Staff-AD-email-disabler/.claude-context/00-overview.md

Staff-AD-email-disabler

Daily PowerShell pipeline that keeps staff Active Directory accounts in sync with the school's staff system (ASM) export.

Repository: https://gitea.hideawaygaming.com.au/jessikitty/Staff-AD-email-disabler

Pipeline

1. Extract-StaffColumns.ps1 — ASM export → CSV of PAYROLL_REC_NO, STAFF_STATUS, E_MAIL
2. Update-StaffAD.ps1 — for each row:
   • found + email differs → update email
   • found + INAC/LEFT → disable, move to inactive OU
   • found + ACTV → ensure in active OU
   • not found + ACTV → create account in new-user OU
   • not found + other status → log and skip
   • Domain Admin accounts are never moved

Rules

• Payroll number is the match key (equals AD username)
• Duplicate rows: ACTV takes priority
• Always write a log, even with no changes; not-found users listed individually with parsed names
• -DryRun previews every action (email, disable, create, move)

Related

• Set-StudentEmail — student-side equivalent for email addresses

Session Log

• 2026-02-27 — Staff Extract and AD Email/Disable Sync — Built extract + update scripts with preview, duplicate handling and itemised logging
• 2026-05-20 — User Creation, Dry Run and OU Moves — Added ACTV account creation, -DryRun, active/inactive OU moves, Domain Admin exclusion

---

Created by: Jess Rogerson (yelling commands at Claude.AI)