claudetools/clients/cascades-tucson/docs/migration/share-group-roster-proposed-2026-06-25.md

# CS-SERVER Share Group Roster — PROPOSED (for review)

> **Built 2026-06-25 (Howard)** by inverting `share-access-matrix-2026-04-23.md` onto the
> **live** `SG-*` groups on CS-SERVER. **Nothing assigned yet** — every `SG-*-RW` group is
> currently EMPTY. This is the worksheet to walk through and confirm "the right people"
> before we populate the groups. Tick/strike names as we go.
>
> Legend: **[OPEN]** = matrix left this person's scope unresolved · *(leaving)* = exclude ·
> *(no AD acct yet)* = create account first · **[VERIFY AD]** = confirm a domain account exists.

---

## Live state snapshot (2026-06-25)

- **All access groups exist but are EMPTY:** `SG-Management-RW`, `SG-Mgmt-RW` (dup),
  `SG-Sales-RW`, `SG-Sales-RO`, `SG-Server-RW`, `SG-Directory-RW`, `SG-Receptionist-RW`,
  `SG-Culinary-RW`, `SG-Activities-RW`, `SG-IT-RW`, `SG-Chat-RW` (retired share).
- **Populated (not part of this pass):** `SG-Caregivers` (38), `SG-FolderRedirect` (8),
  `SG-FrontDesk` (1), `SG-Reception-PCs` (1 = RECEPTIONIST-PC), `SG-PC-MainTower` (1 = NURSESTATION-PC).
- **Data shares present:** Accounting, Activities, Culinary, directoryshare, Executive, IT,
  Management, Receptionist, Sales, SalesDept, Server, homes.
- **Missing vs matrix:** no **ALdocs** / **WebDocs** share or group; no **Clinical/PHI** share
  (pending Meredith); `SG-Office-PHI-Internal/-External` exist empty.

---

## Per-group proposed rosters

### `SG-Management-RW`  →  `\\CS-SERVER\Management`
**RW:** Meredith Kuhn, Ashley Jensen, Lauren Hasselman, Allison Reibschied, Megan Hiatt,
Crystal Rodriguez, Veronica Feller, Shelby Trozzi, Christina DuPras  ·  ~~Tamra Matthews~~ *(OFFBOARDED 2026-06-30)*
**RO (read-only):** Lois Lane, Christine Nyanzunda **[OPEN]**, Susan Hicks **[OPEN]**, John Trozzi, Lupe Sanchez **[OPEN]**
> No `SG-Management-RO` group exists — RO members need either a new RO group or a direct NTFS read ACL. **Decision needed.**

### `SG-Sales-RW`  →  `\\CS-SERVER\Sales` / `SalesDept`
**RW:** Meredith Kuhn, Ashley Jensen, Lauren Hasselman, Megan Hiatt, Crystal Rodriguez  ·  ~~Tamra Matthews~~ *(OFFBOARDED 2026-06-30)*
**RO (`SG-Sales-RO`):** Shelby Trozzi
> **Two shares exist — `Sales` and `SalesDept`.** SalesDept holds the real history (2014–2026 reports, marketing). Confirm which the group maps to (or both), and what `Sales` is for.

### `SG-ALdocs-RW`  →  `\\CS-SERVER\ALdocs`  *(share + group NOT created yet)*
**RW:** Lois Lane, Karen Rossini, Meredith Kuhn, Ashley Jensen, Megan Hiatt, Crystal Rodriguez  ·  ~~Tamra Matthews~~ *(OFFBOARDED 2026-06-30)*
> Must create the share + `SG-ALdocs-RW` group before assigning. Nurses (Lois/Karen) + Exec tier + Sales team.

### `SG-WebDocs-RW`  →  `\\CS-SERVER\WebDocs`  *(share + group NOT created yet)*
**RW:** Megan Hiatt, Crystal Rodriguez, Meredith Kuhn, Ashley Jensen  ·  ~~Tamra Matthews~~ *(OFFBOARDED 2026-06-30)*
> Must create the share + `SG-WebDocs-RW` group. Distinct from the retired DSM `web` station.

### `SG-Server-RW`  →  `\\CS-SERVER\Server`
**RW:** Meredith Kuhn, Ashley Jensen, Lauren Hasselman, Veronica Feller, Shelby Trozzi, Christina DuPras, John Trozzi **[OPEN — Server or just Directory?]**
**RO:** Matt Brooks
> No `SG-Server-RO` group — Matt's RO needs an RO group or direct NTFS read.

### `SG-Directory-RW`  →  `\\CS-SERVER\directoryshare`
**RW (per matrix "Access: Directory"):** Meredith, Ashley, Lauren, Allison, Megan, Crystal,
Lois, Karen, Veronica, Shelby, Christine, Christina DuPras, Cathy Kingston, Shontiel Nunn,
Kyla Quick Tiffany *(no AD acct yet)*, Michelle Shestko, Sebastian Leon, Sheldon Gardfrey,
Ray Rai, Susan Hicks, Sharon Edwards, John Trozzi, Matt Brooks, Lupe Sanchez  ·  ~~Alma R Montt~~ *(OFFBOARDED 2026-06-25)*
**Excluded:** kitchen staff (JD, Ramon, Alyssa), drivers, caregivers
> **Big question:** matrix intro says "most staff need **read**" but each person's line reads
> "Access" (= RW). Does everyone really need WRITE to the resident directory, or **read for most +
> write for the few who maintain it** (front desk)? Likely should be a `SG-Directory-RO` (most) +
> `SG-Directory-RW` (front-desk maintainers). **Decision needed.**

### `SG-Receptionist-RW`  →  `\\CS-SERVER\Receptionist`  *(Tower front desk ONLY)*
**RW:** Cathy Kingston, Shontiel Nunn, Kyla Quick Tiffany *(no AD acct yet)*, Sebastian Leon,
Sheldon Gardfrey, Ray Rai, Christina DuPras, Meredith Kuhn, Ashley Jensen
**RO:** Lauren Hasselman
**Explicitly excluded:** Michelle Shestko (MC desk), Matt Brooks (MC coverage), Sales team
> Mapped **by machine + user** via GPO/logon script — drive appears only on Tower reception PC(s)
> for users in this group. Needs the machine-scope GPO, not just group membership.

### `SG-Culinary-RW`  →  `\\CS-SERVER\Culinary`
**RW:** JD Martin, Ramon Castaneda, Alyssa Brooks
**RO:** Meredith Kuhn, John Trozzi, Ashley Jensen
> Kitchen staff get Culinary ONLY (no Directory, no other shares). No `SG-Culinary-RO` group — RO trio needs one or direct NTFS read.

### `SG-Activities-RW`  →  `\\CS-SERVER\Activities`  (= Life Enrichment)
**RW:** Susan Hicks **[OPEN]**, Sharon Edwards, Veronica Feller, Meredith Kuhn, Ashley Jensen  ·  ~~Alma R Montt~~ *(OFFBOARDED 2026-06-25)*
**RO:** Shelby Trozzi, Christina DuPras
> Confirm `Activities` share == the Life Enrichment data share (matrix called it `LifeEnrichment`).
> LE workstations have no mapped drives today — this is their first map.

### `SG-IT-RW`  →  `\\CS-SERVER\IT`
**RW:** IT only — ACG admins (no Cascades staff)
> Leave as admin-only.

### Clinical / PHI  →  `\\CS-SERVER\Clinical-PHI`  **(PENDING — share may not be created)**
**Proposed RW *if* created:** Meredith Kuhn, Ashley Jensen, Lois Lane, Karen Rossini,
Veronica Feller, Shelby Trozzi, Christine Nyanzunda
> Synology `pacs` was empty. **Meredith decision:** create an empty Clinical-PHI share with this
> list, or retire the concept (everything clinical lives in ALIS) and strip Clinical from all lines above.
> `SG-Office-PHI-Internal/-External` already exist empty — decide if those are the intended groups.

### Accounting  →  `\\CS-SERVER\Accounting`  **(share exists, no SG group, not in matrix)**
**Proposed RW:** Allison Reibschied (Accounting Asst), Lauren Hasselman (Business Office Dir)? Meredith/Ashley?
> **Not defined in the 2026-04-23 matrix.** Confirm who owns the Accounting share + whether it needs its own `SG-Accounting-RW` group.

### Direct-ACL shares (no group — leave as-is)
- **`Executive`** — Ashley Jensen + Meredith Kuhn (done 2026-06-24, #32193).
- **Sandra Fish Archive** (`D:\Shares\Archive\Former-Director-Sandra-Fish`) — Meredith, sole custodian.

---

## Structural decisions to make before we populate (not per-person)

1. **RO groups missing.** Only `SG-Sales-RO` exists. Several shares need read-only members
   (Management, Server, Culinary, Receptionist, Activities). Create matching `SG-*-RO` groups, or
   apply direct NTFS read ACLs? (Groups are cleaner/auditable; recommend RO groups.)
2. **Dedupe `SG-Management-RW` vs `SG-Mgmt-RW`** — keep one, delete the other (both empty — zero risk).
3. **Delete `SG-Chat-RW`** — the chat share is retired (→ Teams).
4. **Create ALdocs + WebDocs** shares + `SG-ALdocs-RW`/`SG-WebDocs-RW` groups.
5. **Directory RW-vs-RO model** — decide read-for-most + write-for-front-desk (recommended) vs everyone-RW.
6. **Clinical/PHI** — create or retire (Meredith).
7. **Accounting share** — define ownership + group.

## Per-person open questions (carry over from the matrix — confirm with John/Meredith)
- [ ] **Lois Lane** — Clinical + Directory + Mgmt-read, or ALIS-only?
- [ ] **Karen Rossini** — Clinical + Directory, or less?
- [ ] **Susan Hicks** — LE Director scope as proposed?
- [ ] **John Trozzi** — Server access, or just Directory + Culinary-read?
- [ ] **Lupe Sanchez** — Directory only, or + Management read?
- [ ] **Shelby Trozzi** — narrowed MC-Director scope (no admin-full) OK?
- [ ] **Matt Brooks** — primary dept: Maintenance or MC Reception?
- [ ] **Christine Nyanzunda** — Management read or write?

## AD-account verification needed before assignment
Confirm a domain account exists for: Cathy Kingston, Shontiel Nunn, Michelle Shestko,
Sebastian Leon, Sheldon Gardfrey, Ray Rai, Sharon Edwards, Allison Reibschied.
**Create first:** Kyla Quick Tiffany (matrix: not yet created).
*(Alma R Montt — OFFBOARDED 2026-06-25, see `docs/security/offboarding-2026-06-25-alma-montt.md`.)*