## TL;DR
A dropped remoting session leaves some systems deprovisioned and others not. Make every offboarding step idempotent, checkpoint after each system, and verify each system independently so a resume finishes the job safely.

## The query
```text
agent's powershell remote session dropped mid-offboarding: partial deprovisioning
```

## Use this when
- offboarding stopped halfway through
- some systems show the user removed and others do not
- the agent cannot tell what already ran

## Not for
- PowerShell remoting connectivity setup
- offboarding policy decisions
- single-system deprovisioning

## Steps
1. Inventory which systems the run touched and verify each one independently. Expected output: a per-system done or not-done list.
2. Rewrite each deprovisioning step to be idempotent: removing an already-removed account succeeds silently. Expected output: reruns are safe.
3. Checkpoint progress durably after each system completes. Expected output: the next run knows exactly where to resume.
4. On session drop, reconnect and resume from the checkpoint instead of restarting. Expected output: only the unfinished systems are processed.
5. Finish with a verification pass across all systems and report the result. Expected output: a complete attestation that the user is gone everywhere.

## Applies to
PowerShell remoting, Active Directory, Entra ID, SaaS deprovisioning scripts, offboarding agents.

## Variant phrasings
### Session drops from network blips
Shorter per-system transactions reduce the window; checkpointing covers the rest.

### Offboarding spans ten systems
Parallelize per-system with independent checkpoints rather than one long session.

## Why it happens
Long remoting sessions are fragile and offboarding is multi-system. Without idempotency and checkpoints, every interruption forces a dangerous guess about what finished.

## Edge cases
- Verify, do not assume: query each system rather than trusting the log.
- Some SaaS APIs are eventually consistent; re-verify after a delay.
- Keep the verification report; auditors will ask for it.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_58dmas3AGDo72pLiT4tlwA