,DC=cascades,DC=local                                                   users=0 groups=1 computers=0
+
+   OU=Housekeeping,OU=Departments,DC=cascades,DC=local                              users=1 groups=0 computers=0
+
+   OU=Life Enrichment,OU=Departments,DC=cascades,DC=local                           users=2 groups=0 computers=0
+
+   OU=Maintenance,OU=Departments,DC=cascades,DC=local                               users=2 groups=0 computers=0
+
+   OU=Marketing,OU=Departments,DC=cascades,DC=local                                 users=4 groups=0 computers=0
+
+   OU=Nurses,OU=Care-Assisted Living,OU=Departments,DC=cascades,DC=local            users=0 groups=0 computers=0
+
+   OU=Resident Services,OU=Departments,DC=cascades,DC=local                         users=8 groups=0 computers=0
+
+   OU=ServiceAccounts,DC=cascades,DC=local                                          users=1 groups=0 computers=0
+
+   OU=Shared PCs,OU=Workstations,DC=cascades,DC=local                               users=0 groups=0 computers=0
+
+   OU=Staff PCs,OU=Workstations,DC=cascades,DC=local                                users=0 groups=0 computers=6
+
+   OU=Transportation,OU=Departments,DC=cascades,DC=local                            users=3 groups=0 computers=0
+
+   OU=Workstations,DC=cascades,DC=local                                             users=0 groups=0 computers=0
+
+
+
+Users in default CN=Users container (not ideal - should be in an OU for sync scope):
+
+   Count: 8
+
+   - Administrator (Administrator)
+
+   - directoryshare (directoryshare)
+
+   - Guest (Guest)
+
+   - krbtgt (krbtgt)
+
+   - localadmin (localadmin)
+
+   - QBDataServiceUser34 (QBDataServiceUser34)
+
+   - Receptionist (RECEPTIONIST)
+
+   - sysadmin (Sysadmin)
+
+
+
+============================================================================
+
+== 3. All AD users - identity attributes for sync match
+
+============================================================================
+
+Total users: 44
+
+Enabled:     42
+
+Disabled:    2
+
+
+
+Per-user identity dump (focus: anything that affects soft-match):
+
+
+
+SAM | UPN | Mail | ProxyAddrs | PwdLastSet | PwdNeverExp | Enabled | OU
+
+---
+
+Administrator |  |  |  | 2024-08-04 | True | True | CN=Users
+
+Allison.Reibschied | Allison.Reibschied@cascadestucson.com |  |  | 2026-03-13 | False | True | OU=Administrative,OU=Departments
+
+Alyssa.Brooks | Alyssa.Brooks@cascadestucson.com |  |  | 2025-12-12 | False | True | OU=Culinary,OU=Departments
+
+Ashley.Jensen | Ashley.Jensen@cascadestucson.com |  |  | NULL | False | True | OU=Administrative,OU=Departments
+
+britney.thompson | britney.thompson@cascadestucson.com |  |  | NULL | False | True | OU=Care-Assisted Living,OU=Departments
+
+Cathy.Kingston | Cathy.Kingston@cascadestucson.com |  |  | 2025-12-12 | False | True | OU=Resident Services,OU=Departments
+
+Christina.DuPras | Christina.DuPras@cascadestucson.com |  |  | 2026-01-06 | False | True | OU=Resident Services,OU=Departments
+
+Christine.Nyanzunda | Christine.Nyanzunda@cascadestucson.com |  |  | NULL | False | True | OU=Care-Memorycare,OU=Departments
+
+Christopher.Holick | Christopher.Holick@cascadestucson.com |  |  | 2025-12-12 | False | True | OU=Transportation,OU=Departments
+
+Crystal.Rodriguez | Crystal.Rodriguez@cascadestucson.com |  |  | 2026-04-20 | False | True | OU=Marketing,OU=Departments
+
+Culinary | Culinary@cascades.local |  |  | 2024-12-27 | True | True | OU=Culinary,OU=Departments
+
+directoryshare | directoryshare@cascades.local |  |  | 2025-12-01 | True | True | CN=Users
+
+Guest |  |  |  | NULL | True | False | CN=Users
+
+howard | howard@cascadestucson.com |  |  | 2025-08-11 | True | True | OU=Administrative,OU=Departments
+
+JD.Martin | JD.Martin@cascadestucson.com |  |  | NULL | False | True | OU=Culinary,OU=Departments
+
+John.Trozzi | John.Trozzi@cascadestucson.com |  |  | NULL | False | True | OU=Maintenance,OU=Departments
+
+Julian.Crim | Julian.Crim@cascadestucson.com |  |  | 2025-12-12 | False | True | OU=Transportation,OU=Departments
+
+karen.rossini | karen.rossini@cascadestucson.com |  |  | 2025-12-12 | False | True | OU=Care-Assisted Living,OU=Departments
+
+krbtgt |  |  |  | 2024-08-28 | False | False | CN=Users
+
+Kyla.QuickTiffany | Kyla.QuickTiffany@cascadestucson.com |  |  | 2026-04-13 | False | True | OU=Resident Services,OU=Departments
+
+lauren.hasselman | lauren.hasselman@cascadestucson.com |  |  | 2026-04-01 | False | True | OU=Administrative,OU=Departments
+
+localadmin |  |  |  | 2024-12-03 | True | True | CN=Users
+
+Lois.Lane | Lois.Lane@cascadestucson.com |  |  | 2025-12-22 | True | True | OU=Care-Assisted Living,OU=Departments
+
+Lupe.Sanchez | Lupe.Sanchez@cascadestucson.com |  |  | 2025-12-12 | False | True | OU=Housekeeping,OU=Departments
+
+Matt.Brooks | Matt.Brooks@cascadestucson.com |  |  | NULL | False | True | OU=Maintenance,OU=Departments
+
+Megan.Hiatt | Megan.Hiatt@cascadestucson.com |  |  | NULL | False | True | OU=Marketing,OU=Departments
+
+Meredith.Kuhn | Meredith.Kuhn@cascadestucson.com |  |  | NULL | False | True | OU=Administrative,OU=Departments
+
+Michelle.Shestko | Michelle.Shestko@cascadestucson.com |  |  | NULL | False | True | OU=Resident Services,OU=Departments
+
+QBDataServiceUser34 |  |  |  | 2024-10-02 | True | True | CN=Users
+
+Ramon.Castaneda | Ramon.Castaneda@cascadestucson.com |  |  | NULL | False | True | OU=Culinary,OU=Departments
+
+Ray.Rai | Ray.Rai@cascadestucson.com |  |  | 2025-12-12 | False | True | OU=Resident Services,OU=Departments
+
+Receptionist | RECEPTIONIST@cascades.local |  |  | 2026-04-07 | True | True | CN=Users
+
+Richard.Adams | Richard.Adams@cascadestucson.com |  |  | 2025-12-12 | False | True | OU=Transportation,OU=Departments
+
+saleshare |  |  |  | 2025-10-27 | False | True | OU=Marketing,OU=Departments
+
+Sebastian.Leon | Sebastian.Leon@cascadestucson.com |  |  | NULL | False | True | OU=Resident Services,OU=Departments
+
+Sharon.Edwards | Sharon.Edwards@cascadestucson.com |  |  | 2026-04-13 | False | True | OU=Life Enrichment,OU=Departments
+
+Shelby.Trozzi | Shelby.Trozzi@cascadestucson.com |  |  | 2025-12-11 | True | True | OU=Care-Memorycare,OU=Departments
+
+Sheldon.Gardfrey | Sheldon.Gardfrey@cascadestucson.com |  |  | 2025-12-12 | False | True | OU=Resident Services,OU=Departments
+
+Shontiel.Nunn | Shontiel.Nunn@cascadestucson.com |  |  | 2025-12-12 | False | True | OU=Resident Services,OU=Departments
+
+Susan.Hicks | Susan.Hicks@cascadestucson.com |  |  | 2026-04-13 | False | True | OU=Life Enrichment,OU=Departments
+
+svc-audit-upload |  |  |  | 2026-04-17 | True | True | OU=ServiceAccounts
+
+sysadmin | sysadmin@cascadestucson.com |  |  | 2024-09-29 | True | True | CN=Users
+
+Tamra.Matthews | Tamra.Matthews@cascadestucson.com |  |  | NULL | False | True | OU=Marketing,OU=Departments
+
+Veronica.Feller | Veronica.Feller@cascadestucson.com |  |  | NULL | False | True | OU=Care-Assisted Living,OU=Departments
+
+
+
+============================================================================
+
+== 4. Soft-match risk scan - accounts likely to duplicate in Entra
+
+============================================================================
+
+--- Users with NO proxyAddresses and NO mail (soft-match engine has nothing to work with):
+
+   - Administrator (UPN: )
+
+   - localadmin (UPN: )
+
+   - Meredith.Kuhn (UPN: Meredith.Kuhn@cascadestucson.com)
+
+   - John.Trozzi (UPN: John.Trozzi@cascadestucson.com)
+
+   - Megan.Hiatt (UPN: Megan.Hiatt@cascadestucson.com)
+
+   - Crystal.Rodriguez (UPN: Crystal.Rodriguez@cascadestucson.com)
+
+   - Tamra.Matthews (UPN: Tamra.Matthews@cascadestucson.com)
+
+   - Lois.Lane (UPN: Lois.Lane@cascadestucson.com)
+
+   - Christina.DuPras (UPN: Christina.DuPras@cascadestucson.com)
+
+   - Christine.Nyanzunda (UPN: Christine.Nyanzunda@cascadestucson.com)
+
+   - Susan.Hicks (UPN: Susan.Hicks@cascadestucson.com)
+
+   - Ashley.Jensen (UPN: Ashley.Jensen@cascadestucson.com)
+
+   - Veronica.Feller (UPN: Veronica.Feller@cascadestucson.com)
+
+   - Sebastian.Leon (UPN: Sebastian.Leon@cascadestucson.com)
+
+   - JD.Martin (UPN: JD.Martin@cascadestucson.com)
+
+   - Matt.Brooks (UPN: Matt.Brooks@cascadestucson.com)
+
+   - Ramon.Castaneda (UPN: Ramon.Castaneda@cascadestucson.com)
+
+   - Michelle.Shestko (UPN: Michelle.Shestko@cascadestucson.com)
+
+   - Sharon.Edwards (UPN: Sharon.Edwards@cascadestucson.com)
+
+   - sysadmin (UPN: sysadmin@cascadestucson.com)
+
+   - QBDataServiceUser34 (UPN: )
+
+   - Culinary (UPN: Culinary@cascades.local)
+
+   - Receptionist (UPN: RECEPTIONIST@cascades.local)
+
+   - britney.thompson (UPN: britney.thompson@cascadestucson.com)
+
+   - howard (UPN: howard@cascadestucson.com)
+
+   - saleshare (UPN: )
+
+   - directoryshare (UPN: directoryshare@cascades.local)
+
+   - Shelby.Trozzi (UPN: Shelby.Trozzi@cascadestucson.com)
+
+   - karen.rossini (UPN: karen.rossini@cascadestucson.com)
+
+   - Alyssa.Brooks (UPN: Alyssa.Brooks@cascadestucson.com)
+
+   - Lupe.Sanchez (UPN: Lupe.Sanchez@cascadestucson.com)
+
+   - Sheldon.Gardfrey (UPN: Sheldon.Gardfrey@cascadestucson.com)
+
+   - Cathy.Kingston (UPN: Cathy.Kingston@cascadestucson.com)
+
+   - Shontiel.Nunn (UPN: Shontiel.Nunn@cascadestucson.com)
+
+   - Ray.Rai (UPN: Ray.Rai@cascadestucson.com)
+
+   - Richard.Adams (UPN: Richard.Adams@cascadestucson.com)
+
+   - Julian.Crim (UPN: Julian.Crim@cascadestucson.com)
+
+   - Christopher.Holick (UPN: Christopher.Holick@cascadestucson.com)
+
+   - lauren.hasselman (UPN: lauren.hasselman@cascadestucson.com)
+
+   - Allison.Reibschied (UPN: Allison.Reibschied@cascadestucson.com)
+
+   - Kyla.QuickTiffany (UPN: Kyla.QuickTiffany@cascadestucson.com)
+
+   - svc-audit-upload (UPN: )
+
+
+
+--- Users whose UPN suffix is NOT cascadestucson.com (will mismatch M365 target unless renamed):
+
+   - Culinary UPN=Culinary@cascades.local
+
+   - Receptionist UPN=RECEPTIONIST@cascades.local
+
+   - directoryshare UPN=directoryshare@cascades.local
+
+
+
+--- Users whose SAM does not match their UPN prefix (name mismatch candidates):
+
+
+
+--- Users with DisplayName different from Given+Surname (may cause display oddities post-sync):
+
+   - SAM=Crystal.Rodriguez display='Crystal  Rodriguez' expected='Crystal Rodriguez'
+
+   - SAM=howard display='howard' expected='Howard Dax'
+
+   - SAM=Cathy.Kingston display='Cathy.Kingston' expected='Cathy Kingston'
+
+
+
+============================================================================
+
+== 5. Password hygiene (affects whether sync-derived sign-in will work)
+
+============================================================================
+
+--- Enabled users with null PasswordLastSet (never set a password):
+
+   - Meredith.Kuhn whenCreated=2024-08-28
+
+   - John.Trozzi whenCreated=2024-08-28
+
+   - Megan.Hiatt whenCreated=2024-08-28
+
+   - Tamra.Matthews whenCreated=2024-08-28
+
+   - Christine.Nyanzunda whenCreated=2024-08-28
+
+   - Ashley.Jensen whenCreated=2024-08-28
+
+   - Veronica.Feller whenCreated=2024-08-28
+
+   - Sebastian.Leon whenCreated=2024-08-28
+
+   - JD.Martin whenCreated=2024-08-28
+
+   - Matt.Brooks whenCreated=2024-08-28
+
+   - Ramon.Castaneda whenCreated=2024-08-28
+
+   - Michelle.Shestko whenCreated=2024-08-28
+
+   - britney.thompson whenCreated=2025-06-12
+
+
+
+--- Users with PasswordNotRequired=True:
+
+   - Guest enabled=False
+
+
+
+--- Users with PasswordNeverExpires=True:
+
+   - Administrator PwdLastSet=08/04/2024 18:39:34 Description='Built-in account for administering the computer/domain'
+
+   - localadmin PwdLastSet=12/03/2024 15:22:15 Description=''
+
+   - Lois.Lane PwdLastSet=12/22/2025 09:52:55 Description=''
+
+   - sysadmin PwdLastSet=09/29/2024 21:23:28 Description=''
+
+   - QBDataServiceUser34 PwdLastSet=10/02/2024 12:22:12 Description='This account has been established to run the QuickBooks database system.'
+
+   - Culinary PwdLastSet=12/27/2024 10:17:03 Description=''
+
+   - Receptionist PwdLastSet=04/07/2026 12:54:47 Description=''
+
+   - howard PwdLastSet=08/11/2025 13:18:03 Description='Home Offie'
+
+   - directoryshare PwdLastSet=12/01/2025 10:02:12 Description=''
+
+   - Shelby.Trozzi PwdLastSet=12/11/2025 14:03:27 Description=''
+
+   - svc-audit-upload PwdLastSet=04/17/2026 15:21:13 Description='Write-only access to \\CS-SERVER\AuditDrop$. Used by Syncro audit upload script. Do not use interactively.'
+
+
+
+--- Currently locked-out accounts:
+
+
+
+krbtgt password last set: 08/28/2024 10:02:37 (age: 602 days)
--- a/clients/cascades-tucson/reports/2026-04-22-g1-dryrun.md
+++ b/clients/cascades-tucson/reports/2026-04-22-g1-dryrun.md
@@ -0,0 +1,244 @@
+# G1 AD Hygiene Dry-Run
+
+**Command ID:** 110f0836-9fa7-4773-b82c-e7f0eb9b5bbe
+**Exit:** 0
+**Completed:** 2026-04-23T03:26:52.186400Z
+
+## STDOUT
+
+```
+G1 AD Hygiene - 2026-04-22 20:26:50 -07:00
+
+Host: CS-SERVER
+
+Mode: DRY-RUN (no changes)
+
+Backup dir: D:\Backups\g1-hygiene-2026-04-22-202650
+
+
+
+============================================================================
+
+== 0. Pre-state backup (always runs)
+
+============================================================================
+
+[OK]    Exported users-pre.csv
+
+[OK]    Exported groups-pre.csv
+
+[OK]    Exported ous-pre.csv
+
+
+
+[OK]    Pre-state saved at D:\Backups\g1-hygiene-2026-04-22-202650
+
+Rollback commands (if needed after execute):
+
+   - proxyAddresses: Set-ADUser from users-pre.csv column ProxyAddresses
+
+   - OU moves: Move-ADObject back to old DistinguishedName
+
+   - Groups created today: Remove-ADGroup (safe since memberless)
+
+
+
+============================================================================
+
+== 1. OU=Excluded-From-Sync  +  move 4 role accounts
+
+============================================================================
+
+[WOULD] Create OU=Excluded-From-Sync (ProtectedFromAccidentalDeletion=true)
+
+[WOULD] Move Culinary from OU=Culinary,OU=Departments,DC=cascades,DC=local to OU=Excluded-From-Sync,DC=cascades,DC=local
+
+[WOULD] Move Receptionist from CN=Users,DC=cascades,DC=local to OU=Excluded-From-Sync,DC=cascades,DC=local
+
+[WOULD] Move saleshare from OU=Marketing,OU=Departments,DC=cascades,DC=local to OU=Excluded-From-Sync,DC=cascades,DC=local
+
+[WOULD] Move directoryshare from CN=Users,DC=cascades,DC=local to OU=Excluded-From-Sync,DC=cascades,DC=local
+
+
+
+============================================================================
+
+== 2. Populate proxyAddresses (34 users - live data from M365 Graph 2026-04-22)
+
+============================================================================
+
+[WOULD] Allison.Reibschied
+
+       before: <empty>
+
+       after:  SMTP:Allison.Reibschied@cascadestucson.com
+
+       mail=<empty> -> Allison.Reibschied@cascadestucson.com
+
+[WOULD] Alyssa.Brooks
+
+       before: <empty>
+
+       after:  SMTP:alyssa.brooks@cascadestucson.com
+
+       mail=<empty> -> alyssa.brooks@cascadestucson.com
+
+[WOULD] Ashley.Jensen
+
+       before: <empty>
+
+       after:  SMTP:ashley.jensen@cascadestucson.com; smtp:ashley.jenson@cascadestucson.com
+
+       mail=<empty> -> ashley.jensen@cascadestucson.com
+
+[WOULD] britney.thompson
+
+       before: <empty>
+
+       after:  SMTP:Britney.Thompson@cascadestucson.com
+
+       mail=<empty> -> Britney.Thompson@cascadestucson.com
+
+[WOULD] Cathy.Kingston
+
+       before: <empty>
+
+       after:  SMTP:cathy.kingston@cascadestucson.com
+
+       mail=<empty> -> cathy.kingston@cascadestucson.com
+
+[WOULD] Christina.DuPras
+
+       before: <empty>
+
+       after:  SMTP:christina.dupras@cascadestucson.com
+
+       mail=<empty> -> christina.dupras@cascadestucson.com
+
+[WOULD] Christine.Nyanzunda
+
+       before: <empty>
+
+       after:  SMTP:christine.nyanzunda@cascadestucson.com
+
+       mail=<empty> -> christine.nyanzunda@cascadestucson.com
+
+[WOULD] Christopher.Holick
+
+       before: <empty>
+
+       after:  SMTP:christopher.holick@cascadestucson.com
+
+       mail=<empty> -> christopher.holick@cascadestucson.com
+
+[WOULD] Crystal.Rodriguez
+
+       before: <empty>
+
+       after:  SMTP:crystal.rodriguez@cascadestucson.com; smtp:crystal.suszek@cascadestucson.com
+
+       mail=<empty> -> crystal.rodriguez@cascadestucson.com
+
+[WOULD] howard
+
+       before: <empty>
+
+       after:  SMTP:dax.howard@cascadestucson.com; smtp:cara.lespron@cascadestucson.com
+
+       mail=<empty> -> dax.howard@cascadestucson.com
+
+[WOULD] JD.Martin
+
+       before: <empty>
+
+       after:  SMTP:jd.martin@cascadestucson.com
+
+       mail=<empty> -> jd.martin@cascadestucson.com
+
+[WOULD] John.Trozzi
+
+       before: <empty>
+
+       after:  SMTP:john.trozzi@cascadestucson.com
+
+       mail=<empty> -> john.trozzi@cascadestucson.com
+
+[WOULD] Julian.Crim
+
+       before: <empty>
+
+       after:  SMTP:julian.crim@cascadestucson.com
+
+       mail=<empty> -> julian.crim@cascadestucson.com
+
+[WOULD] karen.rossini
+
+       before: <empty>
+
+       after:  SMTP:karen.rossini@cascadestucson.com
+
+       mail=<empty> -> karen.rossini@cascadestucson.com
+
+[WOULD] Kyla.QuickTiffany
+
+       before: <empty>
+
+       after:  SMTP:kyla.quicktiffany@cascadestucson.com
+
+       mail=<empty> -> kyla.quicktiffany@cascadestucson.com
+
+[WOULD] lauren.hasselman
+
+       before: <empty>
+
+       after:  SMTP:lauren.hasselman@cascadestucson.com
+
+       mail=<empty> -> lauren.hasselman@cascadestucson.com
+
+[WOULD] Lois.Lane
+
+       before: <empty>
+
+       after:  SMTP:lois.lane@cascadestucson.com
+
+       mail=<empty> -> lois.lane@cascadestucson.com
+
+[WOULD] Lupe.Sanchez
+
+       before: <empty>
+
+       after:  SMTP:lupe.sanchez@cascadestucson.com
+
+       mail=<empty> -> lupe.sanchez@cascadestucson.com
+
+[WOULD] Matt.Brooks
+
+       before: <empty>
+
+       after:  SMTP:matthew.brooks@cascadestucson.com
+
+       mail=<empty> -> matthew.brooks@cascadestucson.com
+
+[WOULD] Megan.Hiatt
+
+       before: <empty>
+
+       after:  SMTP:megan.hiatt@cascadestucson.com
+
+       mail=<empty> -> megan.hiatt@cascadestucson.com
+
+[WOULD] Meredith.Kuhn
+
+       before: <empty>
+
+       after:  SMTP:meredith.kuhn@cascadestucson.com
+
+       mail=<empty> -> meredith.kuhn@cascadestucson.com
+
+[WOULD] Michelle.Shestko
+
+       before: <empty>
+
+       after:  SMTP:michelle.shestko@cascadestucson.com
+
+       mail=<empty> -> michelle.shestko@cascadestucson.com
--- a/clients/cascades-tucson/reports/2026-04-22-g1-execute.md
+++ b/clients/cascades-tucson/reports/2026-04-22-g1-execute.md
@@ -0,0 +1,228 @@
+# G1 AD Hygiene - EXECUTE
+
+**Command ID:** d49bb8dd-4916-4634-bf0c-c46bbcfcd81b
+**Exit:** 0
+**Completed:** 2026-04-23T03:32:39.186512Z
+
+## STDOUT
+
+```
+G1 AD Hygiene - 2026-04-22 20:32:32 -07:00
+
+Host: CS-SERVER
+
+Mode: EXECUTE
+
+Backup dir: D:\Backups\g1-hygiene-2026-04-22-203232
+
+
+
+============================================================================
+
+== 0. Pre-state backup (always runs)
+
+============================================================================
+
+[OK]    Exported users-pre.csv
+
+[OK]    Exported groups-pre.csv
+
+[OK]    Exported ous-pre.csv
+
+
+
+[OK]    Pre-state saved at D:\Backups\g1-hygiene-2026-04-22-203232
+
+Rollback commands (if needed after execute):
+
+   - proxyAddresses: Set-ADUser from users-pre.csv column ProxyAddresses
+
+   - OU moves: Move-ADObject back to old DistinguishedName
+
+   - Groups created today: Remove-ADGroup (safe since memberless)
+
+
+
+============================================================================
+
+== 1. OU=Excluded-From-Sync  +  move 4 role accounts
+
+============================================================================
+
+[DID]   Created OU=Excluded-From-Sync
+
+[DID]   Moved Culinary: OU=Culinary,OU=Departments,DC=cascades,DC=local -> OU=Excluded-From-Sync,DC=cascades,DC=local
+
+[DID]   Moved Receptionist: CN=Users,DC=cascades,DC=local -> OU=Excluded-From-Sync,DC=cascades,DC=local
+
+[DID]   Moved saleshare: OU=Marketing,OU=Departments,DC=cascades,DC=local -> OU=Excluded-From-Sync,DC=cascades,DC=local
+
+[DID]   Moved directoryshare: CN=Users,DC=cascades,DC=local -> OU=Excluded-From-Sync,DC=cascades,DC=local
+
+
+
+============================================================================
+
+== 2. Populate proxyAddresses (34 users - live data from M365 Graph 2026-04-22)
+
+============================================================================
+
+[DID]   Allison.Reibschied
+
+       before: <empty>
+
+       after:  SMTP:Allison.Reibschied@cascadestucson.com
+
+       mail=Allison.Reibschied@cascadestucson.com
+
+[DID]   Alyssa.Brooks
+
+       before: <empty>
+
+       after:  SMTP:alyssa.brooks@cascadestucson.com
+
+       mail=alyssa.brooks@cascadestucson.com
+
+[DID]   Ashley.Jensen
+
+       before: <empty>
+
+       after:  SMTP:ashley.jensen@cascadestucson.com; smtp:ashley.jenson@cascadestucson.com
+
+       mail=ashley.jensen@cascadestucson.com
+
+[DID]   britney.thompson
+
+       before: <empty>
+
+       after:  SMTP:Britney.Thompson@cascadestucson.com
+
+       mail=Britney.Thompson@cascadestucson.com
+
+[DID]   Cathy.Kingston
+
+       before: <empty>
+
+       after:  SMTP:cathy.kingston@cascadestucson.com
+
+       mail=cathy.kingston@cascadestucson.com
+
+[DID]   Christina.DuPras
+
+       before: <empty>
+
+       after:  SMTP:christina.dupras@cascadestucson.com
+
+       mail=christina.dupras@cascadestucson.com
+
+[DID]   Christine.Nyanzunda
+
+       before: <empty>
+
+       after:  SMTP:christine.nyanzunda@cascadestucson.com
+
+       mail=christine.nyanzunda@cascadestucson.com
+
+[DID]   Christopher.Holick
+
+       before: <empty>
+
+       after:  SMTP:christopher.holick@cascadestucson.com
+
+       mail=christopher.holick@cascadestucson.com
+
+[DID]   Crystal.Rodriguez
+
+       before: <empty>
+
+       after:  SMTP:crystal.rodriguez@cascadestucson.com; smtp:crystal.suszek@cascadestucson.com
+
+       mail=crystal.rodriguez@cascadestucson.com
+
+[DID]   howard
+
+       before: <empty>
+
+       after:  SMTP:dax.howard@cascadestucson.com; smtp:cara.lespron@cascadestucson.com
+
+       mail=dax.howard@cascadestucson.com
+
+[DID]   JD.Martin
+
+       before: <empty>
+
+       after:  SMTP:jd.martin@cascadestucson.com
+
+       mail=jd.martin@cascadestucson.com
+
+[DID]   John.Trozzi
+
+       before: <empty>
+
+       after:  SMTP:john.trozzi@cascadestucson.com
+
+       mail=john.trozzi@cascadestucson.com
+
+[DID]   Julian.Crim
+
+       before: <empty>
+
+       after:  SMTP:julian.crim@cascadestucson.com
+
+       mail=julian.crim@cascadestucson.com
+
+[DID]   karen.rossini
+
+       before: <empty>
+
+       after:  SMTP:karen.rossini@cascadestucson.com
+
+       mail=karen.rossini@cascadestucson.com
+
+[DID]   Kyla.QuickTiffany
+
+       before: <empty>
+
+       after:  SMTP:kyla.quicktiffany@cascadestucson.com
+
+       mail=kyla.quicktiffany@cascadestucson.com
+
+[DID]   lauren.hasselman
+
+       before: <empty>
+
+       after:  SMTP:lauren.hasselman@cascadestucson.com
+
+       mail=lauren.hasselman@cascadestucson.com
+
+[DID]   Lois.Lane
+
+       before: <empty>
+
+       after:  SMTP:lois.lane@cascadestucson.com
+
+       mail=lois.lane@cascadestucson.com
+
+[DID]   Lupe.Sanchez
+
+       before: <empty>
+
+       after:  SMTP:lupe.sanchez@cascadestucson.com
+
+       mail=lupe.sanchez@cascadestucson.com
+
+[DID]   Matt.Brooks
+
+       before: <empty>
+
+       after:  SMTP:matthew.brooks@cascadestucson.com
+
+       mail=matthew.brooks@cascadestucson.com
+
+[DID]   Megan.Hiatt
+
+       before: <empty>
+
+       after:  SMTP:megan.hiatt@cascadestucson.com
+
+       mail=megan.hiatt@cascadestucson.com
--- a/clients/cascades-tucson/reports/2026-04-22-g1-post-verify.md
+++ b/clients/cascades-tucson/reports/2026-04-22-g1-post-verify.md
@@ -0,0 +1,121 @@
+# G1 AD Hygiene - Post-Execute Idempotency Verification
+
+**Command ID:** 2bd999a0-b9a1-4599-a44b-d90f32a332ad
+**Exit:** 0
+**Completed:** 2026-04-23T03:33:28.670135Z
+
+## STDOUT
+
+```
+G1 AD Hygiene - 2026-04-22 20:33:27 -07:00
+
+Host: CS-SERVER
+
+Mode: DRY-RUN (no changes)
+
+Backup dir: D:\Backups\g1-hygiene-2026-04-22-203327
+
+
+
+============================================================================
+
+== 0. Pre-state backup (always runs)
+
+============================================================================
+
+[OK]    Exported users-pre.csv
+
+[OK]    Exported groups-pre.csv
+
+[OK]    Exported ous-pre.csv
+
+
+
+[OK]    Pre-state saved at D:\Backups\g1-hygiene-2026-04-22-203327
+
+Rollback commands (if needed after execute):
+
+   - proxyAddresses: Set-ADUser from users-pre.csv column ProxyAddresses
+
+   - OU moves: Move-ADObject back to old DistinguishedName
+
+   - Groups created today: Remove-ADGroup (safe since memberless)
+
+
+
+============================================================================
+
+== 1. OU=Excluded-From-Sync  +  move 4 role accounts
+
+============================================================================
+
+[SKIP]  OU=Excluded-From-Sync already exists
+
+[SKIP]  Culinary already in Excluded-From-Sync
+
+[SKIP]  Receptionist already in Excluded-From-Sync
+
+[SKIP]  saleshare already in Excluded-From-Sync
+
+[SKIP]  directoryshare already in Excluded-From-Sync
+
+
+
+============================================================================
+
+== 2. Populate proxyAddresses (34 users - live data from M365 Graph 2026-04-22)
+
+============================================================================
+
+[SKIP]  Allison.Reibschied proxyAddresses already current
+
+[SKIP]  Alyssa.Brooks proxyAddresses already current
+
+[SKIP]  Ashley.Jensen proxyAddresses already current
+
+[SKIP]  britney.thompson proxyAddresses already current
+
+[SKIP]  Cathy.Kingston proxyAddresses already current
+
+[SKIP]  Christina.DuPras proxyAddresses already current
+
+[SKIP]  Christine.Nyanzunda proxyAddresses already current
+
+[SKIP]  Christopher.Holick proxyAddresses already current
+
+[SKIP]  Crystal.Rodriguez proxyAddresses already current
+
+[SKIP]  howard proxyAddresses already current
+
+[SKIP]  JD.Martin proxyAddresses already current
+
+[SKIP]  John.Trozzi proxyAddresses already current
+
+[SKIP]  Julian.Crim proxyAddresses already current
+
+[SKIP]  karen.rossini proxyAddresses already current
+
+[SKIP]  Kyla.QuickTiffany proxyAddresses already current
+
+[SKIP]  lauren.hasselman proxyAddresses already current
+
+[SKIP]  Lois.Lane proxyAddresses already current
+
+[SKIP]  Lupe.Sanchez proxyAddresses already current
+
+[SKIP]  Matt.Brooks proxyAddresses already current
+
+[SKIP]  Megan.Hiatt proxyAddresses already current
+
+[SKIP]  Meredith.Kuhn proxyAddresses already current
+
+[SKIP]  Michelle.Shestko proxyAddresses already current
+
+[SKIP]  Ramon.Castaneda proxyAddresses already current
+
+[SKIP]  Ray.Rai proxyAddresses already current
+
+[SKIP]  Richard.Adams proxyAddresses already current
+
+[SKIP]  Sebastian.Leon proxyAddresses already current
+
--- a/clients/cascades-tucson/reports/2026-04-22-howard-account-cleanup.md
+++ b/clients/cascades-tucson/reports/2026-04-22-howard-account-cleanup.md
@@ -0,0 +1,82 @@
+# Howard Account Cleanup - 2026-04-22
+
+## Context
+
+Two separate humans share the name "Howard":
+- **Howard Enos** — MSP tech at Computer Guru. Accesses Cascades tenant.
+- **Dax Howard** — a person who runs Cascades. Has the `dax.howard@cascadestucson.com` member mailbox.
+
+Prior documentation (`docs/cloud/m365.md` as it existed) incorrectly mapped the AD `howard` account to Dax Howard's M365 mailbox, conflating the two identities. The G1 hygiene script executed earlier tonight populated the AD `howard` account's `proxyAddresses` / `mail` / `DisplayName` with Dax Howard's attributes — a genuine error that would have caused a duplicate / orphan at Entra Connect sync time.
+
+## Decision (Howard Enos, 2026-04-22)
+
+1. **Remove the external guest** `howard@azcomputerguru.com` from Cascades tenant — was redundant; MSP access preserved via `sysadmin@cascadestucson.com`.
+2. **Remove the AD `howard` account** — orphan MSP-created account (desc "Home Offie" typo, PasswordNeverExpires, unused group memberships). Not in active use.
+3. **Leave `dax.howard@cascadestucson.com` alone** — Dax Howard's real Cascades mailbox. Keep as-is.
+
+## Pre-state checks (safety)
+
+- **Global Admin role membership** (Graph): `sysadmin@cascadestucson.com` (Computer Guru Support) holds the Global Administrator role. Admin path preserved after guest removal.
+- **Guest's role/group memberships** (Graph): none. Pure sign-in account with no authorization side effects.
+- **AD `howard`'s group memberships** (AD): only `Domain Users` (default). No custom groups depending on it.
+
+## Actions executed
+
+### 1. Deleted M365 guest `howard@azcomputerguru.com`
+
+- Tier: `user-manager` (Graph write)
+- Object ID: `db2aee97-9c5d-40ce-8610-b75efc3ca906`
+- UPN: `howard_azcomputerguru.com#EXT#@NETORGFT4257522.onmicrosoft.com`
+- HTTP: 204 (success)
+- Verify: subsequent GET returns 404 Request_ResourceNotFound
+- **Soft-delete recovery window:** 30 days in Entra (`Restore-MgDirectoryDeletedItem`)
+
+### 2. Deleted AD user `howard`
+
+- Ran via GuruRMM on CS-SERVER (agent `6766e973-e703-47c1-be56-76950290f87c`)
+- Script: `docs/migration/scripts/ad-howard-delete.ps1`
+- Pre-state exported: `D:\Backups\howard-delete-2026-04-22-205158\howard-pre.xml`
+- Pre-state captured:
+  - SAM=howard
+  - UPN=howard@cascadestucson.com
+  - Display="Howard Dax" (wrong value from earlier G1 script — was correct to delete)
+  - Description="Home Offie" (typo)
+  - mail=dax.howard@cascadestucson.com (wrong value from G1 — was correct to delete)
+  - proxyAddresses=SMTP:dax.howard@cascadestucson.com, smtp:cara.lespron@cascadestucson.com (wrong — belonged to Dax)
+  - Groups: Domain Users only
+- Removed via `Remove-ADUser -Identity howard -Confirm:$false`
+- Verified: `Get-ADUser -Identity howard` returns "Cannot find an object"
+- **AD Recycle Bin recovery window:** 180 days
+- **Rollback:** `Restore-ADObject -Identity 2050d21f-7649-4033-b1fd-83cfc286b056`
+
+### 3. Updated docs/cloud/m365.md
+
+- Corrected the `howard | dax.howard@` mapping line (root cause of the confusion)
+- Struck through the `howard@azcomputerguru.com` + `howaed@azcomputerguru.com` external guest entries (both no longer in tenant)
+
+## Dax Howard — open questions
+
+Dax Howard has a Cascades M365 member account (`dax.howard@cascadestucson.com`, Business Standard license, alias `cara.lespron@`) but no AD account. As of 2026-04-22, he's:
+
+- Not on the returned staff CSV from Meredith/John (`reports/cascades-staff-2026-04-22.csv`)
+- Not on the working account-setup list (`docs/cloud/cascades-staff-working-list-2026-04-22.md`)
+- Has an active licensed mailbox
+
+**Questions to ask Meredith when convenient:**
+1. Who is Dax Howard? (executive / regional / legacy?)
+2. Is his mailbox actively used?
+3. Should he have an AD account created for hybrid identity?
+4. Is the `cara.lespron@` alias still needed, or can it be removed?
+
+Not blocking Wave 0.5 — he's cloud-only and stays that way unless an AD counterpart is added.
+
+## Impact on Entra Connect sync plan
+
+- AD now has 41 enabled users (was 42, howard removed).
+- The earlier G1 hygiene run's wrong `proxyAddresses` / `mail` / `DisplayName` attributes on AD `howard` are gone with the account — no lingering mismatch to clean up.
+- Dax Howard stays cloud-only; his M365 account will show as "Cloud Only" in Entra admin post-sync, separate from the AD-synced population. No conflict.
+- No need to re-run the G1 hygiene script — the deletion is idempotent.
+
+## Session log for future reference
+
+Added this cleanup as a concrete lesson: **always verify identity mapping from live Graph data, not from prior doc state**, before bulk AD attribute changes. The G1 script's proxyAddresses mapping came from `docs/cloud/m365.md` which had the wrong assumption baked in. The error was caught immediately by Howard spotting the dual-identity before it reached a sync attempt.