nordlo.partille.cblifecycle 0.3.0-rc.6

Added

• SPN registration on Invoke-PKChromebookLifecycle. Every account is ensured to carry host/<serial> and host/<serial>.<DnsDomain> on servicePrincipalName. SPNs are written atomically at creation via New-ADComputer -OtherAttributes and ensured on existing accounts via Set-ADComputer -Add (add-only: other SPNs already on the object are left alone). Adds SpnsAdded to the return object and SPN additions to the run summary.
• Event IDs 1140 / 1141 - SPN added to AD account / error adding SPN.
• -MatchAttribute parameter on Invoke-PKChromebookLifecycle (default extensionAttribute1) - AD attribute holding the Chromebook serial number, used as the identity key for matching and for TameMyCerts certificate-to-account resolution. Validated at startup against the AD schema (must exist and be single-valued) to catch typos.
• -SamAccountPrefix parameter (default CB-) - prefix for the generated SAM name.
• -Server parameter - pins all AD operations to a single DC (defaults to the PDC emulator) to avoid replication-delay races between consecutive reads/writes.
• -OrgUnitGroupMap parameter - hashtable of regex pattern -> single AD group. Devices whose orgUnitPath matches a pattern are added to the associated group; memberships are reconciled (a device is removed from a rule's group once its orgUnitPath no longer matches). Reconciliation is bounded to groups listed in the map; -MemberOf groups are still add-only. Conflicts between -MemberOf and -OrgUnitGroupMap throw at startup. Invalid regex or missing groups also throw at startup.
• Disable/re-enable lifecycle driven by CSV status column. Non-ACTIVE rows (e.g. DEPROVISIONED, DISABLED) disable the matching AD account if it exists; missing AD accounts for non-ACTIVE devices are not created. Accounts whose CSV status returns to ACTIVE are re-enabled. Inactive serials are excluded from the deletion pass (still present in CSV).
• Return object fields: Disabled, Reenabled, InactiveCount.
• Event ID 1102 - legacy account detected (no value in -MatchAttribute), create skipped to avoid duplicates.
• Event IDs 1122 / 1123 - account removed from AD group (OU-rule reconcile) / error removing from group.
• Event IDs 1130 / 1131 - AD account disabled (CSV status not ACTIVE) / error disabling.
• Event IDs 1132 / 1133 - AD account re-enabled (CSV status returned to ACTIVE) / error re-enabling.
• README section on registering the Windows Event Log source manually (for scheduled-task service accounts without local admin).

Changed

• Invoke-PKChromebookLifecycle now matches AD accounts via -MatchAttribute instead of by Name/sAMAccountName. New accounts get a randomly generated sAMAccountName of the form CB-<11 hex chars> (14 characters), decoupled from the Chromebook serial number — which is now stored in the attribute named by -MatchAttribute. The 15-character NetBIOS limit applies only to the generated SAM name; serial numbers of any length are supported.
• DNSHostName is built from <serialNumber>.<DnsDomain> (was <samName>.<DnsDomain>) so Google MDM WiFi profiles authenticate against the correct hostname at NPS/RADIUS. Cert-to-AD matching is unaffected — it still resolves via -MatchAttribute.
• CSV gating column changed from provisionStatus=PROVISIONED to status=ACTIVE to match the actual Google Admin Console export schema.
• Account creation is now atomic: MatchAttribute and all -AttributeMap values are written via New-ADComputer -OtherAttributes, eliminating the previous create-then-set race that could leave orphan accounts.
• Renamed Get-GoogleChromeDevices to Get-GoogleChromeDevice (singular noun per PowerShell conventions). File renamed to match. [OutputType] declared.
• Upgraded module scaffold (build pipeline, VS Code tasks, PSScriptAnalyzer settings, generic tests) to the latest templates.
• Introduced GitVersion.yml for automated versioning.
• Event Log writes use [System.Diagnostics.EventLog]::WriteEntry(...) instead of Write-EventLog (which was removed from Microsoft.PowerShell.Management in PowerShell 7). Removed the now-unused EventLogName parameter from Write-CbLog.

Fixed

• Log file writes (Out-File in Write-CbLog and the run summary) no longer suppressed by -WhatIf — the audit trail is always written, even in dry runs.
• Import-Module ActiveDirectory no longer emits implicit-remoting proxy-copy What if: noise under -WhatIf. $WhatIfPreference is temporarily cleared around the import (and restored immediately after) so the temporary remoteIpMoProxy_* file copies don't inherit it. Wrapped in try/catch to surface a clear error if RSAT is missing.

Migration

• TameMyCerts policy must be repointed to <DirectoryServicesAttribute>extensionAttribute1</DirectoryServicesAttribute> (or the attribute chosen via -MatchAttribute). Coordinated outside this module.
• Existing accounts from prior versions are handled by delete-and-recreate, and require two runs because deletion happens after create/update inside a single invocation:
  • Run 1 with -EnableDeletion (add -ForceDelete if over the safety threshold): legacy accounts trigger event 1102 and are skipped for creation, then removed by the deletion pass.
  • Run 2: legacy accounts are gone, new CB-<hex> accounts are created.
• Tip: dry-run with -WhatIf -EnableDeletion first to count legacy accounts before deciding on -ForceDelete.
• Accounts already on the new CB-<hex> scheme but with <samName>.<DnsDomain> DNSHostName will be migrated to <serial>.<DnsDomain> in-place on the next run (event 1110 with a DNSHostName: ... -> ... change). Expect a one-shot batch of "updated" accounts.

Known gaps

• No Pester tests covering the new naming behaviour (legacy detection, conflict guard, SAM prefix validation, DNSHostName regen). To follow up in a separate change.