40 lines
2.8 KiB
Markdown
40 lines
2.8 KiB
Markdown
# Staff Extract and AD Email/Disable Sync
|
|
|
|
**Date:** 2026-02-27
|
|
**Project:** Staff-AD-email-disabler
|
|
**Status:** resolved
|
|
**Tags:** powershell, active-directory, asm, csv, staff, automation, logging
|
|
|
|
## Context
|
|
The school's staff system (ASM) produces a daily export. Jess wanted (1) a script to extract just the staff status and email columns into a clean CSV, and (2) a second script that reads that extract, updates each staff member's AD email address, and disables accounts for staff who are inactive or have left — with a preview of changes before anything is committed. Work ran 2026-02-25 to 2026-02-27.
|
|
|
|
## Key Decisions
|
|
- **Two scripts, not one** — extraction (`Extract-StaffColumns.ps1`) is separate from AD changes (`Update-StaffAD.ps1`) so the CSV can be inspected, and so the extract can be reused by other tooling.
|
|
- **Match on payroll number** — `PAYROLL_REC_NO` is the stable key. The first draft searched AD by `EmployeeID`; it was changed to look the user up directly by identity (the AD username equals the payroll number in this environment).
|
|
- **Disable on `INAC` or `LEFT`**, never delete — reversible, and keeps audit history.
|
|
- **Duplicate rows: `ACTV` wins** — the export can contain multiple rows per person (e.g. an old LEFT row and a current ACTV row); active status takes priority so current staff are never disabled by a stale record.
|
|
- **Always write a log entry**, even when nothing changes — a missing log is otherwise ambiguous (did it run?).
|
|
- **List not-found accounts individually, with a name** — name is parsed from the `Firstname.Lastname@` email since the extract has no name column; falls back to `Unknown`.
|
|
- **Not-found users are skipped, not created** (at this stage — see the 2026-05-20 session, which changed this).
|
|
|
|
## Technical Details
|
|
- Input columns: `PAYROLL_REC_NO`, `STAFF_STATUS` (`ACTV` / `INAC` / `LEFT`), `E_MAIL`.
|
|
- `$DisableStatuses = @("INAC","LEFT")`.
|
|
- Name parse regex: `^([^.]+)\.([^@]+)@` → "First Last".
|
|
- Log summary lists counts plus each not-found account as `<payroll>, <First Last>`.
|
|
- Intended to run daily as a scheduled task after the ASM export lands.
|
|
|
|
## Code Changes
|
|
- `Extract-StaffColumns.ps1` — new; pulls the three columns from the ASM export.
|
|
- `Update-StaffAD.ps1` — new; preview + apply email updates and disables; duplicate handling; always-log; itemised not-found list with parsed names.
|
|
- `README.md` — usage docs.
|
|
|
|
## Open Questions / Next Steps
|
|
- Superseded in part by the 2026-05-20 session (user creation, dry run, OU moves).
|
|
|
|
## Artifacts
|
|
- `2fb501c` — Include parsed name alongside payroll number for not-found AD accounts
|
|
- `666fdf9` — Always log an entry even when no changes are made
|
|
- `0fdf3d0` — Handle duplicate entries - ACTV status takes priority
|
|
- Repo: https://gitea.hideawaygaming.com.au/jessikitty/Staff-AD-email-disabler
|