Staff-AD-email-disabler/.claude-context/sessions/2026-02-27-staff-extract-and-ad-sync.md

Staff Extract and AD Email/Disable Sync

Date: 2026-02-27 Project: Staff-AD-email-disabler Status: resolved Tags: powershell, active-directory, asm, csv, staff, automation, logging

Context

The school's staff system (ASM) produces a daily export. Jess wanted (1) a script to extract just the staff status and email columns into a clean CSV, and (2) a second script that reads that extract, updates each staff member's AD email address, and disables accounts for staff who are inactive or have left — with a preview of changes before anything is committed. Work ran 2026-02-25 to 2026-02-27.

Key Decisions

• Two scripts, not one — extraction (Extract-StaffColumns.ps1) is separate from AD changes (Update-StaffAD.ps1) so the CSV can be inspected, and so the extract can be reused by other tooling.
• Match on payroll number — PAYROLL_REC_NO is the stable key. The first draft searched AD by EmployeeID; it was changed to look the user up directly by identity (the AD username equals the payroll number in this environment).
• Disable on INAC or LEFT, never delete — reversible, and keeps audit history.
• Duplicate rows: ACTV wins — the export can contain multiple rows per person (e.g. an old LEFT row and a current ACTV row); active status takes priority so current staff are never disabled by a stale record.
• Always write a log entry, even when nothing changes — a missing log is otherwise ambiguous (did it run?).
• List not-found accounts individually, with a name — name is parsed from the Firstname.Lastname@ email since the extract has no name column; falls back to Unknown.
• Not-found users are skipped, not created (at this stage — see the 2026-05-20 session, which changed this).

Technical Details

• Input columns: PAYROLL_REC_NO, STAFF_STATUS (ACTV / INAC / LEFT), E_MAIL.
• $DisableStatuses = @("INAC","LEFT").
• Name parse regex: ^([^.]+)\.([^@]+)@ → "First Last".
• Log summary lists counts plus each not-found account as <payroll>, <First Last>.
• Intended to run daily as a scheduled task after the ASM export lands.

Code Changes

• Extract-StaffColumns.ps1 — new; pulls the three columns from the ASM export.
• Update-StaffAD.ps1 — new; preview + apply email updates and disables; duplicate handling; always-log; itemised not-found list with parsed names.
• README.md — usage docs.

Open Questions / Next Steps

• Superseded in part by the 2026-05-20 session (user creation, dry run, OU moves).

Artifacts

• 2fb501c — Include parsed name alongside payroll number for not-found AD accounts
• 666fdf9 — Always log an entry even when no changes are made
• 0fdf3d0 — Handle duplicate entries - ACTV status takes priority
• Repo: https://gitea.hideawaygaming.com.au/jessikitty/Staff-AD-email-disabler