azcomputerguru/claudetools
1
0
Fork 0
Code Issues 58 Pull Requests Actions Packages Projects Releases Wiki Activity

sync: auto-sync from HOWARD-HOME at 2026-07-20 20:42:54

Browse Source 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-20 20:42:54
This commit is contained in:
Howard Enos
2026-07-20 20:43:24 -07:00
parent c945ad2e06
commit 03e17829c6
1 changed files with 86 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

86
clients/cascades-tucson/session-logs/2026-07/2026-07-20-howard-domain-join-batch-and-offboard.md Normal file
View File

@@ -0,0 +1,86 @@
# 2026-07-20 — Cascades Domain Join Batch + Juan Andrade Offboard Verification
## User
- **User:** Howard Enos (howard)
- **Machine:** Howard-Home
- **Role:** tech
## Session Summary
Closed out the Juan Andrade offboard (tracker issue #28) by verifying all three offboard steps via Graph API against the correct Cascades tenant (`cascadestucson.com`, tenant ID `207fa277-e9d8-4eb7-ada1-1064d2221498`). Account disabled, all licenses reclaimed, all group memberships removed. Issue closed with verification comment.
Began working through the domain-join machine list from issue #24 (REMAINING-WORK-PLAN.md WS1+2). Howard joined DESKTOP-TRCIEJA (Lupe Sanchez, room 426), ANN-PC (Christina), and NurseAssist (Veronica Feller) to the domain onsite. Also added printer ECOSYS MA2100CWfx to CSCNet in room 426. DESKTOP-TRCIEJA was previously marked EOL/replace in the work plan; Howard joined it instead.
For NurseAssist (Veronica Feller): identified her AD account (`Veronica.Feller`, enabled) and M365 account (`veronica.feller@cascadestucson.com`). Reset her AD password to `1369Cascades!!` on CS-SERVER via RMM. Set her M365 password to match. OneDrive was blocking local login on NurseAssist, so we unlinked OneDrive remotely via RMM (removed Business1 + Personal account keys and auto-start from registry). Howard is downloading her OneDrive data from the cloud to the machine before proceeding with ProfWiz.
The hive-cleanup-shellfolders.ps1 script was staged on NurseAssist at `C:\ProfileBackups\` but could not run because Veronica's profile was still loaded (user logged in). The established Cascades runbook order is: hive-cleanup (before ProfWiz) -> ProfWiz -> prep-profile-for-redirection.ps1 (after ProfWiz, before first domain login). This must wait until Veronica is logged off.
Veronica is not in SG-Caregivers but is subject to the MFA-for-all CA policy. Generated a TAP (`WF3P9%*+`, 60 min, multi-use) to bypass MFA for the OneDrive login. Howard raised the question of location-based MFA bypass (on-network = no MFA) — Cascades already has Named Locations configured (72.211.21.217/32 + 184.191.143.62/32) and this can be added as a CA condition on the MFA-for-all policy. Deferred for now.
## Key Decisions
- DESKTOP-TRCIEJA was previously marked EOL/replace; Howard domain-joined it instead (plan change).
- Veronica Feller's OneDrive unlinked remotely via RMM registry edits rather than fighting the local login/MFA loop.
- Password set to `1369Cascades!!` for both AD and M365 (manual sync since Entra Connect is still in staging).
- Location-based MFA bypass (on-network skip MFA) identified as a future CA policy change — deferred to a separate session.
- Confirmed the correct Cascades tenant domain is `cascadestucson.com` (not `cascadesoftucson.onmicrosoft.com`) — the latter is a different tenant that has no app consent.
## Problems Encountered
- Initial M365 password reset targeted the wrong user ID (`508d7b35` = Juan Andrade instead of `a2188357` = Veronica Feller). Root cause: reused the user ID from the earlier Juan Andrade offboard verification without re-resolving. Fixed by looking up Veronica's actual Graph user ID and re-issuing the PATCH.
- The remediation-tool `get-token.sh` cert-based auth broke mid-session (exit 3, `cert_private_key_pem_b64 did not decode to a valid PEM`). Worked around by using client_secret auth directly via curl against the correct vault path (`D:/vault/msp-tools/computerguru-security-investigator.sops.yaml`). The vault files for the app suite are in `msp-tools/`, not `services/`.
- AD PowerShell query (`Get-ADUser`) on CS-SERVER timed out at 30s. Switched to `dsquery`/`dsget` which completed in seconds.
- hive-cleanup script too large for RMM inline dispatch (12KB encoded > 6KB limit). Staged via base64 file write instead.
- hive-cleanup could not run because Veronica's NTUSER.DAT was locked (user still logged in).
## Configuration Changes
- NurseAssist registry: removed `HKCU\Software\Microsoft\OneDrive\Accounts\Business1`, `Personal`, and OneDrive Run key (via RMM, SID S-1-5-21-1777292141-3886650548-1988923861-1002)
- Staged `hive-cleanup-shellfolders.ps1` at `C:\ProfileBackups\hive-cleanup-shellfolders.ps1` on NurseAssist
- AD password reset for Veronica.Feller on CS-SERVER
- M365 password reset for veronica.feller@cascadestucson.com
- TAP created for Veronica Feller (60 min, multi-use)
## Credentials & Secrets
- **Veronica Feller AD password:** `1369Cascades!!` (set via Set-ADAccountPassword on CS-SERVER)
- **Veronica Feller M365 password:** `1369Cascades!!` (set via Graph PATCH, user ID `a2188357-3519-4399-b5ad-62b9f1ae924d`)
- **Veronica Feller TAP:** `WF3P9%*+` (created 2026-07-20T18:45:38Z, 60 min lifetime, multi-use) — likely expired by session end
## Infrastructure & Servers
- Cascades tenant: `cascadestucson.com`, tenant ID `207fa277-e9d8-4eb7-ada1-1064d2221498`
- CS-SERVER agent ID: resolved live each time (do not cache)
- NurseAssist agent ID: `fc88f14b-06eb-47ac-b9e6-971c44d700ba` (verify before reuse — UUIDs change on re-enroll)
- Veronica Feller AD SID: `S-1-5-21-1777292141-3886650548-1988923861-1002` (local profile on NurseAssist)
- Veronica Feller Graph user ID: `a2188357-3519-4399-b5ad-62b9f1ae924d`
- Juan Andrade Graph user ID: `508d7b35-f3ed-467e-880e-7b0960260299` (disabled, offboarded)
- Printer added: ECOSYS MA2100CWfx on CSCNet, room 426
## Commands & Outputs
- `dsquery user -name "Veronica*" | dsget user -samid -display -disabled` on CS-SERVER -> confirmed `Veronica.Feller`, enabled
- `Get-ChildItem C:\Users -Directory` on NurseAssist -> `Localadmin`, `Public`, `Veronica`
- Graph `GET /users` filter for Veronica -> `veronica.feller@cascadestucson.com`, `accountEnabled: true`
- Graph `GET /users/a2188357.../memberOf` -> only `SG-SSPR-Eligible` (not in SG-Caregivers, subject to MFA-for-all)
- Graph `POST .../temporaryAccessPassMethods` -> TAP `WF3P9%*+` created successfully
## Pending / Incomplete Tasks
- **NurseAssist (Veronica Feller):** OneDrive data downloading from cloud. When done: log Veronica off, run `hive-cleanup-shellfolders.ps1 -ProfilePath 'C:\Users\Veronica'` (already staged at `C:\ProfileBackups\`), then ProfWiz to `cascades\Veronica.Feller`, then `prep-profile-for-redirection.ps1` on the migrated profile, then first domain login.
- **Remaining domain-join machines (~7):** DESKTOP-LPOPV30 (Karen, READY), MAINTENANCE-PC (Bruce, READY), ASSISTMAN-PC (Meredith, reboot), MDIRECTOR-PC (Shelby, reboot), MEMRECEPT-PC (memfrtdesk, reboot), LAPTOP-8P7HDSEI (KFM unlink), CHEF-PC (reinstall first).
- **DESKTOP-TRCIEJA + ANN-PC:** joined but may need reboot + post-join verify + prep-profile scripts.
- **Location-based MFA bypass:** CA policy change to skip MFA on-network using existing Named Locations. Deferred.
- **Entra Connect:** still in staging. Moving to production would sync AD/M365 passwords automatically.
- **Tracker issue #24:** open, updated with today's progress (3 machines joined).
- **Vault:** store Veronica.Feller password in vault (not done this session).
## Reference Information
- Tracker issue #28 (Juan Andrade offboard): CLOSED 2026-07-20
- Tracker issue #24 (domain-join remaining machines): OPEN, 2 comments added today
- REMAINING-WORK-PLAN.md: `clients/cascades-tucson/docs/REMAINING-WORK-PLAN.md`
- Migration scripts: `clients/cascades-tucson/docs/migration/scripts/phase3-*.ps1`
- Hive cleanup: `clients/cascades-tucson/scripts/hive-cleanup-shellfolders.ps1`
- Prep profile: `clients/cascades-tucson/scripts/prep-profile-for-redirection.ps1`
- Cascades Named Locations (trusted IPs): 72.211.21.217/32, 184.191.143.62/32