From 03e17829c6326372ce526df615e87b41de418ad8 Mon Sep 17 00:00:00 2001 From: Howard Enos Date: Mon, 20 Jul 2026 20:43:24 -0700 Subject: [PATCH] sync: auto-sync from HOWARD-HOME at 2026-07-20 20:42:54 Author: Howard Enos Machine: HOWARD-HOME Timestamp: 2026-07-20 20:42:54 --- ...0-howard-domain-join-batch-and-offboard.md | 86 +++++++++++++++++++ 1 file changed, 86 insertions(+) create mode 100644 clients/cascades-tucson/session-logs/2026-07/2026-07-20-howard-domain-join-batch-and-offboard.md diff --git a/clients/cascades-tucson/session-logs/2026-07/2026-07-20-howard-domain-join-batch-and-offboard.md b/clients/cascades-tucson/session-logs/2026-07/2026-07-20-howard-domain-join-batch-and-offboard.md new file mode 100644 index 00000000..3996432f --- /dev/null +++ b/clients/cascades-tucson/session-logs/2026-07/2026-07-20-howard-domain-join-batch-and-offboard.md @@ -0,0 +1,86 @@ +# 2026-07-20 — Cascades Domain Join Batch + Juan Andrade Offboard Verification + +## User +- **User:** Howard Enos (howard) +- **Machine:** Howard-Home +- **Role:** tech + +## Session Summary + +Closed out the Juan Andrade offboard (tracker issue #28) by verifying all three offboard steps via Graph API against the correct Cascades tenant (`cascadestucson.com`, tenant ID `207fa277-e9d8-4eb7-ada1-1064d2221498`). Account disabled, all licenses reclaimed, all group memberships removed. Issue closed with verification comment. + +Began working through the domain-join machine list from issue #24 (REMAINING-WORK-PLAN.md WS1+2). Howard joined DESKTOP-TRCIEJA (Lupe Sanchez, room 426), ANN-PC (Christina), and NurseAssist (Veronica Feller) to the domain onsite. Also added printer ECOSYS MA2100CWfx to CSCNet in room 426. DESKTOP-TRCIEJA was previously marked EOL/replace in the work plan; Howard joined it instead. + +For NurseAssist (Veronica Feller): identified her AD account (`Veronica.Feller`, enabled) and M365 account (`veronica.feller@cascadestucson.com`). Reset her AD password to `1369Cascades!!` on CS-SERVER via RMM. Set her M365 password to match. OneDrive was blocking local login on NurseAssist, so we unlinked OneDrive remotely via RMM (removed Business1 + Personal account keys and auto-start from registry). Howard is downloading her OneDrive data from the cloud to the machine before proceeding with ProfWiz. + +The hive-cleanup-shellfolders.ps1 script was staged on NurseAssist at `C:\ProfileBackups\` but could not run because Veronica's profile was still loaded (user logged in). The established Cascades runbook order is: hive-cleanup (before ProfWiz) -> ProfWiz -> prep-profile-for-redirection.ps1 (after ProfWiz, before first domain login). This must wait until Veronica is logged off. + +Veronica is not in SG-Caregivers but is subject to the MFA-for-all CA policy. Generated a TAP (`WF3P9%*+`, 60 min, multi-use) to bypass MFA for the OneDrive login. Howard raised the question of location-based MFA bypass (on-network = no MFA) — Cascades already has Named Locations configured (72.211.21.217/32 + 184.191.143.62/32) and this can be added as a CA condition on the MFA-for-all policy. Deferred for now. + +## Key Decisions + +- DESKTOP-TRCIEJA was previously marked EOL/replace; Howard domain-joined it instead (plan change). +- Veronica Feller's OneDrive unlinked remotely via RMM registry edits rather than fighting the local login/MFA loop. +- Password set to `1369Cascades!!` for both AD and M365 (manual sync since Entra Connect is still in staging). +- Location-based MFA bypass (on-network skip MFA) identified as a future CA policy change — deferred to a separate session. +- Confirmed the correct Cascades tenant domain is `cascadestucson.com` (not `cascadesoftucson.onmicrosoft.com`) — the latter is a different tenant that has no app consent. + +## Problems Encountered + +- Initial M365 password reset targeted the wrong user ID (`508d7b35` = Juan Andrade instead of `a2188357` = Veronica Feller). Root cause: reused the user ID from the earlier Juan Andrade offboard verification without re-resolving. Fixed by looking up Veronica's actual Graph user ID and re-issuing the PATCH. +- The remediation-tool `get-token.sh` cert-based auth broke mid-session (exit 3, `cert_private_key_pem_b64 did not decode to a valid PEM`). Worked around by using client_secret auth directly via curl against the correct vault path (`D:/vault/msp-tools/computerguru-security-investigator.sops.yaml`). The vault files for the app suite are in `msp-tools/`, not `services/`. +- AD PowerShell query (`Get-ADUser`) on CS-SERVER timed out at 30s. Switched to `dsquery`/`dsget` which completed in seconds. +- hive-cleanup script too large for RMM inline dispatch (12KB encoded > 6KB limit). Staged via base64 file write instead. +- hive-cleanup could not run because Veronica's NTUSER.DAT was locked (user still logged in). + +## Configuration Changes + +- NurseAssist registry: removed `HKCU\Software\Microsoft\OneDrive\Accounts\Business1`, `Personal`, and OneDrive Run key (via RMM, SID S-1-5-21-1777292141-3886650548-1988923861-1002) +- Staged `hive-cleanup-shellfolders.ps1` at `C:\ProfileBackups\hive-cleanup-shellfolders.ps1` on NurseAssist +- AD password reset for Veronica.Feller on CS-SERVER +- M365 password reset for veronica.feller@cascadestucson.com +- TAP created for Veronica Feller (60 min, multi-use) + +## Credentials & Secrets + +- **Veronica Feller AD password:** `1369Cascades!!` (set via Set-ADAccountPassword on CS-SERVER) +- **Veronica Feller M365 password:** `1369Cascades!!` (set via Graph PATCH, user ID `a2188357-3519-4399-b5ad-62b9f1ae924d`) +- **Veronica Feller TAP:** `WF3P9%*+` (created 2026-07-20T18:45:38Z, 60 min lifetime, multi-use) — likely expired by session end + +## Infrastructure & Servers + +- Cascades tenant: `cascadestucson.com`, tenant ID `207fa277-e9d8-4eb7-ada1-1064d2221498` +- CS-SERVER agent ID: resolved live each time (do not cache) +- NurseAssist agent ID: `fc88f14b-06eb-47ac-b9e6-971c44d700ba` (verify before reuse — UUIDs change on re-enroll) +- Veronica Feller AD SID: `S-1-5-21-1777292141-3886650548-1988923861-1002` (local profile on NurseAssist) +- Veronica Feller Graph user ID: `a2188357-3519-4399-b5ad-62b9f1ae924d` +- Juan Andrade Graph user ID: `508d7b35-f3ed-467e-880e-7b0960260299` (disabled, offboarded) +- Printer added: ECOSYS MA2100CWfx on CSCNet, room 426 + +## Commands & Outputs + +- `dsquery user -name "Veronica*" | dsget user -samid -display -disabled` on CS-SERVER -> confirmed `Veronica.Feller`, enabled +- `Get-ChildItem C:\Users -Directory` on NurseAssist -> `Localadmin`, `Public`, `Veronica` +- Graph `GET /users` filter for Veronica -> `veronica.feller@cascadestucson.com`, `accountEnabled: true` +- Graph `GET /users/a2188357.../memberOf` -> only `SG-SSPR-Eligible` (not in SG-Caregivers, subject to MFA-for-all) +- Graph `POST .../temporaryAccessPassMethods` -> TAP `WF3P9%*+` created successfully + +## Pending / Incomplete Tasks + +- **NurseAssist (Veronica Feller):** OneDrive data downloading from cloud. When done: log Veronica off, run `hive-cleanup-shellfolders.ps1 -ProfilePath 'C:\Users\Veronica'` (already staged at `C:\ProfileBackups\`), then ProfWiz to `cascades\Veronica.Feller`, then `prep-profile-for-redirection.ps1` on the migrated profile, then first domain login. +- **Remaining domain-join machines (~7):** DESKTOP-LPOPV30 (Karen, READY), MAINTENANCE-PC (Bruce, READY), ASSISTMAN-PC (Meredith, reboot), MDIRECTOR-PC (Shelby, reboot), MEMRECEPT-PC (memfrtdesk, reboot), LAPTOP-8P7HDSEI (KFM unlink), CHEF-PC (reinstall first). +- **DESKTOP-TRCIEJA + ANN-PC:** joined but may need reboot + post-join verify + prep-profile scripts. +- **Location-based MFA bypass:** CA policy change to skip MFA on-network using existing Named Locations. Deferred. +- **Entra Connect:** still in staging. Moving to production would sync AD/M365 passwords automatically. +- **Tracker issue #24:** open, updated with today's progress (3 machines joined). +- **Vault:** store Veronica.Feller password in vault (not done this session). + +## Reference Information + +- Tracker issue #28 (Juan Andrade offboard): CLOSED 2026-07-20 +- Tracker issue #24 (domain-join remaining machines): OPEN, 2 comments added today +- REMAINING-WORK-PLAN.md: `clients/cascades-tucson/docs/REMAINING-WORK-PLAN.md` +- Migration scripts: `clients/cascades-tucson/docs/migration/scripts/phase3-*.ps1` +- Hive cleanup: `clients/cascades-tucson/scripts/hive-cleanup-shellfolders.ps1` +- Prep profile: `clients/cascades-tucson/scripts/prep-profile-for-redirection.ps1` +- Cascades Named Locations (trusted IPs): 72.211.21.217/32, 184.191.143.62/32