sync: auto-sync from HOWARD-HOME at 2026-04-22 21:40:31
Author: Howard Enos Machine: HOWARD-HOME Timestamp: 2026-04-22 21:40:31
This commit is contained in:
@@ -0,0 +1,82 @@
|
||||
# Howard Account Cleanup - 2026-04-22
|
||||
|
||||
## Context
|
||||
|
||||
Two separate humans share the name "Howard":
|
||||
- **Howard Enos** — MSP tech at Computer Guru. Accesses Cascades tenant.
|
||||
- **Dax Howard** — a person who runs Cascades. Has the `dax.howard@cascadestucson.com` member mailbox.
|
||||
|
||||
Prior documentation (`docs/cloud/m365.md` as it existed) incorrectly mapped the AD `howard` account to Dax Howard's M365 mailbox, conflating the two identities. The G1 hygiene script executed earlier tonight populated the AD `howard` account's `proxyAddresses` / `mail` / `DisplayName` with Dax Howard's attributes — a genuine error that would have caused a duplicate / orphan at Entra Connect sync time.
|
||||
|
||||
## Decision (Howard Enos, 2026-04-22)
|
||||
|
||||
1. **Remove the external guest** `howard@azcomputerguru.com` from Cascades tenant — was redundant; MSP access preserved via `sysadmin@cascadestucson.com`.
|
||||
2. **Remove the AD `howard` account** — orphan MSP-created account (desc "Home Offie" typo, PasswordNeverExpires, unused group memberships). Not in active use.
|
||||
3. **Leave `dax.howard@cascadestucson.com` alone** — Dax Howard's real Cascades mailbox. Keep as-is.
|
||||
|
||||
## Pre-state checks (safety)
|
||||
|
||||
- **Global Admin role membership** (Graph): `sysadmin@cascadestucson.com` (Computer Guru Support) holds the Global Administrator role. Admin path preserved after guest removal.
|
||||
- **Guest's role/group memberships** (Graph): none. Pure sign-in account with no authorization side effects.
|
||||
- **AD `howard`'s group memberships** (AD): only `Domain Users` (default). No custom groups depending on it.
|
||||
|
||||
## Actions executed
|
||||
|
||||
### 1. Deleted M365 guest `howard@azcomputerguru.com`
|
||||
|
||||
- Tier: `user-manager` (Graph write)
|
||||
- Object ID: `db2aee97-9c5d-40ce-8610-b75efc3ca906`
|
||||
- UPN: `howard_azcomputerguru.com#EXT#@NETORGFT4257522.onmicrosoft.com`
|
||||
- HTTP: 204 (success)
|
||||
- Verify: subsequent GET returns 404 Request_ResourceNotFound
|
||||
- **Soft-delete recovery window:** 30 days in Entra (`Restore-MgDirectoryDeletedItem`)
|
||||
|
||||
### 2. Deleted AD user `howard`
|
||||
|
||||
- Ran via GuruRMM on CS-SERVER (agent `6766e973-e703-47c1-be56-76950290f87c`)
|
||||
- Script: `docs/migration/scripts/ad-howard-delete.ps1`
|
||||
- Pre-state exported: `D:\Backups\howard-delete-2026-04-22-205158\howard-pre.xml`
|
||||
- Pre-state captured:
|
||||
- SAM=howard
|
||||
- UPN=howard@cascadestucson.com
|
||||
- Display="Howard Dax" (wrong value from earlier G1 script — was correct to delete)
|
||||
- Description="Home Offie" (typo)
|
||||
- mail=dax.howard@cascadestucson.com (wrong value from G1 — was correct to delete)
|
||||
- proxyAddresses=SMTP:dax.howard@cascadestucson.com, smtp:cara.lespron@cascadestucson.com (wrong — belonged to Dax)
|
||||
- Groups: Domain Users only
|
||||
- Removed via `Remove-ADUser -Identity howard -Confirm:$false`
|
||||
- Verified: `Get-ADUser -Identity howard` returns "Cannot find an object"
|
||||
- **AD Recycle Bin recovery window:** 180 days
|
||||
- **Rollback:** `Restore-ADObject -Identity 2050d21f-7649-4033-b1fd-83cfc286b056`
|
||||
|
||||
### 3. Updated docs/cloud/m365.md
|
||||
|
||||
- Corrected the `howard | dax.howard@` mapping line (root cause of the confusion)
|
||||
- Struck through the `howard@azcomputerguru.com` + `howaed@azcomputerguru.com` external guest entries (both no longer in tenant)
|
||||
|
||||
## Dax Howard — open questions
|
||||
|
||||
Dax Howard has a Cascades M365 member account (`dax.howard@cascadestucson.com`, Business Standard license, alias `cara.lespron@`) but no AD account. As of 2026-04-22, he's:
|
||||
|
||||
- Not on the returned staff CSV from Meredith/John (`reports/cascades-staff-2026-04-22.csv`)
|
||||
- Not on the working account-setup list (`docs/cloud/cascades-staff-working-list-2026-04-22.md`)
|
||||
- Has an active licensed mailbox
|
||||
|
||||
**Questions to ask Meredith when convenient:**
|
||||
1. Who is Dax Howard? (executive / regional / legacy?)
|
||||
2. Is his mailbox actively used?
|
||||
3. Should he have an AD account created for hybrid identity?
|
||||
4. Is the `cara.lespron@` alias still needed, or can it be removed?
|
||||
|
||||
Not blocking Wave 0.5 — he's cloud-only and stays that way unless an AD counterpart is added.
|
||||
|
||||
## Impact on Entra Connect sync plan
|
||||
|
||||
- AD now has 41 enabled users (was 42, howard removed).
|
||||
- The earlier G1 hygiene run's wrong `proxyAddresses` / `mail` / `DisplayName` attributes on AD `howard` are gone with the account — no lingering mismatch to clean up.
|
||||
- Dax Howard stays cloud-only; his M365 account will show as "Cloud Only" in Entra admin post-sync, separate from the AD-synced population. No conflict.
|
||||
- No need to re-run the G1 hygiene script — the deletion is idempotent.
|
||||
|
||||
## Session log for future reference
|
||||
|
||||
Added this cleanup as a concrete lesson: **always verify identity mapping from live Graph data, not from prior doc state**, before bulk AD attribute changes. The G1 script's proxyAddresses mapping came from `docs/cloud/m365.md` which had the wrong assumption baked in. The error was caught immediately by Howard spotting the dual-identity before it reached a sync attempt.
|
||||
Reference in New Issue
Block a user