# Staff Extract and AD Email/Disable Sync

**Date:** 2026-02-27
**Project:** Staff-AD-email-disabler
**Status:** resolved
**Tags:** powershell, active-directory, asm, csv, staff, automation, logging

## Context
The school's staff system (ASM) produces a daily export. Jess wanted (1) a script to extract just the staff status and email columns into a clean CSV, and (2) a second script that reads that extract, updates each staff member's AD email address, and disables accounts for staff who are inactive or have left — with a preview of changes before anything is committed. Work ran 2026-02-25 to 2026-02-27.

## Key Decisions
- **Two scripts, not one** — extraction (`Extract-StaffColumns.ps1`) is separate from AD changes (`Update-StaffAD.ps1`) so the CSV can be inspected, and so the extract can be reused by other tooling.
- **Match on payroll number** — `PAYROLL_REC_NO` is the stable key. The first draft searched AD by `EmployeeID`; it was changed to look the user up directly by identity (the AD username equals the payroll number in this environment).
- **Disable on `INAC` or `LEFT`**, never delete — reversible, and keeps audit history.
- **Duplicate rows: `ACTV` wins** — the export can contain multiple rows per person (e.g. an old LEFT row and a current ACTV row); active status takes priority so current staff are never disabled by a stale record.
- **Always write a log entry**, even when nothing changes — a missing log is otherwise ambiguous (did it run?).
- **List not-found accounts individually, with a name** — name is parsed from the `Firstname.Lastname@` email since the extract has no name column; falls back to `Unknown`.
- **Not-found users are skipped, not created** (at this stage — see the 2026-05-20 session, which changed this).

## Technical Details
- Input columns: `PAYROLL_REC_NO`, `STAFF_STATUS` (`ACTV` / `INAC` / `LEFT`), `E_MAIL`.
- `$DisableStatuses = @("INAC","LEFT")`.
- Name parse regex: `^([^.]+)\.([^@]+)@` → "First Last".
- Log summary lists counts plus each not-found account as `<payroll>, <First Last>`.
- Intended to run daily as a scheduled task after the ASM export lands.

## Code Changes
- `Extract-StaffColumns.ps1` — new; pulls the three columns from the ASM export.
- `Update-StaffAD.ps1` — new; preview + apply email updates and disables; duplicate handling; always-log; itemised not-found list with parsed names.
- `README.md` — usage docs.

## Open Questions / Next Steps
- Superseded in part by the 2026-05-20 session (user creation, dry run, OU moves).

## Artifacts
- `2fb501c` — Include parsed name alongside payroll number for not-found AD accounts
- `666fdf9` — Always log an entry even when no changes are made
- `0fdf3d0` — Handle duplicate entries - ACTV status takes priority
- Repo: https://gitea.hideawaygaming.com.au/jessikitty/Staff-AD-email-disabler