azcomputerguru/claudetools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sync: auto-sync from HOWARD-HOME at 2026-04-23 11:09:16

Browse Source 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-04-23 11:09:16
This commit is contained in:
Howard Enos
2026-04-23 11:09:16 -07:00
parent 4ddc3a0a1f
commit 854e109199
2 changed files with 130 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
clients/cascades-tucson/docs/cloud/user-account-rollout-plan.md
View File

@@ -94,6 +94,20 @@ OU=Cascades Users
CA policies target groups, not OUs. OUs drive GPO inheritance (folder redirection, local policy) only.
**File-share access groups (created 2026-04-22 by `g1-ad-hygiene.ps1`, memberships populated in Phase 4 per `phase2-file-shares.ps1`):**
| Persona | `SG-Receptionist-RW`<br/>(`\\CS-SERVER\Receptionist`) | `SG-Directory-RW`<br/>(`\\CS-SERVER\directoryshare`) | Other shares | Notes |
|---|---|---|---|---|
| **Shared-PC Reception** (Cathy, Shontiel, Kyla, Michelle) | **Y** | **Y** | — | Reception-desk workflows need the `Receptionist` share (printed directories, sign-in sheets, fax-in scans) **and** the Resident `directoryshare` (resident contact lists). Everything else these users do is in M365 (Frontdesk@ shared mailbox, Teams, SharePoint). No other on-prem share access required. |
| **Courtesy Patrol** (Sebastian, Sheldon, Ray) | **Y** | **Y** | — | Same reception-coverage scope — they back up the front desk after hours. |
| Office-PHI (external-OK) | per-role | Y | per-role (Mgmt, Sales, etc.) | directoryshare is resident-contact data; all office-PHI staff need read at minimum. RW memberships granted per department (e.g., Meredith → SG-Management-RW, Megan → SG-Sales-RW). |
| Office-PHI (in-building) | N | Y | per-role | |
| Maintenance PHI (Matt Brooks) | N | Y | — | directoryshare read access for room-assignment lookups. |
| Caregiver / Agency | N | Y | — | Caregivers need resident contact info — directoryshare is the single canonical source. |
| Drivers | N | N | — | Drivers lose all IT access per 2026-04-22 decision. |
**Operational note — Workgroup (non-domain-joined) reception PCs:** RECEPTIONIST-PC and MEMRECEPT-PC are both WORKGROUP machines. Until they're domain-joined (Phase 3), users must enter `cascades\<username>` explicitly when Windows prompts for the share credential, then tick "Remember my credentials" so File Explorer doesn't silently fall back to the local machine user on next reboot. After Entra Connect + domain join, SSO removes this step.
## 5. Conditional Access policy set
**Decision 2026-04-22 (Howard → Meredith/John):** Default-deny external sign-in for all licensed users. Maintain a small allow-list group for users who legitimately work off-site.