azcomputerguru/claudetools
1
0
Fork 0
Code Issues 59 Pull Requests Actions Packages Projects Releases Wiki Activity
Files
840b0ce9d650ca1b941dcf94a183020e931e27d4
claudetools/clients/cascades-tucson/reports/2026-07-01-caretaker-roster-update.md
Howard Enos 875048f9ad sync: auto-sync from HOWARD-HOME at 2026-07-01 14:43:57 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-01 14:43:57
2026-07-01 14:44:29 -07:00

5.9 KiB
Raw Blame History

Cascades — Caretaker roster update (client list received 2026-07-01)

Source: updated caretaker list from the client, reconciled against live AD (CS-SERVER, OU=Caregivers,OU=Departments,DC=cascades,DC=local + SG-Caregivers) pulled 2026-07-01 via RMM (cmd bf80962c).

Live state: OU holds 42 objects = 40 enabled caregivers + pilot.test (test artifact) + n.castro (disabled). SG-Caregivers = the same 40. All 40 were Business Premium-licensed + temp-passworded 2026-06-30. The client's 40-entry list maps 1:1 onto the 40 enabled accounts — no unknowns in either direction.

Departures — 7 marked "no longer with us" (all have live enabled accounts)

Person Account Notes
Bella Mendoza b.mendoza ALIS: already Discharged
Corey Tate c.tate ALIS: already Discharged
Diana Fierros d.fierros no ALIS record
Gloria Williford g.williford ALIS: already Discharged
Kasey Flores k.flores ALIS: already Discharged
Maia Baker m.baker ALIS: already Discharged
Mary Kariuki m.kariuki ALIS: Discharged, DUP records 429856/429858

These are exactly the 7 flagged 2026-06-29/30 as ALIS-Discharged / no-ALIS-record — consistent with them having already left. None ever logged in (accounts bulk-created May, passwords never used). Offboarding = disable AD account + remove from SG-Caregivers + remove Business Premium license (frees 7 of 45 seats).

Additions — 5 requested

Person Proposed account Status
Christine Nyanzunda christine.nyanzunda (EXISTS, OU=Care-Memorycare) Was explicitly EXCLUDED from SG-Caregivers 2026-06-30 (Howard: frontline only; she is admin-adjacent, Health Admin Assistant roles in ALIS). Client now lists her as a caretaker — needs decision.
Alejandra Vallejo a.vallejo (new) Already in ALIS as caregiver; no AD account (known gap from 6/30).
Jeanpabtiste Munezero j.munezero (new) New hire; no AD or ALIS record found.
Nicole Cota n.cota (new) New hire. No conflict with disabled n.castro.
Katlyn Robinson k.robinson (new) New hire.

New accounts follow the f.lastname@cascadestucson.com caregiver convention. Full onboarding per 6/30 pattern: AD account in OU=Caregivers, SG-Caregivers add (on-prem only — cloud adds fail), usageLocation=US + Business Premium, temp password forced-change, vault, ALIS staff record Email=UPN.

Flags from the client's annotations

  • Tele Sepopo Lassey Assiakoley = Cecilia/Celia Lassey (client-confirmed). BOTH c.lassey and t.lassey-assiakoley exist enabled, licensed, and in SG-Caregivers — one person, two accounts, two licenses. Consolidate: pick one, disable the other, reclaim a seat. (Resolves the 6/4 worklist open question.)
  • Zeke Huerta (e.huerta) now works the front desk. He is in SG-Caregivers → subject to the caregiver CA lockdown (on-network + allow-listed devices only, no MFA). Front desk may need the privileged bucket instead (email from anywhere, MFA offsite) and different ALIS roles. Decision needed. UPN stays e.huerta (Howard 6/30: do not "correct" to z.huerta).
  • Charity Sika = b.sika — client list ties the name Charity to b.sika@, consistent with ALIS "Bariffa Sika" (staffId 309045). Treat as same person.

License math (SPB, 45 seats, 45 consumed as of 6/30)

Disable 7 leavers + 1 Lassey dup = 8 seats freed; 4-5 new hires need seats (Nyanzunda may already be licensed) → net 3-4 seats free after the update.

Status (executed 2026-07-01, Howard's decisions via session prompts)

  • Disabled 7 departed accounts + removed from SG-Caregivers + reclaimed licenses (RMM cmd b5329b71)
  • Lassey duplicate: KEEP c.lassey; t.lassey-assiakoley disabled + license reclaimed
  • Huerta: removed from SG-Caregivers (front desk -> privileged bucket). Account stays enabled in OU=Caregivers — sync scope is ONLY OU=Caregivers/Groups/Caregiver Devices, so an OU move would delete his cloud object. Move deferred until Administrative OU enters sync scope. He needs MFA (Authenticator) registration — now under the MFA-for-all-users policy with no caregiver-block policies.
  • Nyanzunda: LEFT OUT of SG-Caregivers (frontline-only rule stands; she keeps her existing christine.nyanzunda account with broader access)
  • Created 4 new accounts (a.vallejo, j.munezero, n.cota, k.robinson): OU=Caregivers, SG-Caregivers, usageLocation=US, Business Premium, forced-change temp passwords. Vault: clients/cascades-tucson/caregiver-temp-passwords-2026-07-01.sops.yaml. Passwords DM'd to Howard (Discord msg 1521981205443117116).
  • Verified: 8 offboarded = accountEnabled=false + 0 licenses; 4 new = SPB licensed. SG-Caregivers = 35 members. SPB pool: 45 enabled / 41 consumed (4 free).
  • Phone-login verification + CA cutover (2026-07-01, Howard's go): all 35 SG-Caregivers members verified enabled/unlocked in AD and enabled/licensed in Entra (cloud group synced, 4 new hires present). Root cause of would-be login failure found and fixed: (1) Require MFA for all users excluded only the stale pilot group — added SG-Caregivers (8b8d9222) to excludeGroups, break-glass preserved; (2) CSC - Block caregivers on non-compliant device DISABLED (phones are Intune-noncompliant; interim posture = caretakers on desktops + phones, on-network only). Allow-list policy left test-scoped. Phones-only lockdown deferred — tracking list: docs/cloud/caretaker-phones-only-list.md.
  • ALIS: create staff records for Munezero/Cota/Robinson (need job roles: Certified vs Resident Caregiver); Vallejo exists — set Email=a.vallejo@ (UPN). Import .xls via alis skill build-import.
  • Huerta MFA registration (Authenticator) — first time he's onsite.
  • Optional: notify client that Nyanzunda already has an account (not added to caregiver group by design).
Reference in New Issue View Git Blame Copy Permalink