# 2026-07-14 — BCB-OFFICE26: duplicate Dropbox/iCloud Explorer sidebar entry removal

## User
- **User:** Howard Enos (howard)
- **Machine:** Howard-Home
- **Role:** tech

## Session Summary

Howard reported two "Dropbox" icons on BCB-OFFICE26 (Bardach, Barbara — Main site), one correct and one pointing at an iCloud file that is double-backed-up in both Dropbox and iCloud. Initial request was to rename the wrong icon Dropbox → iCloud, then → "Photos" (since an iCloud Drive entry already exists), and finally the user settled on: just remove it.

Investigation ran entirely through GuruRMM (agent e0ad1c3f-2b19-491f-bbf1-4657b4eee058, online, user barbarabardach logged on at console). Enumerated desktop .lnk files across all user profiles + Public Desktop, resolved shortcut targets via WScript.Shell and Shell.Application (including CLSID/IDList folder shortcuts), checked Desktop known-folder redirection in the user's registry hive, and inspected Dropbox PC-backup folders and iCloudDrive. Her real Desktop folder (`C:\Users\BarbaraBardach\Desktop`, not redirected) contains exactly one shortcut — `Dropbox.lnk` → her real Dropbox folder — so no desktop file explained the duplicate.

Asked Howard where the icons appear: **File Explorer sidebar** (navigation pane). Enumerated pinned shell namespace CLSIDs in her hive + HKLM. Found the offender: a per-user pinned entry named **"iCloud Photos"** (CLSID `{98B050B1-6360-483D-AEF0-C78C96A3F5D2}`) whose target is `C:\Users\BarbaraBardach\Dropbox\PC (4)\Pictures\iCloud Photos\Photos` — iCloud Photos content nested inside a Dropbox PC-backup folder, hence double-synced to both clouds. Howard confirmed that was the entry to remove.

Removal (registry-only, no files touched): set `System.IsPinnedToNameSpaceTree = 0` on the CLSID in her hive and deleted the matching `Desktop\NameSpace\{98B050B1-...}` key. Verified pin=0 and key gone. Posted [RMM] alert to #dev-alerts.

## Key Decisions

- Used `ps-encoded.sh` (Write tool script file + `-EncodedCommand` dispatch) after the first inline heredoc JSON dispatch failed — Git Bash collapses `\\` in heredocs, producing invalid JSON escapes (known fleet-wide gotcha).
- Chose to unpin via registry flags rather than delete the CLSID key wholesale — reversible, and iCloud may recreate/manage the key.
- Left the second genuine duplicate alone: sidebar still has TWO literal "Dropbox" entries (per-user `{E0B6F00F-6493-42EC-B060-9DCFCFD070AC}` → real Dropbox folder, plus machine-wide HKLM `{E31EA727-12ED-4702-820C-4B6445F28E1A}`/`{...1B}`). User only asked for the iCloud Photos one.
- Did not touch the underlying double-backup problem (files still sync to both clouds) — flagged to Howard as follow-up.
- Asked via AskUserQuestion before deleting anything — the only Dropbox .lnk on her visible desktop was the CORRECT one; deleting on assumption would have removed the wrong icon.

## Problems Encountered

- Inline JSON heredoc dispatch to RMM failed with "invalid escape" — Git Bash heredoc collapsed `\\` in Windows paths. Fixed by switching to `ps-encoded.sh`.
- WScript.Shell returned empty TargetPath for folder/CLSID shortcuts — resolved with Shell.Application `GetLink.Target.Path` (returned `::{E0B6F00F-...}` for the desktop Dropbox.lnk).
- Running as SYSTEM, `%USERPROFILE%`-based .lnk targets resolved to `C:\windows\system32\config\systemprofile\...` — misleading; actual targets are under her profile.
- `Get-ChildItem Registry::HKEY_USERS` enumeration silently returned nothing for her hive in one script; direct `reg.exe query HKU\<SID>` worked.

## Configuration Changes

On BCB-OFFICE26 (registry, hive `HKU\S-1-12-1-1104233520-1256390324-3559642798-2806790374`):
- `...\Software\Classes\CLSID\{98B050B1-6360-483D-AEF0-C78C96A3F5D2}\System.IsPinnedToNameSpaceTree` = 0 (was 1)
- Deleted `...\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{98B050B1-6360-483D-AEF0-C78C96A3F5D2}`

No files in repo changed (temp .ps1 helpers created and deleted).

## Credentials & Secrets

None new. RMM auth via vault `infrastructure/gururmm-server.sops.yaml` as usual.

## Infrastructure & Servers

- BCB-OFFICE26 — Bardach, Barbara / Main, Windows, GuruRMM agent id `e0ad1c3f-2b19-491f-bbf1-4657b4eee058`
- Logged-on user: `barbarabardach` (console), profile `C:\Users\BarbaraBardach`, SID `S-1-12-1-1104233520-1256390324-3559642798-2806790374`
- Cloud sync stack on the box: Dropbox (with PC backup: `My PC (BCB)`, `PC`, `PC (2)`, `PC (4)` folders), iCloud Drive (`C:\Users\BarbaraBardach\iCloudDrive`), OneDrive personal + "OneDrive - Long Realty Company"
- Syncro installer present on old desktop backup: `SyncroSetup-bardach_barbara-v1-641151.exe`

## Commands & Outputs

- `bash .claude/scripts/rmm-search.sh BCB-OFFICE26` → 1 match
- `bash .claude/scripts/ps-encoded.sh rmm <agent-id> <script>.ps1 --timeout 60 [--user-session]` — used for all dispatches
- Sidebar namespace enumeration key output:
  - `{E0B6F00F-6493-42EC-B060-9DCFCFD070AC}` name=[Dropbox] user hive, target=`C:\Users\BarbaraBardach\Dropbox` (correct)
  - `{98B050B1-6360-483D-AEF0-C78C96A3F5D2}` name=[iCloud Photos] target=`C:\Users\BarbaraBardach\Dropbox\PC (4)\Pictures\iCloud Photos\Photos` (removed)
  - `{C6BBCD82-88F8-405A-8EA2-559227F01177}` name=[iCloud Drive] target=`C:\Users\BarbaraBardach\iCloudDrive`
  - HKLM `{E31EA727-12ED-4702-820C-4B6445F28E1A}` + `{...1B}` name=[Dropbox] (machine-wide, still pinned)
- Unpin command id: `59f65e95-52b8-4cd5-8797-a8937613c8f9` (exit 0, verified)

## Pending / Incomplete Tasks

- [ ] Double-backup still active: iCloud Photos lives inside `Dropbox\PC (4)\Pictures` — syncing to both Dropbox and iCloud, burning quota in both. Fix = disable Dropbox folder backup for Pictures or relocate iCloud Photos. Awaiting Howard's go.
- [ ] Two literal "Dropbox" sidebar entries remain (per-user + HKLM machine-wide). One-line unpin of `{E31EA727-...}` if the client complains.
- [ ] If the iCloud Photos entry lingers in the sidebar, a new Explorer window or sign-out/in refreshes it; iCloud for Windows may also re-pin it on update — re-run the unpin if so.

## Reference Information

- GuruRMM API: `http://172.16.3.30:3001`; agent id `e0ad1c3f-2b19-491f-bbf1-4657b4eee058`
- RMM command ids: enumeration `6fcf0969`, `964d03b1`, `e9b06c3c`, `ea6554fb`, `fb09d69f`, `998b3e28`, `0fdfce5f`, `104ddd56`; fix `59f65e95`
- #dev-alerts message id: `1526737970487627839`
