docs: add session log for staff extract and AD sync

.claude-context/sessions/2026-02-27-staff-extract-and-ad-sync.md

@@ -0,0 +1,39 @@
+# Staff Extract and AD Email/Disable Sync
+
+**Date:** 2026-02-27
+**Project:** Staff-AD-email-disabler
+**Status:** resolved
+**Tags:** powershell, active-directory, asm, csv, staff, automation, logging
+
+## Context
+The school's staff system (ASM) produces a daily export. Jess wanted (1) a script to extract just the staff status and email columns into a clean CSV, and (2) a second script that reads that extract, updates each staff member's AD email address, and disables accounts for staff who are inactive or have left — with a preview of changes before anything is committed. Work ran 2026-02-25 to 2026-02-27.
+
+## Key Decisions
+- **Two scripts, not one** — extraction (`Extract-StaffColumns.ps1`) is separate from AD changes (`Update-StaffAD.ps1`) so the CSV can be inspected, and so the extract can be reused by other tooling.
+- **Match on payroll number** — `PAYROLL_REC_NO` is the stable key. The first draft searched AD by `EmployeeID`; it was changed to look the user up directly by identity (the AD username equals the payroll number in this environment).
+- **Disable on `INAC` or `LEFT`**, never delete — reversible, and keeps audit history.
+- **Duplicate rows: `ACTV` wins** — the export can contain multiple rows per person (e.g. an old LEFT row and a current ACTV row); active status takes priority so current staff are never disabled by a stale record.
+- **Always write a log entry**, even when nothing changes — a missing log is otherwise ambiguous (did it run?).
+- **List not-found accounts individually, with a name** — name is parsed from the `Firstname.Lastname@` email since the extract has no name column; falls back to `Unknown`.
+- **Not-found users are skipped, not created** (at this stage — see the 2026-05-20 session, which changed this).
+
+## Technical Details
+- Input columns: `PAYROLL_REC_NO`, `STAFF_STATUS` (`ACTV` / `INAC` / `LEFT`), `E_MAIL`.
+- `$DisableStatuses = @("INAC","LEFT")`.
+- Name parse regex: `^([^.]+)\.([^@]+)@` → "First Last".
+- Log summary lists counts plus each not-found account as `<payroll>, <First Last>`.
+- Intended to run daily as a scheduled task after the ASM export lands.
+
+## Code Changes
+- `Extract-StaffColumns.ps1` — new; pulls the three columns from the ASM export.
+- `Update-StaffAD.ps1` — new; preview + apply email updates and disables; duplicate handling; always-log; itemised not-found list with parsed names.
+- `README.md` — usage docs.
+
+## Open Questions / Next Steps
+- Superseded in part by the 2026-05-20 session (user creation, dry run, OU moves).
+
+## Artifacts
+- `2fb501c` — Include parsed name alongside payroll number for not-found AD accounts
+- `666fdf9` — Always log an entry even when no changes are made
+- `0fdf3d0` — Handle duplicate entries - ACTV status takes priority
+- Repo: https://gitea.hideawaygaming.com.au/jessikitty/Staff-AD-email-disabler