nordlo.partille.cblifecycle 0.5.0-rc.1

Added

• Optional -PrimaryGroup parameter on Invoke-PKChromebookPreprovision and Invoke-PKChromebookLifecycle (also surfaced by the Run-ChromebookProvisioning.ps1 wrapper) that sets each computer account's AD primary group (primaryGroupID) to a named group instead of the built-in Domain Computers (RID 515). The device is joined to the group first if needed, then primaryGroupID is changed whenever it differs — so the switch applies to both freshly created and existing accounts and is idempotent. Omitting the parameter leaves the primary group unmanaged (accounts are never reverted to Domain Computers). All group-add and primaryGroupID writes stay pinned to the same DC (the PDC emulator by default) so there is no replication race between the two operations. Must be an add-only group (a -MemberOf group or -DefaultGroup), never an -OrgUnitGroupMap rule group; a startup warning is logged if it collides with a rule group. (Preprovision events 1156/1157; lifecycle events 1124/1125, plus warning 1126.)
• Non-ACTIVE accounts now have their info block and mapped extension attributes refreshed when the source data changes, instead of being only disabled. Previously a deprovisioned/disabled account kept whatever values it had the last time it was ACTIVE — most visibly an info block still reading Status: ACTIVE. The Description is deliberately preserved, so a device whose annotatedUser/OU Google has cleared does not lose its student identity. Extension-attribute updates still skip empty new values, so nothing is blanked. (Event 1110.)
• Timed deletion of DEPROVISIONED devices. Invoke-PKChromebookLifecycle now records the date a device is first detected as DEPROVISIONED in a configurable AD attribute (-DeprovisionDateAttribute, default extensionAttribute1) and, when -EnableDeletion is set, removes the account once it has been deprovisioned for at least -DeprovisionRetentionDays days (default 90). Deletions are governed by the existing -DeletionSafetyLimit / -ForceDelete safeguards. The stamp is cleared automatically if the device returns to ACTIVE. Set -DeprovisionRetentionDays 0 to keep the disable+stamp behaviour but never delete. New parameters are also forwarded by the Run-ChromebookProvisioning.ps1 wrapper. (Events 1134/1135/1205.)
• ACTIVE-wins precedence for duplicate export rows: if a serial appears with both ACTIVE and non-ACTIVE status, the account is created/updated and enabled and is never disabled, deprovision-stamped, or deleted. The conflict is logged (event 1136).
• Get-GoogleChromeDevice -HttpTimeoutSec (default 100) sets a per-request timeout on the Google token and Directory API calls so a stalled TCP connection can no longer hang the fetch indefinitely. Retries (MaximumRetryCount) do not cover a hang — they only fire on a completed 429/5xx response. Exposed by the Run-ChromebookProvisioning.ps1 wrapper as -GoogleHttpTimeoutSec.
• Phase tracking and per-step timing in Run-ChromebookProvisioning.ps1. The wrapper now logs each phase transition (Startup, ImportModule, GoogleFetch, Preprovision, Lifecycle, Finalize) and, at the end of every run, a timing summary with the elapsed time of each step and the total run time. The current phase is stamped into the lock breadcrumb, so an ABNORMAL_END alert now names the exact phase (with a descriptive label) the killed run had reached instead of leaving it a mystery.

Changed

• Invoke-PKChromebookPreprovision no longer performs its two full-OU Get-ADComputer reads when the watch folder is empty. The input-file enumeration now runs first, and both the pre-run index fetch and the post-run count are skipped on a no-file tick. Empty ticks (the common case) drop from minutes to seconds against large OUs; file-processing behaviour is unchanged.
• Duplicate-serial warning now reports the exact count and names the specific duplicated serials, and detects two non-ACTIVE rows sharing a serial (the previous count heuristic missed that case).
• Behaviour change: existing -EnableDeletion users will begin deleting devices that have been DEPROVISIONED for ≥90 days. Opt out with -DeprovisionRetentionDays 0.