sync: auto-sync from HOWARD-HOME at 2026-07-23 18:38:31

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-23 18:38:31

clients/cascades-tucson/session-logs/2026-07/2026-07-23-howard-veronica-domain-join-mfa-sso.md

@@ -102,3 +102,60 @@ Work then moved to setting up Edge SSO for NurseAssist so Veronica gets auto-log
 - GPO "CSC - Disable Windows Hello (Staff PCs)": `ece3f27b-ad28-491f-8291-111aaa3b0675`
 - CA policy "CSC - Block on-site-only users off Cascades network": `91f918b8-def5-46fd-9fa7-2eae2189aff0`
 - Entra Connect connector: `bfcac3b0-5c7f-4e20-97c8-257b3fab34b3` (cascades.local)
+
+---
+
+## Update: 18:37 PT — Lois Lane Profile Migration, AD Reorganization, Entra Connect Expansion
+
+### Session Summary
+
+Continued onsite work after the Veronica MFA resolution. Investigated the Entra Connect sync scope and Hybrid Join prerequisites for SSO. The existing sync scope only covered `OU=Caregivers`, `OU=Groups`, and `OU=Caregiver Devices` — no staff department OUs or Staff PCs were syncing.
+
+Reorganized AD computer objects. Moved machines out of `OU=Staff PCs` to leave only the three that belong: NURSEASSIST, DESKTOP-DLTAGOI, DESKTOP-ROK7VNM. RECEPTIONIST-PC moved to `OU=Shared PCs`. ACCT2-PC, CRYSTAL-PC, DESKTOP-1ISF081, DESKTOP-H6QHRR7 moved back to `CN=Computers` pending proper OU assignment. MEMRECEPT-PC is not yet domain-joined so no move needed.
+
+Howard ran the Entra Connect wizard on CS-SERVER to add `OU=Care-Assisted Living,OU=Departments` and `OU=Staff PCs,OU=Workstations` to the sync scope. Confirmed sync scope now includes 4 OUs: Caregivers, Groups, Care-Assisted Living, Staff PCs (Caregiver Devices is a child of Staff PCs, so it's covered). Delta sync triggered. PHS will overwrite cloud passwords with AD passwords for newly synced users — Veronica's passwords already match; other Care-AL users (Karen Rossini, Lois Lane) may be affected.
+
+Moved to Lois Lane's machine (Health-Services-Director, actual hostname HEALTH-SERVICES, formerly DESKTOP-KQSL232). Machine was already domain-joined, Lois already logged in with domain profile. Two `Lois Lane` profiles existed — domain (SID ...1113, active) and old local (SID ...1002). Both shared the same `C:\Users\Lois Lane` path. Edge showed a conflict between old and new profile data. Howard exported passwords from the old Edge profile and imported into the domain profile to resolve.
+
+Christina DuPras was identified as next — Resident Services Director, mapped to ALASSIST-PC, classified as privileged/outside (same tier as Lois Lane). ALASSIST-PC not found in RMM under that name; machine may have been renamed. Awaiting Howard's confirmation of the hostname.
+
+### Key Decisions
+
+- Reorganized Staff PCs OU to contain only machines that should get Hybrid Join + SSO now: NURSEASSIST, DESKTOP-DLTAGOI, DESKTOP-ROK7VNM. Other machines moved out until they're ready.
+- RECEPTIONIST-PC moved to Shared PCs OU (not Staff PCs) — reception machines are shared-use.
+- Entra Connect scope expanded to include `OU=Care-Assisted Living` (syncs user accounts like Veronica, Lois, Karen) and `OU=Staff PCs` (syncs machine objects for Hybrid Join).
+- Lois Lane classified as privileged/outside — will be in SG-OnOffSite, gets MFA when off Cascades network, no MFA when on-site.
+- Christina DuPras same classification as Lois Lane — privileged/outside.
+- Edge password export/import used to recover Lois Lane's saved passwords from old local profile to domain profile (DPAPI encryption ties passwords to the Windows SID).
+
+### Problems Encountered
+
+- Entra Connect OU scope cannot be modified via PowerShell cmdlets remotely (`Set-ADSyncConnector` does not exist, `Enable-ADSyncConnectorPartitionHierarchy` parameter binding fails). Must use the GUI wizard on CS-SERVER.
+- Lois Lane's Edge showed profile conflict ("You've already used your account with a different profile") because both local and domain profiles share the same `C:\Users\Lois Lane` folder path. Resolved by switching to the existing Edge profile and exporting/importing passwords.
+- ALASSIST-PC (Christina DuPras) not found in RMM — machine likely renamed. Need hostname from Howard.
+- NurseAssist RMM agent showing offline/pending — gpupdate and dsregcmd verification deferred until machine is back online.
+
+### Configuration Changes
+
+- AD: RECEPTIONIST-PC moved from `OU=Staff PCs` to `OU=Shared PCs,OU=Workstations`
+- AD: ACCT2-PC, CRYSTAL-PC, DESKTOP-1ISF081, DESKTOP-H6QHRR7 moved from `OU=Staff PCs` to `CN=Computers`
+- Entra Connect: Sync scope expanded — added `OU=Care-Assisted Living,OU=Departments` and `OU=Staff PCs,OU=Workstations` (done by Howard via wizard)
+- Entra Connect: `OU=Caregiver Devices` no longer separately listed (child of Staff PCs, covered by parent inclusion)
+- Delta sync triggered on CS-SERVER
+
+### Infrastructure & Servers
+
+- HEALTH-SERVICES (formerly DESKTOP-KQSL232): Lois Lane's machine, RMM agent `3d6a6fed-500b-41d4-a785-6032e3d5297f`, domain-joined `cascades.local`, Win 11 Pro
+- ALASSIST-PC: Christina DuPras, not found in RMM under this name — needs hostname verification
+
+### Pending / Incomplete Tasks
+
+- [ ] NurseAssist: gpupdate + reboot + verify Hybrid Join (`dsregcmd /status` AzureAdJoined/AzureAdPrt) — machine offline
+- [ ] NurseAssist: ProfWiz still needed to migrate Veronica's old local profile to domain profile
+- [ ] HEALTH-SERVICES (Lois Lane): verify Hybrid Join status after Entra Connect sync completes
+- [ ] HEALTH-SERVICES: add Lois Lane to SG-OnOffSite for off-site MFA policy
+- [ ] Christina DuPras: identify current machine hostname, domain join status, begin same workflow
+- [ ] Karen Rossini (DESKTOP-LPOPV30): same privileged/outside tier, not yet started
+- [ ] Edge SSO GPO for Staff PCs (`BrowserSignin=2`, `EdgeDefaultProfileEnabled=1`) — deferred until all machines are Hybrid Joined
+- [ ] Verify PHS doesn't lock out Karen Rossini or Lois Lane (cloud password overwritten by AD password)
+- [ ] Remaining ~7 domain join machines from the original list