claudetools/clients/cascades-tucson/reports/2026-04-22-g1-post-verify.md

G1 AD Hygiene - Post-Execute Idempotency Verification

Command ID: 2bd999a0-b9a1-4599-a44b-d90f32a332ad Exit: 0 Completed: 2026-04-23T03:33:28.670135Z

STDOUT

G1 AD Hygiene - 2026-04-22 20:33:27 -07:00

Host: CS-SERVER

Mode: DRY-RUN (no changes)

Backup dir: D:\Backups\g1-hygiene-2026-04-22-203327



============================================================================

== 0. Pre-state backup (always runs)

============================================================================

[OK]    Exported users-pre.csv

[OK]    Exported groups-pre.csv

[OK]    Exported ous-pre.csv



[OK]    Pre-state saved at D:\Backups\g1-hygiene-2026-04-22-203327

Rollback commands (if needed after execute):

   - proxyAddresses: Set-ADUser from users-pre.csv column ProxyAddresses

   - OU moves: Move-ADObject back to old DistinguishedName

   - Groups created today: Remove-ADGroup (safe since memberless)



============================================================================

== 1. OU=Excluded-From-Sync  +  move 4 role accounts

============================================================================

[SKIP]  OU=Excluded-From-Sync already exists

[SKIP]  Culinary already in Excluded-From-Sync

[SKIP]  Receptionist already in Excluded-From-Sync

[SKIP]  saleshare already in Excluded-From-Sync

[SKIP]  directoryshare already in Excluded-From-Sync



============================================================================

== 2. Populate proxyAddresses (34 users - live data from M365 Graph 2026-04-22)

============================================================================

[SKIP]  Allison.Reibschied proxyAddresses already current

[SKIP]  Alyssa.Brooks proxyAddresses already current

[SKIP]  Ashley.Jensen proxyAddresses already current

[SKIP]  britney.thompson proxyAddresses already current

[SKIP]  Cathy.Kingston proxyAddresses already current

[SKIP]  Christina.DuPras proxyAddresses already current

[SKIP]  Christine.Nyanzunda proxyAddresses already current

[SKIP]  Christopher.Holick proxyAddresses already current

[SKIP]  Crystal.Rodriguez proxyAddresses already current

[SKIP]  howard proxyAddresses already current

[SKIP]  JD.Martin proxyAddresses already current

[SKIP]  John.Trozzi proxyAddresses already current

[SKIP]  Julian.Crim proxyAddresses already current

[SKIP]  karen.rossini proxyAddresses already current

[SKIP]  Kyla.QuickTiffany proxyAddresses already current

[SKIP]  lauren.hasselman proxyAddresses already current

[SKIP]  Lois.Lane proxyAddresses already current

[SKIP]  Lupe.Sanchez proxyAddresses already current

[SKIP]  Matt.Brooks proxyAddresses already current

[SKIP]  Megan.Hiatt proxyAddresses already current

[SKIP]  Meredith.Kuhn proxyAddresses already current

[SKIP]  Michelle.Shestko proxyAddresses already current

[SKIP]  Ramon.Castaneda proxyAddresses already current

[SKIP]  Ray.Rai proxyAddresses already current

[SKIP]  Richard.Adams proxyAddresses already current

[SKIP]  Sebastian.Leon proxyAddresses already current

[SKIP]  Sharon.Edwards proxyAddresses already current

[SKIP]  Shelby.Trozzi proxyAddresses already current

[SKIP]  Sheldon.Gardfrey proxyAddresses already current

[SKIP]  Shontiel.Nunn proxyAddresses already current

[SKIP]  Susan.Hicks proxyAddresses already current

[SKIP]  sysadmin proxyAddresses already current

[SKIP]  Tamra.Matthews proxyAddresses already current

[SKIP]  Veronica.Feller proxyAddresses already current



============================================================================

== 3. Create 16 SG-* security groups (CA / file-share / break-glass)

============================================================================

[SKIP]  SG-External-Signin-Allowed already exists

[SKIP]  SG-Caregivers already exists

[SKIP]  SG-FrontDesk already exists

[SKIP]  SG-CourtesyPatrol already exists

[SKIP]  SG-Drivers already exists

[SKIP]  SG-Management-RW already exists

[SKIP]  SG-Sales-RW already exists

[SKIP]  SG-Culinary-RW already exists

[SKIP]  SG-IT-RW already exists

[SKIP]  SG-Receptionist-RW already exists

[SKIP]  SG-Directory-RW already exists

[SKIP]  SG-Server-RW already exists

[SKIP]  SG-Chat-RW already exists

[SKIP]  SG-Office-PHI-External already exists

[SKIP]  SG-Office-PHI-Internal already exists

[SKIP]  SG-CA-BreakGlass already exists



============================================================================

== 4. DisplayName cosmetic fixes (3 users)

============================================================================

[SKIP]  Crystal.Rodriguez DisplayName already 'Crystal Rodriguez'

[SKIP]  howard DisplayName already 'Howard Dax'

[SKIP]  Cathy.Kingston DisplayName already 'Cathy Kingston'



============================================================================

== 5. Summary

============================================================================

Mode:         DRY-RUN (no changes)

Created:      0

Moved:        0

Updated:      0

Skipped:      0

Errors:       0



Backup dir:   D:\Backups\g1-hygiene-2026-04-22-203327



DRY-RUN complete. To execute:

  1. Review the [WOULD] lines above

  2. Re-run this script with $doExecute = $true

  3. Compare post-state vs pre-state CSVs in the backup dir



Completed at 2026-04-22 20:33:28 -07:00