sync: auto-sync from HOWARD-HOME at 2026-06-26 08:41:22

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-06-26 08:41:22

clients/cascades-tucson/session-logs/2026-06/2026-06-25-howard-edr-rollout-bitdefender-removal.md

@@ -138,3 +138,46 @@ background watcher (`bfm81iqdz`) was left polling GuruRMM to process machines as
   `session-logs/2026-06/2026-06-25-howard-datto-edr-skill-and-lifecycle-test.md`.
 - Cascades EDR now 34 agents; 8 original gaps -> 7 closed (6 online + RECEPTIONIST box2), 2 queued
   (offline), net remaining gap = the 2 offline + laptop3 RMM-side.
+
+---
+
+## Update: 2026-06-26 08:40 PT (HOWARD-HOME) — wiki recompile, overnight straggler monitoring, onsite handoff
+
+### What happened since the prior section
+- **Wiki recompiled** (`/wiki-compile client:cascades-tucson --full`, commit `9a243a9`): article now leads with the
+  Bitdefender->Datto EDR/AV migration; billing refreshed live (46.75 hrs, 0 open tickets, 29 devices); History +
+  [FLEET] item updated; index row updated. 634 -> 649 lines.
+- **Overnight straggler monitoring:** the 7 offline target machines were watched for reconnect (40-min background
+  watcher + 30-min cron sweeps at 5:12 / 5:42 / 6:12 / 6:45 local). **None came online.** Switched to a single
+  9:02am one-shot check (cron `9288b586`) + keep-awake guard (`bl9idsqip`) holding the host awake to 9:05am.
+  NOTE: cron jobs are session-only; clearing context / closing Claude ends the 9am auto-check (Howard is going
+  onsite and will handle machines directly).
+
+### EDR ROLLOUT STATUS (billing + onsite reference — Cascades of Tucson, Syncro 20149445)
+DONE (this engagement, 2026-06-25):
+- Datto EDR installed + enrolled on **7 machines**; Cascades EDR org count **27 -> 34** (org `2d5ea96e`, target group
+  `1dbd2b02`, reg key `6qw68y2rwl`). Machines: Assistnurse-pc, CascadesProxess, DESKTOP-N5G1ROO,
+  Health-Services-Director, LAPTOP-8P7HDSEI, MDIRECTOR-PC, + RECEPTIONIST-PC box1 (serial MJ0KQH4R).
+- **Bitdefender removed** from both RECEPTIONIST-PC physical boxes (serials MJ0KQH4R + MJ0KQHNP) via GravityZone
+  console "Uninstall client" task. **6 orphaned BD folders deleted** (CRYSTAL-PC, DESKTOP-DLTAGOI, DESKTOP-U2DHAP0,
+  LAPTOP-E0STJJE8, MAINTENANCE-PC, megan).
+- Full audit: 33 RMM devices reconciled vs EDR; per-device BD sweep of all 27 online machines.
+
+STILL OPEN (do onsite / next):
+- **EDR install on 2 offline machines** (queued, auto-runs on reconnect): DESKTOP-F94M8UT (RMM
+  `675311a1-...`, last seen 06-23 UTC — likely powered off/decommission candidate), NurseAssist (`fc88f14b-...`).
+- **BD-check on 5 offline has-EDR machines** (confirm BD off): DESKTOP-KQSL232 (`f1674059-...`, last seen 05-29 UTC,
+  decommission candidate), DESKTOP-MD6UQI3 (`99d7c8a7-...`), DESKTOP-TRCIEJA (`c9bf1a2d-...`, slated for replacement),
+  SALES4-PC (`975f70d8-...`), Laptop4 (`7a23fa6c-...`, BD-check was unresponsive twice).
+- **Remove Cascades from Syncro's Bitdefender deployment** (GUI-only) so BD does not redeploy onto cleaned machines.
+- **GravityZone portal cleanup:** RECEPTIONIST-PC endpoint records `66b04593e14f46ee79b1c87f` +
+  `66b045ee2f4dee3f01f54630` (Cascades company `66b0448e1e0441d02508bad8`) still listed — review/remove.
+- **Inverse gap:** `laptop3` has an active Datto EDR agent (v5552) but NO matching GuruRMM agent — install RMM agent
+  or reconcile hostname. Stale EDR agents to confirm/remove: laptop1 (last seen 2026-05-08), cascades-laptop (06-23).
+- CS-SERVER: confirm prior-MSP CentraStage RMM leftover is removed (separate from EDR).
+
+### How to resume the straggler work (any session)
+`eval "$(bash .claude/scripts/rmm-auth.sh)"`; check the 7 machine IDs above for status=online; for offline-install
+ones verify queued cmd ran (a4623704 DESKTOP-F94M8UT, d1806aa3 NurseAssist) + enrollment in EDR org `2d5ea96e`,
+else re-dispatch `Install-EDR -URL "https://azcomp4587.infocyte.com" -RegKey 6qw68y2rwl`. BD-check the rest; any
+BD_ACTIVE -> GravityZone console uninstall (policy "GPS Default" has no uninstall password).