sync: auto-sync from HOWARD-HOME at 2026-07-20 08:26:49

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-20 08:26:49

clients/cascades/session-logs/2026-07/2026-07-20-howard-maintenance-pc-icons-homedepot.md

@@ -0,0 +1,51 @@
+# Session Log: MAINTENANCE-PC Desktop Icons + Home Depot Access Denied
+
+## User
+- **User:** Howard Enos (howard)
+- **Machine:** Howard-Home
+- **Role:** tech
+
+## Session Summary
+
+Investigated two issues on MAINTENANCE-PC at Cascades of Tucson, reported by the user (bruce miller logged on, john using the machine for Home Depot).
+
+**Issue 1 -- Desktop icons rearranged over the weekend.** Ran RMM diagnostics (reboot history, Windows Update history, display resolution, GPU events). Found that Windows Updates (KB5101650, KB5120102, KB5100998) installed over the weekend, triggering multiple reboots on 7/19 including a TrustedInstaller-initiated restart at 5:32 PM. An unexpected shutdown (Event 6008) also occurred at 4:57 PM. During the multi-reboot cycle, the display driver unloads temporarily and Windows falls back to generic resolution, which resets the desktop icon layout registry (Shell\Bags\1\Desktop IconStreams). Resolution returned to 1920x1080 on the AMD Radeon integrated GPU (single Lenovo monitor) but icon positions were already wiped. This is a known Windows behavior with no retroactive fix -- user must re-arrange manually.
+
+**Issue 2 -- John getting "Access Denied" on homedepot.com.** Screenshot showed an Akamai WAF block (Reference #18.aef7d517, errors.edgesuite.net). Ran network diagnostics via RMM: public IP 184.191.143.62, DNS via pfSense (192.168.0.1), no proxy configured, clean hosts file, Home Depot DNS resolving normally to Akamai edge. Enumerated Chrome extensions for John Trozzi's profile and found two: Google Docs Offline (built-in, harmless) and Malwarebytes Browser Guard v3.3.1. The Browser Guard modifies/strips HTTP headers which Akamai's aggressive WAF flags as bot traffic. Howard removed the Browser Guard extension. Advised clearing Home Depot cookies after removal to flush any flagged Akamai session cookies.
+
+## Key Decisions
+
+- Identified Windows Update reboot cycle as root cause of icon rearrangement rather than a display driver issue or malware -- event log timeline was conclusive (TrustedInstaller.exe initiated restart, multiple reboots in sequence).
+- Identified Malwarebytes Browser Guard as the Akamai block cause based on the extension's known behavior of modifying HTTP headers, rather than pursuing pfSense/network-level investigation first. The mystery `__MSG_extName__` extension was resolved to Google Docs Offline (built-in Chrome component) by reading the locale messages.json file on the endpoint.
+
+## Configuration Changes
+
+- Removed Malwarebytes Browser Guard extension from Chrome on MAINTENANCE-PC (John Trozzi's profile).
+
+## Infrastructure & Servers
+
+- **MAINTENANCE-PC** (Cascades of Tucson, agent ID: 2fbda0d2-efd7-4389-9ac5-3f89db467c1f)
+  - Windows, build 26200, AMD Radeon integrated GPU, 1920x1080 single Lenovo monitor (LENF918)
+  - Public IP: 184.191.143.62
+  - DNS: 192.168.0.1 (pfSense, pfsense.cascades.local)
+  - On Wi-Fi 2, IP 10.0.20.96
+  - Logged on user: bruce miller (console session)
+  - Security: Windows Defender + Datto AV
+
+## Commands & Outputs
+
+- RMM search: `bash .claude/scripts/rmm-search.sh MAINTENANCE-PC --client cascades` -- found agent online
+- Reboot diagnostics: Event 6008 (unexpected shutdown 4:57 PM 7/19), Event 1074 (TrustedInstaller restart 5:32 PM 7/19), three reboots in sequence
+- Windows Updates: KB5101650, KB5120102 (Security), KB5100998 (Update) -- all dated 7/20
+- Chrome extension enumeration: Google Docs Offline (ghbmnnjooekpmoecnnnilnnbdlolhkhi, v1.107.1), Malwarebytes Browser Guard (v3.3.1, removed)
+- Home Depot DNS: resolved to e14801.x.akamaiedge.net / 23.63.210.77 via pfSense
+
+## Pending / Incomplete Tasks
+
+- John should clear Home Depot cookies and retry; if still blocked, investigate pfSense content filtering (Squid/pfBlockerNG/Snort) as next step.
+- Desktop icons: user must re-arrange manually. If recurring, could deploy a scheduled task to back up IconStreams registry before Windows Update.
+
+## Reference Information
+
+- Akamai error reference: #18.aef7d517.1784559975.f84fc2a
+- RMM commands dispatched: 85fc1844 (reboot/update diag), e5d3cab3 (network diag), 5ec44cf1 (Chrome extension enum)

errorlog.md

@@ -19,6 +19,14 @@ Categories (the `[type]` tag): _(none)_ = skill/command execution failure ·
 
 <!-- Append entries below this line -->
 
+2026-07-20 | Howard-Home | remediation-tool | get-token: AADSTS7000229 — app not consented in tenant [ctx: tenant=7b34194a-9dda-47f1-8c96-d59e3c2ce03c tier=exchange-op-graph auth=cert]
+
+2026-07-20 | Howard-Home | remediation-tool | get-token: AADSTS7000229 — app not consented in tenant [ctx: tenant=7b34194a-9dda-47f1-8c96-d59e3c2ce03c tier=tenant-admin auth=cert] (x4)
+
+2026-07-20 | Howard-Home | remediation-tool | get-token: AADSTS7000229 — app not consented in tenant [ctx: tenant=7b34194a-9dda-47f1-8c96-d59e3c2ce03c tier=user-manager auth=cert] (x2)
+
+2026-07-20 | Howard-Home | remediation-tool | get-token: AADSTS7000229 — app not consented in tenant [ctx: tenant=7b34194a-9dda-47f1-8c96-d59e3c2ce03c tier=investigator auth=cert] (x3)
+
 2026-07-19 | Howard-Home | bug-tracker/prairie-schooner | [correction] assumed disabling Domain firewall profile was sufficient; Private/Public profiles were also blocking AD traffic because TPS-SVR NIC was classified as Private/Public instead of Domain [ctx: ref=prairie-schooner-migration]
 
 2026-07-19 | Howard-Home | unifi-wifi/gw-sitemanager | Site Manager API call failed (HTTP 404) [ctx: path=/v1/connector/consoles/E4388319DCF3000000000716C1DE00000000077029F700000000639C7A87:1980774344/proxy/networkapi/s/default/rest/networkconf]