# Cascades of Tucson — Phase 2.6 Session Log

**Date:** 2026-05-20
**Duration:** Multi-session (continued from context-limit session)

## User
- **User:** Howard Enos (howard)
- **Machine:** HOWARD-HOME
- **Role:** tech

## Summary

Completed Phase 2.6: print server build-out, GPO creation, and AD account cleanup. All 13 printers are now installed and shared on CS-SERVER. Four CSC GPOs are created and staged (unlinked until Phase 3 domain join cutover).

---

## Work Completed

### 1. Front Desk Epson ET-5800 — Printer Installation

**Problem:** EPWizard.exe fails on Windows Server 2019 — `wlanapi.dll` stub is present but the WLAN stack is absent.

**Fix:**
1. Ran EPWizard.exe on CS-SERVER, let it extract drivers to `AppData\Local\Temp\ET-5800\` before dismissing the error
2. Copied extracted INFs to `C:\Users\sysadmin\Documents\ComputerGuru Connect v2\Files\epsonetdrivers\`
3. `pnputil /add-driver <INF> /install` staged the driver in Windows Driver Store
4. `Add-PrinterDriver -Name "EPSON ET-5800 Series"` registered it with the Print Spooler
5. `Add-Printer` / `Add-PrinterPort` created the printer at 192.168.2.147, shared as `FrontDesk`

**Driver name (from INF):** `EPSON ET-5800 Series`
**INF location:** E_WF1XCE.INF (UTF-16 LE with BOM FF FE — `Select-String` fails on it; must use `[System.IO.File]::ReadAllBytes()`)

### 2. Memory Care Director + MedTech Printers

Added to CS-SERVER (via GuruRMM remote PowerShell):

| Printer | Share | IP | Driver |
|---------|-------|----|--------|
| Memory Care Director - Canon MF751CDW | MCDirector | 192.168.3.52 | Canon Generic Plus PCL6 |
| Memory Care MedTech - Brother | MCMedTech | 192.168.2.53 | Brother Generic Jpeg Type2 Class Driver |

Both reachable and shared. Total shared printers on CS-SERVER: **13**.

### 3. Script: phase2-print-server.ps1

Updated `clients/cascades-tucson/docs/migration/scripts/phase2-print-server.ps1`:
- Status header updated to **COMPLETE 2026-05-20** (all 13 printers)
- Added FrontDesk, MCDirector, MCMedTech to `$printers` array
- Documented Epson ET-5800 workaround in header comments
- KM driver archived to `D:\Shares\Server\Drivers\KM_Universal_PCL6\`

### 4. AD Account Cleanup (5 accounts)

Executed via GuruRMM remote PowerShell on CS-SERVER. All `Disable-ADAccount` calls succeeded.

| Account | OU | Reason |
|---------|----|--------|
| britney.thompson | Care-Assisted Living | Departed 2026-04-22 |
| Richard.Adams | Transportation | Drivers no longer get IT access |
| Julian.Crim | Transportation | Drivers no longer get IT access |
| Christopher.Holick | Transportation | Drivers no longer get IT access |
| Shontiel.Nunn | Resident Services | Old-format account — s.nunn (Caregivers) is correct |

**Note:** britney.thompson's M365 license is still active and not yet harvested. Action needed before next billing cycle.

### 5. CSC - Security Baseline GPO

Created via `New-GPO` + `Set-GPRegistryValue` + direct SYSVOL writes.

**Screen saver (HKCU via GPP):**
- ScreenSaveTimeOut = 900 (15 min)
- ScreenSaveActive = 1
- ScreenSaverIsSecure = 1
- SCRNSAVE.EXE = scrnsave.scr

**GptTmpl.inf (Machine security — written as Unicode UTF-16):**
```
MinimumPasswordLength = 12
PasswordComplexity = 1
PasswordHistorySize = 24
MaximumPasswordAge = 90
MinimumPasswordAge = 1
LockoutBadCount = 5
ResetLockoutCount = 30
LockoutDuration = 30
```

**GPT.INI:** machine version bumped, security extension GUID `{827D319E-6EAC-11D2-A4EA-00C04F79F83A}{803E14A0-B4FB-11D0-A0D0-00A0C90F574B}` added.

**Status: UNLINKED.** Link to domain root at Phase 3 cutover.

### 6. CSC - Windows Update GPO

Created via `New-GPO` + `Set-GPRegistryValue` (HKLM AU key).

| Setting | Value |
|---------|-------|
| NoAutoUpdate | 0 |
| AUOptions | 4 (auto download + install) |
| ScheduledInstallDay | 1 (Sunday) |
| ScheduledInstallTime | 3 (3:00 AM) |
| NoAutoRebootWithLoggedOnUsers | 1 |
| EnableFeaturedSoftware | 0 |

**Status: UNLINKED.** Link to domain root at Phase 3 cutover.

### 7. CSC - Printer Deployment GPO

Created `Printers.xml` in SYSVOL at `{GPO-GUID}\User\Preferences\Printers\`.

13 printers with OU-based item-level targeting (`FilterOrgUnit`):

| Share | ILT |
|-------|-----|
| CopyRoom | No filter — all staff |
| BusinessOffice | OU=Administrative |
| Accounting | OU=Administrative |
| AdminOffice | OU=Administrative OR OU=Resident Services |
| ExecDirector | OU=Administrative |
| SalesMarketing | OU=Marketing |
| Kitchen | OU=Culinary |
| CulinaryChef | OU=Culinary |
| FrontDesk | OU=Resident Services |
| HealthServices | OU=Care-Assisted Living OR OU=Care-Memorycare |
| LifeEnrichment | OU=Life Enrichment |
| MCDirector | OU=Care-Memorycare |
| MCMedTech | OU=Caregivers OR OU=Care-Memorycare |

**CSE GUID:** `{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}{D02B1F72-3407-48AE-BA88-E8213C6761F1}`

**Status: UNLINKED.** Link to OU=Workstations at Phase 3 cutover.

### 8. CSC - Drive Mappings GPO

Created `Drives.xml` in SYSVOL at `{GPO-GUID}\User\Preferences\Drives\`.

| Drive | Share | ILT |
|-------|-------|-----|
| M: | \\CS-SERVER\Management | FilterGroup: CASCADES\SG-Mgmt-RW |
| S: | \\CS-SERVER\Sales | FilterGroup: CASCADES\SG-Sales-RW |
| T: | \\CS-SERVER\Activities | FilterGroup: CASCADES\SG-Activities-RW |
| K: | \\CS-SERVER\Culinary | FilterOrgUnit: OU=Culinary,OU=Departments |
| R: | \\CS-SERVER\Receptionist | FilterOrgUnit: OU=Resident Services,OU=Departments |

**CSE GUID:** `{5794DAFD-BE60-433f-88A2-1A31939AC01F}{D02B1F72-3407-48AE-BA88-E8213C6761F1}`

**Status: UNLINKED.** Link to OU=Departments at Phase 3 cutover.

---

## Final CSC GPO Inventory (8 GPOs, all AllSettingsEnabled)

```
CSC - Always Wait For Network    (pre-existing)
CSC - Drive Mappings             UNLINKED — link to OU=Departments at Phase 3
CSC - Folder Redirection         UNLINKED — blocked on Phase 3 domain joins
CSC - Folder Redirection (LE)    LIVE — linked to OU=Life Enrichment
CSC - Life Enrichment Printers   LIVE — linked to OU=Life Enrichment
CSC - Printer Deployment         UNLINKED — link to OU=Workstations at Phase 3
CSC - Security Baseline          UNLINKED — link to domain root at Phase 3
CSC - Windows Update             UNLINKED — link to domain root at Phase 3
```

---

## Docs Updated

- `clients/cascades-tucson/docs/migration/scripts/phase2-print-server.ps1` — Complete status + all 13 printers
- `clients/cascades-tucson/docs/servers/active-directory.md` — Accounts disabled, GPO table updated, pending issues updated, printer shares table updated

---

## Phase 3 Prerequisites (next major work)

Domain join order (per `migration/phase3-domain-join.md`):
1. DESKTOP-KQSL232 (10.0.20.227)
2. CHEF-PC (10.0.20.232)
3. SALES4-PC (10.0.20.203)
4. MDIRECTOR-PC (192.168.3.20) — **needs Windows 10 Pro upgrade first** (currently Home)

After first successful join — link GPOs per phase3-domain-join.md step 5c.

---

## Open Items

| Item | Priority | Notes |
|------|----------|-------|
| ~~britney.thompson M365 offboarding~~ | ~~Done~~ | Sign-in blocked, license removed, litigation hold applied (sysadmin@ via admin center 2026-05-20) |

---

## Update: 14:53 PT — britney.thompson M365 offboarding + next session scope

### britney.thompson M365 Offboarding (Complete)

Attempted Graph API via device code flow. The well-known PowerShell client ID (`1950a258-227b-4e31-a9cf-717495945fc2`) is blocked in the tenant (AADSTS65002 — preauthorization required). No Graph-capable modules installed on HOWARD-HOME (Microsoft.Graph, MSOnline, AzureAD all absent). No Azure CLI.

Howard logged into admin.microsoft.com as `sysadmin@cascadestucson.com` and completed offboarding manually:
- Sign-in blocked in M365
- License removed (returned to pool)
- Litigation hold applied on mailbox

AD account was disabled earlier in this session (see main log above). Offboarding is fully complete.

### Next Session — Accounting Office Folder Redirection

Planned work for next session:
- Machines in the accounting office (Room 103 area): ACCT2-PC (already domain-joined), plus any others in that area
- Folder redirection for accounting staff: Documents, Downloads, Desktop → `\\CS-SERVER\homes\%USERNAME%\`
- **Key difference from LE GPO:** GrantExclusive=true — removes inherited permissions, grants the user exclusive access (plus Domain Admins). No other domain users can browse sibling folders.
- Linked to OU=Administrative (or a sub-scope if only accounting staff targeted)
- Sales department folder redirection possibly follows same session if accounting goes cleanly
- Pre-check required: OneDrive KFM status on each accounting PC before applying GPO (see 2026-04-17 session log for procedure)
| Phase 3 domain joins | High | Block on MDIRECTOR-PC needing Win10 Pro upgrade |
| krbtgt password rotation | Medium | 569+ days old — deferred |
| Remove Meredith.Kuhn + John.Trozzi from Domain Admins | Low | Deferred |
| SG-Mgmt-RW + SG-Sales-RW membership | Medium | Populate before Phase 3 GPO linking |
| CSC - Folder Redirection (full) | Medium | Blocked on Phase 3 — check OneDrive KFM on each PC first |
