azcomputerguru/claudetools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sync: auto-sync from HOWARD-HOME at 2026-07-15 12:21:30

Browse Source 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-15 12:21:30
This commit is contained in:
Howard Enos
2026-07-15 12:22:01 -07:00
parent 5aeabbcfb6
commit 0e244a610f
10 changed files with 197 additions and 65 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
.dc16-mkuser.ps1 Normal file
View File

@@ -0,0 +1,9 @@
$ErrorActionPreference = 'Stop'
Import-Module ActiveDirectory
$pw = ConvertTo-SecureString 'Lcyaz0KF5L8IoRh7Pf4K.7QQwJq' -AsPlainText -Force
New-ADUser -Name 'svc-msp360' -SamAccountName 'svc-msp360' -UserPrincipalName 'svc-msp360@acg.local' -DisplayName 'MSP360 Backup Service' -Description 'Service account for MSP360/Online Backup Exchange backup on NEPTUNE. Created 2026-07-15 by Howard via ClaudeTools.' -AccountPassword $pw -Enabled $true -PasswordNeverExpires $true -CannotChangePassword $true
Add-ADGroupMember -Identity 'Organization Management' -Members 'svc-msp360'
Start-Sleep -Seconds 2
$u = Get-ADUser 'svc-msp360' -Properties PasswordNeverExpires, MemberOf
Write-Output ('created: ' + $u.SamAccountName + ' enabled=' + $u.Enabled + ' pwdNeverExpires=' + $u.PasswordNeverExpires)
$u.MemberOf | ForEach-Object { Write-Output ('member: ' + $_) }

18
.neptune-iis-probe.ps1 Normal file
View File

@@ -0,0 +1,18 @@
$ErrorActionPreference = 'Continue'
Import-Module WebAdministration
Write-Output '=== App pools (Exchange PowerShell) ==='
Get-ChildItem IIS:\AppPools | Where-Object Name -match 'PowerShell|MSExchange' | Select-Object Name, State | Format-Table -AutoSize
Write-Output '=== PowerShell vdirs ==='
Get-WebApplication -Name PowerShell | Format-List Path, ApplicationPool, PhysicalPath, ItemXPath
Write-Output '=== Default Web Site + Back End bindings ==='
Get-Website | Select-Object Name, State, @{n='Bind';e={($_.bindings.Collection | ForEach-Object bindingInformation) -join ' ; '}} | Format-Table -AutoSize
Write-Output '=== Auth on Default Web Site/PowerShell ==='
foreach ($a in 'anonymousAuthentication','windowsAuthentication','basicAuthentication') {
$v = Get-WebConfigurationProperty -Filter "system.webServer/security/authentication/$a" -PSPath 'IIS:\Sites\Default Web Site\PowerShell' -Name enabled -ErrorAction SilentlyContinue
Write-Output "DWS/PowerShell $a = $($v.Value)"
}
Write-Output '=== SSL flags on DWS/PowerShell ==='
(Get-WebConfigurationProperty -Filter 'system.webServer/security/access' -PSPath 'IIS:\Sites\Default Web Site\PowerShell' -Name sslFlags -ErrorAction SilentlyContinue)
Write-Output '=== recent HTTP 4xx/5xx to /powershell (IIS log tail) ==='
$log = Get-ChildItem 'C:\inetpub\logs\LogFiles\W3SVC1' -Filter *.log -ErrorAction SilentlyContinue | Sort-Object LastWriteTime -Descending | Select-Object -First 1
if ($log) { Get-Content $log.FullName -Tail 400 | Select-String -SimpleMatch '/powershell' | Select-Object -Last 10 }

22
.neptune-svc.ps1 Normal file
View File

@@ -0,0 +1,22 @@
$ErrorActionPreference = 'Stop'
Add-LocalGroupMember -Group 'Administrators' -Member 'ACG\svc-msp360' -ErrorAction SilentlyContinue
Write-Output ('local admin: ' + [bool](Get-LocalGroupMember -Group 'Administrators' -Member 'ACG\svc-msp360' -ErrorAction SilentlyContinue))
$sid = (New-Object System.Security.Principal.NTAccount('ACG','svc-msp360')).Translate([System.Security.Principal.SecurityIdentifier]).Value
$tmp = 'C:\Windows\Temp\se.inf'
secedit /export /cfg $tmp /areas USER_RIGHTS | Out-Null
$c = Get-Content $tmp
$line = $c | Where-Object { $_ -match '^SeServiceLogonRight' }
if ($line -notmatch [regex]::Escape($sid)) {
$new = $c -replace '^(SeServiceLogonRight *=.*)$', ('$1,*' + $sid)
if (-not $line) { $new += 'SeServiceLogonRight = *' + $sid }
$new | Set-Content $tmp -Encoding Unicode
secedit /configure /db C:\Windows\Temp\se.sdb /cfg $tmp /areas USER_RIGHTS | Out-Null
Write-Output 'SeServiceLogonRight granted'
} else { Write-Output 'SeServiceLogonRight already present' }
Remove-Item $tmp, C:\Windows\Temp\se.sdb -ErrorAction SilentlyContinue
$svc = Get-WmiObject Win32_Service -Filter "Name='Online Backup Service'"
$r = $svc.Change($null,$null,$null,$null,$null,$null,'ACG\svc-msp360','Lcyaz0KF5L8IoRh7Pf4K.7QQwJq')
Write-Output ('service change rc=' + $r.ReturnValue)
Restart-Service 'Online Backup Service' -Force
Start-Sleep -Seconds 5
Get-WmiObject Win32_Service -Filter "Name='Online Backup Service'" | Select-Object Name, StartName, State | Format-Table -AutoSize

19
.neptune-winrm-probe.ps1 Normal file
View File

@@ -0,0 +1,19 @@
$ErrorActionPreference = 'Continue'
Write-Output '=== WinRM service ==='
Get-Service WinRM | Select-Object Name, Status, StartType | Format-Table -AutoSize
Write-Output '=== Test-WSMan localhost ==='
try { Test-WSMan -ComputerName neptune -ErrorAction Stop | Out-String } catch { Write-Output "FAIL: $($_.Exception.Message)" }
Write-Output '=== WinRM listeners ==='
winrm enumerate winrm/config/listener 2>&1
Write-Output '=== Exchange PowerShell vdir session test ==='
try {
$s = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri http://neptune/PowerShell/ -Authentication Kerberos -ErrorAction Stop
Write-Output "SESSION OK: $($s.State)"
Remove-PSSession $s
} catch { Write-Output "FAIL: $($_.Exception.Message)" }
Write-Output '=== plain PSSession test ==='
try {
$s2 = New-PSSession -ComputerName neptune -ErrorAction Stop
Write-Output "SESSION OK: $($s2.State)"
Remove-PSSession $s2
} catch { Write-Output "FAIL: $($_.Exception.Message)" }

15
clients/cascades-tucson/docs/cloud/m365.md
View File

@@ -10,19 +10,26 @@
- Former Admin: admin@NETORGFT4257522.onmicrosoft.com (Sandra Fish — previous director, removed 2026-04-14: global admin revoked, sign-in blocked, P2 license removed) - Former Admin: admin@NETORGFT4257522.onmicrosoft.com (Sandra Fish — previous director, removed 2026-04-14: global admin revoked, sign-in blocked, P2 license removed)
- DirSync / Entra Connect: **Not configured** (all accounts cloud-only) — **PLANNED: Install Entra Connect for SSO** - DirSync / Entra Connect: **Not configured** (all accounts cloud-only) — **PLANNED: Install Entra Connect for SSO**
- HIPAA BAA: **Covered by MCA** — Microsoft Customer Agreement automatically includes the HIPAA BAA for Business plan subscribers (confirmed 2026-05-14, no separate acceptance needed) - HIPAA BAA: **Covered by MCA** — Microsoft Customer Agreement automatically includes the HIPAA BAA for Business plan subscribers (confirmed 2026-05-14, no separate acceptance needed)
- MFA: **Not enabled** — Security Defaults not configured - MFA: **Enabled for all staff** via Conditional Access (live; caregivers protected by on-network restriction + 8h sign-in frequency instead of MFA prompts). Earlier "not enabled" note was pre-CA-rollout.
## Licensing ## Licensing (updated 2026-07-15 — live Graph verification by Mike/GURU-5070)
| License Type | Total | Assigned | Available | | License Type | Total | Assigned | Available |
|---|---|---|---| |---|---|---|---|
| Microsoft 365 Business Standard | 34 | 34 | 0 | | Microsoft 365 Business Premium | 45 | 41 | 4 |
| Microsoft 365 Business Standard | **SUSPENDED** | 30 consumed | — |
| Microsoft Entra ID P2 | 1 | 0 | 1 (unassigned — was Sandra Fish, available for testing) | | Microsoft Entra ID P2 | 1 | 0 | 1 (unassigned — was Sandra Fish, available for testing) |
| Microsoft Power Automate Free | 10000 | 2 | 9998 | | Microsoft Power Automate Free | 10000 | 2 | 9998 |
| Microsoft Stream Trial | 1000000 | 0 | 1000000 | | Microsoft Stream Trial | 1000000 | 0 | 1000000 |
| Exchange Online Essentials | — | 4 | — | | Exchange Online Essentials | — | 4 | — |
**Note:** Business Standard is fully allocated (34/34, 0 available). Any new hires require purchasing additional licenses. **Note (2026-07-15):** The Business Premium migration is largely done — 45 Premium owned,
41 assigned (the caregiver rollout). The old Business Standard subscription is **suspended**
with ~30 office staff still sitting on it; none of them hold Premium. Moving them is
**net-new spend** (~26 net-new paid seats ≈ $572/mo; best case ~17 net-new ≈ $374/mo after
converting 8 role/shared mailboxes — accounting@, hr@, frontdesk@, etc. — to free shared
mailboxes and removing former employee jodi.ramstack). The per-user table below predates
this and reflects the old Standard assignments.
### Planned expansion — caregiver rollout (not yet purchased) ### Planned expansion — caregiver rollout (not yet purchased)

90
clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.html
View File

@@ -89,6 +89,7 @@
table.todo td.tgt{ font-family:var(--f-mono); font-size:8px; color:var(--accent-ink); table.todo td.tgt{ font-family:var(--f-mono); font-size:8px; color:var(--accent-ink);
font-weight:500; white-space:nowrap; } font-weight:500; white-space:nowrap; }
table.todo td.cost{ font-family:var(--f-mono); font-size:8px; color:var(--ink-2); white-space:nowrap; } table.todo td.cost{ font-family:var(--f-mono); font-size:8px; color:var(--ink-2); white-space:nowrap; }
table.todo td.comp{ font-family:var(--f-mono); font-size:8px; color:var(--ink-3); min-width:46px; }
table.mach{ border-collapse:collapse; width:calc(100% - 29px); margin:3px 0 0 29px; } table.mach{ border-collapse:collapse; width:calc(100% - 29px); margin:3px 0 0 29px; }
table.mach th{ font-family:var(--f-mono); font-size:6.8px; font-weight:500; table.mach th{ font-family:var(--f-mono); font-size:6.8px; font-weight:500;
@@ -135,18 +136,29 @@
<div class="eyebrow">Technology Plan · FY 2026–2027</div> <div class="eyebrow">Technology Plan · FY 2026–2027</div>
<h1>Cascades of Tucson Technology Plan</h1> <h1>Cascades of Tucson Technology Plan</h1>
<p class="lede">A living action document: for each area of the facility's technology, what has <p class="lede">A living action document: for each area of the facility's technology, what has
been done and what is planned, with an owner, cost, and target for every action. Prepared with been done and what is planned, with an owner, cost, target, and completion date for every action. Prepared with
Az Computer Guru. Reviewed and updated at least annually.</p> Az Computer Guru. Reviewed and updated at least annually.</p>
</div> </div>
<div class="gov"> <div class="gov">
<div><span class="k">Plan owner</span><span class="v">Cascades of Tucson</span></div> <div><span class="k">Plan owner</span><span class="v">Cascades of Tucson — Administrator (Ashley Jensen)</span></div>
<div><span class="k">Prepared with</span><span class="v">Az Computer Guru</span></div> <div><span class="k">Prepared with</span><span class="v">Az Computer Guru</span></div>
<div><span class="k">Plan period</span><span class="v">FY 2026–2027</span></div> <div><span class="k">Plan period</span><span class="v">FY 2026–2027</span></div>
<div><span class="k">Adopted by / date</span><span class="v"><i>at adoption</i></span></div> <div><span class="k">Adopted by / date</span><span class="v"><i>at adoption</i></span></div>
<div><span class="k">Next annual review</span><span class="v"><i>adoption + 12 months</i></span></div> <div><span class="k">Next annual review</span><span class="v"><i>adoption + 12 months</i></span></div>
<div style="grid-column:1/-1"><span class="k">Standard reference</span><span class="v">CARF Technology and System Plan, Aging Services Standards Manual (Section 1, "CARF Plans") — <i>manual edition confirmed at adoption</i></span></div>
</div> </div>
<div class="band-label">Basis of this plan</div>
<p class="lede" style="max-width:none">This plan is based on the needs of the people Cascades serves and the people who serve them.
<b>Persons served:</b> resident safety (Helpany fall/motion sensors with no camera and no microphone), reliable building-wide
WiFi for residents and families, and protection of resident health records. <b>Personnel:</b> dependable workstations, one
sign-on to the clinical record, and secure access that follows staff roles. <b>Other stakeholders:</b> families (connectivity
and privacy), regulators (HIPAA safeguards), and vendors (managed under Business Associate Agreements).</p>
<p class="lede" style="max-width:none">Technology priorities align with Cascades' strategic goals: resident safety first (safety sensors, proven power-outage
recovery), regulatory standing (HIPAA safeguards, CARF conformance, auditable records), and efficient operations (modern
workstations, single sign-on, and a sanctioned analytics path for leadership).</p>
<div class="band-label">The eight areas</div> <div class="band-label">The eight areas</div>
<section class="area"> <section class="area">
@@ -159,11 +171,11 @@
</ul> </ul>
<span class="lbl lbl--todo">To do</span> <span class="lbl lbl--todo">To do</span>
<table class="todo"> <table class="todo">
<tr><th style="width:52%">Action</th><th>Owner</th><th>Cost</th><th>Target</th></tr> <tr><th style="width:46%">Action</th><th>Owner</th><th>Cost</th><th>Target</th><th>Completed</th></tr>
<tr><td>Install the purchased enterprise SSDs (scheduled window)</td><td class="own">ACG</td><td class="cost">purchased</td><td class="tgt">30–60 days</td></tr> <tr><td>Install the purchased enterprise SSDs (scheduled window)</td><td class="own">ACG</td><td class="cost">purchased</td><td class="tgt">30–60 days</td><td class="comp"></td></tr>
<tr><td>Replace workstations marked for replacement (list below, 5 + spare)</td><td class="own">ACG</td><td class="cost">~$700–950 ea</td><td class="tgt">60–90 days</td></tr> <tr><td>Replace workstations marked for replacement (list below, 5 + spare)</td><td class="own">ACG</td><td class="cost">~$700–950 ea</td><td class="tgt">60–90 days</td><td class="comp"></td></tr>
<tr><td>Scope and quote a server refresh project</td><td class="own">ACG + Cascades</td><td class="cost">formal quote</td><td class="tgt">90 days</td></tr> <tr><td>Scope and quote a server refresh project</td><td class="own">ACG + Cascades</td><td class="cost">formal quote</td><td class="tgt">90 days</td><td class="comp"></td></tr>
<tr><td>Bring remaining switch ports up to full gigabit speed</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">90 days</td></tr> <tr><td>Bring remaining switch ports up to full gigabit speed</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">90 days</td><td class="comp"></td></tr>
</table> </table>
<span class="lbl lbl--todo">Workstations marked for replacement</span> <span class="lbl lbl--todo">Workstations marked for replacement</span>
<table class="mach"> <table class="mach">
@@ -187,11 +199,11 @@
</ul> </ul>
<span class="lbl lbl--todo">To do</span> <span class="lbl lbl--todo">To do</span>
<table class="todo"> <table class="todo">
<tr><th style="width:52%">Action</th><th>Owner</th><th>Cost</th><th>Target</th></tr> <tr><th style="width:46%">Action</th><th>Owner</th><th>Cost</th><th>Target</th><th>Completed</th></tr>
<tr><td>Right-size Microsoft 365 licensing: move users off the legacy license; full Office licenses only where needed, lighter licenses for everyone else</td><td class="own">ACG</td><td class="cost">reduces monthly cost</td><td class="tgt">30 days</td></tr> <tr><td>Move office staff off the suspended legacy Microsoft 365 license onto supported licenses; full Office only where needed, lighter licenses elsewhere</td><td class="own">ACG</td><td class="cost">new licensing, ~$375–575/mo</td><td class="tgt">30 days</td><td class="comp"></td></tr>
<tr><td>Complete staff domain migration + department drives</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">60–90 days</td></tr> <tr><td>Complete staff domain migration + department drives</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">60–90 days</td><td class="comp"></td></tr>
<tr><td>Final Windows Pro upgrade (1 deferred device)</td><td class="own">ACG</td><td class="cost">~$99</td><td class="tgt">next window</td></tr> <tr><td>Final Windows Pro upgrade (1 deferred device)</td><td class="own">ACG</td><td class="cost">~$99</td><td class="tgt">next window</td><td class="comp"></td></tr>
<tr><td>Retire the per-PC Synology sync client as machines migrate</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">with migration</td></tr> <tr><td>Retire the per-PC Synology sync client as machines migrate</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">with migration</td><td class="comp"></td></tr>
</table> </table>
</section> </section>
@@ -207,13 +219,13 @@
</ul> </ul>
<span class="lbl lbl--todo">To do</span> <span class="lbl lbl--todo">To do</span>
<table class="todo"> <table class="todo">
<tr><th style="width:52%">Action</th><th>Owner</th><th>Cost</th><th>Target</th></tr> <tr><th style="width:46%">Action</th><th>Owner</th><th>Cost</th><th>Target</th><th>Completed</th></tr>
<tr><td>Create emergency break-glass admin accounts with hardware security keys</td><td class="own">ACG</td><td class="cost">~$110 keys</td><td class="tgt">30 days</td></tr> <tr><td>Create emergency break-glass admin accounts with hardware security keys</td><td class="own">ACG</td><td class="cost">~$110 keys</td><td class="tgt">30 days</td><td class="comp"></td></tr>
<tr><td>Enforce the caregiver device allow-list (final enforcement phase)</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">30–60 days</td></tr> <tr><td>Enforce the caregiver device allow-list (final enforcement phase)</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">30–60 days</td><td class="comp"></td></tr>
<tr><td>Limit trusted-network sign-in to approved devices (next enforcement phase)</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">30–60 days</td></tr> <tr><td>Limit trusted-network sign-in to approved devices (next enforcement phase)</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">30–60 days</td><td class="comp"></td></tr>
<tr><td>Enable file-access audit logging with 90-day / 6-year retention</td><td class="own">ACG</td><td class="cost">~$50–120/mo</td><td class="tgt">60–90 days</td></tr> <tr><td>Enable file-access audit logging with 90-day / 6-year retention</td><td class="own">ACG</td><td class="cost">~$50–120/mo</td><td class="tgt">60–90 days</td><td class="comp"></td></tr>
<tr><td>Formalize a same-day offboarding checklist</td><td class="own">Cascades HR + ACG</td><td class="cost">none</td><td class="tgt">30 days, standing</td></tr> <tr><td>Formalize a same-day offboarding checklist</td><td class="own">Cascades HR + ACG</td><td class="cost">none</td><td class="tgt">30 days, standing</td><td class="comp"></td></tr>
<tr><td>Package the dated security risk assessment</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">60 days</td></tr> <tr><td>Package the dated security risk assessment</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">60 days</td><td class="comp"></td></tr>
</table> </table>
</section> </section>
@@ -226,11 +238,11 @@
</ul> </ul>
<span class="lbl lbl--todo">To do</span> <span class="lbl lbl--todo">To do</span>
<table class="todo"> <table class="todo">
<tr><th style="width:52%">Action</th><th>Owner</th><th>Cost</th><th>Target</th></tr> <tr><th style="width:46%">Action</th><th>Owner</th><th>Cost</th><th>Target</th><th>Completed</th></tr>
<tr><td>Complete the Business Associate Agreement inventory (every vendor touching PHI)</td><td class="own">Cascades + ACG</td><td class="cost">none</td><td class="tgt">60 days</td></tr> <tr><td>Complete the Business Associate Agreement inventory (every vendor touching PHI)</td><td class="own">Cascades + ACG</td><td class="cost">none</td><td class="tgt">60 days</td><td class="comp"></td></tr>
<tr><td>Move ALIS fully to single sign-on (retire the separate native login)</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">60 days</td></tr> <tr><td>Move ALIS fully to single sign-on (retire the separate native login)</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">60 days</td><td class="comp"></td></tr>
<tr><td>Enable encryption on the resident-data file share</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">60–90 days</td></tr> <tr><td>Enable encryption on the resident-data file share</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">60–90 days</td><td class="comp"></td></tr>
<tr><td>Maintain a one-page contract / renewal / BAA tracker</td><td class="own">Cascades + ACG</td><td class="cost">none</td><td class="tgt">90 days, standing</td></tr> <tr><td>Maintain a one-page contract / renewal / BAA tracker</td><td class="own">Cascades + ACG</td><td class="cost">none</td><td class="tgt">90 days, standing</td><td class="comp"></td></tr>
</table> </table>
</section> </section>
@@ -243,10 +255,10 @@
</ul> </ul>
<span class="lbl lbl--todo">To do</span> <span class="lbl lbl--todo">To do</span>
<table class="todo"> <table class="todo">
<tr><th style="width:52%">Action</th><th>Owner</th><th>Cost</th><th>Target</th></tr> <tr><th style="width:46%">Action</th><th>Owner</th><th>Cost</th><th>Target</th><th>Completed</th></tr>
<tr><td>Repurpose the Synology NAS as the onsite backup for the server (with off-site backup continuing)</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">60–90 days</td></tr> <tr><td>Repurpose the Synology NAS as the onsite backup for the server (with off-site backup continuing)</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">60–90 days</td><td class="comp"></td></tr>
<tr><td>Run and document a test restore</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">90 days</td></tr> <tr><td>Run and document a test restore</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">90 days</td><td class="comp"></td></tr>
<tr><td>Confirm and document the retention policy</td><td class="own">ACG</td><td class="cost">none</td><td class="tgt">60 days</td></tr> <tr><td>Confirm and document the retention policy</td><td class="own">ACG</td><td class="cost">none</td><td class="tgt">60 days</td><td class="comp"></td></tr>
</table> </table>
</section> </section>
@@ -259,9 +271,9 @@
</ul> </ul>
<span class="lbl lbl--todo">To do</span> <span class="lbl lbl--todo">To do</span>
<table class="todo"> <table class="todo">
<tr><th style="width:52%">Action</th><th>Owner</th><th>Cost</th><th>Target</th></tr> <tr><th style="width:46%">Action</th><th>Owner</th><th>Cost</th><th>Target</th><th>Completed</th></tr>
<tr><td>Complete the Helpany rollout; move sensors to their own protected network segment</td><td class="own">Helpany + ACG</td><td class="cost">vendor + labor</td><td class="tgt">90 days</td></tr> <tr><td>Complete the Helpany rollout; move sensors to their own protected network segment</td><td class="own">Helpany + ACG</td><td class="cost">vendor + labor</td><td class="tgt">90 days</td><td class="comp"></td></tr>
<tr><td>Inventory all resident-facing technology (nurse-call / pendants, assistive listening, resident WiFi for telehealth) into this plan</td><td class="own">Cascades + ACG</td><td class="cost">none</td><td class="tgt">next review</td></tr> <tr><td>Inventory all resident-facing technology (nurse-call / pendants, assistive listening, resident WiFi for telehealth) into this plan</td><td class="own">Cascades + ACG</td><td class="cost">none</td><td class="tgt">next review</td><td class="comp"></td></tr>
</table> </table>
</section> </section>
@@ -274,10 +286,10 @@
</ul> </ul>
<span class="lbl lbl--todo">To do</span> <span class="lbl lbl--todo">To do</span>
<table class="todo"> <table class="todo">
<tr><th style="width:52%">Action</th><th>Owner</th><th>Cost</th><th>Target</th></tr> <tr><th style="width:46%">Action</th><th>Owner</th><th>Cost</th><th>Target</th><th>Completed</th></tr>
<tr><td>Write the formal disaster-recovery / business-continuity plan with recovery-time targets</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">90 days</td></tr> <tr><td>Write the formal disaster-recovery / business-continuity plan with recovery-time targets</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">90 days</td><td class="comp"></td></tr>
<tr><td>Documented restore test (with area 5)</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">90 days</td></tr> <tr><td>Documented restore test (with area 5)</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">90 days</td><td class="comp"></td></tr>
<tr><td>Server redundancy (pairs with the server refresh project)</td><td class="own">ACG + Cascades</td><td class="cost">project quote</td><td class="tgt">FY project</td></tr> <tr><td>Server redundancy (pairs with the server refresh project)</td><td class="own">ACG + Cascades</td><td class="cost">project quote</td><td class="tgt">FY project</td><td class="comp"></td></tr>
</table> </table>
</section> </section>
@@ -285,15 +297,15 @@
<div class="area__head"><span class="area__no">08</span><h2 class="area__title">Virus &amp; threat protection</h2></div> <div class="area__head"><span class="area__no">08</span><h2 class="area__title">Virus &amp; threat protection</h2></div>
<span class="lbl lbl--done">Done</span> <span class="lbl lbl--done">Done</span>
<ul class="done"> <ul class="done">
<li>Managed endpoint detection &amp; response (EDR) on every managed device (about 35), <b>including the main server</b> (completed July 2026).</li> <li>Managed endpoint detection &amp; response (EDR) on every managed, enrolled device (35), <b>including the main server</b> (verified live July 2026).</li>
<li>Microsoft Defender and Exchange Online Protection on email; managed monitoring and patching on all devices.</li> <li>Microsoft Defender and Exchange Online Protection on email; managed monitoring and patching on all devices.</li>
<li>Legacy agents from the previous IT provider removed from the server.</li> <li>Legacy agents from the previous IT provider removed from the server.</li>
</ul> </ul>
<span class="lbl lbl--todo">To do</span> <span class="lbl lbl--todo">To do</span>
<table class="todo"> <table class="todo">
<tr><th style="width:52%">Action</th><th>Owner</th><th>Cost</th><th>Target</th></tr> <tr><th style="width:46%">Action</th><th>Owner</th><th>Cost</th><th>Target</th><th>Completed</th></tr>
<tr><td>Remove remaining legacy agents: DESKTOP-TRCIEJA (retires with its replacement) and DESKTOP-F94M8UT (powered off; completes on power-on); finish console cleanup</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">30–60 days</td></tr> <tr><td>Remove remaining legacy agents: DESKTOP-TRCIEJA (retires with its replacement); finish console cleanup</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">30–60 days</td><td class="comp"></td></tr>
<tr><td>Standing coverage audit: every device reporting into managed security</td><td class="own">ACG</td><td class="cost">none</td><td class="tgt">quarterly</td></tr> <tr><td>Standing coverage audit: every device reporting into managed security</td><td class="own">ACG</td><td class="cost">none</td><td class="tgt">quarterly</td><td class="comp"></td></tr>
</table> </table>
</section> </section>

58
clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.md
View File

@@ -5,12 +5,28 @@
| Governance | | | Governance | |
|---|---| |---|---|
| Plan owner | Cascades of Tucson | | Plan owner | Cascades of Tucson — Administrator (Ashley Jensen) |
| Prepared with | Az Computer Guru (Mike Swanson, Howard Enos) | | Prepared with | Az Computer Guru (Mike Swanson, Howard Enos) |
| Standard reference | CARF Technology and System Plan, Aging Services Standards Manual (Section 1, "CARF Plans") — *[manual edition confirmed at adoption]* |
| Plan period | FY 2026–2027 | | Plan period | FY 2026–2027 |
| Adopted by / date | *[at adoption]* | | Adopted by / date | *[at adoption]* |
| Next annual review | *[adoption + 12 months]* | | Next annual review | *[adoption + 12 months]* |
## Basis of this plan
This plan is based on the needs of the people Cascades serves and the people who serve
them. **Persons served:** resident safety (Helpany fall/motion sensors with no camera and
no microphone), reliable building-wide WiFi for residents and families, and protection of
resident health records. **Personnel:** dependable workstations, one sign-on to the
clinical record, and secure access that follows staff roles. **Other stakeholders:**
families (connectivity and privacy), regulators (HIPAA safeguards), and vendors (managed
under Business Associate Agreements).
Technology priorities align with Cascades' strategic goals: resident safety first (safety
sensors, proven power-outage recovery), regulatory standing (HIPAA safeguards, CARF
conformance, auditable records), and efficient operations (modern workstations, single
sign-on, and a sanctioned analytics path for leadership).
--- ---
## 1. Hardware ## 1. Hardware
@@ -22,8 +38,8 @@
- Windows Pro upgrades completed on nearly all workstations for domain readiness. - Windows Pro upgrades completed on nearly all workstations for domain readiness.
**To do** **To do**
| Action | Owner | Cost | Target | | Action | Owner | Cost | Target | Completed |
|---|---|---|---| |---|---|---|---|---|
| Install the purchased enterprise SSDs (scheduled window) | ACG | already purchased | 30–60 days | | Install the purchased enterprise SSDs (scheduled window) | ACG | already purchased | 30–60 days |
| Replace workstations marked for replacement (list below, 5 + spare) | ACG | ~$700–950 ea | 60–90 days | | Replace workstations marked for replacement (list below, 5 + spare) | ACG | ~$700–950 ea | 60–90 days |
| Scope and quote a server refresh project | ACG + Cascades | formal quote | 90 days | | Scope and quote a server refresh project | ACG + Cascades | formal quote | 90 days |
@@ -48,9 +64,9 @@
department structure and drive mapping built. department structure and drive mapping built.
**To do** **To do**
| Action | Owner | Cost | Target | | Action | Owner | Cost | Target | Completed |
|---|---|---|---| |---|---|---|---|---|
| Right-size Microsoft 365 licensing: move users off the legacy license; full Office licenses only where needed, lighter licenses for everyone else | ACG | reduces monthly cost | 30 days | | Move office staff off the suspended legacy Microsoft 365 license onto supported licenses; full Office only where needed, lighter licenses elsewhere | ACG | new licensing, ~$375–575/mo depending on mix | 30 days |
| Complete staff domain migration + department drives | ACG | labor | 60–90 days | | Complete staff domain migration + department drives | ACG | labor | 60–90 days |
| Final Windows Pro upgrade (1 deferred device) | ACG | ~$99 | next window | | Final Windows Pro upgrade (1 deferred device) | ACG | ~$99 | next window |
| Retire the per-PC Synology sync client as machines migrate | ACG | labor | with migration | | Retire the per-PC Synology sync client as machines migrate | ACG | labor | with migration |
@@ -66,8 +82,8 @@
- Email authentication (SPF, DKIM, DMARC) enforced. - Email authentication (SPF, DKIM, DMARC) enforced.
**To do** **To do**
| Action | Owner | Cost | Target | | Action | Owner | Cost | Target | Completed |
|---|---|---|---| |---|---|---|---|---|
| Create emergency break-glass admin accounts with hardware security keys | ACG | ~$110 keys | 30 days | | Create emergency break-glass admin accounts with hardware security keys | ACG | ~$110 keys | 30 days |
| Enforce the caregiver device allow-list (final enforcement phase) | ACG | labor | 30–60 days, after break-glass | | Enforce the caregiver device allow-list (final enforcement phase) | ACG | labor | 30–60 days, after break-glass |
| Limit trusted-network sign-in to approved devices (next enforcement phase) | ACG | labor | 30–60 days | | Limit trusted-network sign-in to approved devices (next enforcement phase) | ACG | labor | 30–60 days |
@@ -82,8 +98,8 @@
- Shared care devices auto-lock; resident and voice traffic isolated on the network. - Shared care devices auto-lock; resident and voice traffic isolated on the network.
**To do** **To do**
| Action | Owner | Cost | Target | | Action | Owner | Cost | Target | Completed |
|---|---|---|---| |---|---|---|---|---|
| Complete the Business Associate Agreement inventory (every vendor touching PHI) | Cascades + ACG | none | 60 days | | Complete the Business Associate Agreement inventory (every vendor touching PHI) | Cascades + ACG | none | 60 days |
| Move ALIS fully to single sign-on (retire the separate native login) | ACG | labor | 60 days | | Move ALIS fully to single sign-on (retire the separate native login) | ACG | labor | 60 days |
| Enable encryption on the resident-data file share | ACG | labor | 60–90 days | | Enable encryption on the resident-data file share | ACG | labor | 60–90 days |
@@ -97,8 +113,8 @@
- Firewall and network configuration backed up. - Firewall and network configuration backed up.
**To do** **To do**
| Action | Owner | Cost | Target | | Action | Owner | Cost | Target | Completed |
|---|---|---|---| |---|---|---|---|---|
| Repurpose the Synology NAS as the onsite backup for the server (with off-site backup continuing) | ACG | labor | 60–90 days | | Repurpose the Synology NAS as the onsite backup for the server (with off-site backup continuing) | ACG | labor | 60–90 days |
| Run and document a test restore | ACG | labor | 90 days | | Run and document a test restore | ACG | labor | 90 days |
| Confirm and document the retention policy | ACG | none | 60 days | | Confirm and document the retention policy | ACG | none | 60 days |
@@ -111,8 +127,8 @@
- Building-wide WiFi supporting resident and family connectivity. - Building-wide WiFi supporting resident and family connectivity.
**To do** **To do**
| Action | Owner | Cost | Target | | Action | Owner | Cost | Target | Completed |
|---|---|---|---| |---|---|---|---|---|
| Complete the Helpany rollout; move sensors to their own protected network segment | Helpany + ACG | vendor-billed + labor | 90 days | | Complete the Helpany rollout; move sensors to their own protected network segment | Helpany + ACG | vendor-billed + labor | 90 days |
| Inventory all resident-facing technology (nurse-call/pendants, assistive listening, resident WiFi for telehealth) into this plan | Cascades + ACG | none | next review | | Inventory all resident-facing technology (nurse-call/pendants, assistive listening, resident WiFi for telehealth) into this plan | Cascades + ACG | none | next review |
@@ -124,8 +140,8 @@
- UPS battery backup installed on core equipment and all network switches; off-site backup running. - UPS battery backup installed on core equipment and all network switches; off-site backup running.
**To do** **To do**
| Action | Owner | Cost | Target | | Action | Owner | Cost | Target | Completed |
|---|---|---|---| |---|---|---|---|---|
| Write the formal disaster-recovery / business-continuity plan with recovery-time targets | ACG | labor | 90 days | | Write the formal disaster-recovery / business-continuity plan with recovery-time targets | ACG | labor | 90 days |
| Documented restore test (with area 5) | ACG | labor | 90 days | | Documented restore test (with area 5) | ACG | labor | 90 days |
| Server redundancy (pairs with the server refresh project) | ACG + Cascades | project quote | FY project | | Server redundancy (pairs with the server refresh project) | ACG + Cascades | project quote | FY project |
@@ -133,16 +149,16 @@
## 8. Virus & threat protection ## 8. Virus & threat protection
**Done** **Done**
- Managed endpoint detection & response (EDR) on every managed device (about 35), - Managed endpoint detection & response (EDR) on every managed, enrolled device (35),
**including the main server** (completed July 2026). **including the main server** (verified live July 2026).
- Microsoft Defender and Exchange Online Protection on email; managed monitoring and - Microsoft Defender and Exchange Online Protection on email; managed monitoring and
patching on all devices. patching on all devices.
- Legacy agents from the previous IT provider removed from the server. - Legacy agents from the previous IT provider removed from the server.
**To do** **To do**
| Action | Owner | Cost | Target | | Action | Owner | Cost | Target | Completed |
|---|---|---|---| |---|---|---|---|---|
| Remove remaining legacy agents: DESKTOP-TRCIEJA (retires with its replacement) and DESKTOP-F94M8UT (powered off; completes on power-on); finish console cleanup | ACG | labor | 30–60 days | | Remove remaining legacy agents: DESKTOP-TRCIEJA (retires with its replacement); finish console cleanup | ACG | labor | 30–60 days |
| Standing coverage audit: every device reporting into managed security | ACG | none | quarterly | | Standing coverage audit: every device reporting into managed security | ACG | none | quarterly |
--- ---

BIN
clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.pdf
View File

Binary file not shown.

29
clients/cascades-tucson/session-logs/2026-07/2026-07-15-howard-technology-plan-final.md
View File

@@ -133,3 +133,32 @@ None touched this session.
- Remaining-work plan: `clients/cascades-tucson/docs/REMAINING-WORK-PLAN.md` - Remaining-work plan: `clients/cascades-tucson/docs/REMAINING-WORK-PLAN.md`
- Straggler pass log: `clients/cascades-tucson/session-logs/2026-06/2026-06-26-howard-edr-bd-straggler-9am-pass.md` - Straggler pass log: `clients/cascades-tucson/session-logs/2026-06/2026-06-26-howard-edr-bd-straggler-9am-pass.md`
- Prepaid balance shown in footer: 37.5 hrs as of 2026-07-10 - Prepaid balance shown in footer: 37.5 hrs as of 2026-07-10
## Update: 12:21 PT — Mike's verification edits applied
Applied all 4 items from Mike's coord message (6c0abc15) per Howard's "fix the cost wording
and update the docs, and do as mike wants":
1. **Area 2 cost correction** — Mike's live Graph check showed the relicensing claim was wrong
(office staff sit on a SUSPENDED Business Standard sub, no Premium seats). Reworded to
"new licensing, ~$375–575/mo depending on mix" (net-new spend, not savings).
2. **Area 8 wording** — "every device" -> "every managed, enrolled device (35), including the
main server (verified live July 2026)". Dropped DESKTOP-F94M8UT from the legacy-agent row
(already gone from the Datto console); DESKTOP-TRCIEJA remains.
3. **CARF conformance elements added** — standard reference row (CARF Technology and System
Plan, Aging Services manual Section 1, edition placeholder), "Basis of this plan" section
(needs of persons served / personnel / stakeholders + strategic alignment), Ashley Jensen
restored as named plan owner (governance table ONLY — masthead stays "Attn: Business
Office"; Howard approved via "do as mike wants" after the earlier name-removal request),
and a Completed column added to all 28 action rows across 8 to-do tables (living-action-
document format).
4. **Stale docs refreshed** — wiki CS-SERVER line superseded (Datto EDR agent reinstalled,
agent b41befcf-e418-4d0d-8552-bc7662364d07, verified live; 6/26 removal note no longer
current) and docs/cloud/m365.md licensing section rewritten to the live Graph numbers
(SPB 45/41/4, Standard SUSPENDED 30 consumed) + stale "MFA: Not enabled" line fixed.
PDF re-rendered: 4 pages, 433,980 bytes, verified visually page-by-page. Coord reply sent to
Mike (GURU-5070) confirming: id 3c07fd3e-7f93-401d-8d46-339c968552f9.
Files touched this update: proposals .md/.html/.pdf, docs/cloud/m365.md,
wiki/clients/cascades-tucson.md.

2
wiki/clients/cascades-tucson.md
View File

@@ -489,7 +489,7 @@ Cascades' line-of-business / reporting SaaS (the systems they pull data OUT of,
### CS-SERVER SMB & Endpoint AV (2026-06-26) ### CS-SERVER SMB & Endpoint AV (2026-06-26)
- **The "CS-SERVER SMB error 67 outage" was a TEST-METHOD ARTIFACT, not a real outage.** RMM-dispatched SMB client commands (`net use`/`net view`/`Test-Path`/`Get-SmbConnection`, even in `user_session`) **false-negative** -- they return error 67 (BAD_NETWORK_NAME) / RPC 1702 / "none" even for KNOWN-GOOD targets. **CS-SERVER SMB is healthy** -- `Get-SmbSession` showed 7 live SMB 3.1.1 users / 30 open files / new sessions forming. **VALIDATE SMB server-side (`Get-SmbSession`/`Get-SmbOpenFile`) or with a REAL interactive test -- never from RMM client-side results.** A drive-map `verify` failure is NOT proof of a problem (skill caveat added; errorlog `rmm/smb-testing`). - **The "CS-SERVER SMB error 67 outage" was a TEST-METHOD ARTIFACT, not a real outage.** RMM-dispatched SMB client commands (`net use`/`net view`/`Test-Path`/`Get-SmbConnection`, even in `user_session`) **false-negative** -- they return error 67 (BAD_NETWORK_NAME) / RPC 1702 / "none" even for KNOWN-GOOD targets. **CS-SERVER SMB is healthy** -- `Get-SmbSession` showed 7 live SMB 3.1.1 users / 30 open files / new sessions forming. **VALIDATE SMB server-side (`Get-SmbSession`/`Get-SmbOpenFile`) or with a REAL interactive test -- never from RMM client-side results.** A drive-map `verify` failure is NOT proof of a problem (skill caveat added; errorlog `rmm/smb-testing`).
- **CS-SERVER endpoint AV was DattoAV, not GravityZone Bitdefender.** It was the Datto EDR "Endpoint Protection SDK" (Bitdefender engine + Avira "Sentry" driver -> drivers `BdSentry`/`rtp1`/`rtp2`), managed by Datto RMM (CentraStage/`CagService`) + Datto EDR Agent (`HUNTAgent`/Infocyte HUNT, tenant azcomp4587). Removing the box from the GravityZone console did nothing because GravityZone never managed it. **ALL Datto software was fully removed from CS-SERVER 2026-06-26** (services deleted, `infocyte`/`CentraStage` dirs gone, registry + kernel drivers cleared). CS-SERVER was already de-enrolled from the EDR tenant, so no uninstall token could be issued -- forced removal once the tamper drivers were gone. - **CS-SERVER endpoint AV was DattoAV, not GravityZone Bitdefender.** It was the Datto EDR "Endpoint Protection SDK" (Bitdefender engine + Avira "Sentry" driver -> drivers `BdSentry`/`rtp1`/`rtp2`), managed by Datto RMM (CentraStage/`CagService`) + Datto EDR Agent (`HUNTAgent`/Infocyte HUNT, tenant azcomp4587). Removing the box from the GravityZone console did nothing because GravityZone never managed it. The prior-MSP Datto stack was fully removed from CS-SERVER 2026-06-26 (services deleted, `infocyte`/`CentraStage` dirs gone, registry + kernel drivers cleared; the box was de-enrolled so removal was forced once the tamper drivers were gone). **[SUPERSEDED 2026-07-15]: the ACG-managed Datto EDR agent was subsequently REINSTALLED — CS-SERVER is protected** (agent `b41befcf-e418-4d0d-8552-bc7662364d07`, Datto EDR sensor + Datto AV, live heartbeat, defs current; verified live in the azcomp4587 console by Mike). Do not read the 6/26 removal as "server unprotected."
- **Karen Rossini share access -- RESOLVED.** `CASCADES\karen.rossini` (reset + vaulted `clients/cascades-tucson/karen-rossini.sops.yaml`, member of `SG-IT-RW`) verified able to open `\CS-SERVER\Server` shares **interactively** from another PC. Her ALDocs desktop shortcut + Quick Access pin were set on DESKTOP-LPOPV30 (`\CS-SERVER\Server\ALDocs`) via the `drive-map` skill. Note: her earlier move to CSCNet (WPA3-SAE) broke NAS-by-name resolution (unrelated side effect). - **Karen Rossini share access -- RESOLVED.** `CASCADES\karen.rossini` (reset + vaulted `clients/cascades-tucson/karen-rossini.sops.yaml`, member of `SG-IT-RW`) verified able to open `\CS-SERVER\Server` shares **interactively** from another PC. Her ALDocs desktop shortcut + Quick Access pin were set on DESKTOP-LPOPV30 (`\CS-SERVER\Server\ALDocs`) via the `drive-map` skill. Note: her earlier move to CSCNet (WPA3-SAE) broke NAS-by-name resolution (unrelated side effect).
### Datto EDR / Bitdefender Decommission ### Datto EDR / Bitdefender Decommission