## User
- **User:** Howard Enos (howard)
- **Machine:** HOWARD-HOME
- **Role:** tech
- **Session span:** 2026-05-20 ~22:47 PT – 2026-05-21 afternoon

---

## Session Summary

Short session bridging the end of the 2026-05-20 phase 2.6 work and a midday sync on 2026-05-21. The primary action was posting an internal comment to Syncro ticket #32303 (110680053) documenting that passwords supplied for Lauren Hasselman and Crystal Rodriguez did not work this session, preventing work on their machines. The comment was posted via the Syncro API (`/api/v1/tickets/110680053/comment`) using form-encoded data (JSON body returned 400 — resolved by switching to form encoding with `--data-urlencode`).

Ran `/sync` at midday on 2026-05-21 and pulled 11 commits from Mike Swanson, including a major overhaul of the `/syncro` skill. The timer-based billing workflow (`timer_entry → charge_timer_entry`) has been replaced with a direct `add_line_item` approach. Reviewed the updated `syncro.md` to understand the new billing flow before the next Cascades session.

---

## Key Decisions

- Comment posted as hidden/internal to avoid customer-visible email. `do_not_email: true`, `hidden: true`.
- Used form-encoded POST (`--data-urlencode`) instead of JSON body — Syncro `/comment` endpoint returns 400 on JSON content-type but requires `subject` field when form-encoded.
- Did not attempt any machine work for Lauren or Crystal this session — passwords were not working and no alternative access path was available.

---

## Problems Encountered

- **Syncro comment endpoint returned 400 on JSON POST:** Two JSON attempts failed with 400 (no error message in body, just HTML 400 page). Switched to `--data-urlencode` form encoding; first attempt returned `{"success":false,"message":["Subject can't be blank"]}` — added `subject` field, comment posted successfully on second attempt.

---

## Configuration Changes

None — no server or domain changes this session.

---

## Credentials & Secrets

- Howard Syncro API key: `Tde5174a6e9e312d14-02fd5bfe0f0ee40c87d027507c680e18`
- GuruRMM API: http://172.16.3.30:3001 — claude-api@azcomputerguru.com / ClaudeAPI2026!@# (JWT required)

---

## Infrastructure & Servers

- CS-SERVER: DC + file server, cascades.local
- Cascades customer ID: 20149445, prepay remaining: 35.5 hours (as of 2026-05-20 evening)

---

## Commands & Outputs

```bash
# Successful comment POST (form-encoded)
curl -s -X POST "https://computerguru.syncromsp.com/api/v1/tickets/110680053/comment" \
  -H "Authorization: Tde5174a6e9e312d14-02fd5bfe0f0ee40c87d027507c680e18" \
  --data-urlencode "subject=Lauren Hasselman / Crystal Rodriguez - unable to access machines" \
  --data-urlencode "body=Attempted to continue Administrative dept migration this session. Passwords provided by Lauren Hasselman and Crystal Rodriguez did not work - could not log into their machines. Will need updated credentials or a scheduled time to access those machines before their folder redirection can be completed. Zachary Nelson folder redirection was confirmed working on ACCT2-PC." \
  --data-urlencode "hidden=true" \
  --data-urlencode "do_not_email=true"

# Response: {"comment":{"id":412091314,"created_at":"2026-05-20T22:47:14.264-07:00","ticket_id":110680053,"subject":"Lauren Hasselman / Crystal Rodriguez - unable to access machines","tech":"Howard Enos","hidden":true,"user_id":1750}}
```

---

## Pending / Incomplete Tasks

1. **Lauren Hasselman** — Howard must move her OneDrive data to local folders manually first, then:
   ```powershell
   Add-ADGroupMember -Identity SG-FolderRedirect -Members lauren.hasselman
   ```
   Log her off/on, verify `\\CS-SERVER\homes\lauren.hasselman\` populated. Get working credentials first.

2. **Crystal Rodriguez** — Same prereq (working credentials). Folder redirection pending.

3. **Entra Connect expansion** — Add `cascadestucson.com` UPN suffix; change Administrative OU users' UPNs to `@cascadestucson.com`; add OU=Administrative to sync scope; run delta sync; verify soft-match.

4. **Phase 3 domain joins** — DESKTOP-KQSL232, CHEF-PC, SALES4-PC, MDIRECTOR-PC (MDIRECTOR-PC needs Win10 Home → Pro first).

5. **Pre-Phase 3 prerequisites** — Populate SG-Mgmt-RW, SG-Sales-RW, SG-Activities-RW; krbtgt rotation (569+ days); remove Meredith.Kuhn + John.Trozzi from Domain Admins.

---

## Update: ~21:30 PT — RECEPTIONIST-PC planning, frontdesk@ M365 audit, CA/MFA review, licensing gap

### Session Summary

Planned the RECEPTIONIST-PC / front desk migration. Reviewed machine info from Syncro: RECEPTIONIST-PC is a Lenovo ThinkCentre M90a on WORKGROUP (not domain-joined), running Windows 11 Pro 26200, local user `RECEPTIONIST-PC\Front Desk`, IP 10.0.20.102. GuruRMM agent was installed on the machine during this session. Share permissions for both the Receptionist share and the directoryshare were granted to the frontdesk user by Howard.

Reviewed the Entra CA and M365 configuration to understand how the frontdesk account fits into the existing migration plan. Queried the Graph API using the Tenant Admin SP and confirmed that `frontdesk@cascadestucson.com` exists as a cloud-only licensed user (display name "Front Desk", account enabled, Member type, not synced from on-prem AD). The account was not visible in initial searches because the display name is two words ("Front Desk") not "FrontDesk". No `receptionist@cascadestucson.com` account exists.

Identified a significant licensing gap: the Business Standard subscription (O365_BUSINESS_PREMIUM SKU) is suspended, but 31 users — including frontdesk@ — still have their license assigned to it. The Business Premium subscription (SPB SKU) is active with 34 purchased seats and only 3 consumed (pilot.test, MDMS service account, one other), leaving 31 seats available. All 31 affected users need their license assignment switched from the suspended Business Standard SKU to the active Business Premium SKU. This does not block the PC migration but is a time-sensitive M365 task.

Confirmed the Named Location (`CascadesTrustedLocation`, id `061c6b06-b980-40de-bff9-6a50a4071f6f`) is already created with both Cascades WAN IPs (`72.211.21.217/32` and `184.191.143.62/32`). The active all-users-MFA CA policy already has `excludeLocations: AllTrusted`, meaning MFA is already bypassed for all users signing in from the Cascades office network. No additional CA policy is needed for the frontdesk account. The three caregiver CA policies remain in Report-only mode scoped to SG-Caregivers-Pilot only.

Discussed the GPO ILT issue: the FrontDesk printer and R: Receptionist drive are currently ILT'd to OU=Resident Services, which would also push to Courtesy Patrol and the RS Director who don't need them. Recommended switching both ILT rules to `FilterGroup: CASCADES\SG-FrontDesk` (the group already exists with 0 members). This change needs to be made to the Printers.xml and Drives.xml in SYSVOL before the GPOs go live at Phase 3.

### Key Decisions

- Keep `frontdesk@cascadestucson.com` as a licensed user (not converting to shared mailbox yet) so it can serve as the domain sign-in identity for RECEPTIONIST-PC. Shared mailbox conversion deferred to Phase 5 when individual receptionist accounts are set up.
- Use `SG-FrontDesk` (existing, 0 members) as the ILT filter for FrontDesk printer and R: drive instead of OU=Resident Services. This prevents Courtesy Patrol and RS Director from receiving resources intended for front desk only.
- Scanner (Canon imageRunner C478iF in copy room) scans to `\\CS-SERVER\Receptionist` via an existing stored credential. No changes to scanner config at this time — the share is already in place and the scanner is working. Credential migration to a dedicated service account is deferred to Phase 5.
- Do not modify the directoryshare's existing permissions structure — add only a new ACE for the frontdesk user. Non-domain users are still accessing it and existing ACEs must not be disturbed.
- Machine will be ProfWiz-migrated (local profile to domain account) when domain join happens. No data loss approach.

### Configuration Changes

- RECEPTIONIST-PC: GuruRMM agent installed (agent ID to be confirmed in next session via GuruRMM API)
- Receptionist share (D:\Shares\Receptionist) + directoryshare: frontdesk user permissions granted by Howard on CS-SERVER
- No other changes made this session

### Credentials & Secrets

- `frontdesk@cascadestucson.com` / `sccssccs#3` — M365 user password; also the local Windows login for `RECEPTIONIST-PC\Front Desk`
- **Vault obligation:** this credential is not yet vaulted — create `clients/cascades-tucson/frontdesk-user.sops.yaml` in next session

### Infrastructure & Servers

- RECEPTIONIST-PC: Lenovo ThinkCentre M90a (11CDS0DC00), serial MJ0KQHNP, Win 11 Pro 26200, IP 10.0.20.102, MAC 98:59:7A:B0:06:58, WORKGROUP
- Local user: `RECEPTIONIST-PC\Front Desk` (password sccssccs#3)
- frontdesk@cascadestucson.com: cloud-only, enabled, Business Standard (suspended SKU — needs Business Premium reassignment)
- Named Location: `CascadesTrustedLocation` id `061c6b06-b980-40de-bff9-6a50a4071f6f` (72.211.21.217/32 + 184.191.143.62/32)
- Business Premium SKU (SPB `cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46`): 34 purchased, 31 available
- Business Standard SKU (O365_BUSINESS_PREMIUM `f245ecc8-75af-4f8e-b61f-27d8114de5f3`): SUSPENDED, 31 users still assigned

### Pending / Incomplete Tasks

1. Vault `frontdesk@cascadestucson.com` credential: `clients/cascades-tucson/frontdesk-user.sops.yaml`
2. Relicense 31 users from suspended Business Standard → active Business Premium (time-sensitive)
3. Update CSC - Printer Deployment GPO: FrontDesk ILT from OU=Resident Services → SG-FrontDesk
4. Update CSC - Drive Mappings GPO: R: ILT from OU=Resident Services → SG-FrontDesk
5. Add receptionist users (Cathy.Kingston, Kyla.QuickTiffany, Michelle.Shestko) to SG-FrontDesk when ready
6. RECEPTIONIST-PC: confirm GuruRMM agent ID via API
7. RECEPTIONIST-PC: domain join using Phase 3 template + ProfWiz (local Front Desk profile → FrontDesk domain account)
8. Create AD account for frontdesk in a synced OU with UPN frontdesk@cascadestucson.com (so Entra Connect soft-matches to existing cloud account)
9. Vault the frontdesk credential once vaulted, update migration plan

## Reference Information

- Migration master plan: `C:\Users\Howard\.claude\plans\wise-discovering-panda.md`
- Resume command: "resume the Cascades migration plan"
- Syncro migration ticket: https://computerguru.syncromsp.com/tickets/110680053 (#32303)
- Cascades customer ID: 20149445, prepay: 35.5 hrs remaining
- CSC - Folder Redirection GPO GUID: {512B43A4-F049-4CE5-BFAC-860AD13E92BE}
- SG-FolderRedirect current members: Zachary.Nelson only
- **Billing note:** New Syncro billing workflow uses `add_line_item` directly — do NOT use timer workflow. See `.claude/commands/syncro.md`.
