# 2026-07-14 — MVAN email issues triage + Syncro ticket #32554

## User
- **Executed by:** ClaudeTools Discord Bot (GURU-BEAST-ROG)
- **Requested by:** Winter Williams (@winterguru, via Discord) - tech
- **Role:** automation (acting on the requester's behalf)

## Session Summary

Winter reported (via Discord thread 1526651647214882956, #tech-department) that MVAN
Enterprises contacted ACG about ongoing email issues across @mvaninc.com accounts, with
five symptoms: (1) senders receiving "domain not found" bounces, (2) moved emails
reappearing in the inbox as unread, (3) emails from 2024 resurfacing, (4) delayed
delivery / older messages backfilling after the inbox was cleared, and (5) the Outlook
view layout changing after a login last week with the user unable to restore it.

Triage of symptom 1: the bounce text itself cited `mitch.v@mvanic.com` — domain
`mvanic.com` is missing an "n" vs the real domain `mvaninc.com`. Live DNS verification
(via 8.8.8.8) confirmed: `mvaninc.com` MX is healthy (`mvaninc-com.mail.protection.outlook.com`,
M365) with valid SPF (`v=spf1 include:spf.protection.outlook.com -all`), while `mvanic.com`
is NXDOMAIN. Conclusion: sender-side typo (likely bad cached autocomplete/contact on the
senders' end); nothing to fix on MVAN's side.

Symptoms 2-5 were assessed as one event, not four: a full mailbox re-sync plus client
change — prime suspect a forced New Outlook toggle or an Outlook profile rebuild
(view changes, local cache rebuilds, everything re-downloads, read/moved state appears
reset, older dates backfill). Outstanding questions posed for the client: which users are
affected, which mail client(s) they use (Outlook classic / New Outlook / OWA / Mac Mail /
phone), and whether the view change was in browser or desktop.

Winter asked for a Syncro ticket. Mike directed that the bounce (symptom 1) be excluded
from the ticket. Created Syncro ticket **#32554** (id 113827636) for MVAN Enterprises Inc
(customer 29462761) with subject "Email issues - mailbox re-sync symptoms, changed Outlook
view", assigned to Winter (user 1737), priority 2 Normal, issue type Email, with an
internal (do_not_email) Initial Issue comment documenting symptoms 2-5, the suspected
cause, and the awaiting-client questions. Bot alert posted to #bot-alerts.

## Key Decisions

- Bounce/typo-domain finding excluded from the ticket per Mike's explicit instruction —
  it is a sender-side problem, not MVAN's.
- Symptoms 2-5 grouped as a single suspected root cause (mailbox re-sync / client change,
  possible New Outlook toggle) rather than tracked as separate issues.
- Ticket attributed to and assigned to Winter (thread opener); Syncro API calls made with
  Winter's per-user key via syncro-env.sh requester resolution.
- Initial Issue comment posted with do_not_email: true (internal diagnostic detail).

## Problems Encountered

- None. All API calls succeeded on first attempt.

## Configuration Changes

- Created: `clients/mvan-inc/session-logs/2026-07/2026-07-14-winter-mvan-email-issues-ticket.md` (this log)
- No other repo or infrastructure changes.

## Credentials & Secrets

- Read (path only): Winter's Syncro API key via `.claude/scripts/syncro-env.sh`
  (vault `msp-tools/syncro-winter`). No credentials created or changed.
- Noted for future work: MVAN M365 tenant creds at `clients/mvan-inc/m365.sops.yaml`
  (tenant mvan.onmicrosoft.com) — not accessed this session.

## Infrastructure & Servers

- mvaninc.com MX: `mvaninc-com.mail.protection.outlook.com` (pref 0) — M365
- mvaninc.com SPF: `v=spf1 include:spf.protection.outlook.com -all`
- mvanic.com (typo domain): NXDOMAIN — does not exist
- Syncro customer: MVAN Enterprises Inc, id 29462761, primary contact june.b@mvaninc.com

## Commands & Outputs

- `nslookup -type=MX mvaninc.com 8.8.8.8` → mvaninc-com.mail.protection.outlook.com
- `nslookup -type=MX mvanic.com 8.8.8.8` → Non-existent domain
- `POST /tickets` → ticket id 113827636, number 32554, status New
- `POST /tickets/113827636/comment` → comment id 423682194 ("Initial Issue")
- `post-bot-alert.sh` → message_id 1526653579702566972

## Pending / Incomplete Tasks

- Awaiting from MVAN (blocks further diagnosis on ticket #32554):
  - Which users are affected (all, or mainly one/two — June? Mitch?)
  - Which mail client(s) in use: Outlook classic / New Outlook / OWA / Mac Mail / phone
  - Whether the "view changed" was in browser or desktop Outlook
- Optional next step offered: remediation-tool mailbox check (inbox rules, forwarding,
  recent config changes) once an affected mailbox is named.
- Communicate to MVAN that the "domain not found" bounces are a sender-side typo
  (mvanic.com vs mvaninc.com) — senders must fix their cached contact. Not on the ticket
  per Mike; still worth relaying to the client.

## Reference Information

- Syncro ticket: #32554 — https://computerguru.syncromsp.com/tickets/113827636
- Discord thread: 1526651647214882956 (#tech-department, Arizona Computer Guru)
- Wiki: `wiki/clients/mvan-enterprises.md` (GPS client, Syncro cid 29462761)
- Vault: `clients/mvan-inc/m365.sops.yaml`, `msp-tools/syncro-winter`

## Update: 15:28 AZ — RMM restore, risky sign-in check, MFA remediation (requested by Mike)

Follow-on work in the same Discord thread, requested by **Mike Swanson** (@azcomputerguru).

### RMM / ScreenConnect
- MVAN RMM footprint: 1 agent — "June" (92f583bc-1095-400c-8cd3-2e15a881ab3d), offline since
  2026-07-12 05:05 UTC despite the machine being in active use.
- ScreenConnect session JUNE (0737c201-61a0-4f07-b7b8-68dcc5796cad) was online (June Bradford
  logged in, Win 11 Pro). CP1 tag has a typo: "MVAN Enterprised" (fix pending).
- Reinstalled GuruRMM agent via SC send-command using site installer one-liner
  (site Main, code LOWER-FORGE-6736). Agent checked back in at 18:28 UTC (11:28 AZ). Verified online.

### Risky sign-in check (remediation-tool, tenant 5affaf1e-de89-416b-a655-1b2cf615d5b1)
- **No compromise**: 0 active risk detections, 0 successful anomalous sign-ins (14-day window,
  126 events). Legit sign-ins from Boise ID (June/Mitch), OKC (Jason).
- **Active distributed credential attack**: mitch.v@mvaninc.com — 72 fails / 73 unique IPs /
  6 countries (US CA DE IT RO NL), err 50053/50126, ongoing. m.vandeveer@modernstile.com —
  14 fails (JP NL NP), account had NO MFA.
- MFA gaps found: m.vandeveer@modernstile.com, j.bradford@modernstile.com, kyeri.b@mvaninc.com,
  invoicing@mvaninc.com.
- Full report: `clients/mvan-inc/reports/2026-07-14-risky-signin-check.md`

### Remediation (approved by Mike in-thread)
- Internal comment with findings posted to Syncro #32554 (comment 423730614) + bot alert.
- **Disabled** m.vandeveer@modernstile.com and j.bradford@modernstile.com (never a successful
  sign-in, unlicensed, no MFA) — PATCH accountEnabled=false via user-manager tier, verified
  after ~20s replication lag (204 + immediate read-back showed stale true; re-read confirmed).
- Consent audit was AMBER (tenant-admin missing Policy.Read.All → 403 on CA endpoints).
  Mike re-consented interactively; refreshed token shows full manifest.
- Created CA policy "ACG - Require MFA for all users (report-only)"
  (f69d7b41-bf13-4631-b1cd-ccf449ef06b9), enabledForReportingButNotEnforced, all users/apps,
  MFA grant, break-glass sysadmin@mvaninc.com excluded. Security defaults off; only the 2
  Microsoft-managed policies pre-existed.

### Pending
- MVAN answers for ticket #32554 (affected users, mail client, browser vs desktop view change).
- kyeri.b (active) + invoicing (dormant since 2025-09) MFA enrollment or disable decision.
- Review report-only CA impact after a few days; explicit go before flipping to enabled.
- SC CP1 typo fix ("MVAN Enterprised" -> "MVAN Enterprises").
- Exchange Operator consent still AMBER (Mail.ReadWrite) — verify on next EXO task.
