release: v1.3.3 — AD account status detection & opt-in SkipDisabledUsers (#21)#23
Merged
Conversation
Handle departed employees correctly using only universal Active Directory signals, so it works for every customer regardless of their leaver process. - ConvertTo-SPSUserRecord reads userAccountControl (bit 0x2 = ACCOUNTDISABLE) and exposes AccountStatus (Active/Disabled/NotFound) and Enabled. A resolved entry with no userAccountControl (some non-AD LDAP directories) stays Active, unchanged from before. PS 5.1-safe [Int32]::TryParse. - SPSyncUserInfoList carries AccountStatus into the JSON snapshot, and its HTML report gains an 'AD Status' column and a 'Disabled in AD' card (note pointing at SkipDisabledUsers) so disabled/departed accounts are visible at a glance. - SPSyncUserProfile: new opt-in SkipDisabledUsers (default $false = unchanged behaviour) reports Disabled accounts as Not Added instead of provisioning them. Each Not-Added entry is tagged with a NotAddedReason (AD_NOT_FOUND, MISSING_ATTRIBUTES or DISABLED) and the run prints the breakdown. Logic extracted into a testable Split-SPSProfileUser helper. - Resolve-SPSADUserBatch fallback records gain the two fields for shape parity. - Tests: account-status projection, Split-SPSProfileUser routing, and the report AD Status column / Disabled card (+ pre-1.3.3 backward-compat). Docs updated. Fixes #21
Pester Test Results100 tests 100 ✅ 3s ⏱️ Results for commit c60fa4d. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #21. Ships the 1.3.3 release, which also includes the already-merged CI Node 20 action bumps (#22).
Why
Field analysis of the large Not Added population showed it is mostly departed employees the customer keeps in the SharePoint User Information List for permission history. Two departure shapes must both be handled — disabled (kept in AD) and deleted (gone from AD) — and the solution must work for every customer, so it relies only on universal AD signals, never on a customer-specific leaver process (no dedicated OU, naming convention, HR feed or retention policy).
What
Detection (universal).
ConvertTo-SPSUserRecordreads theuserAccountControlattribute (bit0x2= ACCOUNTDISABLE) and exposes two additive fields on every record:AccountStatus(Active/Disabled/NotFound) andEnabled.SPSyncUserInfoListcarriesAccountStatusinto the JSON snapshot. A resolved entry with nouserAccountControl(some non-AD LDAP directories) staysActive, unchanged.Handling (opt-in, backward-compatible).
SkipDisabledUsersinsync-settings.psd1(default$false= pre-1.3.3 behaviour). When$true,SPSyncUserProfilereportsDisabledaccounts as Not Added instead of provisioning them.NotAddedReason—AD_NOT_FOUND(deleted/departed, or a forest not declared inad-domains.psd1),MISSING_ATTRIBUTES, orDISABLED— and the run prints the per-reason breakdown, so an expected miss is easy to tell apart from an actionable one.Split-SPSProfileUserhelper.Visibility. The
SPSyncUserInfoListHTML report gains an AD Status column and a Disabled in AD summary card (with a note pointing atSkipDisabledUsers), so disabled/departed accounts are visible before the profile sync runs.Guarantees for every customer
userAccountControlbit0x2AccountStatusNotFoundNo dependency on OU layout, naming, HR feeds or retention. Defaults preserve current behaviour; nothing changes unless
SkipDisabledUsersis set.Compatibility
AccountStatusis additive; older consumers ignore it, and a pre-1.3.3 snapshot (noAccountStatus) reports 0 disabled and provisions exactly as before.SkipDisabledUsersacts on the status written bySPSyncUserInfoList1.3.3+, so regenerate the JSON snapshot after upgrading for it to take effect (documented in the release notes / wiki).[Int32]::TryParse(2-arg) keeps parsing Windows PowerShell 5.1 / .NET Framework safe (same lesson as the 1.3.2[Enum]::Parsefix).Tests
ConvertTo-SPSUserRecord: active / disabled (514) / disable-bit-with-other-flags (66050) / string uac / no-uac (backward compatible) / null entry →NotFound.Split-SPSProfileUser: eligible vs Not-Added routing, reason tagging,SkipDisabledUserson/off, pre-1.3.3 snapshots.Export-SPSUserReport: AD Status column + Disabled card + note, and backward-compat (no AccountStatus).Follow-up (not in this PR)
AD_NOT_FOUNDinto "forest not declared" (actionable) vs "deleted in a reachable forest" (expected).