nordlo.partille.cblifecycle 0.5.0

Added

• Run-ChromebookProvisioning.ps1 sends a reminder FAILURE mail while the status stays ERROR, once -AlertRepeatHours (default 24, 0 = off) have passed since the last alert; subject reads FAILURE (still failing since <time>). The state file gains FailingSince and LastAlertSent. A state file written by an older wrapper with an open, alerted streak gets a reminder on the first failing run after upgrade.
• Invoke-PKChromebookLifecycle now reports why each account was queued for deletion: missing from Google data, empty MatchAttribute (legacy), or deprovisioned past retention. The breakdown appears in event 1202, both run summaries and the new result fields DeletionQueued, DeletionSafetyLimit and DeletionBreakdown.
• Domain-controller fallback for Invoke-PKChromebookLifecycle and Invoke-PKChromebookPreprovision: when -Server is omitted, the PDC emulator is still preferred, but if it is unreachable another available domain controller is used instead of throwing immediately (new private helper Resolve-CBDomainController).
• Run-ChromebookProvisioning.ps1 now requires two consecutive failing runs before sending a FAILURE alert mail (was: every OK→ERROR transition). A RECOVERED mail is only sent if a FAILURE mail was actually sent for the failing streak; a single transient failure that self-recovers on the next run stays silent. Tracked via new ConsecutiveFailures/Alerted fields in the state file.
• Optional -PrimaryGroup parameter on Invoke-PKChromebookPreprovision and Invoke-PKChromebookLifecycle (also surfaced by the Run-ChromebookProvisioning.ps1 wrapper) that sets each computer account's AD primary group (primaryGroupID) to a named group instead of the built-in Domain Computers (RID 515). The device is joined to the group first if needed, then primaryGroupID is changed whenever it differs — so the switch applies to both freshly created and existing accounts and is idempotent. Omitting the parameter leaves the primary group unmanaged (accounts are never reverted to Domain Computers). All group-add and primaryGroupID writes stay pinned to the same DC (the PDC emulator by default) so there is no replication race between the two operations. Must be an add-only group (a -MemberOf group or -DefaultGroup), never an -OrgUnitGroupMap rule group; a startup warning is logged if it collides with a rule group. (Preprovision events 1156/1157; lifecycle events 1124/1125, plus warning 1126.)
• Non-ACTIVE accounts now have their info block and mapped extension attributes refreshed when the source data changes, instead of being only disabled. Previously a deprovisioned/disabled account kept whatever values it had the last time it was ACTIVE — most visibly an info block still reading Status: ACTIVE. The Description is deliberately preserved, so a device whose annotatedUser/OU Google has cleared does not lose its student identity. Extension-attribute updates still skip empty new values, so nothing is blanked. (Event 1110.)
• Timed deletion of DEPROVISIONED devices. Invoke-PKChromebookLifecycle now records the date a device is first detected as DEPROVISIONED in a configurable AD attribute (-DeprovisionDateAttribute, default extensionAttribute1) and, when -EnableDeletion is set, removes the account once it has been deprovisioned for at least -DeprovisionRetentionDays days (default 90). Deletions are governed by the existing -DeletionSafetyLimit / -ForceDelete safeguards. The stamp is cleared automatically if the device returns to ACTIVE. Set -DeprovisionRetentionDays 0 to keep the disable+stamp behaviour but never delete. New parameters are also forwarded by the Run-ChromebookProvisioning.ps1 wrapper. (Events 1134/1135/1205.)
• ACTIVE-wins precedence for duplicate export rows: if a serial appears with both ACTIVE and non-ACTIVE status, the account is created/updated and enabled and is never disabled, deprovision-stamped, or deleted. The conflict is logged (event 1136).
• Get-GoogleChromeDevice -HttpTimeoutSec (default 100) sets a per-request timeout on the Google token and Directory API calls so a stalled TCP connection can no longer hang the fetch indefinitely. Retries (MaximumRetryCount) do not cover a hang — they only fire on a completed 429/5xx response. Exposed by the Run-ChromebookProvisioning.ps1 wrapper as -GoogleHttpTimeoutSec.
• Phase tracking and per-step timing in Run-ChromebookProvisioning.ps1. The wrapper now logs each phase transition (Startup, ImportModule, GoogleFetch, Preprovision, Lifecycle, Finalize) and, at the end of every run, a timing summary with the elapsed time of each step and the total run time. The current phase is stamped into the lock breadcrumb, so an ABNORMAL_END alert now names the exact phase (with a descriptive label) the killed run had reached instead of leaving it a mystery.

Changed

• README: the installation section is now a step-by-step guide (prerequisites, module install from the NuGet feed or manually, run-script configuration, syntax check, dry run, scheduled task, verification, upgrade and rollback). Descriptions of the mail flow updated to the two-run rule and daily reminder.
• Invoke-PKChromebookPreprovision no longer performs its two full-OU Get-ADComputer reads when the watch folder is empty. The input-file enumeration now runs first, and both the pre-run index fetch and the post-run count are skipped on a no-file tick. Empty ticks (the common case) drop from minutes to seconds against large OUs; file-processing behaviour is unchanged.
• Duplicate-serial warning now reports the exact count and names the specific duplicated serials, and detects two non-ACTIVE rows sharing a serial (the previous count heuristic missed that case).
• Behaviour change: existing -EnableDeletion users will begin deleting devices that have been DEPROVISIONED for ≥90 days. Opt out with -DeprovisionRetentionDays 0.

Fixed

• RECOVERED mails reported the time since the previous run (always about 30 minutes) instead of the outage duration; they now measure from the start of the failing streak.
• A module import failure now follows the same alerting rules as other failures (two consecutive runs, then daily reminders) and keeps the state counters; previously it mailed immediately and reset ConsecutiveFailures.
• FAILURE mails triggered by the deletion safety threshold had no ERROR DETAILS section, so the mail did not say what went wrong. The lifecycle pass now adds the block (count, limit, reasons, sample names) to ErrorMessages, and the subject reads FAILURE (deletion blocked).
• Failed preprovision input files (empty CSV, missing serial column, parse error) are now added to ErrorMessages with the file name and reason; previously the mail only showed Files failed: 1.
• Run-ChromebookProvisioning.ps1 now adds a generic line naming the cause and the log file to ERROR DETAILS when a component puts the run in ERROR without supplying a message (new helper Get-RunErrorDetail).