Skip to content

Procedures Review — Club Support Inc.

Imported from OneDrive_1_7-23-2026.zip into documents/_imported/ (original .docx/.pdf/.xlsx + cleaned .txt extracts). Word docs were converted to text by extracting word/document.xml (no Word/pandoc available).

1. Inventory (what we have)

Intake / forms

  • Glencoe Staff Onboarding (internal IT intake) — general info, work location, employment type, computer/app/network/Office/club-account access, license type E1 vs E3, DLs, shared mailboxes, printers, shared drives, phone setup, hardware purchase, authorizing manager.
  • New User Request Form (generic, client-facing) — club, name, phone+ext, email, license type (Exch Online monthly/yearly, Business Std monthly/yearly), DL/shared mailbox, software (Jonas/JAM), Jonas Terminal ID, computer/TeamViewer ID, VPN, shared folder, printer, authorizing mgr.
  • New User Request Form.pdf (same as above, PDF).

Setup / build

  • New Computer Setup Updated 2024 ⭐ — full SOP: pre-checks (rebuild: drives, programs, C:\ docs, Jonas ID, VPN, PST archives, Chrome sync, printers), naming scheme, domain join, Jonas install + terminal ID + NIC offload disables (Flow Control, Interrupt Moderation, checksum/LSO offloads), JAM install, Sentinel One, Atera, misc apps (Chrome, Acrobat, TeamViewer, M365 re-download), user-profile setup, Windows hardening (UAC never-notify, privacy off, notifications off, power Never), redirected-folder ACLs, VPN & RDP.
  • New Computer Setup Updated 2024 - Copy — duplicate (drift risk).
  • Jonas and JAM Installation - Copy — subset of the above (duplicate).
  • Epson Chit/Order Printer Installation Guide — USB & network POS chit printers, Generic/Text-Only driver, Jonas printer styles per terminal ID.
  • Aurora Keyscan Installation Guide — per-club DB host list.
  • Tungsten PDF Install.docx — corrupt (not a valid zip); only the network-install PDF survived.

Identity / lifecycle

  • User Offboarding — Template ⭐ — excellent 10-section checklist:
  • Employee info (incl. Atera ticket #) → 2. Core deactivation (AD/Azure AD disable, M365 disable, VPN revoke, RDP remove, admin privs remove, shared creds reset) → 3. Jonas → 4. POS → 5. 3CX (ext/DID/voicemail/queues/softphone) → 6. Network (VPN certs) → 7. Cameras/Access (DVR) → 8. Equipment recovery →
  • Data protection (OneDrive→mgmt, backup, archive/shared mailbox) →
  • Final verification + signatures.
  • 6 completed offboarding forms (BGC, CRV, MSG, SHA, STG, VGC) — real employee PII; treat as confidential.
  • Account Termination Request Form (client-facing) — immediate-action rule: kick sessions, reset password, block logins first; options for delete vs shared-mailbox, license pool handling, email forward/delegate, OneDrive archive (auto-deletes 30d after license removal), redirected folders handoff.
  • Remove user from GAL — manual AD procedure: set email on General tab, msExchHideFromAddressLists=TRUE, Delta Sync, set mailNickname if still showing, re-sync.

Networking / VPN

  • Unifi Identity VPN with MFA — needs AD group VPN Unifi; sign in w/ Microsoft; MFA via Microsoft Authenticator; remove old L2TP config.
  • CWC-VPN — FortiGate SSL VPN via Entra group SG - FortiGate SSO SSLVPN.

Security

  • GeoPolicy Travel Exclusion (PIM) Quick Guide — time-box GeoPolicy- Exclusions membership via Entra PIM (start/end = travel dates); record in the webapp; never add users directly to the group.

Career development

  • IT Support Technician Certification Roadmap — IT Support Tech → M365 Admin → Systems Admin (M365); stages: MD-100→MD-102+MS-900→MS-203/MS-700→ SC-300/SC-900.
  • IT Field Technician Certification Roadmap — Field Tech → Senior Field Tech → Tier 2; CompTIA ITF+/A+ → Network+ + Windows Client → Server+/Azure Admin + Security+; bonus Project+.

Reference data (spreadsheets — contents not opened into notes)

365 Global Admin and AD Audit.xlsx, O365 Backdoor.xlsx ⚠️, MFA Exclusion List.xlsx ⚠️, Unifi Identity Enterprise Client List.xlsx, DHCP Reservations.xlsx, Book.xlsx, RMA History.xlsx, Overtime*.

2. Strengths

  • Offboarding checklist is genuinely strong — broad scope, auditable, covers the whole stack (not just AD/M365).
  • Correct security instincts — immediate session-kill + password reset + block on termination; conditional-access geo-block; PIM for travel; MFA.
  • Two documented career roadmaps — rare and valuable.
  • Naming convention + per-club references documented (Jonas DB, Aurora DB, ISP numbers, DHCP).
  • License-type choices captured at intake (E1 vs E3, commit terms) — good for cost control.

3. Gaps, risks & recommendations

# Issue Recommendation
R1 Credential sprawl in OneDrive — O365 Backdoor.xlsx, MFA Exclusion List.xlsx stored as shared spreadsheets Move break-glass creds to Entra PIM / cloud-only break-glass accounts; vault the rest in IT Glue/Hudu. Document who is on the MFA-exclusion list and why, with expiry.
R2 Everyone: Full Control on C:\GJCWIN + JAM registry key Jonas/JAM requirement — accept but scope to CSupport + a Jonas group where possible; note as accepted risk.
R3 Duplicate SOPs — two "New Computer Setup" + standalone Jonas copy Consolidate to one canonical doc; delete - Copy.
R4 Tungsten PDF Install.docx is corrupt Re-export from source; only PDFs are usable now.
R5 Docs are loose Word files — no search, no version history, easy drift Stand up a lightweight internal wiki (Hudu/IT Glue/BookStack) as the SOP home; keep Word as export.
R6 Stale exam codes in the Support roadmap (MD-100, "Modern Desktop Admin"/MD-101 are retired → MD-102) Update roadmap; see skills-and-certifications.md.
R7 GAL-hide is fully manual per-attribute Script it: Set-ADUser for msExchHideFromAddressLists + mailNickname, then Start-ADSyncSyncCycle.
R8 Offboarding is a 10-section manual checklist — high volume, error-prone Automate the scriptable slices (Section 2 + GAL-hide + license/shared-mailbox) into one Invoke-Offboarding runner.
R9 New-computer build is long & repetitive Wrap the scriptable parts (NIC offload disable, privacy/power/UAC, bloatware removal, desktop icons) into a provisioning script.
R10 Onboarding is manual end-to-end across AD+M365+Jonas+3CX Build Invoke-Onboarding from the intake CSV.
R11 GeoPolicy exclusion recorded in "the webapp" + the group Confirm single source of truth; alert if a user sits in the group outside a PIM window.
R12 Completed offboarding forms hold live PII Retain per policy; restrict access; purge on schedule.

4. Automation opportunities (concrete, from the procedures)

Priority order by ROI. All PowerShell + Microsoft Graph + RSAT-AD.

  1. Invoke-Offboarding — Section 2 of the checklist + GAL-hide + mailbox archive + license reclaim. Biggest win (most repeatable, highest risk if missed).
  2. Invoke-NewComputerBuild — NIC offload disables, UAC/privacy/power hardening, bloatware strip, desktop icons, Atera/TeamViewer checks.
  3. Hide-ADUserFromGAL — the R7 one-liner-and-sync.
  4. Invoke-Onboarding — AD user + license + group adds (VPN Unifi / FortiGate SSO) + MFA enrollment nudge.
  5. Get-ClubLicenseReport — per-tenant license usage/cost (catch waste).

5. What I changed in this repo

  • Extracted the archive to documents/_imported/ (skipped the 1.1 GB Tungsten installer zip + Setup.exe — not run, static review only).
  • Added cleaned .txt of each .docx.
  • Wrote environment.md (stack reference) and updated skills-and-certifications.md + workflow-tools-and-ideas.md to match the real environment (Atera, not Autotask; Jonas/JAM/3CX stack).