For bonus safety, redundantly check for dryRun here

The logic up top should make this check unnecessary, but we want
to be extra certain that in dryRun mode no changes are made, so
we'll explicitly guard on it every time. This protects the code
less from itself, and more from future modifications.

pkg/agent/clean/active_directory.go

@@ -346,7 +346,7 @@ func UnmigrateAdGUIDUsers(clientConfig *restclient.Config, dryRun bool, deleteMi
 		logrus.Errorf("[%v] unable to migrate user '%v' due to a connection failure; this user will be skipped", migrateAdUserOperation, user.originalUser.Name)
 	}
 	for _, missingUser := range missingUsers {
-		if deleteMissingUsers {
+		if deleteMissingUsers && !dryRun {
 			logrus.Infof("[%v] user '%v' with GUID '%v' does not seem to exist in Active Directory. deleteMissingUsers is true, proceeding to delete this user permanently", migrateAdUserOperation, missingUser.originalUser.Name, missingUser.guid)
 			err = sc.Management.Users("").Delete(missingUser.originalUser.Name, &metav1.DeleteOptions{})
 			if err != nil {