From 12077aa1d9f2b9c71a2675df7a03ede97f64e687 Mon Sep 17 00:00:00 2001 From: Howard Enos Date: Thu, 23 Jul 2026 18:38:59 -0700 Subject: [PATCH] sync: auto-sync from HOWARD-HOME at 2026-07-23 18:38:31 Author: Howard Enos Machine: HOWARD-HOME Timestamp: 2026-07-23 18:38:31 --- ...-23-howard-veronica-domain-join-mfa-sso.md | 57 +++++++++++++++++++ 1 file changed, 57 insertions(+) diff --git a/clients/cascades-tucson/session-logs/2026-07/2026-07-23-howard-veronica-domain-join-mfa-sso.md b/clients/cascades-tucson/session-logs/2026-07/2026-07-23-howard-veronica-domain-join-mfa-sso.md index ce40ad35..1a7fcf67 100644 --- a/clients/cascades-tucson/session-logs/2026-07/2026-07-23-howard-veronica-domain-join-mfa-sso.md +++ b/clients/cascades-tucson/session-logs/2026-07/2026-07-23-howard-veronica-domain-join-mfa-sso.md @@ -102,3 +102,60 @@ Work then moved to setting up Edge SSO for NurseAssist so Veronica gets auto-log - GPO "CSC - Disable Windows Hello (Staff PCs)": `ece3f27b-ad28-491f-8291-111aaa3b0675` - CA policy "CSC - Block on-site-only users off Cascades network": `91f918b8-def5-46fd-9fa7-2eae2189aff0` - Entra Connect connector: `bfcac3b0-5c7f-4e20-97c8-257b3fab34b3` (cascades.local) + +--- + +## Update: 18:37 PT — Lois Lane Profile Migration, AD Reorganization, Entra Connect Expansion + +### Session Summary + +Continued onsite work after the Veronica MFA resolution. Investigated the Entra Connect sync scope and Hybrid Join prerequisites for SSO. The existing sync scope only covered `OU=Caregivers`, `OU=Groups`, and `OU=Caregiver Devices` — no staff department OUs or Staff PCs were syncing. + +Reorganized AD computer objects. Moved machines out of `OU=Staff PCs` to leave only the three that belong: NURSEASSIST, DESKTOP-DLTAGOI, DESKTOP-ROK7VNM. RECEPTIONIST-PC moved to `OU=Shared PCs`. ACCT2-PC, CRYSTAL-PC, DESKTOP-1ISF081, DESKTOP-H6QHRR7 moved back to `CN=Computers` pending proper OU assignment. MEMRECEPT-PC is not yet domain-joined so no move needed. + +Howard ran the Entra Connect wizard on CS-SERVER to add `OU=Care-Assisted Living,OU=Departments` and `OU=Staff PCs,OU=Workstations` to the sync scope. Confirmed sync scope now includes 4 OUs: Caregivers, Groups, Care-Assisted Living, Staff PCs (Caregiver Devices is a child of Staff PCs, so it's covered). Delta sync triggered. PHS will overwrite cloud passwords with AD passwords for newly synced users — Veronica's passwords already match; other Care-AL users (Karen Rossini, Lois Lane) may be affected. + +Moved to Lois Lane's machine (Health-Services-Director, actual hostname HEALTH-SERVICES, formerly DESKTOP-KQSL232). Machine was already domain-joined, Lois already logged in with domain profile. Two `Lois Lane` profiles existed — domain (SID ...1113, active) and old local (SID ...1002). Both shared the same `C:\Users\Lois Lane` path. Edge showed a conflict between old and new profile data. Howard exported passwords from the old Edge profile and imported into the domain profile to resolve. + +Christina DuPras was identified as next — Resident Services Director, mapped to ALASSIST-PC, classified as privileged/outside (same tier as Lois Lane). ALASSIST-PC not found in RMM under that name; machine may have been renamed. Awaiting Howard's confirmation of the hostname. + +### Key Decisions + +- Reorganized Staff PCs OU to contain only machines that should get Hybrid Join + SSO now: NURSEASSIST, DESKTOP-DLTAGOI, DESKTOP-ROK7VNM. Other machines moved out until they're ready. +- RECEPTIONIST-PC moved to Shared PCs OU (not Staff PCs) — reception machines are shared-use. +- Entra Connect scope expanded to include `OU=Care-Assisted Living` (syncs user accounts like Veronica, Lois, Karen) and `OU=Staff PCs` (syncs machine objects for Hybrid Join). +- Lois Lane classified as privileged/outside — will be in SG-OnOffSite, gets MFA when off Cascades network, no MFA when on-site. +- Christina DuPras same classification as Lois Lane — privileged/outside. +- Edge password export/import used to recover Lois Lane's saved passwords from old local profile to domain profile (DPAPI encryption ties passwords to the Windows SID). + +### Problems Encountered + +- Entra Connect OU scope cannot be modified via PowerShell cmdlets remotely (`Set-ADSyncConnector` does not exist, `Enable-ADSyncConnectorPartitionHierarchy` parameter binding fails). Must use the GUI wizard on CS-SERVER. +- Lois Lane's Edge showed profile conflict ("You've already used your account with a different profile") because both local and domain profiles share the same `C:\Users\Lois Lane` folder path. Resolved by switching to the existing Edge profile and exporting/importing passwords. +- ALASSIST-PC (Christina DuPras) not found in RMM — machine likely renamed. Need hostname from Howard. +- NurseAssist RMM agent showing offline/pending — gpupdate and dsregcmd verification deferred until machine is back online. + +### Configuration Changes + +- AD: RECEPTIONIST-PC moved from `OU=Staff PCs` to `OU=Shared PCs,OU=Workstations` +- AD: ACCT2-PC, CRYSTAL-PC, DESKTOP-1ISF081, DESKTOP-H6QHRR7 moved from `OU=Staff PCs` to `CN=Computers` +- Entra Connect: Sync scope expanded — added `OU=Care-Assisted Living,OU=Departments` and `OU=Staff PCs,OU=Workstations` (done by Howard via wizard) +- Entra Connect: `OU=Caregiver Devices` no longer separately listed (child of Staff PCs, covered by parent inclusion) +- Delta sync triggered on CS-SERVER + +### Infrastructure & Servers + +- HEALTH-SERVICES (formerly DESKTOP-KQSL232): Lois Lane's machine, RMM agent `3d6a6fed-500b-41d4-a785-6032e3d5297f`, domain-joined `cascades.local`, Win 11 Pro +- ALASSIST-PC: Christina DuPras, not found in RMM under this name — needs hostname verification + +### Pending / Incomplete Tasks + +- [ ] NurseAssist: gpupdate + reboot + verify Hybrid Join (`dsregcmd /status` AzureAdJoined/AzureAdPrt) — machine offline +- [ ] NurseAssist: ProfWiz still needed to migrate Veronica's old local profile to domain profile +- [ ] HEALTH-SERVICES (Lois Lane): verify Hybrid Join status after Entra Connect sync completes +- [ ] HEALTH-SERVICES: add Lois Lane to SG-OnOffSite for off-site MFA policy +- [ ] Christina DuPras: identify current machine hostname, domain join status, begin same workflow +- [ ] Karen Rossini (DESKTOP-LPOPV30): same privileged/outside tier, not yet started +- [ ] Edge SSO GPO for Staff PCs (`BrowserSignin=2`, `EdgeDefaultProfileEnabled=1`) — deferred until all machines are Hybrid Joined +- [ ] Verify PHS doesn't lock out Karen Rossini or Lois Lane (cloud password overwritten by AD password) +- [ ] Remaining ~7 domain join machines from the original list