# Staff-AD-email-disabler

Daily PowerShell pipeline that keeps staff Active Directory accounts in sync with the school's staff system (ASM) export.

**Repository:** https://gitea.hideawaygaming.com.au/jessikitty/Staff-AD-email-disabler

## Pipeline
1. `Extract-StaffColumns.ps1` — ASM export → CSV of `PAYROLL_REC_NO`, `STAFF_STATUS`, `E_MAIL`
2. `Update-StaffAD.ps1` — for each row:
   - found + email differs → update email
   - found + `INAC`/`LEFT` → disable, move to inactive OU
   - found + `ACTV` → ensure in active OU
   - not found + `ACTV` → create account in new-user OU
   - not found + other status → log and skip
   - Domain Admin accounts are never moved

## Rules
- Payroll number is the match key (equals AD username)
- Duplicate rows: `ACTV` takes priority
- Always write a log, even with no changes; not-found users listed individually with parsed names
- `-DryRun` previews every action (email, disable, create, move)

## Related
- `Set-StudentEmail` — student-side equivalent for email addresses

## Session Log
- 2026-02-27 — Staff Extract and AD Email/Disable Sync — Built extract + update scripts with preview, duplicate handling and itemised logging
- 2026-05-20 — User Creation, Dry Run and OU Moves — Added ACTV account creation, -DryRun, active/inactive OU moves, Domain Admin exclusion

---
*Created by: Jess Rogerson (yelling commands at Claude.AI)*