# GPS Audit — Held-Client Endpoint Backup Verification + Janet/Marty Ryan Onboarding

## User
- **User:** Howard Enos (howard)
- **Machine:** Howard-Home
- **Role:** tech

## Session Summary

Continuation of the GPS -> GuruRMM backup verification (prior log
`2026-07-05-howard-gps-backup-map-msp360.md`). Deleted a wrong weekend findings DM to
Winter, then resolved the 4 "held / Datto-candidate" billed-backup clients from the map
(Reliant, The Prairie Schooner, Janet Altschuler, Design & Brand Envoys) by putting eyes
directly on the machines.

For the 3 clients that already had online GuruRMM agents (Reliant, Prairie, Envoys), ran a
Datto-product inventory then a full backup-software scan. Result: their machines run Datto
EDR + Datto RMM (security/management) but **no Datto backup client and no backup software of
any kind** — confirming "Datto backup" per Mike was EDR/RMM, not a backup. The one apparent
exception, Prairie's `TPS-SERVER` showing `wbadmin=yes`, turned out to be a Windows Server
Backup to a USB disk whose last successful run was **3/7/2018** (~8 years dead). So all
verified NOT backing up.

Janet Altschuler had zero footprint (no RMM agent). Located her 2 machines in ScreenConnect
(`ALTSCHULER-FRON`, `ALTSCHULER-JANE`, Company "Altschuler", both online), onboarded a
GuruRMM client + site, pushed the agent via SC send-command, and both enrolled. Both already
had Datto EDR (confirmed in the EDR console) so per Howard left EDR alone; tied the accounts
together (SC Company/Site normalized to "Janet Altschuler"/"Main", created her wiki). A full
backup-software scan of both machines confirmed **no backup running** (only Dropbox, stopped).

Updated the Winter + Mike Discord messages in place (PATCH) with the endpoint-verified
results rather than sending new ones. Then ran the GPS-RMM autoenroll plan for machines that
came back online: `WillcoxDOTAdmin` enrolled and auto-reassigned to Reliant (verified a real
Reliant Syncro asset); `DESKTOP-OC2PH4I` (Marty Ryan) enrolled to Staging. Per Howard,
onboarded a new "Marty Ryan" RMM client and reassigned that machine into it; left the
disabled `GPS-RMM-AutoEnroll` scheduled task disabled. Updated customer wikis for the added
machines (created marty-ryan.md and reliant-well-drilling.md; janet-altschuler.md already
existed).

## Key Decisions

- Verified the held clients by direct endpoint inspection instead of waiting on the Datto
  Workplace super-admin key — RMM agents were already present on 3 of 4, giving ground truth.
- Trusted the Datto EDR **console** over an endpoint registry scan when the two disagreed on
  Janet's EDR status (the first quick scan missed the EDR agent; console showed both online).
- Left EDR untouched on Janet's machines (both already covered) per Howard's rule; only tied
  accounts together (SC + wiki).
- Edited the existing Winter/Mike DMs in place rather than sending new messages — keeps one
  authoritative thread and avoids another retraction (the weekend Winter DM had to be deleted).
- Onboarded Marty Ryan as a real RMM client so the Staging machine could be reassigned; left
  the autoenroll scheduled task disabled per Howard (manual sweeps only).

## Problems Encountered

- First quick Datto scan on Janet's machines reported only "Datto RMM" (no EDR); a thorough
  re-scan + the EDR console both showed Datto EDR Agent present. Transient miss — resolved by
  treating the console as authoritative.
- Broad backup-detection regex matched Windows built-ins (MareBackup, RegIdleBackup, Recovery-*,
  Sync Host) and unrelated apps (Dropbox, Nero, NETGEAR Genie) — filtered those out; the only
  real signal was Prairie TPS-SERVER's ancient wbadmin history.
- ScreenConnect extension does not expose full-fleet listing (`GetSessions` absent) — can only
  query `GetSessionsByName`, so finding Janet's machines required her hostnames (Howard supplied
  them: ALTSCHULER-FRON / ALTSCHULER-JANE).
- `git rebase` conflict in `errorlog.md` during a `/sync` (two machines appended entries) —
  resolved by keeping both sides (append-only log), `git add` + `rebase --continue`.
- ownCloud `usage`/`users` too slow (occ load) to confirm Mineralogical earlier — used direct
  SSH + filecache MySQL query instead (separate finding, prior in-session).

## Configuration Changes

Created:
- `wiki/clients/janet-altschuler.md` (earlier in session)
- `wiki/clients/marty-ryan.md`, `wiki/clients/reliant-well-drilling.md`
- Vault: `clients/altschuler/gururmm-site-main.sops.yaml`, `clients/marty-ryan/gururmm-site-main.sops.yaml`
Modified:
- `projects/gps-rmm-audit/backup-map.md` (4 held clients -> endpoint-verified NOT BACKING UP;
  rollup now 7 of 16 not backing up)
- `projects/gps-rmm-audit/gps-clients.json` (40-client cid list, earlier)
- `projects/gps-rmm-audit/autoenroll.log` (manual sweep run 2026-07-07 07:18)

## Credentials & Secrets

- **GuruRMM enrollment key — Janet Altschuler**: vault `clients/altschuler/gururmm-site-main.sops.yaml`.
  client_id `d041b8db-1f68-4b30-9ef9-c7b38f44c079`, site **GOLD-LION-1382**.
- **GuruRMM enrollment key — Marty Ryan**: vault `clients/marty-ryan/gururmm-site-main.sops.yaml`.
  client_id `b223e7eb-8220-495b-9dcf-4cfd6d974e20`, site **WARM-WOLF-1324**.
- **Datto EDR reg key — Janet Altschuler**: `altschul01` (org "Altschuler, Janet"
  `c430e9ac-5d5f-43a7-af8b-f241f6a7dfb1`), already vaulted `msp-tools/datto-edr-regkeys.sops.yaml`.
- Datto Workplace super-admin API key: still NOT received from Mike (existing key 6d1dbfa4 = 0 projects).

## Infrastructure & Servers

- **GuruRMM API** `http://172.16.3.30:3001` (RMM base via rmm-auth.sh).
- **ScreenConnect** `https://computerguru.screenconnect.com` (RESTful API Manager, GetSessionsByName only).
- **Janet Altschuler** SC sessions: ALTSCHULER-FRON `73e2b210-a794-4c82-8903-8b9d55842eab`,
  ALTSCHULER-JANE `00aab70e-dcce-4278-83ea-7c6107ce6b73` (Company set to "Janet Altschuler", Site "Main").
- **Datto EDR** instance azcomp4587 (infocyte.com). Both Altschuler machines online, agent v3.17.1.5552.
- RMM machine placements 2026-07-07: Reliant = BookKeeper, RWD-CHRIS, WillcoxDOTAdmin; Marty Ryan
  = DESKTOP-OC2PH4I; Janet Altschuler = Altschuler-Front, Altschuler-Janet.

## Commands & Outputs

```bash
# autoenroll plan (push Staging installer to online-not-in-RMM, wait, reassign)
bash .claude/scripts/gps-rmm-autoenroll.sh          # 2026-07-07 07:18: pushed 2, reassigned 1
python projects/gps-rmm-audit/tools/rebuild-and-push.py --dry   # ONLINE now:2 active<=14d:10 stale:4 dead:58
python projects/gps-rmm-audit/tools/reassign-staging.py         # DESKTOP-OC2PH4I -> Marty Ryan
# onboard (client + site + vault key): POST /api/clients {name}; POST /api/sites {client_id,name:Main}
# Datto EDR install one-liner: edr.py deploy-cmd --regkey altschul01
# Discord message edit (PATCH): /channels/{ch}/messages/{id} {content}
```

Endpoint backup scan result (held clients, 2026-07-06/07): Reliant BookKeeper/RWD-CHRIS =
none; Prairie Mel-PC/TPS-Tina = none, TPS-SERVER = WSB last 3/7/2018 (dead), TPS-SVR unscannable;
Envoys DESKTOP-BCLOLSI/-I51630E = none (OSGOOD-PAUL offline); Janet FRON/JANE = none (Dropbox stopped).

## Pending / Incomplete Tasks

- **Mike/Winter reply** to the backup question (4 clients) + the Datto Workplace super-admin API
  request — both still unanswered as of 2026-07-07.
- **10 machines "active <=14d"** not currently online — will only enroll on a manual autoenroll
  sweep (`gps-rmm-autoenroll.sh`); the scheduled task is left DISABLED per Howard.
- Prairie `TPS-SVR` failed to scan (offline/timeout) — re-check backup on it when online.
- Envoys `OSGOOD-PAUL` offline — scan when it surfaces.
- Backup billing decisions for Mike/Winter still open (7 of 16 billed clients not backing up;
  revenue leaks; $0 backup lines) — see backup-map.md.

## Reference Information

- Backup map: `projects/gps-rmm-audit/backup-map.md`
- Client wikis: `wiki/clients/janet-altschuler.md`, `marty-ryan.md`, `reliant-well-drilling.md`
- Autoenroll tooling: `.claude/scripts/gps-rmm-autoenroll.sh`,
  `projects/gps-rmm-audit/tools/{rebuild-and-push,reassign-staging}.py`
- Memory: `reference_msp360_backup_monitoring`, `feedback_backup_targets_never_guessed`
- Discord msg IDs (edited in place): winter `1523814142128033922`, mike `1523814169705578550`
