23 KiB
Share Access Review — Cascades of Tucson
Prepared: 2026-04-23 (Howard) · For review by: John Trozzi / Meredith Kuhn
What you're looking at: every current employee, their department + position, and which shared folders they should have access to on the new CS-SERVER setup. Please read through and confirm each person is (a) in the right department/position, and (b) has the right folder access. Flag anything wrong.
No changes have been made yet. This is the review draft. Once you sign off, we apply it to AD and the share permissions on CS-SERVER.
Reading the list
- Access: X, Y, Z means read + write on those folders.
- Read-only: X means they can open files but not save/delete.
- Everyone gets the
Publicshare (company-wide scratch space) and their own personalhomefolder. Those aren't repeated per person below. - IT, Culinary, Sandra Fish Archive, Clinical (pacs), and Life Enrichment (Activities) are special-access — only the people listed get in.
- The old
chatfolder is being retired — company chat is moving to Teams.
Folders at a glance
| Folder | What's in it |
|---|---|
| Management | Office/admin docs, budgets, HR-adjacent files |
| Sales | Sales and move-in coordination docs (resident intake) |
| ALdocs | Assisted Living documentation (clinical/operational) — new share, CS-SERVER only |
| WebDocs | Web / marketing / sales-collateral docs — new share, CS-SERVER only (distinct from retired DSM web share) |
| Server | IT/vendor docs, server config, maintenance records |
| Directory | Resident directory (phone, room, emergency contact) — most staff need read |
| Receptionist | Dump folder for scans from the copy room — Tower front desk only. Front-desk staff pull the scans from here, process them, and delete as they go. Drive is mapped by machine + user via GPO / logon script: it appears only on Tower reception PC(s) and only for users who are in the Tower reception role group. MC receptionist PC does not get this mapped. |
| Culinary | Menus, kitchen ordering, dining room operations |
| Life Enrichment | Activity calendars, program docs — new share, CS-SERVER only. LE machines currently have no mapped drives, so this will be the first file-share those stations connect to. |
| Clinical (PHI) | Medical imaging / clinical records. Howard verified 2026-04-23: the Synology pacs folder is empty — no data to migrate. Question is whether clinical staff need a shared clinical folder on CS-SERVER at all, or if ALIS covers everything. Pending Meredith. |
| IT | Systems admin docs — IT only |
| Sandra Fish Archive | Former director's personal folder — Meredith only |
| Home | Each person's own personal folder (folder redirection) |
| Public | Company-wide scratch space — everyone |
Administrative
Meredith Kuhn — Executive Director
Access: Management, Sales, ALdocs, WebDocs, Server, Directory, Receptionist, Life Enrichment, Clinical, Sandra Fish Archive (sole custodian) Read-only: Culinary
Ashley Jensen — Assistant Executive Director
Access: Management, Sales, ALdocs, WebDocs, Server, Directory, Receptionist, Life Enrichment, Clinical Read-only: Culinary Note: Same level as Meredith per Howard 2026-04-23.
Lauren Hasselman — Business Office Director
Access: Management, Sales, Server, Directory Read-only: Receptionist
Allison Reibschied — Accounting Assistant
Access: Management, Directory
Marketing / Sales
Megan Hiatt — Sales Director
Access: Management, Sales, ALdocs, WebDocs, Directory
Crystal Rodriguez — Sales Associate
Access: Management, Sales, ALdocs, WebDocs, Directory
Note: Crystal Suszek is Crystal Rodriguez's former name (confirmed 2026-04-23). Consolidate to the single Crystal.Rodriguez AD account at cutover; disable the old Synology Crystal Suszek account.
Tamra Matthews — Move-In Coordinator
Access: Management, Sales, ALdocs, WebDocs, Directory
Note: Leaving June 2026 — access ends on her departure.
Action before cutover: Tamra has a Sales Dept folder in the root of her user profile on her PC that does not appear to be syncing to the server. Back it up and migrate its contents into \\CS-SERVER\SalesDept (or the new CS-SERVER Sales share path) before her departure.
Care, Assisted Living (Nursing / Clinical)
Lois Lane — Health Services Director
Access: ALdocs, Directory, Clinical (PHI) Read-only: Management Note: ALdocs is the main nursing share. She and Karen are the only nurses granted RW per Howard 2026-04-23 ("only nurses will need access to the ALdocs"). Anomaly: Currently has no share access on Synology — proposed scope is based on her director role. Confirm she actually wants file access vs. working only through ALIS.
Karen Rossini — Health Services Manager
Access: ALdocs, Directory, Clinical (PHI) Note: Same nursing-access pattern as Lois. Anomaly: Currently only has home-folder access on Synology — likely underprovisioned.
Veronica Feller — Care, Assisted Living Aide
Access: Management, Sales, Server, Directory, Life Enrichment, Clinical
Note (Howard 2026-04-23): Keep the permissions she currently has on Synology, but not at admin level — she's a regular RW user, not a share administrator. Scope above matches her current Synology RW list (minus the retiring chat share, minus Sandra Fish which is Meredith-only, minus Culinary which is now restricted to kitchen staff only).
Care, Memory Care
Shelby Trozzi — Memory Care Director
Access: Management, Server, Directory, Receptionist, Clinical (PHI) Read-only: Sales, Life Enrichment Note: Currently has admin-full (ownership-class) access to 5 shares on Synology. Per Howard's direction she does not need that level — proposed scope above is what a MC Director actually uses day-to-day.
Christine Nyanzunda — Memory Care Admin Assistant (also PT MedTech)
Access: Directory, Receptionist, Clinical (PHI) Read-only: Management
Resident Services
Christina DuPras — Resident Services Director
Access: Management, Server, Directory, Receptionist Read-only: Life Enrichment
Cathy Kingston — Receptionist (Tower front desk, shared PC)
Access: Directory, Receptionist
Shontiel Nunn — Receptionist (Tower front desk, shared PC)
Access: Directory, Receptionist
Kyla Quick Tiffany — Receptionist (Tower front desk, shared PC)
Access: Directory, Receptionist
Note: AD account not yet created (Wave 1 of user rollout). Spelling confirmed per Kyla as Kyla.QuickTiffany.
Michelle Shestko — MC Receptionist (MC front desk, shared PC)
Access: Directory
Note: MC front desk does NOT get the Receptionist scan-drop share — that's Tower-front-desk-only per Howard 2026-04-23.
Sebastian Leon — Courtesy Patrol
Access: Directory, Receptionist
Sheldon Gardfrey — Courtesy Patrol
Access: Directory, Receptionist
Ray Rai — Courtesy Patrol
Access: Directory, Receptionist
Life Enrichment
Susan Hicks — Life Enrichment Director
Access: Directory, Life Enrichment
Read-only: Management
Note: Life Enrichment workstations currently have no mapped drives at all. The new LifeEnrichment share will be the first file share those PCs connect to — needs a one-time map at setup.
Sharon Edwards — Life Enrichment Assistant
Access: Directory, Life Enrichment Note: Same LE-new-mapping note as Susan.
Alma R Montt — MC Life Enrichment
Access: Directory, Life Enrichment Note: AD account not yet created (Wave 1 of user rollout). LE-machine drive mapping applies once her account + PC are set up.
Culinary
JD Martin — Culinary Director
Access: Culinary Note: Kitchen staff only need the Culinary share — no Directory, no other shares (Howard 2026-04-23).
Ramon Castaneda — Kitchen Manager
Access: Culinary
Alyssa Brooks — Dining Manager
Access: Culinary
Maintenance
John Trozzi — Facilities Director
Access: Server, Directory Read-only: Management, Culinary Anomaly: Currently has no share access on Synology. Proposed scope gives him Server for vendor/maintenance records. John — confirm you want Server, or just Directory? Culinary read-only is by design (he's on the approved Culinary read list alongside Meredith and Ashley — only kitchen staff write there).
Matt Brooks — MC Receptionist (also works Maintenance)
Access: Directory
Read-only: Server
Note: HR has him in Maintenance; CSV says MC Receptionist. Works both departments — confirm primary dept assignment. Does NOT get the Receptionist scan-drop share (that's Tower-front-desk-only, and he covers the MC desk, not Tower).
Housekeeping
Lupe Sanchez — Housekeeping Director
Access: Directory Anomaly: Currently has no share access on Synology. Confirm this minimal scope is right, or does she need Management read for budgets/supplier docs?
Transportation — no IT access
Per 2026-04-22 decision, drivers' AD accounts are being disabled. No share access going forward.
- Richard Adams — Driver
- Julian Crim — Driver
- Christopher Holick — Driver
Caregivers (shift staff) — no on-prem shares
All 37 caregivers access clinical data exclusively through ALIS. No SMB/file-share access of any kind — no Directory, no Clinical, nothing. Confirmed 2026-04-23.
Names (from CSV): Thelma Abainza, Niel Castro, Espe Esperance, Barbara Johnson, Kasey Flores, Richard Flores, Marie Kastner, Bella Mendoza, Rosa Morales, Sandra Padilla, Whisper Reed, Patricia Sandoval-Beck, Charity Sika, Ederick Yuzon, Juan Andrade, Jahmeka Clarke, Karina Aziakpo, Jinnelle Dittbenner, Agnes McFerren, Samuel Ramirez, Erica Sanchez, Katrina Wyzykowski, Corey Tate, Ashli Atwood, Cole Johnson, Roseline Cooper, Monique Lopez, Gloria Williford, Sarah Carroll, Luke Hogan, Gina Williams, Jen Higdon, Mary Kariuki, CeCe Lassey, Paty Doran, Ezekiel Huerta, Maia Baker.
Agency placeholders ("Reliable Agency 1/2") are not being created as accounts — per-person names required before PHI access, per HIPAA review 2026-04-22.
Accounts to remove at cutover (not current employees)
These names show up on Synology but are not in John's current employee list. They'll be disabled when we retire the Synology file-share role:
- Amber M Lee, Ann Dery, Anna Pitzlin, Britney Thompson, Haris Durut, Monica RamirezRossette, Nela Durut-Azizi, Stephanie Devin — all former employees.
- Tamra Johnson (old alias — now
Tamra Matthews) - CasAdmin201 — prior-MSP admin account. Confirm with Meredith before deletion.
- Role accounts —
Accounting,Dining Manager,Front Desk,mcnurse,memcarenurse,Memcare Receptionist,Nurse Tower. These are shared logins that violate HIPAA unique-user-identification requirement. Replaced by the named-person accounts above.
Decisions already settled
- Sandra Fish Archive — archived to
CS-SERVER\Archive\Former-Director-Sandra-Fish\, Meredith is the sole custodian (settled 2026-04-23). - Drivers lose IT access — Richard Adams / Julian Crim / Christopher Holick AD accounts disabled (settled 2026-04-22).
- Agency caregivers — no shared logins; per-person accounts only when Reliable supplies names (settled 2026-04-22 per HIPAA review).
chatshare retired — Teams replaces it company-wide (settled 2026-04-23). No migration needed.- Culinary access limited — only kitchen staff (JD, Ramon, Alyssa) get write access. Meredith, John Trozzi, and Ashley get read-only. Nobody else has access (settled 2026-04-23).
- Culinary folder path — Culinary lives at
D:\Shares\Culinaryon CS-SERVER (local to the server, not synced with Synology). Kitchen team doesn't need the data anywhere else, so no two-way sync (settled 2026-04-23). - Veronica Feller — keeps her current Synology RW scope (Management, Sales, Server, Life Enrichment, Clinical) + Directory, but NOT at admin level. Settled 2026-04-23.
- Caregivers — zero on-prem share access — all clinical work through ALIS. No Directory, no Clinical, no read access to the resident contact list from phones, no exceptions (settled 2026-04-23).
- Crystal Suszek → Crystal Rodriguez — same person, former name. Single AD account
Crystal.Rodriguez; old SynologyCrystal Suszekaccount disabled at cutover (settled 2026-04-23). CasAdmin201— will NOT become a domain user on cs-server/CS-SERVER. Disabled on Synology at cutover (settled 2026-04-23).- New CS-SERVER shares to create (settled 2026-04-23):
LifeEnrichment— CS-SERVER local, RW for Susan/Sharon/Alma only. LE workstations currently have no mapped drives — this will be their first.ALdocs— Assisted Living documentation, CS-SERVER local, RW for nurses (Lois, Karen) + Meredith + Ashley + Sales team (Megan, Crystal, Tamra).WebDocs— web/marketing collateral, CS-SERVER local, RW for Sales team + Meredith + Ashley. Distinct from the retired SynologywebDSM share.
- Sales team share set (settled 2026-04-23) — Megan, Crystal, Tamra all get RW on: ALdocs, WebDocs, SalesDept, Management, Directory.
- Tamra's local
Sales Deptfolder — she has aSales Deptfolder in the root of her user profile that's NOT syncing to the server. Action before her June 2026 departure: back it up and move contents into\\CS-SERVER\SalesDept. Tracked as action item below. - Kitchen staff scope (settled 2026-04-23) — JD, Ramon, Alyssa only get RW on
Culinary. No Directory, no other shares. They don't need them. - Sales team Receptionist access (settled 2026-04-23) — removed. Megan, Crystal, Tamra don't need the Receptionist scan-drop share.
- Receptionist share scoping (settled 2026-04-23) — the
Receptionistshare is a dump folder for scans from the copy room. Tower front desk only — not MC receptionist, not Sales, not sales-supporting roles. It is mapped by machine + user via GPO or logon script: drive appears only on Tower reception PC(s) for users in the Tower receptionist role group. Michelle (MC receptionist) and Matt Brooks (MC receptionist coverage) do NOT get this mapped. Courtesy Patrol (Sebastian, Sheldon, Ray) cover Tower reception after hours, so they keep access. Christina DuPras keeps access for RS Director oversight. Meredith + Ashley keep access for executive oversight.
Decisions still needed from John / Meredith
Tick each when answered:
- Lois Lane — grant the director-level access proposed (Directory + Clinical + Mgmt read), or leave her at ALIS-only?
- Karen Rossini — grant Clinical + Directory, or less?
- Susan Hicks — grant LE Director scope as proposed?
- John Trozzi — want Server access for vendor/maintenance docs, or just Directory + Culinary?
- Lupe Sanchez — minimal scope (Directory only) OK, or does she need Management read?
- Shelby Trozzi — OK with the narrower scope (no admin-full), keeping her as MC Director?
- Matt Brooks — primary department: Maintenance or Resident Services (MC Receptionist)?
- Christine Nyanzunda — Management as read-only OK, or does she need write?
Activitiesfolder — confirm contents are Life Enrichment only (so we create CS-SERVERLifeEnrichmentshare with just LE team RW)pacsfolder — Howard verified 2026-04-23 it's empty on Synology. Do we create a Clinical shared folder on CS-SERVER at all? If clinical staff use ALIS for everything, retire the concept entirely (and strip Clinical from everyone's access lines above). If there's a future need, we create an emptyClinical-PHIshare with the access list already proposed.webfolder — confirm we can retire entirely (DSM web station, not a business share)
Pre-cutover action items
- Tamra Matthews — back up
Sales Deptfolder in root of her user profile; migrate into\\CS-SERVER\SalesDept. Must complete before her June 2026 departure. Verify it really isn't syncing (check the Synology Drive Client on her PC). - Create three new shares on CS-SERVER —
LifeEnrichment,ALdocs,WebDocsatD:\Shares\<name>. Populate NTFS per this doc. - Map the new shares — LE workstations are net-new mappings (no drives today). Script the drive maps via GPO or logon script once per-user interviews close.
- Receptionist share — machine+user GPO/logon-script mapping — drive letter (likely
S:) should only map when the machine is a Tower reception PC (currentlyRECEPTIONIST-PC, and any future Tower-desk stations) AND the user is in a Tower receptionist role group. MC receptionist PC and Sales workstations must NOT get the drive auto-mapped even if the user also logs in elsewhere.
Transition from Synology Drive Client to SMB mapped drives
Current state. The Synology NAS (cascadesDS) two-way syncs its shares to CS-SERVER at D:\Shares\Main\ via a Synology Drive Client running on CS-SERVER. That sync stays in place until Phase 4 cutover. Separately, some user workstations also have Synology Drive Client installed locally, pulling a cached copy of the shares to each PC — that's how those users access Management / SalesDept / Server / Public today.
Goal. Replace each user's local Synology Drive Client with a standard SMB mapped drive (e.g. \\CS-SERVER\Management, backed by D:\Shares\Main\Management). Because CS-SERVER's copy is kept current by the NAS-side sync, users see the same files via the mapped drive as they did via Synology Drive Client — no data move, just a different access path.
Prerequisite. NTFS permissions on each D:\Shares\Main\<share> folder must match this access matrix before drives are mapped on a user's PC. Otherwise users will see the folder but hit access-denied on files.
Rollout per user:
- Create / populate that user's
SG-*-RWgroup memberships per this matrix. - Map their drives via GPO Preferences (or logon script) based on those group memberships.
- Have the user sign in, open each mapped drive, confirm read-and-write works where expected.
- Uninstall Synology Drive Client from the PC. Delete the local cached folder once confirmed empty of unsynced changes.
- Log the change in the session log for that day.
At Phase 4 cutover the sync direction breaks: CS-SERVER becomes authoritative, the Synology moves to read-only, then to a backup target. Mapped drives already point at CS-SERVER so no user-side change is needed at cutover.
Do not retarget the CS-SERVER Synology Drive Client sync path. It stays at D:\Shares\Main\ for the duration. An earlier version of this doc proposed moving it to D:\Shares\Synology\ — that plan is scrapped because it would break the current user-side Synology Drive Client sync for the users still on it.
Next step — per-user interviews
Howard is walking the proposal around the building 2026-04-23 onward, asking each staff member which folders they actually use. Anything a user doesn't touch in their normal workflow gets set to not active for that person — the doc's current access list is the starting point, not the final word. Once interviews are done:
- Update this doc with the approved values
- Populate the
SG-*-RWAD groups accordingly (one-shot script, no service interruption) - Run
scripts/phase2-file-shares.ps1to create/update shares on CS-SERVER with the new NTFS permissions - Spot-check from one PC per department to verify effective access matches the plan
- Leave the Synology in two-way sync during the overlap period; Phase 4 cutover retires Synology as primary once stable
Implementation detail — folder paths on CS-SERVER
For Howard's reference during setup. Reviewers can skip this section.
Two path conventions on CS-SERVER's D: drive:
D:\Shares\Main\<name>\— two-way synced with cascadesDS via Synology Drive Client running on CS-SERVER. Use this for any share that needs to exist on both the Synology NAS and CS-SERVER during the Phase 4 overlap window: Management, SalesDept, Server, Public, and any others Meredith wants kept in sync. This is the existing sync target — do not retarget.D:\Shares\<name>\— CS-SERVER-local only, no Synology sync. Use this for shares that don't exist on Synology today or don't need a Synology copy: Culinary, IT, Receptionist, directoryshare, LifeEnrichment, ALdocs, WebDocs.D:\Homes\<username>\— per-user folder-redirection share. Exposed as\\CS-SERVER\homes. Not under either shares tree; not Synology-synced.
SMB share names stay flat (\\CS-SERVER\Management, \\CS-SERVER\Culinary) — users never see the path difference. Only the NTFS path under the hood changes.
Shares to create/update on CS-SERVER at this path convention:
| SMB share | CS-SERVER path | Synced with Synology? |
|---|---|---|
| Management | D:\Shares\Main\Management |
yes |
| SalesDept | D:\Shares\Main\SalesDept |
yes |
| Server | D:\Shares\Main\Server |
yes |
| Public | D:\Shares\Main\Public |
yes |
| homes | D:\Homes |
no (local, folder-redirection target) |
| LifeEnrichment | D:\Shares\LifeEnrichment |
no (CS-SERVER local, new) |
| ALdocs | D:\Shares\ALdocs |
no (CS-SERVER local, new) |
| WebDocs | D:\Shares\WebDocs |
no (CS-SERVER local, new) |
Clinical-PHI (from pacs) |
D:\Shares\Clinical-PHI (if created) |
Pending A12. Synology pacs is empty — if Meredith wants a clinical shared folder going forward, create empty on CS-SERVER (local, not synced). If not, retire and strip Clinical from access lines. |
| Culinary | D:\Shares\Culinary |
no (local to CS-SERVER) |
| Receptionist | D:\Shares\Receptionist |
no |
| directoryshare | D:\Shares\directoryshare |
no |
| IT | D:\Shares\IT |
no |
| Sandra Fish Archive | D:\Shares\Archive\Former-Director-Sandra-Fish |
no — Meredith-only, archived |
The existing Synology Drive Client sync target on CS-SERVER is D:\Shares\Main\ (per docs/servers/cs-server.md). It stays there for the duration of the Phase 4 overlap. An earlier draft of this doc proposed retargeting to D:\Shares\Synology\ — that plan is scrapped; users currently rely on D:\Shares\Main\ and a retarget would break their sync.
scripts/phase2-file-shares.ps1 will need its $DestRoot + per-share Path values updated to match (D:\Shares\Main\<name> for synced shares, D:\Shares\<name> for local-only).
Source data
- Synology permissions as of 2026-04-22 —
docs/migration/synology-permission-inventory.md - Current AD users + titles —
docs/servers/active-directory.md - Employee roster from John/Meredith (2026-04-22) —
reports/cascades-staff-2026-04-22.csv - User rollout plan —
docs/cloud/user-account-rollout-plan.md
Howard's input 2026-04-23: Ashley → Meredith tier · Veronica → Meredith tier (flagged as strong anomaly for Meredith's sign-off) · Shelby → narrowed from Synology admin-full to MC Director scope · Stephanie Devin removed (not in employee list) · Sandra Fish → Meredith sole custodian.