import: ingested 160 files from C:\Users\howar\Clients
Howard's personal MSP client documentation folder imported into shared
ClaudeTools repo via /import command. Scope:
Clients (structured MSP docs under clients/<name>/docs/):
- anaise (NEW) - 13 files
- cascades-tucson - 47 files merged (existing had only reports/)
- dataforth - 18 files merged (alongside incident reports)
- instrumental-music-center - 14 files merged
- khalsa (NEW) - 22 files, multi-site (camden, river)
- kittle (NEW) - 16 files incl. fix-pdf-preview, gpo-intranet-zone
- lens-auto-brokerage (NEW) - 3 files (name matches SOPS vault)
- _client_template - 13-file scaffold for new clients
MSP tooling (projects/msp-tools/):
- msp-audit-scripts/ - server_audit.ps1, workstation_audit.ps1, README
- utilities/ - clean_printer_ports, win11_upgrade,
screenconnect-toolbox-commands
Credential handling:
- Extracted 1 inline password (Anaise DESKTOP-O8GF4SD / david)
to SOPS vault: clients/anaise/desktop-o8gf4sd.sops.yaml
- Redacted overview.md with vault reference pattern
- Scanned all 160 files for keys/tokens/connection strings -
no other credentials found
Skipped:
- Cascades/.claude/settings.local.json (per-machine config)
- Source-root CLAUDE.md (personal, claudetools has its own)
- scripts/server_audit.ps1 and workstation_audit.ps1 at source root
(identical duplicates of msp-audit-scripts versions)
Memory updates:
- reference_client_docs_structure.md (layout, conventions, active list)
- reference_msp_audit_scripts.md (locations, ScreenConnect 80-char rule)
Session log: session-logs/2026-04-16-howard-client-docs-import.md
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
329
clients/cascades-tucson/docs/servers/active-directory.md
Normal file
329
clients/cascades-tucson/docs/servers/active-directory.md
Normal file
@@ -0,0 +1,329 @@
|
||||
# Active Directory — cascades.local
|
||||
|
||||
## Domain Info (audit 2026-03-20)
|
||||
- Domain: cascades.local (NetBIOS: CASCADES)
|
||||
- Forest Functional Level: Windows2016Forest
|
||||
- Domain Functional Level: Windows2016Domain
|
||||
- Domain Controllers: CS-SERVER (192.168.2.254) — **ONLY DC** (all FSMO roles)
|
||||
- Sites: Default-First-Site-Name
|
||||
- No trusts configured
|
||||
|
||||
## AD Users (42 total — 40 enabled, 2 disabled) — cleaned 2026-04-13
|
||||
|
||||
**New since last doc update:** Allison Reibschied (2026-03-13), Lauren Hasselman (2026-02-26)
|
||||
|
||||
### Enabled Accounts — HR Roster (updated 2026-04-13)
|
||||
| Name | SamAccountName | Position | Department | Shared Email | Notes |
|
||||
|------|---------------|----------|------------|-------------|-------|
|
||||
| Administrator | Administrator | — | — | — | Built-in |
|
||||
| localadmin | localadmin | — | — | — | Local admin |
|
||||
| Sysadmin | sysadmin | — | — | — | System admin |
|
||||
| Howard Dax | howard | Home Office | Administrative | first.last@ | MSP technician |
|
||||
| Meredith Kuhn | Meredith.Kuhn | Executive Director | Administrative | first.last@ | |
|
||||
| John Trozzi | John.Trozzi | Maintenance Director | Maintenance | first.last@ | PC: MAINTENANCE-PC |
|
||||
| Lupe Sanchez | Lupe.Sanchez | Housekeeping Director | Housekeeping | first.last@ | Renamed from Guadalupe.Sanchez, duplicate deleted (2026-04-13) |
|
||||
| Megan Hiatt | Megan.Hiatt | Sales Director | Marketing | first.last@, Sales@ | |
|
||||
| Crystal Rodriguez | Crystal.Rodriguez | Sales Associate | Marketing | first.last@, Sales@ | PC: CRYSTAL-PC |
|
||||
| Tamra Matthews | Tamra.Matthews | Move-In Coordinator | Marketing | first.last@ | Renamed from Tamra.Johnson (2026-04-13) |
|
||||
| Lois Lane | Lois.Lane | Health Services Director | Care, Assisted Living | first.last@, Nurses@ | |
|
||||
| Christina DuPras | Christina.DuPras | Resident Services Director | Resident Services | first.last@ | |
|
||||
| Christine Nyanzunda | Christine.Nyanzunda | Memory Care Admin Assistant | Care, Memory Care | first.last@ | |
|
||||
| Susan Hicks | Susan.Hicks | Life Enrichment Director | Life Enrichment | first.last@ | PC: DESKTOP-ROK7VNM |
|
||||
| Ashley Jensen | Ashley.Jensen | Assistant Executive Director | Administrative | first.last@, Accounting@ | |
|
||||
| Veronica Feller | Veronica.Feller | Care, Assisted Living Aide | Care, Assisted Living | first.last@ | |
|
||||
| Sebastian Leon | Sebastian.Leon | RS Courtesy Patrol | Resident Services | Frontdesk@, Courtesypatrol@ | |
|
||||
| JD Martin | JD.Martin | Culinary Director | Culinary | first.last@ | |
|
||||
| Alyssa Brooks | Alyssa.Brooks | Dining Manager | Culinary | first.last@ | Renamed from Alyssa.Shestko, duplicate deleted (2026-04-13) |
|
||||
| Matt Brooks | Matt.Brooks | Memory Care Receptionist | Maintenance | first.last@ | Dept says Maintenance (HR data) |
|
||||
| Ramon Castaneda | Ramon.Castaneda | Kitchen Manager | Culinary | first.last@ | |
|
||||
| Michelle Shestko | Michelle.Shestko | Resident Services Receptionist | Resident Services | MC Front Desk | |
|
||||
| Sharon Edwards | Sharon.Edwards | Life Enrichment Assistant | Life Enrichment | first.last@ | PC: DESKTOP-DLTAGOI |
|
||||
| Britney Thompson | britney.thompson | Memory Care Nurse | Care, Assisted Living | first.last@, Nurses@ | lowercase SamAccountName |
|
||||
| Shelby Trozzi | Shelby.Trozzi | Memory Care Director | Care, Memory Care | first.last@ | Renamed from strozzi (2026-04-13) |
|
||||
| Karen Rossini | karen.rossini | Health Services Manager | Care, Assisted Living | first.last@, Nurses@ | lowercase SamAccountName |
|
||||
| Sheldon Gardfrey | Sheldon.Gardfrey | RS Courtesy Patrol | Resident Services | Frontdesk@, Courtesypatrol@ | |
|
||||
| Cathy Kingston | Cathy.Kingston | Resident Services Receptionist | Resident Services | Frontdesk@ | |
|
||||
| Shontiel Nunn | Shontiel.Nunn | Resident Services Receptionist | Resident Services | Frontdesk@ | |
|
||||
| Ray Rai | Ray.Rai | RS Courtesy Patrol | Resident Services | Frontdesk@ | |
|
||||
| Richard Adams | Richard.Adams | Driver | Transportation | Transportation@ | |
|
||||
| Julian Crim | Julian.Crim | Driver | Transportation | Transportation@ | |
|
||||
| Christopher Holick | Christopher.Holick | Driver | Transportation | Transportation@ | Fixed from Holik (2026-04-13) |
|
||||
| Lauren Hasselman | lauren.hasselman | Business Office Director | Administrative | first.last@, Accounting@ | Replaced Jeff Bristol. lowercase SamAccountName |
|
||||
| Allison Reibschied | Allison.Reibschied | Accounting Assistant | Administrative | first.last@ | Added 2026-03-13. PC: ACCT2-PC |
|
||||
| QBDataServiceUser34 | QBDataServiceUser34 | — | — | — | QuickBooks service account |
|
||||
| Culinary | Culinary | — | — | — | Generic department account — replace Phase 5 |
|
||||
| RECEPTIONIST | Receptionist | — | — | — | Generic role account — replace Phase 5 |
|
||||
| saleshare | saleshare | — | — | — | Shared sales resource — replace Phase 5 |
|
||||
| directoryshare | directoryshare | — | — | — | Shared directory resource — replace Phase 5 |
|
||||
|
||||
### Not in AD — Needs Account Created
|
||||
| Name | Position | Department | Shared Email | Notes |
|
||||
|------|----------|------------|-------------|-------|
|
||||
| Kyla Quick Tiffany | Resident Services Receptionist | Resident Services | Frontdesk@ | New — needs AD + M365 account |
|
||||
|
||||
### Accounts Deleted (2026-04-13 cleanup)
|
||||
Anna.Pitzlin, Nela.Durut-Azizi, Jodi.Ramstack, Monica.Ramirez, Haris.Durut, Nuria.Diaz, Cathy.Reece, Kelly.Wallace, Isabella.Islas, ann.dery, alyssa.brooks (duplicate), Lupe.Sanchez (duplicate), jeff.bristol
|
||||
|
||||
### Disabled Accounts (2) — cleaned 2026-04-13
|
||||
| Name | SamAccountName | Notes |
|
||||
|------|---------------|-------|
|
||||
| Guest | Guest | Built-in — correct to leave disabled |
|
||||
| krbtgt | krbtgt | Built-in Kerberos — correct to leave disabled. **Password 569+ days old — needs rotation** |
|
||||
|
||||
## Domain-Joined Computers (8)
|
||||
|
||||
### OU=Domain Controllers
|
||||
| Computer | Role |
|
||||
|----------|------|
|
||||
| CS-SERVER | Primary DC, File Server, Hyper-V host |
|
||||
|
||||
### CN=Computers (default)
|
||||
| Computer | Role |
|
||||
|----------|------|
|
||||
| CS-QB | Hyper-V VM — VoIP server |
|
||||
|
||||
### OU=Staff PCs,OU=Workstations (moved 2026-04-13)
|
||||
| Computer | User | Role |
|
||||
|----------|------|------|
|
||||
| ACCT2-PC | Allison Reibschied | Accounting |
|
||||
| CRYSTAL-PC | Crystal Rodriguez | Sales Associate |
|
||||
| DESKTOP-H6QHRR7 | Sylvia Cuen | Staff workstation |
|
||||
| DESKTOP-1ISF081 | TBD | Unknown — needs identification |
|
||||
| DESKTOP-DLTAGOI | Sharon Edwards | Life Enrichment Assistant |
|
||||
| DESKTOP-ROK7VNM | Susan Hicks | Life Enrichment Director |
|
||||
|
||||
### Missing from AD (listed in overview but NOT domain-joined)
|
||||
- **SALES4-PC** — Sales workstation (10.0.20.203) — NOT in AD
|
||||
- **CHEF-PC** — Kitchen workstation (10.0.20.232) — NOT in AD
|
||||
- **MDIRECTOR-PC** — MemCare Director (192.168.3.20) — NOT in AD
|
||||
- **DESKTOP-KQSL232** — Unknown (10.0.20.227) — NOT in AD
|
||||
|
||||
These 4 machines are on the network but not domain-joined. They may be workgroup machines or were never joined to the domain.
|
||||
|
||||
## Organizational Units
|
||||
|
||||
### Current State (pre-cleanup)
|
||||
```
|
||||
cascades.local
|
||||
├── Builtin (system)
|
||||
├── Computers (default container) ← 5 PCs here: ACCT2-PC, CRYSTAL-PC, CS-QB, DESKTOP-1ISF081, DESKTOP-H6QHRR7
|
||||
├── Users (default container) ← 20 accounts dumped here (system + stale + needs placement)
|
||||
├── Domain Controllers
|
||||
│ └── CS-SERVER
|
||||
├── Managment ← MISSPELLED, empty — DELETE
|
||||
├── Sales ← empty — DELETE
|
||||
├── MemCare ← empty — DELETE
|
||||
├── Administrative ← ROOT DUPLICATE of Departments\Administrative — DELETE
|
||||
├── Care-Assisted Living ← ROOT DUPLICATE — DELETE
|
||||
├── Care-Memorycare ← ROOT DUPLICATE — DELETE
|
||||
├── Culinary ← ROOT DUPLICATE — DELETE
|
||||
├── Housekeeping ← ROOT DUPLICATE — DELETE
|
||||
├── Life Enrichment ← ROOT DUPLICATE — DELETE
|
||||
├── Maintenance ← ROOT DUPLICATE — DELETE
|
||||
├── Marketing ← ROOT DUPLICATE — DELETE
|
||||
├── Resident Services ← ROOT DUPLICATE — DELETE
|
||||
├── Transportation ← ROOT DUPLICATE — DELETE
|
||||
└── Departments
|
||||
├── Administrative (6 users)
|
||||
├── Care-Assisted Living (4 users)
|
||||
│ └── Nurses (sub-OU, empty)
|
||||
├── Care-Memorycare (2 users)
|
||||
├── Culinary (4 users)
|
||||
├── Housekeeping (1 user)
|
||||
├── Life Enrichment (2 users)
|
||||
├── Maintenance (2 users)
|
||||
├── Marketing (4 users)
|
||||
├── Resident Services (7 users)
|
||||
└── Transportation (3 users)
|
||||
```
|
||||
|
||||
### Target State (after cleanup — Phase 2.1 + 2.2)
|
||||
```
|
||||
cascades.local
|
||||
├── Builtin (system)
|
||||
├── Computers (default container) ← CS-QB stays here (VM, not staff PC)
|
||||
├── Users (default container) ← system/service accounts only
|
||||
├── Domain Controllers
|
||||
│ └── CS-SERVER
|
||||
├── Workstations ← NEW
|
||||
│ ├── Staff PCs ← NEW — CRYSTAL-PC, ACCT2-PC, DESKTOP-H6QHRR7, DESKTOP-1ISF081, DESKTOP-DLTAGOI, DESKTOP-ROK7VNM
|
||||
│ └── Shared PCs ← NEW — shared/rotation workstations (GPO: CSC - Shared Workstation)
|
||||
└── Departments
|
||||
├── Administrative (6 users)
|
||||
├── Care-Assisted Living (4 users)
|
||||
│ └── Nurses (sub-OU)
|
||||
├── Care-Memorycare (2 users)
|
||||
├── Culinary (4 users)
|
||||
├── Housekeeping (1 user)
|
||||
├── Life Enrichment (2 users)
|
||||
├── Maintenance (2 users)
|
||||
├── Marketing (4 users)
|
||||
├── Resident Services (7 users)
|
||||
└── Transportation (3 users)
|
||||
```
|
||||
|
||||
### Cleanup Scripts
|
||||
- `migration/scripts/phase2-ou-cleanup.ps1` — Audit + delete 13 root-level OUs, handle CN=Users accounts
|
||||
- `migration/scripts/phase2-ad-setup.ps1` — Security fixes, create Workstations OU, security groups, move computers
|
||||
|
||||
## Group Policy (as of 2026-03-07 export)
|
||||
|
||||
GPOs exist but effectiveness is limited since most PCs aren't domain-joined.
|
||||
|
||||
| GPO | Created | Modified | Settings | Notes |
|
||||
|-----|---------|----------|----------|-------|
|
||||
| Default Domain Policy | Aug 2024 | Mar 2026 | Password: 7-char min, 42-day max, complexity on, 24 history. **Lockout: 5 attempts / 30 min** (fixed 2026-03-09). Kerberos defaults. | OK |
|
||||
| Default Domain Controllers Policy | Aug 2024 | Oct 2024 | IIS app pool audit rights, print operator driver loading. Standard. | OK |
|
||||
| Power Options | Jul 2025 | Jul 2025 | "Cascades Default" power plan: never sleep/hibernate, display off 15 min (plugged in) / 10 min (battery), password on wake. | Reasonable — keep |
|
||||
| ~~CopyRoomPrinter~~ | Dec 2025 | Dec 2025 | EMPTY | **DELETED 2026-03-09** |
|
||||
| ~~Nurses-Kiosk~~ | Dec 2025 | Dec 2025 | EMPTY | **DELETED 2026-03-09** |
|
||||
| ~~MemCareMedTechPrinter~~ | Dec 2025 | Dec 2025 | EMPTY | **DELETED 2026-03-09** |
|
||||
|
||||
**GPO Review (2026-03-07):** All 3 Dec 2025 GPOs are completely empty shells — no computer or user settings, not linked to any OU. Safe to delete with zero impact. The Default Domain Policy has account lockout disabled (threshold = 0), allowing unlimited password brute-force attempts — this needs to be fixed in the security baseline GPO.
|
||||
|
||||
## RDS Licensing
|
||||
- **Mode: NotConfigured**
|
||||
- **License Servers: None**
|
||||
- RDS roles are installed on CS-SERVER (Connection Broker, Session Host, Web Access) but licensing is NOT configured.
|
||||
- **Compliance risk:** Windows Server allows a 120-day grace period for RDS without licensing. After that, connections may be refused. Since the server was installed 8/4/2024 (~19 months ago), the grace period has long expired. RDS may be running in non-compliant mode.
|
||||
|
||||
## Existing AD Groups (Custom)
|
||||
|
||||
| Group | Members | Notes |
|
||||
|-------|---------|-------|
|
||||
| QuickBooks Access | Meredith.Kuhn, Megan.Hiatt, Ashley.Jensen, lauren.hasselman | Renamed from "Quickboosk acccess" on 2026-03-09 |
|
||||
| Roaming | (empty) | Old roaming profile attempt — unused |
|
||||
| MemoryCareDepartment | (empty) | Never populated |
|
||||
| KitchenAdmin | (empty) | Never populated |
|
||||
|
||||
## Migration Plan — AD Changes (Phase 2.2 + 2.6 + 3)
|
||||
|
||||
See `migration/phase2-server-prep.md` and `migration/scripts/phase2-ad-setup.ps1`.
|
||||
|
||||
### Security Fixes (immediate)
|
||||
- Remove disabled Monica.Ramirez from **Domain Admins** (security risk)
|
||||
- Disable Haris.Durut (still enabled, not employed)
|
||||
- Fix "Quickboosk acccess" → "QuickBooks Access"
|
||||
- Add lauren.hasselman to QuickBooks Access (replaced Jeff Bristol)
|
||||
|
||||
### OU Changes
|
||||
- **DELETE 10 root-level duplicate OUs** (Administrative, Care-Assisted Living, Care-Memorycare, Culinary, Housekeeping, Life Enrichment, Maintenance, Marketing, Resident Services, Transportation) — duplicates of Departments sub-OUs
|
||||
- **DELETE 3 empty root-level OUs** (Managment, MemCare, Sales) — unused
|
||||
- Create: `OU=Workstations,DC=cascades,DC=local`
|
||||
- Create: `OU=Staff PCs,OU=Workstations,DC=cascades,DC=local`
|
||||
|
||||
### Security Groups (created with members from Synology permission mapping)
|
||||
|
||||
| Group | Members |
|
||||
|-------|---------|
|
||||
| SG-Management-RW | Meredith.Kuhn, Ashley.Jensen, Megan.Hiatt, Crystal.Rodriguez, Tamra.Matthews, britney.thompson, Veronica.Feller, strozzi, Alyssa.Brooks, lauren.hasselman |
|
||||
| SG-Sales-RW | Megan.Hiatt, Crystal.Rodriguez, Tamra.Matthews |
|
||||
| SG-Server-RW | Ashley.Jensen, britney.thompson, Christina.DuPras, Veronica.Feller, Meredith.Kuhn |
|
||||
| SG-Chat-RW | Ashley.Jensen, britney.thompson, Veronica.Feller |
|
||||
| SG-Culinary-RW | JD.Martin, Ramon.Castaneda, Alyssa.Brooks |
|
||||
| SG-IT-RW | howard, sysadmin |
|
||||
| SG-Receptionist-RW | Cathy.Kingston, Shontiel.Nunn, Ray.Rai, Sebastian.Leon, Michelle.Shestko |
|
||||
| SG-Directory-RW | Cathy.Kingston, Shontiel.Nunn, Christina.DuPras |
|
||||
| SG-AllShares-RO | (populated as needed) |
|
||||
|
||||
### Account Removals (client confirmed)
|
||||
|
||||
**Already disabled — delete:** Anna.Pitzlin, Nela.Durut-Azizi, Jodi.Ramstack, Monica.Ramirez, jeff.bristol
|
||||
|
||||
**Enabled but not in HR — disable + delete:** Haris.Durut, Nuria.Diaz, Cathy.Reece, Kelly.Wallace, alyssa.brooks, Isabella.Islas, ann.dery
|
||||
|
||||
**Keep:** lauren.hasselman (replaced Bristol as Business Office Director)
|
||||
|
||||
### CN=Users — HR Verified (2026-03-10)
|
||||
|
||||
HR (Meredith) responded. All accounts resolved:
|
||||
|
||||
| Account | Enabled | Last Logon | Action |
|
||||
|---------|---------|-----------|--------|
|
||||
| Lupe.Sanchez | Yes | Never | **Keep** — confirmed same person as Guadalupe.Sanchez (M365: lupe.sanchez@). Merge or delete duplicate |
|
||||
| Receptionist | Yes | 2/22/2026 | Shared account — keep until Phase 5 replacement |
|
||||
| directoryshare | Yes | 2/26/2026 | Shared/service account — keep until Phase 5 replacement |
|
||||
|
||||
**Confirmed DELETE by HR:**
|
||||
- Anna.Pitzlin (disabled) — was forwarded to Meredith, OK to delete now
|
||||
- Nela.Durut-Azizi (disabled) — was forwarded to Meredith, OK to delete now
|
||||
- Jodi.Ramstack (disabled)
|
||||
- Monica.Ramirez (disabled, already removed from Domain Admins)
|
||||
- Kristiana.Dowse — M365 only, not in AD. Delete M365 account + remove license
|
||||
|
||||
**Already confirmed for removal (not current employees, never logged in):**
|
||||
Haris.Durut, Nuria.Diaz, Cathy.Reece, Kelly.Wallace, Isabella.Islas, ann.dery, alyssa.brooks (lowercase duplicate)
|
||||
|
||||
**System/service accounts staying in CN=Users:**
|
||||
Administrator, Guest, krbtgt, localadmin, sysadmin, QBDataServiceUser34
|
||||
|
||||
### Domain Join (Phase 3)
|
||||
Join these PCs to cascades.local in OU=Staff PCs,OU=Workstations:
|
||||
- DESKTOP-KQSL232 (first)
|
||||
- CHEF-PC
|
||||
- SALES4-PC
|
||||
- MDIRECTOR-PC (last)
|
||||
|
||||
### GPOs to Create (Phase 2.6)
|
||||
1. **CSC - Drive Mappings** — S:, M:, T:, K:, I:, R:, P: with item-level targeting
|
||||
2. **CSC - Printer Deployment** — Deploy printers by OU/group targeting (Life Enrichment first: 1F-132-RecRoom-Canon + CopyRoom)
|
||||
3. **CSC - Security Baseline** — 12-char passwords, complexity, lockout 5/30, screen lock 15 min
|
||||
4. **CSC - Windows Update** — Auto download, Sundays 3 AM, no auto-restart
|
||||
5. **CSC - Folder Redirection** — Desktop, Documents, Downloads → `\\CS-SERVER\homes\%username%\`
|
||||
6. **CSC - Shared Workstation** — Linked to Shared PCs OU; ILT by computer name for reception drive (R:), front desk printer, Outlook online mode, shared mailbox auto-mount. Blocked on: M365 tenant details, onsite PC identification.
|
||||
|
||||
### Entra Connect (Phase 2.7 — NEW)
|
||||
- Install Entra Connect on CS-SERVER for AD → M365 sync + SSO
|
||||
- **BLOCKED ON:** AD cleanup (renames, deletions, duplicate resolution) must complete first
|
||||
- See `cloud/m365.md` → "Entra Connect — SSO Setup Plan" for full prerequisites and steps
|
||||
- Enables: single sign-on, one password, auto Office/Edge activation per user, roaming experience without roaming profiles
|
||||
|
||||
### Shared Account Replacement (Phase 5)
|
||||
Replace Culinary, Receptionist, saleshare, directoryshare with security group access.
|
||||
|
||||
## Domain Admins (from 2026-03-07 export)
|
||||
|
||||
| Account | Status | Action Needed |
|
||||
|---------|--------|---------------|
|
||||
| Administrator | Enabled | OK (built-in) |
|
||||
| Meredith.Kuhn | Enabled | **REMOVE** — administrative staff, not IT |
|
||||
| John.Trozzi | Enabled | **REMOVE** — maintenance, not IT |
|
||||
| ~~Monica.Ramirez~~ | **Disabled** | **REMOVED 2026-03-09** |
|
||||
| sysadmin | Enabled | OK (IT account) |
|
||||
|
||||
## Login Activity (audit 2026-03-20)
|
||||
|
||||
Only 12 of 49 enabled accounts have ever logged in. Most staff have never used their AD accounts because their PCs aren't domain-joined.
|
||||
|
||||
| Account | Last Logon | Notes |
|
||||
|---------|-----------|-------|
|
||||
| sysadmin | 2026-03-16 | |
|
||||
| QBDataServiceUser34 | 2026-03-14 | QuickBooks service |
|
||||
| Allison.Reibschied | 2026-03-13 | **NEW** — Administrative |
|
||||
| lauren.hasselman | 2026-03-12 | Business Office Director |
|
||||
| Administrator | 2026-03-11 | |
|
||||
| Receptionist | 2026-03-11 | Shared account |
|
||||
| directoryshare | 2026-03-10 | Shared account |
|
||||
| localadmin | 2026-03-09 | |
|
||||
| Crystal.Rodriguez | 2026-03-09 | CRYSTAL-PC |
|
||||
| Culinary | 2026-02-20 | Shared account |
|
||||
| saleshare | 2025-12-08 | Shared account |
|
||||
| Christina.DuPras | 2026-01-06 | |
|
||||
| Monica.Ramirez | 2024-11-04 | **Disabled** |
|
||||
|
||||
**37 enabled accounts have NEVER logged in** — most have never set a password either.
|
||||
|
||||
## Issues Found
|
||||
1. **Only 6 computers domain-joined** — At least 4 known staff PCs are NOT in AD. (Migration Phase 3 will fix)
|
||||
2. **3 GPOs from Dec 2025 undocumented** — CopyRoomPrinter, Nurses-Kiosk, MemCareMedTechPrinter. Need to review settings and linkage. Previous MSP or sysadmin created these.
|
||||
3. **RDS licensing not configured** — Compliance risk, grace period expired ~17 months ago. (Phase 5 decision)
|
||||
4. **12 accounts to remove** — 5 disabled + 7 former employees still enabled. (Phase 2.1/2.2)
|
||||
5. **4 shared/generic accounts** (Culinary, Receptionist, saleshare, directoryshare) — To be replaced. (Phase 5)
|
||||
6. **Monica.Ramirez (disabled) still in Domain Admins** — Security risk, fix immediately. (Phase 2.2)
|
||||
7. **Meredith.Kuhn and John.Trozzi in Domain Admins** — Non-IT staff should not be DAs. (Phase 2.2)
|
||||
8. **"Managment" OU misspelled** — To be deleted (empty). (Phase 2.1)
|
||||
9. **"Quickboosk acccess" group typo** — To be fixed. (Phase 2.2)
|
||||
10. **13 junk root-level OUs** — 10 duplicate department OUs + Managment + MemCare + Sales, all empty. Delete in Phase 2.1.
|
||||
11. **20 accounts in CN=Users** — Mix of system, stale, and misplaced. Clean up in Phase 2.1.
|
||||
12. **5 computers in CN=Computers** — Move 4 staff PCs to Workstations OU. CS-QB stays. (Phase 2.2)
|
||||
13. **Lupe.Sanchez** — In CN=Users, possible duplicate of Guadalupe.Sanchez (Housekeeping). Flag for onsite review.
|
||||
299
clients/cascades-tucson/docs/servers/cs-server.md
Normal file
299
clients/cascades-tucson/docs/servers/cs-server.md
Normal file
@@ -0,0 +1,299 @@
|
||||
# Server: CS-SERVER
|
||||
|
||||
## General Info
|
||||
- Hostname: CS-SERVER
|
||||
- IP Address: 192.168.2.254
|
||||
- Subnet Mask: 255.255.252.0 (/22)
|
||||
- Default Gateway: 192.168.0.1 (pfSense)
|
||||
- DNS Servers: 127.0.0.1 (itself), 192.168.0.1 (pfSense) — **FIXED 2026-03-06**
|
||||
- OS: Microsoft Windows Server 2019 Standard
|
||||
- OS Version: 10.0.17763 Build 17763
|
||||
- OS Configuration: **Primary Domain Controller**
|
||||
- Domain: cascades.local
|
||||
- Physical / Virtual: Physical (Hyper-V host)
|
||||
- Location: Server room (1st Floor)
|
||||
- Original Install Date: 8/4/2024
|
||||
- Last Boot: 3/14/2026 (uptime 5.9 days as of audit)
|
||||
- Timezone: (UTC-07:00) Arizona — **FIXED 2026-03-07** (was Pacific Time)
|
||||
|
||||
## Hardware
|
||||
- Make/Model: **Dell PowerEdge R610** (CRITICAL: ~2009 era hardware, 16+ years old)
|
||||
- BIOS: Dell Inc. 6.6.0, 5/22/2018
|
||||
- CPU: 2x Intel Xeon (Nehalem, Model 26) @ 2261 MHz
|
||||
- RAM: 48 GB (36.9 GB available)
|
||||
- System Type: x64-based PC
|
||||
|
||||
## Storage
|
||||
|
||||
### RAID Controller
|
||||
- Controller: Dell SAS 6/iR Integrated (Embedded)
|
||||
- Type: Hardware RAID (basic, no battery-backed cache)
|
||||
|
||||
### Physical Disks (5 total)
|
||||
| Disk ID | Model | Bus | Size | Mfg Year | Serial | Role | Status |
|
||||
|---------|-------|-----|------|----------|--------|------|--------|
|
||||
| 0:0:0 | Seagate ST1200MM0088 | SAS | 1.12 TB | 2016 wk52 | Z400WHK8 | RAID (D: Shares) | OK |
|
||||
| 0:0:1 | Seagate ST1200MM0088 | SAS | 1.12 TB | 2015 wk43 | S400RL2N | RAID (D: Shares) | OK |
|
||||
| 0:0:2 | Hitachi HTS545032B9A300 | SATA | 297.5 GB | Unknown | 100602PB... | RAID (C: OS) | OK |
|
||||
| 0:0:3 | WD WD3200BEVT-75ZCT2 | SATA | 297.5 GB | Unknown | WD-WXEX... | RAID (C: OS) | OK |
|
||||
| 1:0:4 | Seagate ST1200MM0088 | SAS | 1.12 TB | 2016 wk52 | Z400WHML | **Global Hot Spare** | Ready |
|
||||
|
||||
**Failure Predicted on any disk: No** (all currently healthy)
|
||||
|
||||
### Disk Concerns
|
||||
- Disks 0:0:2 and 0:0:3 are **consumer-grade SATA laptop drives** (Hitachi 2.5" and WD Scorpio Blue) running the OS RAID. These are NOT enterprise drives. They have no manufacture date — likely very old.
|
||||
- Disks 0:0:0 and 0:0:1 are enterprise SAS drives from 2015-2016 — now 9-10 years old.
|
||||
- Disk 1:0:4 is a **global hot spare** (SAS, 1.12TB) — good, this will auto-rebuild if a SAS drive fails in the D: array. However, there is NO hot spare for the C: SATA array.
|
||||
- The SAS 6/iR controller is very basic — does NOT have a battery-backed write cache.
|
||||
|
||||
### Logical Volumes
|
||||
| Drive | Label | Filesystem | Size | Free | Used | Backed By |
|
||||
|-------|-------|------------|------|------|------|-----------|
|
||||
| C: | (OS) | NTFS | 296.9 GB | 152.1 GB | 49% | 2x SATA laptop drives (RAID 1 likely) |
|
||||
| D: | Shares | NTFS | 1.09 TB | 584.6 GB | 48% | 2x SAS enterprise drives (RAID 1 likely) + hot spare |
|
||||
| - | Recovery | NTFS | 499 MB | 482.8 MB | | |
|
||||
|
||||
## Network Interfaces
|
||||
| NIC | Description | MAC | Status | IP |
|
||||
|-----|------------|-----|--------|-----|
|
||||
| Ethernet | QLogic BCM5709C #37 | 00:22:19:60:50:E1 | **Disconnected** | - |
|
||||
| Ethernet 2 | QLogic BCM5709C #35 | 00:22:19:60:50:DD | **Disconnected** | - |
|
||||
| Ethernet 3 | QLogic BCM5709C (used by Hyper-V vSwitch) | 00:22:19:60:50:DB | Active (underlying) | - |
|
||||
| Ethernet 4 | QLogic BCM5709C #36 | 00:22:19:60:50:DF | **Disconnected** | - |
|
||||
| vEthernet | Hyper-V Virtual Adapter | 00:22:19:60:50:DB | **Active** | 192.168.2.254 |
|
||||
|
||||
Only 1 of 4 physical NICs is in use (via Hyper-V virtual switch). 3 NICs disconnected.
|
||||
|
||||
## Roles and Services (Installed)
|
||||
- [x] **Active Directory Domain Services** (Primary DC)
|
||||
- [x] **DHCP Server**
|
||||
- [x] **DNS Server**
|
||||
- [x] **File Server** (D:\Shares)
|
||||
- [x] **Hyper-V** (Hypervisor)
|
||||
- [x] **Remote Desktop Services** (Connection Broker, Session Host, Web Access) — **NOT USED, can be removed**
|
||||
- [x] **IIS Web Server** (ASP.NET 4.7, Windows Auth)
|
||||
- [x] **Network Policy and Access Services (NPS/RADIUS)** — **NOT USED, no RADIUS clients configured, can be removed**
|
||||
- [x] Group Policy Management
|
||||
- [x] RSAT Tools
|
||||
|
||||
## Hyper-V Virtual Machines
|
||||
| VM Name | State | RAM Assigned | Uptime | Status | Notes |
|
||||
|---------|-------|-------------|--------|--------|-------|
|
||||
| CS-QB | **Running** | 2.35 GB | 7d 10h | Normal | VoIP server — seen on network at 192.168.2.228 |
|
||||
| Synology Sync machine | Off | 0 | - | Normal | NOT USED — safe to delete, was set up "just in case" |
|
||||
| VM-TEMPLATE | Off | 0 | - | Normal | Template VM for cloning |
|
||||
|
||||
- The host's single active NIC is shared via a Hyper-V virtual switch
|
||||
- CS-QB is the VoIP-related VM (explains the "CS-QB" device on 1st Floor USW Port 48)
|
||||
- Synology Sync machine can be removed to free disk space
|
||||
- RAID health: Windows reports virtual disks as healthy, but actual physical drive health is behind the Dell PERC controller. Need Dell OpenManage or `omreport` / `perccli64` to check real disk SMART status
|
||||
|
||||
## SMB File Shares (audit 2026-03-20)
|
||||
| Share Name | Path | SMB Perms | NTFS Notes |
|
||||
|-----------|------|-----------|------------|
|
||||
| Shares | D:\Shares | Everyone=Read, Admins=Full, Domain Computers=Read | **Everyone=FullControl** (too permissive) |
|
||||
| Culinary | D:\Shares\Culinary | Admins=Full, **Everyone=Full** | Everyone=FullControl — needs restriction |
|
||||
| directoryshare | D:\Shares\directoryshare | **Everyone=Full** | Everyone=FullControl — needs restriction |
|
||||
| IT | D:\Shares\IT | Admins=Full, Everyone=Full | Everyone=ReadAndExecute only (OK) |
|
||||
| Receptionist | D:\Shares\Receptionist | Admins=Full, Everyone=Full | Receptionist=Full, admins only |
|
||||
| SaleShare | D:\Shares\SaleShare | Everyone=Read, saleshare=Full | saleshare=Full |
|
||||
| Roaming | D:\Roaming | Admins=Full, Everyone=Full | **Domain Users=FullControl** (too broad) |
|
||||
| RDVirtualDesktopTemplate | C:\RDVirtualDesktopTemplate | Network Service/Admins/RDS=Full | Standard |
|
||||
| MemCare Director Printer | (printer share) | Everyone=Full | Printer share |
|
||||
| MemCare MedTech Printer | (printer share) | Everyone=Full | Printer share |
|
||||
| NETLOGON | C:\Windows\SYSVOL\...\SCRIPTS | Everyone=Read | Standard |
|
||||
| SYSVOL | C:\Windows\SYSVOL\sysvol | Everyone=Read, Admins=Full | Standard |
|
||||
| ADMIN$, C$, D$ | (system) | Admin only | Default admin shares |
|
||||
|
||||
## Synology Sync
|
||||
- **Synology Drive Client** installed on CS-SERVER (2026-03-07)
|
||||
- Syncing all Synology shares to `D:\Shares\Main`
|
||||
- Live continuous sync (Synology → CS-SERVER)
|
||||
- Previous install was removed and reinstalled due to incomplete sync config
|
||||
|
||||
## Installed Software (audit 2026-03-20)
|
||||
| Software | Version | Notes |
|
||||
|----------|---------|-------|
|
||||
| **QuickBooks Pro 2024** | 34.0.4008.3401 | **Should NOT be on a DC** |
|
||||
| Synology Drive Client | 7.5.0.16085 | Live sync from Synology NAS to D:\Shares\Main |
|
||||
| Datto EDR Agent | 3.17.1.4720 | Remove when migrating to new AV |
|
||||
| Datto RMM | 4.4.10748 | Previous RMM — remove |
|
||||
| Dell EMC OpenManage | 9.3.0 | Server management — keep |
|
||||
| Google Chrome | 146.0.7680.154 | |
|
||||
| Mozilla Firefox | 148.0.2 | |
|
||||
| PuTTY | 0.83 | SSH client |
|
||||
| Everything | 1.4.1.1026 | File search tool |
|
||||
| KPAX Agent | 3.1.2409 | Print management |
|
||||
| ScreenConnect Client | 26.1.18.9566 | Remote access |
|
||||
| Splashtop Streamer | 3.8.0.4 | Previous MSP — remove |
|
||||
| Syncro | 1.0.199.18369 | Current RMM |
|
||||
| WinRAR | 7.20 | |
|
||||
| .NET 6.0.x runtimes | Various | Required by apps |
|
||||
| VC++ 2013 & 2022 Redist | Various | Runtime dependencies |
|
||||
|
||||
## Security Findings (audit 2026-03-20)
|
||||
|
||||
### Certificates
|
||||
- **EXPIRED:** CN=CS-SERVER.cascades.local self-signed cert expired **2025-04-02** — causes Schannel errors
|
||||
|
||||
### Password Policy
|
||||
- Min length: **7** (should be 12+)
|
||||
- Complexity: enabled
|
||||
- Max age: 42 days | Min age: 1 day | History: 24
|
||||
- Lockout: 5 attempts / 30 min
|
||||
|
||||
### Critical Security Issues
|
||||
| Finding | Status |
|
||||
|---------|--------|
|
||||
| **No LAPS deployed** (legacy or Windows LAPS) | Not configured |
|
||||
| **MachineAccountQuota = 10** | Any user can join 10 machines |
|
||||
| **AD Recycle Bin NOT enabled** | Deleted objects not recoverable |
|
||||
| **10 accounts with PasswordNeverExpires** | Administrator, localadmin, Lois.Lane, sysadmin, QBDataServiceUser34, Culinary, Receptionist, howard, directoryshare, strozzi |
|
||||
| **23 accounts never set a password** | PasswordLastSet = null |
|
||||
| **Protected Users group EMPTY** | No accounts protected against credential theft |
|
||||
| **RestrictAnonymous = 0** | Null sessions allowed (should be 1+) |
|
||||
| **LDAP Channel Binding not configured** | Should be enabled |
|
||||
| **krbtgt password age: 569 days** | Last set 2024-08-28, should rotate every 180 days |
|
||||
| **No screen lock policy** | No inactivity timeout configured |
|
||||
| **Object Access auditing DISABLED** | No file/registry auditing (HIPAA requirement) |
|
||||
| **TLS 1.0/1.1 and SSL not explicitly disabled** | All at OS default |
|
||||
| **Credential Guard NOT running** | VBS running but CG not enabled |
|
||||
| **AutomationManagerAgent service** | Stopped — file not found (orphan) |
|
||||
| **Windows Server Backup not installed** | Feature not present |
|
||||
| **NPS PowerShell module missing** | Role installed but cmdlets unavailable |
|
||||
|
||||
### Firewall
|
||||
- All 3 profiles (Domain, Private, Public) enabled
|
||||
- Default inbound/outbound: NotConfigured
|
||||
- 341 rules total (206 inbound, 135 outbound) — ALL Allow, no Block rules
|
||||
- No logging enabled
|
||||
- Notable inbound: RDP (3389), HTTP/HTTPS (80/443), AD/DNS, QuickBooks (8019, 64214), Dell OpenManage (1311), Syncro/Splashtop/Datto (any port)
|
||||
|
||||
### Domain Admins — Never Logged In
|
||||
- **Meredith.Kuhn:** Domain Admin, never logged in, never set a password
|
||||
- **John.Trozzi:** Domain Admin, never logged in, never set a password
|
||||
|
||||
## Listening Ports (Key Services)
|
||||
| Port | Protocol | Service | Notes |
|
||||
|------|----------|---------|-------|
|
||||
| 53 | TCP | DNS | On 192.168.2.254 + localhost |
|
||||
| 80/443 | TCP | IIS (HTTP/HTTPS) | Bound to 0.0.0.0 — exposed to all interfaces |
|
||||
| 88 | TCP | Kerberos | AD authentication |
|
||||
| 135 | TCP | RPC Endpoint Mapper | Standard Windows |
|
||||
| 389/636 | TCP | LDAP/LDAPS | AD directory services |
|
||||
| 445 | TCP | SMB | File shares |
|
||||
| 464 | TCP | Kerberos kpasswd | Password changes |
|
||||
| 1311 | TCP | Dell OpenManage Web | Management console |
|
||||
| 2179 | TCP | Hyper-V VMMS | VM management |
|
||||
| 3268/3269 | TCP | Global Catalog / GC SSL | AD Global Catalog |
|
||||
| 3387 | TCP | RDP (alternate) | Second RDP listener (RDS?) |
|
||||
| 3389 | TCP | RDP | Remote Desktop |
|
||||
| 5357 | TCP | WSDAPI | Web Services Discovery |
|
||||
| 5504 | TCP | Unknown | **Needs identification** |
|
||||
| 5985 | TCP | WinRM | PowerShell remoting |
|
||||
| 6600 | TCP | QuickBooks DB Server | On 192.168.2.254 + link-local IPv6 |
|
||||
| 6783 | TCP | Unknown | **Needs identification** |
|
||||
| 8019 | TCP | Unknown | **Needs identification** |
|
||||
| 9389 | TCP | AD Web Services | AD management |
|
||||
|
||||
## Hotfixes Installed (16)
|
||||
KB5066137, KB4486153, KB4539571, KB4577586, KB4589208, KB5005112, KB5075904, KB5040563, KB5050110, KB5058525, KB5062800, KB5065765, KB5066585, KB5070248, KB5074222, KB5075903
|
||||
|
||||
## Related Devices
|
||||
- MAC 00:22:19:60:50:E1 seen on 1st Floor USW Port 44 (PoE OFF)
|
||||
- MAC 00:22:19:60:50:DB seen on 1st Floor USW Port 48 as "CS-QB" (192.168.2.228) — this is the Hyper-V vSwitch NIC
|
||||
|
||||
## Backup
|
||||
- **NONE — NO BACKUP EXISTS FOR THIS SERVER**
|
||||
- **HIPAA VIOLATION:** §164.308(a)(7) requires backup of all PHI. CS-SERVER stores PHI (synced from Synology + file shares).
|
||||
- This server is the ONLY domain controller
|
||||
- If this server dies, Active Directory, DNS, DHCP, file shares, and RDS are ALL lost
|
||||
|
||||
## Known Admin Issues
|
||||
|
||||
### Folder Redirection CSE silently declines to commit — ROOT CAUSE UNKNOWN
|
||||
**Investigated 2026-04-14. Not fully resolved — currently using manual registry fix as workaround.**
|
||||
|
||||
**Symptoms:**
|
||||
- GPO `CSC - Folder Redirection (LE)` is correctly configured (verified via SYSVOL inspection and RSAT on a Win11 PC — both wrote identical, valid `fdeploy1.ini` with `FullPath=\\CS-SERVER\homes\%USERNAME%\Documents` and `Flags=1231`)
|
||||
- GPO is correctly linked to `OU=Life Enrichment`, old `CSC - Folder Redirection` GPO has been unlinked
|
||||
- `gpresult /r /scope:user` on a Life Enrichment user (Sharon.Edwards) confirms the new GPO is in "Applied Group Policy Objects"
|
||||
- At logon, FR client-side extension fires, reads config, and **logs event 1006 "Folder Documents has to be redirected" with correct target path**
|
||||
- Extension then logs event 1001 "finished" — **no error events, no event 1013 (success)**
|
||||
- `HKCU\...\User Shell Folders\Personal` is never updated, Documents stays at `C:\Users\<user>\Documents`
|
||||
- Multiple logon cycles, `gpupdate /force`, clearing GP cache do not resolve
|
||||
|
||||
**What we verified is NOT the cause:**
|
||||
- ❌ GPMC on CS-SERVER writing "broken" files — false. Both CS-SERVER GPMC and Win11 RSAT write identical, valid modern format (`User\Documents & Settings\fdeploy1.ini` with `FullPath=` IS the correct modern location; earlier claim this was "legacy XP format" was wrong)
|
||||
- ❌ SYSVOL ACL problems — SYSVOL writable, `dcdiag /test:sysvolcheck` passes
|
||||
- ❌ NTFS permission issues — user has FullControl on their `\\CS-SERVER\homes\<user>` folder, write test succeeds
|
||||
- ❌ Extension registration — `gPCUserExtensionNames` correctly lists `{25537BA6-77A8-11D2-9B6C-0000F8080861}`
|
||||
- ❌ Target path unreachable — manual `New-Item` and `Test-Path` succeed
|
||||
- ❌ User OU placement — user is in OU=Life Enrichment, GPO applies per gpresult
|
||||
|
||||
**Suspected causes (to investigate later):**
|
||||
- Stale entry in `HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy\History\{25537BA6-77A8-11D2-9B6C-0000F8080861}` referencing the old unlinked GPO. Key is SYSTEM-protected — can't delete from user context, need elevated sysadmin access via HKU\\<SID>
|
||||
- Profile corruption from prior failed redirection attempts / GP Preferences registry hack
|
||||
- Competing shell folder state (e.g., `Desktop` is already at UNC via the original registry hack, `Personal` is local — mixed state may confuse FR)
|
||||
|
||||
**Current workaround (works reliably):**
|
||||
Set the User Shell Folders registry values directly — same pattern as the original GP Preferences Registry hack:
|
||||
```powershell
|
||||
Set-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" `
|
||||
-Name "Personal" `
|
||||
-Value "\\CS-SERVER\homes\<username>\Documents" -Type ExpandString
|
||||
```
|
||||
Then `robocopy /MOVE` local content to server, sign out, sign in. This works; FR does not.
|
||||
|
||||
**Admin console note:** RSAT GPMC on a Win11 Pro domain-joined workstation is now installed on ASSISTNURSE-PC (and Sharon Edwards' PC during testing). All future GPO edits should happen from RSAT — best practice regardless of this issue.
|
||||
|
||||
**Next debug steps (not tonight — fresh eyes needed):**
|
||||
1. Test FR on a **brand new user** (no profile history) in OU=Life Enrichment to rule out profile-level corruption
|
||||
2. If new user works → profile issue, proceed with per-user manual fix + eventual profile reset
|
||||
3. If new user also fails → policy or CSE issue, dig into FR debug logging (`fdeploy.log` verbose mode, enable via registry)
|
||||
4. Clear `Group Policy\History\{25537BA6...}` key from elevated sysadmin via `HKU\<SID>` path to rule out stale history
|
||||
|
||||
---
|
||||
|
||||
## CRITICAL ISSUES (all impact HIPAA compliance)
|
||||
|
||||
### 1. Hardware Age — EXTREME FAILURE RISK
|
||||
The Dell PowerEdge R610 was released in 2009. This server is 16+ years old. PERC RAID controllers, power supplies, and disks from this era have very high failure rates. This is the single most critical risk at Cascades.
|
||||
|
||||
### 2. Single Domain Controller — No Redundancy
|
||||
CS-SERVER is the ONLY DC for cascades.local. If it fails:
|
||||
- No Active Directory authentication
|
||||
- No DNS resolution (for domain-joined devices)
|
||||
- No DHCP (if clients use this DHCP)
|
||||
- No file shares
|
||||
- No RDS sessions
|
||||
- Complete business disruption
|
||||
|
||||
### 3. No Backup
|
||||
There is no backup solution. The Synology NAS at 192.168.0.120 is available as a target but is not configured to back up this server.
|
||||
|
||||
### 4. DHCP — RESOLVED (No Conflict)
|
||||
Windows DHCP role is installed but has NO scopes configured. pfSense handles all DHCP. No conflict exists. The DHCP role could be uninstalled to reduce confusion, but it's not causing harm.
|
||||
|
||||
### 5. DNS Client Misconfiguration — FIXED (2026-03-06)
|
||||
~~CS-SERVER pointed to pfSense (192.168.0.1) + 8.8.8.8 as its DNS servers.~~ Fixed: now uses `127.0.0.1` (itself) as primary, `192.168.0.1` (pfSense) as secondary. Verified working — both AD and external resolution resolve correctly through localhost.
|
||||
|
||||
### 7. CS-QB VM — VoIP Server on Ancient Hardware
|
||||
The CS-QB VM (2.35 GB RAM, running) is the VoIP server at 192.168.2.228. VoIP was noted as not MSP-managed, but the VM runs on CS-SERVER. If CS-SERVER hardware fails, phones go down too.
|
||||
|
||||
### 8. Synology Sync Machine VM is OFF
|
||||
A VM called "Synology Sync machine" exists but is powered off. Unclear if this is intentional or if it should be running to sync data to the Synology NAS. Needs investigation.
|
||||
|
||||
### 6. Too Many Roles on One Box
|
||||
This single server runs: DC, DNS, DHCP, File Server, Hyper-V, RDS, IIS, NPS. Any one role failure or resource contention affects everything.
|
||||
|
||||
## TODO (Priority Order)
|
||||
- [ ] **IMMEDIATE: Set up backup** — Synology Active Backup for Business → back up C: and D: nightly
|
||||
- [ ] **IMMEDIATE: Document VMs** — Run `Get-VM` to see what's running in Hyper-V
|
||||
- [ ] **URGENT: Plan DC migration** — This hardware WILL fail. Plan migration to new hardware or cloud
|
||||
- [ ] **URGENT: Add second DC** — Deploy a second DC (VM or cloud) for AD redundancy
|
||||
- [ ] Check RAID controller type and health: `Get-StorageSubSystem`, or Dell OpenManage
|
||||
- [ ] Verify DHCP scope split between pfSense and CS-SERVER
|
||||
- [ ] Document DNS forwarding chain (pfSense <-> Windows DNS)
|
||||
- [ ] Check RDS licensing status
|
||||
- [ ] List Hyper-V VMs and their purposes
|
||||
49
clients/cascades-tucson/docs/servers/server_template.md
Normal file
49
clients/cascades-tucson/docs/servers/server_template.md
Normal file
@@ -0,0 +1,49 @@
|
||||
# Server: [SERVER NAME]
|
||||
|
||||
## General Info
|
||||
- Hostname:
|
||||
- IP Address:
|
||||
- OS:
|
||||
- OS Version:
|
||||
- Physical / Virtual:
|
||||
- Host (if virtual):
|
||||
- Location:
|
||||
- Last Patched:
|
||||
|
||||
## Hardware (if physical)
|
||||
- Make/Model:
|
||||
- CPU:
|
||||
- RAM:
|
||||
- Storage:
|
||||
- Warranty Expiry:
|
||||
|
||||
## Roles and Services
|
||||
<!-- List all roles this server performs -->
|
||||
- [ ] Domain Controller
|
||||
- [ ] DNS Server
|
||||
- [ ] DHCP Server
|
||||
- [ ] File Server
|
||||
- [ ] Print Server
|
||||
- [ ] Application Server
|
||||
- [ ] Database Server
|
||||
- [ ] Backup Target
|
||||
- [ ] RDS / Terminal Server
|
||||
- [ ] Hyper-V Host
|
||||
|
||||
## Shares (if file server)
|
||||
| Share Name | Path | Permissions Group | Notes |
|
||||
|---------------|-------------------|---------------------|----------------|
|
||||
| | | | |
|
||||
|
||||
## Applications Installed
|
||||
| Application | Version | Purpose | License |
|
||||
|-------------------|------------|----------------------|---------------|
|
||||
| | | | |
|
||||
|
||||
## Backup
|
||||
- Backup Method:
|
||||
- Backup Schedule:
|
||||
- Backup Target:
|
||||
- Last Verified Restore:
|
||||
|
||||
## Notes
|
||||
Reference in New Issue
Block a user