sync: auto-sync from HOWARD-HOME at 2026-07-06 16:41:20

Author: Howard Enos Machine: HOWARD-HOME Timestamp: 2026-07-06 16:41:20
2026-07-06 16:41:48 -07:00
parent 419de64af5
commit 12c3d83f75
6 changed files with 1140 additions and 22 deletions
--- a/.claude/skills/screenconnect/scripts/sc.py
+++ b/.claude/skills/screenconnect/scripts/sc.py
@@ -101,18 +101,37 @@ def _gated(action_desc: str, confirm: bool) -> bool:

 # --- handlers ---
 def cmd_status(client, args):
-    # Auth check via the fleet filter; report instance + custom-property map + counts.
-    access = client.list_sessions(session_type="access")
-    support = client.list_sessions(session_type="support")
-    na = len(access) if isinstance(access, list) else 0
-    ns = len(support) if isinstance(support, list) else 0
+    # Auth check via the most basic verified method (GetSessionsByName), so status
+    # confirms credentials even on an extension version without GetSessionsByFilter.
+    client.get_sessions_by_name("")
    print(f"[OK] Authenticated to {SC_BASE_URL}")
    print(f"  extension: {client.extension_guid}")
    print(f"  custom properties: {CUSTOM_PROPERTIES}")
-    print(f"  fleet: {na} Access (unattended) + {ns} Support session(s)")
+    # Fleet counts are a best-effort add-on: the filter method may be absent, and it
+    # must never fail the auth check that status exists to perform.
+    try:
+        access = client.list_sessions(session_type="access")
+        support = client.list_sessions(session_type="support")
+        na = len(access) if isinstance(access, list) else 0
+        ns = len(support) if isinstance(support, list) else 0
+        print(f"  fleet: {na} Access (unattended) + {ns} Support session(s)")
+    except ScreenConnectError as exc:
+        print(f"  fleet: (listing unavailable via GetSessionsByFilter: {exc})")
    return 0


+def _effective_type(args) -> str:
+    """Resolve the SessionType filter for `sessions`. Explicit --type wins. Otherwise
+    a bare listing defaults to the Access fleet, but a TARGETED search (by name/like/
+    company/site/tag) spans all types - matching the old GetSessionsByName behavior,
+    where a by-name lookup found Support sessions too."""
+    if args.type is not None:
+        return args.type
+    if any([args.name, args.like, args.company, args.site, args.tag]):
+        return "all"
+    return "access"
+
+
 def cmd_sessions(client, args):
    # Full-fleet listing is the default (no selector -> every Access session).
    # A raw --filter wins; otherwise build a filter from the structured flags.
@@ -120,20 +139,17 @@ def cmd_sessions(client, args):
        data = client.get_sessions_by_filter(args.filter)
    else:
        data = client.list_sessions(
-            session_type=args.type,
+            session_type=_effective_type(args),
            name=args.name or None,
            name_like=args.like,
            company=args.company,
            site=args.site,
            tag=args.tag,
        )
-    if isinstance(data, list) and args.limit and len(data) > args.limit:
-        shown = data[: args.limit]
-        if args.json:
-            _emit(shown, True)
-        else:
-            _print_sessions(shown)
-            print(f"  ... {len(data) - args.limit} more (raise --limit or use --json)")
+    # --limit only caps the human-readable print; --json is always the full set.
+    if not args.json and isinstance(data, list) and args.limit and len(data) > args.limit:
+        _print_sessions(data[: args.limit])
+        print(f"  ... {len(data) - args.limit} more (raise --limit or use --json)")
        return 0
    _emit(data, True) if args.json else _print_sessions(data)
    return 0
@@ -225,8 +241,9 @@ def build_parser() -> argparse.ArgumentParser:
    sp.add_argument("--company", help="Filter by CP1 = Company.")
    sp.add_argument("--site", help="Filter by CP2 = Site.")
    sp.add_argument("--tag", help="Filter by CP3 = Tag.")
-    sp.add_argument("--type", default="access",
-                    help="access (default) | support | meeting | all.")
+    sp.add_argument("--type", default=None,
+                    help="access | support | meeting | all. Default: access for a "
+                         "bare listing, all when a name/company/etc selector is given.")
    sp.add_argument("--filter", help="Raw session-filter expression (overrides the flags).")
    sp.add_argument("--limit", type=int, default=0,
                    help="Cap rows printed (0 = no cap; --json is always full).")
--- a/.claude/skills/screenconnect/scripts/sc_client.py
+++ b/.claude/skills/screenconnect/scripts/sc_client.py
@@ -230,7 +230,9 @@ class ScreenConnectClient:
    @staticmethod
    def _filter_literal(value: str) -> str:
        """Single-quote a value for the session-filter language, escaping any
-        embedded single quote by doubling it (SQL-style)."""
+        embedded single quote by doubling it. VERIFIED LIVE 2026-07-06:
+        `CustomProperty1 LIKE '*Andy''s*'` matched the "Andy's Mobile Fuel" session,
+        so doubling is the correct escape for this filter grammar."""
        return "'" + str(value).replace("'", "''") + "'"

    def build_session_filter(
@@ -249,7 +251,12 @@ class ScreenConnectClient:
        CP1/CP2/CP3, `extra` is a raw clause appended verbatim. Defaults to the whole
        Access fleet when nothing else is specified."""
        clauses: list[str] = []
-        if session_type and session_type.lower() != "all":
+        if session_type and session_type.lower() == "all":
+            # 'all' = every session type. Only Access + Support exist on this
+            # instance; an OR clause is the verified match-all (a bare '*' matches
+            # nothing). VERIFIED LIVE 2026-07-06 -> 982 = 958 Access + 24 Support.
+            clauses.append("(SessionType = 'Access' OR SessionType = 'Support')")
+        elif session_type:
            literal = SESSION_TYPE_LITERALS.get(session_type.lower(), session_type)
            clauses.append(f"SessionType = {self._filter_literal(literal)}")
        if name:
--- a/.claude/skills/screenconnect/scripts/selftest.py
+++ b/.claude/skills/screenconnect/scripts/selftest.py
@@ -27,31 +27,40 @@ def run(args):
    return p.returncode, p.stdout, p.stderr


-def check(name, args, *, want_rc=None, out_has=None, out_json_ok=False):
+def check(name, args, *, want_rc=None, out_has=None, out_json_ok=False, out_json_min_len=None):
    rc, out, err = run(args)
    problems = []
    if want_rc is not None and rc != want_rc:
        problems.append(f"rc={rc} want {want_rc}")
    if out_has and out_has not in out:
        problems.append(f"stdout missing {out_has!r}")
-    if out_json_ok:
+    if out_json_ok or out_json_min_len is not None:
        try:
-            json.loads(out)
+            parsed = json.loads(out)
+            if out_json_min_len is not None and len(parsed) < out_json_min_len:
+                problems.append(f"json len {len(parsed)} < {out_json_min_len}")
        except Exception as e:
            problems.append(f"stdout not JSON: {e}")
    results.append(("PASS" if not problems else "FAIL", name, "; ".join(problems)))


 # --- reads: succeed (rc 0) [hit the live instance] ---
-check("status", ["status"], want_rc=0, out_has="fleet:")
+check("status", ["status"], want_rc=0, out_has="Authenticated")
+check("status shows fleet", ["status"], want_rc=0, out_has="fleet:")
 check("sessions (full fleet)", ["sessions"], want_rc=0, out_has="Sessions:")
 check("sessions json", ["sessions", "--json"], want_rc=0, out_json_ok=True)
 check("sessions --limit", ["sessions", "--limit", "5"], want_rc=0, out_has="Sessions:")
 check("sessions --like", ["sessions", "--like", "DELL", "--json"], want_rc=0, out_json_ok=True)
+check("sessions --type all", ["sessions", "--type", "all", "--json"], want_rc=0, out_json_ok=True)
 check("sessions --filter", ["sessions", "--filter", "SessionType = 'Access'", "--json"],
      want_rc=0, out_json_ok=True)
 check("sessions --company", ["sessions", "--company", "Safesite", "--json"],
      want_rc=0, out_json_ok=True)
+# --limit must NOT truncate --json (documented "--json is always full" contract):
+# Safesite has 62 machines; even with --limit 1 the JSON must return them all.
+check("sessions --limit does not truncate json",
+      ["sessions", "--company", "Safesite", "--limit", "1", "--json"],
+      want_rc=0, out_json_min_len=10)

 # --- build-installer: pure URL build (no network) ---
 check("build-installer", ["build-installer", "--name", "HOST", "--company", "AZ Computer Guru",
--- a/clients/goldstein/onboarding-baselines/DALLAS-20260706T233936.json
+++ b/clients/goldstein/onboarding-baselines/DALLAS-20260706T233936.json
@@ -0,0 +1,734 @@
+{
+  "host": "DALLAS",
+  "collected_at_utc": "2026-07-06T23:38:29Z",
+  "os": {
+    "caption": "Microsoft Windows 11 Home",
+    "version": "10.0.26200",
+    "build": "26200",
+    "install_date": "2025-02-04T20:12:28Z",
+    "last_boot_utc": "2026-06-11T20:41:51Z",
+    "architecture": "64-bit"
+  },
+  "facts": {
+    "builtin_admin_enabled": false,
+    "os_eol": {
+      "eol_date": "2027-10-12",
+      "release": "Win11 25H2"
+    },
+    "pending_updates": 1,
+    "pending_reboot": true,
+    "uptime_days": 25.1,
+    "acg_managed_tools": "ScreenConnect / ConnectWise Control",
+    "hardware": {
+      "model": "83HM",
+      "manufacturer": "LENOVO",
+      "bios_date": "2025-09-15",
+      "cpu_logical": 8,
+      "bios_version": "NYCN73WW",
+      "cpu_cores": 8,
+      "ram_gb": 15.6,
+      "serial": "PF570RZ0",
+      "cpu": "Intel(R) Core(TM) Ultra 7 256V"
+    },
+    "third_party_av_active": false,
+    "os_build": "26200",
+    "secure_boot": true,
+    "backup_agents": null,
+    "autoruns_run_keys": [
+      {
+        "key": "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
+        "name": "SecurityHealth",
+        "value": "C:\\Windows\\system32\\SecurityHealthSystray.exe"
+      },
+      {
+        "key": "HKLM:\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run",
+        "name": "Adobe Acrobat Speed Launcher",
+        "value": "\"C:\\Program Files (x86)\\Adobe\\Acrobat 9.0\\Acrobat\\Acrobat_sl.exe\""
+      },
+      {
+        "key": "HKLM:\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run",
+        "name": "(default)",
+        "value": ""
+      },
+      {
+        "key": "HKLM:\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run",
+        "name": "Acrobat Assistant 8.0",
+        "value": "\"C:\\Program Files (x86)\\Adobe\\Acrobat 9.0\\Acrobat\\Acrotray.exe\""
+      },
+      {
+        "key": "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce",
+        "name": "msedge_cleanup_{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}",
+        "value": "\"C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\149.0.4022.98\\Installer\\setup.exe\" --msedgewebview --delete-old-versions --system-level --verbose-logging --on-logon"
+      }
+    ],
+    "physical_disks": [
+      {
+        "health": "Healthy",
+        "model": "SAMSUNG MZAL81T0HDLB-00BL2",
+        "media_type": "SSD"
+      }
+    ],
+    "local_users": [
+      {
+        "last_logon": "2024-10-10",
+        "name": "Administrator",
+        "password_never_expires": false,
+        "enabled": false
+      },
+      {
+        "last_logon": "",
+        "name": "DefaultAccount",
+        "password_never_expires": false,
+        "enabled": false
+      },
+      {
+        "last_logon": "",
+        "name": "Guest",
+        "password_never_expires": false,
+        "enabled": false
+      },
+      {
+        "last_logon": "",
+        "name": "miche",
+        "password_never_expires": false,
+        "enabled": true
+      },
+      {
+        "last_logon": "",
+        "name": "WDAGUtilityAccount",
+        "password_never_expires": false,
+        "enabled": false
+      },
+      {
+        "last_logon": "2026-07-06",
+        "name": "WsiAccount",
+        "password_never_expires": false,
+        "enabled": false
+      }
+    ],
+    "scheduled_tasks_count": 44,
+    "volumes": [
+      {
+        "drive": "[SYSTEM_DRV]",
+        "size_gb": 0.2,
+        "free_pct": 81.7,
+        "free_gb": 0.2
+      },
+      {
+        "drive": "[WINRE_DRV]",
+        "size_gb": 2,
+        "free_pct": 59,
+        "free_gb": 1.2
+      },
+      {
+        "drive": "C:",
+        "size_gb": 951.6,
+        "free_pct": 87.5,
+        "free_gb": 832.4
+      }
+    ],
+    "network_adapters": [
+      {
+        "dhcp": true,
+        "description": "Intel(R) Wi-Fi 7 BE201 320MHz",
+        "gateway": [
+          "192.168.1.1"
+        ],
+        "mac": "68:C6:AC:BB:9E:C3",
+        "ip": [
+          "192.168.1.226",
+          "fe80::4ffb:5716:9793:3369",
+          "fd73:cb91:29c4:645b:46ad:58ba:ac7e:dab"
+        ],
+        "dns": [
+          "192.168.1.1"
+        ]
+      }
+    ],
+    "failed_autostart_services": [
+      {
+        "name": "GoogleUpdaterInternalService150.0.7863.0",
+        "display": "Google Updater Internal Service (GoogleUpdaterInternalService150.0.7863.0)",
+        "state": "Stopped"
+      },
+      {
+        "name": "GoogleUpdaterService150.0.7863.0",
+        "display": "Google Updater Service (GoogleUpdaterService150.0.7863.0)",
+        "state": "Stopped"
+      },
+      {
+        "name": "Intel(R) Platform License Manager Service",
+        "display": "Intel(R) Platform License Manager Service",
+        "state": "Stopped"
+      },
+      {
+        "name": "IntelDisplayUMService",
+        "display": "Intel(R) Graphics Display Service",
+        "state": "Stopped"
+      }
+    ],
+    "stability_14d": {
+      "unexpected_shutdowns": 0,
+      "disk_errors": 0,
+      "bugchecks": 0
+    },
+    "exposure": {
+      "smb1_enabled": false,
+      "laps_present": true,
+      "rdp_enabled": false,
+      "uac_enabled": true,
+      "rdp_nla": true
+    },
+    "accounts_password_never_expires": [],
+    "installed_software": [
+      {
+        "publisher": "Adobe Systems",
+        "name": "Adobe Acrobat 9 Pro",
+        "version": "9.0.0"
+      },
+      {
+        "publisher": "Microsoft Corporation",
+        "name": "Copilot",
+        "version": "150.0.4078.48"
+      },
+      {
+        "publisher": "Google LLC",
+        "name": "Google Chrome",
+        "version": "149.0.7827.158"
+      },
+      {
+        "publisher": "Intel Corporation",
+        "name": "Intel? Unison? Launcher",
+        "version": "1.2.10.0"
+      },
+      {
+        "publisher": "Lenovo",
+        "name": "Lenovo Now",
+        "version": "4.7.0.48"
+      },
+      {
+        "publisher": "Lenovo Group Ltd.",
+        "name": "Lenovo Vantage Service",
+        "version": "5.1.2606.17"
+      },
+      {
+        "publisher": "Microsoft Corporation",
+        "name": "Microsoft 365 - en-us",
+        "version": "16.0.20026.20168"
+      },
+      {
+        "publisher": "Microsoft Corporation",
+        "name": "Microsoft Edge",
+        "version": "150.0.4078.48"
+      },
+      {
+        "publisher": "Microsoft Corporation",
+        "name": "Microsoft Edge WebView2 Runtime",
+        "version": "149.0.4022.98"
+      },
+      {
+        "publisher": "Microsoft Corporation",
+        "name": "Microsoft OneNote - en-us",
+        "version": "16.0.20026.20168"
+      },
+      {
+        "publisher": "Microsoft Corporation",
+        "name": "Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.44.35211",
+        "version": "14.44.35211.0"
+      },
+      {
+        "publisher": "Microsoft Corporation",
+        "name": "Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.44.35211",
+        "version": "14.44.35211.0"
+      },
+      {
+        "publisher": "Microsoft Corporation",
+        "name": "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.44.35211",
+        "version": "14.44.35211"
+      },
+      {
+        "publisher": "Microsoft Corporation",
+        "name": "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.44.35211",
+        "version": "14.44.35211"
+      },
+      {
+        "publisher": "Microsoft Corporation",
+        "name": "Microsoft Visual C++ 2022 X86 Additional Runtime - 14.44.35211",
+        "version": "14.44.35211"
+      },
+      {
+        "publisher": "Microsoft Corporation",
+        "name": "Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.44.35211",
+        "version": "14.44.35211"
+      },
+      {
+        "publisher": "Microsoft Corporation",
+        "name": "Office 16 Click-to-Run Extensibility Component",
+        "version": "16.0.20026.20076"
+      },
+      {
+        "publisher": "ScreenConnect Software",
+        "name": "ScreenConnect Client (1912bf3444b41a08)",
+        "version": "26.4.3.9662"
+      },
+      {
+        "publisher": "McAfee, LLC",
+        "name": "WebAdvisor by McAfee",
+        "version": "4.1.1.1127"
+      }
+    ],
+    "tpm": {
+      "enabled": true,
+      "ready": true,
+      "present": true
+    },
+    "local_groups": [
+      "Administrators",
+      "Device Owners",
+      "Distributed COM Users",
+      "Event Log Readers",
+      "Guests",
+      "Hyper-V Administrators",
+      "IIS_IUSRS",
+      "OpenSSH Users",
+      "Performance Log Users",
+      "Performance Monitor Users",
+      "Remote Management Users",
+      "System Managed Accounts Group",
+      "User Mode Hardware Operators",
+      "Users"
+    ],
+    "battery": {
+      "estimated_charge_remaining": "68",
+      "status": "2",
+      "present": true
+    },
+    "activation": {
+      "edition": "Microsoft Windows 11 Home",
+      "description": "Windows(R) Operating System, OEM_DM channel",
+      "licensed": true,
+      "license_status_code": 1
+    },
+    "time_source": "Local CMOS Clock",
+    "chassis_types": [
+      10
+    ],
+    "last_hotfix": {
+      "hotfix_id": "KB5094126",
+      "installed_on": "2026-06-10T05:00:00Z"
+    },
+    "scheduled_tasks": [
+      {
+        "path": "\\",
+        "name": "MicrosoftEdgeUpdateTaskMachineCore{D2799CF4-E121-4922-8B77-AD0646920725}",
+        "state": "Ready"
+      },
+      {
+        "path": "\\",
+        "name": "MicrosoftEdgeUpdateTaskMachineUA{883A5E2A-0595-480E-A4EC-536F847650F5}",
+        "state": "Ready"
+      },
+      {
+        "path": "\\",
+        "name": "OneDrive Reporting Task-S-1-5-21-798687102-2643481075-3203483788-1001",
+        "state": "Ready"
+      },
+      {
+        "path": "\\",
+        "name": "OneDrive Standalone Update Task-S-1-5-21-798687102-2643481075-3203483788-1001",
+        "state": "Ready"
+      },
+      {
+        "path": "\\",
+        "name": "OneDrive Startup Task-S-1-5-21-798687102-2643481075-3203483788-1001",
+        "state": "Ready"
+      },
+      {
+        "path": "\\GoogleSystem\\GoogleUpdater\\",
+        "name": "GoogleUpdaterTaskSystem150.0.7863.0{AF68D4B1-A697-4CA6-AB8D-DB75E0658376}",
+        "state": "Ready"
+      },
+      {
+        "path": "\\GoogleUserPEH\\",
+        "name": "RunPlatformExperienceHelperOnUnlock",
+        "state": "Ready"
+      },
+      {
+        "path": "\\GoogleUserPEH\\",
+        "name": "RunPlatformExperienceHelper_Daily",
+        "state": "Ready"
+      },
+      {
+        "path": "\\GoogleUserPEH\\",
+        "name": "RunPlatformExperienceHelper_Metrics",
+        "state": "Ready"
+      },
+      {
+        "path": "\\Intel\\Unison\\",
+        "name": "UPIETask",
+        "state": "Ready"
+      },
+      {
+        "path": "\\Lenovo\\",
+        "name": "LenovoMachineFixUser_OOBE_AUTO_Notification",
+        "state": "Ready"
+      },
+      {
+        "path": "\\Lenovo\\",
+        "name": "LenovoNowLauncher",
+        "state": "Ready"
+      },
+      {
+        "path": "\\Lenovo\\",
+        "name": "LenovoNowQuarterlyLaunch",
+        "state": "Ready"
+      },
+      {
+        "path": "\\Lenovo\\",
+        "name": "LenovoNowTask",
+        "state": "Ready"
+      },
+      {
+        "path": "\\Lenovo\\ImController\\",
+        "name": "Lenovo iM Controller Monitor",
+        "state": "Ready"
+      },
+      {
+        "path": "\\Lenovo\\ImController\\",
+        "name": "Lenovo iM Controller Scheduled Maintenance",
+        "state": "Ready"
+      },
+      {
+        "path": "\\Lenovo\\ImController\\TimeBasedEvents\\",
+        "name": "6000a3b3-4b13-442f-a10d-a97e9b83f7ab",
+        "state": "Ready"
+      },
+      {
+        "path": "\\Lenovo\\LenovoVisionService\\",
+        "name": "Uninstall Monitor",
+        "state": "Ready"
+      },
+      {
+        "path": "\\Lenovo\\UDC\\",
+        "name": "Lenovo UDC Lazy Deployment",
+        "state": "Ready"
+      },
+      {
+        "path": "\\Lenovo\\UDC\\",
+        "name": "Lenovo UDC Maintainance Task",
+        "state": "Ready"
+      },
+      {
+        "path": "\\Lenovo\\UDC\\",
+        "name": "Lenovo UDC Monitor",
+        "state": "Ready"
+      },
+      {
+        "path": "\\Lenovo\\Vantage\\",
+        "name": "Lenovo.Vantage.ServiceMaintainance",
+        "state": "Ready"
+      },
+      {
+        "path": "\\Lenovo\\Vantage\\",
+        "name": "StartupFixPlan",
+        "state": "Ready"
+      },
+      {
+        "path": "\\Lenovo\\Vantage\\Schedule\\",
+        "name": "BatteryGaugeAddinDailyScheduleTask",
+        "state": "Ready"
+      },
+      {
+        "path": "\\Lenovo\\Vantage\\Schedule\\",
+        "name": "ConsumerAddinDailyScheduleTask",
+        "state": "Ready"
+      },
+      {
+        "path": "\\Lenovo\\Vantage\\Schedule\\",
+        "name": "DailyTelemetryTransmission",
+        "state": "Ready"
+      },
+      {
+        "path": "\\Lenovo\\Vantage\\Schedule\\",
+        "name": "GenericMessagingAddin",
+        "state": "Ready"
+      },
+      {
+        "path": "\\Lenovo\\Vantage\\Schedule\\",
+        "name": "GenericMessagingAddin_Pulsation",
+        "state": "Ready"
+      },
+      {
+        "path": "\\Lenovo\\Vantage\\Schedule\\",
+        "name": "HeartbeatAddinDailyScheduleTask",
+        "state": "Ready"
+      },
+      {
+        "path": "\\Lenovo\\Vantage\\Schedule\\",
+        "name": "IdeaNotebookAddinDailyEvent",
+        "state": "Ready"
+      },
+      {
+        "path": "\\Lenovo\\Vantage\\Schedule\\",
+        "name": "Lenovo.Vantage.SmartPerformance.MonthlyReport",
+        "state": "Ready"
+      },
+      {
+        "path": "\\Lenovo\\Vantage\\Schedule\\",
+        "name": "Lenovo.Vantage.VirtualExpert.VppScan",
+        "state": "Ready"
+      },
+      {
+        "path": "\\Lenovo\\Vantage\\Schedule\\",
+        "name": "LenovoCompanionAppAddinDailyScheduleTask",
+        "state": "Ready"
+      },
+      {
+        "path": "\\Lenovo\\Vantage\\Schedule\\",
+        "name": "LenovoSupportHealthReportSchedule",
+        "state": "Ready"
+      },
+      {
+        "path": "\\Lenovo\\Vantage\\Schedule\\",
+        "name": "LenovoSystemUpdateAddin_WeeklyTask",
+        "state": "Ready"
+      },
+      {
+        "path": "\\Lenovo\\Vantage\\Schedule\\",
+        "name": "SettingsWidgetAddinDailyScheduleTask",
+        "state": "Ready"
+      },
+      {
+        "path": "\\Lenovo\\Vantage\\Schedule\\",
+        "name": "SmartLock.ExpireReminder",
+        "state": "Ready"
+      },
+      {
+        "path": "\\Lenovo\\Vantage\\Schedule\\",
+        "name": "SmartPerformance.ExpireReminder",
+        "state": "Ready"
+      },
+      {
+        "path": "\\Lenovo\\Vantage\\Schedule\\",
+        "name": "VantageCoreAddinDailyScheduleTask",
+        "state": "Ready"
+      },
+      {
+        "path": "\\Lenovo\\Vantage\\Schedule\\",
+        "name": "VantageCoreAddinIdleScheduleTask",
+        "state": "Running"
+      },
+      {
+        "path": "\\Lenovo\\Vantage\\Schedule\\",
+        "name": "VantageCoreAddinWeekScheduleTask",
+        "state": "Ready"
+      },
+      {
+        "path": "\\SoftLanding\\S-1-5-21-798687102-2643481075-3203483788-1001\\",
+        "name": "SoftLandingCreativeManagementTask",
+        "state": "Ready"
+      },
+      {
+        "path": "\\SoftLanding\\S-1-5-21-798687102-2643481075-3203483788-1001\\",
+        "name": "SoftLandingDeferralTask-{69bb119c-0a87-4a4d-a3f7-6445cce5e474}",
+        "state": "Ready"
+      },
+      {
+        "path": "\\SoftLanding\\S-1-5-21-798687102-2643481075-3203483788-1002\\",
+        "name": "SoftLandingCreativeManagementTask",
+        "state": "Ready"
+      }
+    ],
+    "antivirus_products": [
+      "Windows Defender"
+    ],
+    "domain_joined": false,
+    "defender": {
+      "antispyware_signature_age": 0,
+      "tamper_protected": true,
+      "real_time_protection": true,
+      "nis_enabled": true,
+      "available": true,
+      "antivirus_enabled": true,
+      "am_service_enabled": true
+    },
+    "bitlocker": {
+      "os_volume": "C:",
+      "key_protectors": [
+        "RecoveryPassword",
+        "Tpm"
+      ],
+      "recovery_key_present": true,
+      "available": true,
+      "encryption_percent": 100,
+      "protection_status": "On"
+    },
+    "is_laptop": true,
+    "installed_software_count": 19,
+    "local_administrators": [
+      "Dallas\\Administrator",
+      "Dallas\\miche"
+    ],
+    "firewall_profiles": {
+      "Private": true,
+      "Domain": true,
+      "Public": true
+    },
+    "domain": "WORKGROUP",
+    "foreign_agents": null
+  },
+  "findings": [
+    {
+      "id": "sec.defender.ok",
+      "category": "security",
+      "severity": "info",
+      "title": "Defender active and current",
+      "detail": "Real-time protection on, service running, signatures current.",
+      "evidence": "RealTimeProtectionEnabled=True; AMServiceEnabled=True; AntispywareSignatureAge=0 days; IsTamperProtected=True"
+    },
+    {
+      "id": "sec.av_products.defender_only",
+      "category": "security",
+      "severity": "info",
+      "title": "Defender is the only registered AV",
+      "detail": "Only Microsoft/Windows Defender is registered in Security Center.",
+      "evidence": "Windows Defender"
+    },
+    {
+      "id": "sec.foreign_agents.none",
+      "category": "security",
+      "severity": "info",
+      "title": "No competitor/leftover management agents detected",
+      "detail": "No known competitor RMM or unmanaged remote-access agents found in installed programs or services.",
+      "evidence": "Scanned uninstall hives (HKLM + WOW6432Node) and Win32_Service"
+    },
+    {
+      "id": "sec.foreign_agents.acg.screenconnect_connectwise_control",
+      "category": "security",
+      "severity": "info",
+      "title": "Expected ACG management tooling present: ScreenConnect / ConnectWise Control",
+      "detail": "This is Arizona Computer Guru managed/remote-access tooling that we deploy. Its presence is expected and not a foreign-agent risk.",
+      "evidence": "program: ScreenConnect Client (1912bf3444b41a08) 26.4.3.9662\nservice: ScreenConnect Client (34180592-0226-4f51-b896-74ca49e004b1) (ScreenConnect Client (34180592-0226-4f51-b896-74ca49e004b1)) Running\nservice: ScreenConnect Client (1912bf3444b41a08) (ScreenConnect Client (1912bf3444b41a08)) Running"
+    },
+    {
+      "id": "sec.firewall.ok",
+      "category": "security",
+      "severity": "info",
+      "title": "All firewall profiles enabled",
+      "detail": "Domain, Private, and Public firewall profiles are all enabled.",
+      "evidence": "Private=True; Domain=True; Public=True"
+    },
+    {
+      "id": "sec.bitlocker.ok",
+      "category": "security",
+      "severity": "info",
+      "title": "OS volume encrypted with recovery protector present",
+      "detail": "BitLocker is on for the OS volume and a recovery password protector exists.",
+      "evidence": "Volume=C:; ProtectionStatus=On; EncryptionPercentage=100; KeyProtectors=RecoveryPassword,Tpm"
+    },
+    {
+      "id": "sec.local_admins.list",
+      "category": "security",
+      "severity": "info",
+      "title": "Local administrators (2)",
+      "detail": "Members of the local Administrators group. Review for unexpected or unknown accounts (especially leftover MSP/vendor accounts from a prior provider).",
+      "evidence": "Dallas\\Administrator\nDallas\\miche"
+    },
+    {
+      "id": "sec.patch.os_supported",
+      "category": "security",
+      "severity": "info",
+      "title": "OS build supported: Win11 25H2",
+      "detail": "Build 26200 (Win11 25H2) is in support until 2027-10-12.",
+      "evidence": "Microsoft Windows 11 Home build 26200"
+    },
+    {
+      "id": "sec.patch.pending",
+      "category": "security",
+      "severity": "warning",
+      "title": "1 pending Windows updates",
+      "detail": "Windows Update reports pending (not installed, not hidden) updates. Some may be security updates. Approve/install on the next maintenance window.",
+      "evidence": "Microsoft.Update.Session search IsInstalled=0 and IsHidden=0 -> 1"
+    },
+    {
+      "id": "sec.patch.last_hotfix",
+      "category": "security",
+      "severity": "info",
+      "title": "Last hotfix: KB5094126",
+      "detail": "Most recently installed update (from Get-HotFix; reflects CBS/MSU packages, not all cumulative metadata).",
+      "evidence": "KB5094126 installed 2026-06-10T05:00:00Z"
+    },
+    {
+      "id": "sec.exposure.smb1_off",
+      "category": "security",
+      "severity": "info",
+      "title": "SMBv1 disabled",
+      "detail": "SMBv1 server protocol is disabled.",
+      "evidence": "EnableSMB1Protocol=False"
+    },
+    {
+      "id": "sec.exposure.laps_present",
+      "category": "security",
+      "severity": "info",
+      "title": "LAPS detected",
+      "detail": "A LAPS mechanism is present.",
+      "evidence": "Windows LAPS reg key"
+    },
+    {
+      "id": "health.stability.clean",
+      "category": "health",
+      "severity": "info",
+      "title": "No stability events in the last 14 days",
+      "detail": "No unexpected shutdowns, BSODs, or disk errors logged.",
+      "evidence": "Unexpected shutdowns (id 41)=0; Bugchecks/BSOD (id 1001)=0; Disk errors (id 7/51/153)=0"
+    },
+    {
+      "id": "health.reboot_uptime.pending",
+      "category": "health",
+      "severity": "warning",
+      "title": "Reboot pending",
+      "detail": "A reboot is pending. Pending reboots can block patches and leave the system in a half-updated state. Schedule a restart.",
+      "evidence": "PendingFileRenameOperations"
+    },
+    {
+      "id": "health.failed_services.stopped",
+      "category": "health",
+      "severity": "warning",
+      "title": "4 auto-start service(s) not running",
+      "detail": "These services are set to start automatically but are not running. Some may be benign; review for security agents, backup agents, or AV that should be running.",
+      "evidence": "GoogleUpdaterInternalService150.0.7863.0 (Google Updater Internal Service (GoogleUpdaterInternalService150.0.7863.0)) = Stopped\nGoogleUpdaterService150.0.7863.0 (Google Updater Service (GoogleUpdaterService150.0.7863.0)) = Stopped\nIntel(R) Platform License Manager Service (Intel(R) Platform License Manager Service) = Stopped\nIntelDisplayUMService (Intel(R) Graphics Display Service) = Stopped"
+    },
+    {
+      "id": "health.domain.workgroup",
+      "category": "health",
+      "severity": "info",
+      "title": "Not domain-joined (workgroup)",
+      "detail": "This machine is in workgroup/Azure AD only mode (Domain=WORKGROUP). No on-prem AD secure channel applies.",
+      "evidence": "PartOfDomain=False; Domain=WORKGROUP"
+    },
+    {
+      "id": "health.time.local_cmos",
+      "category": "health",
+      "severity": "warning",
+      "title": "Time source is local CMOS clock (not NTP)",
+      "detail": "The system is not syncing time from an NTP source. Clock drift breaks Kerberos and certificate validation. Configure a reliable time source (domain hierarchy or pool.ntp.org).",
+      "evidence": "Source=Local CMOS Clock"
+    },
+    {
+      "id": "health.battery.present",
+      "category": "health",
+      "severity": "info",
+      "title": "Battery present",
+      "detail": "Battery detected. (Wear-level / design-vs-full-capacity requires a powercfg battery report, not collected here.)",
+      "evidence": "EstimatedChargeRemaining=68%; BatteryStatus=2"
+    },
+    {
+      "id": "health.backup.none",
+      "category": "health",
+      "severity": "info",
+      "title": "No backup agent detected",
+      "detail": "No known backup agent service found. Backup expectation varies by endpoint; confirm whether this machine is supposed to have local/cloud backup and whether server-side or M365 backup covers it.",
+      "evidence": "No matching backup service in Win32_Service"
+    }
+  ]
+}
--- a/clients/goldstein/onboarding-baselines/DALLAS-20260706T233936.md
+++ b/clients/goldstein/onboarding-baselines/DALLAS-20260706T233936.md
@@ -0,0 +1,235 @@
+# Onboarding Diagnostic Baseline - DALLAS
+
+- **Grade:** AMBER
+- **Host:** DALLAS
+- **Client:** Goldstein (`goldstein`)
+- **Collected (UTC):** 2026-07-06T23:38:29Z
+- **Agent ID:** 36c7bbc8-504f-4b4a-8995-3b3e5cdc0f02
+- **Command ID:** f973b3f9-8d63-404c-86d4-2539307aad59
+- **Findings:** 0 critical / 4 warning / 15 info / 0 unknown
+
+- **OS:** Microsoft Windows 11 Home (build 26200)
+
+---
+
+## WARNING (4)
+
+### 1 pending Windows updates
+- **Category:** security
+- **ID:** `sec.patch.pending`
+- Windows Update reports pending (not installed, not hidden) updates. Some may be security updates. Approve/install on the next maintenance window.
+
+```
+Microsoft.Update.Session search IsInstalled=0 and IsHidden=0 -> 1
+```
+
+### Reboot pending
+- **Category:** health
+- **ID:** `health.reboot_uptime.pending`
+- A reboot is pending. Pending reboots can block patches and leave the system in a half-updated state. Schedule a restart.
+
+```
+PendingFileRenameOperations
+```
+
+### 4 auto-start service(s) not running
+- **Category:** health
+- **ID:** `health.failed_services.stopped`
+- These services are set to start automatically but are not running. Some may be benign; review for security agents, backup agents, or AV that should be running.
+
+```
+GoogleUpdaterInternalService150.0.7863.0 (Google Updater Internal Service (GoogleUpdaterInternalService150.0.7863.0)) = Stopped
+GoogleUpdaterService150.0.7863.0 (Google Updater Service (GoogleUpdaterService150.0.7863.0)) = Stopped
+Intel(R) Platform License Manager Service (Intel(R) Platform License Manager Service) = Stopped
+IntelDisplayUMService (Intel(R) Graphics Display Service) = Stopped
+```
+
+### Time source is local CMOS clock (not NTP)
+- **Category:** health
+- **ID:** `health.time.local_cmos`
+- The system is not syncing time from an NTP source. Clock drift breaks Kerberos and certificate validation. Configure a reliable time source (domain hierarchy or pool.ntp.org).
+
+```
+Source=Local CMOS Clock
+```
+
+
+## INFO (15)
+
+### Defender active and current
+- **Category:** security
+- **ID:** `sec.defender.ok`
+- Real-time protection on, service running, signatures current.
+
+```
+RealTimeProtectionEnabled=True; AMServiceEnabled=True; AntispywareSignatureAge=0 days; IsTamperProtected=True
+```
+
+### Defender is the only registered AV
+- **Category:** security
+- **ID:** `sec.av_products.defender_only`
+- Only Microsoft/Windows Defender is registered in Security Center.
+
+```
+Windows Defender
+```
+
+### No competitor/leftover management agents detected
+- **Category:** security
+- **ID:** `sec.foreign_agents.none`
+- No known competitor RMM or unmanaged remote-access agents found in installed programs or services.
+
+```
+Scanned uninstall hives (HKLM + WOW6432Node) and Win32_Service
+```
+
+### Expected ACG management tooling present: ScreenConnect / ConnectWise Control
+- **Category:** security
+- **ID:** `sec.foreign_agents.acg.screenconnect_connectwise_control`
+- This is Arizona Computer Guru managed/remote-access tooling that we deploy. Its presence is expected and not a foreign-agent risk.
+
+```
+program: ScreenConnect Client (1912bf3444b41a08) 26.4.3.9662
+service: ScreenConnect Client (34180592-0226-4f51-b896-74ca49e004b1) (ScreenConnect Client (34180592-0226-4f51-b896-74ca49e004b1)) Running
+service: ScreenConnect Client (1912bf3444b41a08) (ScreenConnect Client (1912bf3444b41a08)) Running
+```
+
+### All firewall profiles enabled
+- **Category:** security
+- **ID:** `sec.firewall.ok`
+- Domain, Private, and Public firewall profiles are all enabled.
+
+```
+Private=True; Domain=True; Public=True
+```
+
+### OS volume encrypted with recovery protector present
+- **Category:** security
+- **ID:** `sec.bitlocker.ok`
+- BitLocker is on for the OS volume and a recovery password protector exists.
+
+```
+Volume=C:; ProtectionStatus=On; EncryptionPercentage=100; KeyProtectors=RecoveryPassword,Tpm
+```
+
+### Local administrators (2)
+- **Category:** security
+- **ID:** `sec.local_admins.list`
+- Members of the local Administrators group. Review for unexpected or unknown accounts (especially leftover MSP/vendor accounts from a prior provider).
+
+```
+Dallas\Administrator
+Dallas\miche
+```
+
+### OS build supported: Win11 25H2
+- **Category:** security
+- **ID:** `sec.patch.os_supported`
+- Build 26200 (Win11 25H2) is in support until 2027-10-12.
+
+```
+Microsoft Windows 11 Home build 26200
+```
+
+### Last hotfix: KB5094126
+- **Category:** security
+- **ID:** `sec.patch.last_hotfix`
+- Most recently installed update (from Get-HotFix; reflects CBS/MSU packages, not all cumulative metadata).
+
+```
+KB5094126 installed 2026-06-10T05:00:00Z
+```
+
+### SMBv1 disabled
+- **Category:** security
+- **ID:** `sec.exposure.smb1_off`
+- SMBv1 server protocol is disabled.
+
+```
+EnableSMB1Protocol=False
+```
+
+### LAPS detected
+- **Category:** security
+- **ID:** `sec.exposure.laps_present`
+- A LAPS mechanism is present.
+
+```
+Windows LAPS reg key
+```
+
+### No stability events in the last 14 days
+- **Category:** health
+- **ID:** `health.stability.clean`
+- No unexpected shutdowns, BSODs, or disk errors logged.
+
+```
+Unexpected shutdowns (id 41)=0; Bugchecks/BSOD (id 1001)=0; Disk errors (id 7/51/153)=0
+```
+
+### Not domain-joined (workgroup)
+- **Category:** health
+- **ID:** `health.domain.workgroup`
+- This machine is in workgroup/Azure AD only mode (Domain=WORKGROUP). No on-prem AD secure channel applies.
+
+```
+PartOfDomain=False; Domain=WORKGROUP
+```
+
+### Battery present
+- **Category:** health
+- **ID:** `health.battery.present`
+- Battery detected. (Wear-level / design-vs-full-capacity requires a powercfg battery report, not collected here.)
+
+```
+EstimatedChargeRemaining=68%; BatteryStatus=2
+```
+
+### No backup agent detected
+- **Category:** health
+- **ID:** `health.backup.none`
+- No known backup agent service found. Backup expectation varies by endpoint; confirm whether this machine is supposed to have local/cloud backup and whether server-side or M365 backup covers it.
+
+```
+No matching backup service in Win32_Service
+```
+
+
+---
+
+## Inventory Baseline Summary
+
+- **Manufacturer / Model:** LENOVO / 83HM
+- **Serial:** PF570RZ0
+- **CPU:** Intel(R) Core(TM) Ultra 7 256V (8 cores / 8 logical)
+- **RAM (GB):** 15.6
+- **BIOS:** NYCN73WW (2025-09-15)
+- **Chassis is laptop:** true
+- **TPM present / Secure Boot:** true / true
+- **Domain joined:** false (WORKGROUP)
+- **OS activation licensed:** true
+- **Uptime (days):** 25.1
+- **Pending reboot:** true
+- **Installed software count:** 19
+- **Scheduled tasks (non-MS, enabled):** 44
+- **Local administrators:** Dallas\Administrator, Dallas\miche
+
+### Fixed volumes
+
+- [SYSTEM_DRV] - 0.2 GB free of 0.2 GB (81.7%)
+- [WINRE_DRV] - 1.2 GB free of 2 GB (59%)
+- C: - 832.4 GB free of 951.6 GB (87.5%)
+
+### Network adapters
+
+- Intel(R) Wi-Fi 7 BE201 320MHz - IP: 192.168.1.226, fe80::4ffb:5716:9793:3369, fd73:cb91:29c4:645b:46ad:58ba:ac7e:dab - DNS: 192.168.1.1 - DHCP: true
+
+---
+
+## Diff vs Prior Baseline
+
+- No prior baseline found for this host. This is the first baseline.
+
+---
+
+_Generated by run-onboarding-diagnostic.sh (GuruRMM onboarding diagnostic, Phase 1). Raw snapshot: `DALLAS-20260706T233936.json` (immutable)._
--- a/clients/goldstein/session-logs/2026-07/2026-07-06-howard-dallas-rmm-onboard.md
+++ b/clients/goldstein/session-logs/2026-07/2026-07-06-howard-dallas-rmm-onboard.md
@@ -0,0 +1,116 @@
+# Session Log — Goldstein: DALLAS RMM Onboarding
+
+## User
+- **User:** Howard Enos (howard)
+- **Machine:** Howard-Home
+- **Role:** tech
+
+## Session Summary
+
+Onboarded a new Goldstein endpoint — the DALLAS laptop (Michelle Goldstein's Lenovo Yoga Slim 7,
+logged-on user `Dallas\miche`) — to remote management under Syncro ticket #32490 ("Remote - Unable
+to remote access to the computers in Dallas"). Work began after ScreenConnect had already been
+installed on the machine manually; this session documented that in the ticket, then deployed the
+GuruRMM agent and ran the onboarding security/health baseline.
+
+First added a private (internal) note to Syncro ticket #32490 recording that Howard spoke with
+Ashly and installed ScreenConnect on the Dallas machine. Then confirmed the GuruRMM client/site
+target: the "Goldstein" client already existed (id 7eed26be-4126-40a5-8414-3c0c28b9d182) with two
+sites — Dallas (SILVER-PEAK-3739) and Tucson (RED-LION-9255). The DALLAS machine belongs in the
+Dallas, TX site (confirmed with the user), which already holds agent ASUS-2024, so no site creation
+was needed — the machine was enrolled into the existing Dallas site.
+
+Deployed the GuruRMM agent by pushing the official site-keyed install one-liner
+(`irm https://rmm.azcomputerguru.com/install/SILVER-PEAK-3739/windows | iex`) to the DALLAS
+ScreenConnect session via `send-command` (SC backstage, runs as the agent/SYSTEM). The SC session
+was also tagged Company=Goldstein / Site=Dallas. Enrollment was verified against the RMM API — the
+agent came up as hostname "Dallas", client Goldstein, site Dallas (agent id
+36c7bbc8-504f-4b4a-8995-3b3e5cdc0f02).
+
+Finally ran the onboarding diagnostic probe against the new agent. Result: **AMBER** grade
+(0 critical / 4 warning / 15 info). No critical security findings — Defender active and
+tamper-protected, BitLocker 100% with recovery protector, all firewall profiles on, SMBv1 off,
+LAPS present, no competitor/leftover RMM agents. The four warnings are routine post-provision
+hygiene items (pending Windows updates, pending reboot, benign stopped Google/Intel auto-start
+services, clock on local CMOS instead of NTP). One health note worth follow-up: no backup agent
+detected on this laptop. Immutable baseline written to
+`clients/goldstein/onboarding-baselines/DALLAS-20260706T233936.{json,md}`.
+
+## Key Decisions
+
+- **Enrolled into the existing Goldstein/Dallas site rather than creating a new client or site.**
+  A "Goldstein" client with a "Dallas" site (SILVER-PEAK-3739) already existed and already held
+  ASUS-2024. Creating a duplicate would have fragmented the client. User confirmed the DALLAS
+  machine belongs in Dallas, TX.
+- **Deployed the agent via ScreenConnect `send-command`, not an RMM push.** The machine was not yet
+  an RMM agent, so `/rmm run` was unavailable; ScreenConnect was the existing access path. Used the
+  official site-keyed install script so enrollment/self-tagging is handled by GuruRMM.
+- **Verified enrollment against the RMM API rather than SC command output.** SC `send-command`
+  returns `{}` and the install runs asynchronously, so success was confirmed by polling
+  `GET /api/agents` for the new Dallas agent.
+- **Ticket note set to private (hidden).** Internal record of the ScreenConnect install and the
+  conversation with Ashly; not customer-facing.
+
+## Problems Encountered
+
+- None blocking. The SC `send-command` empty-`{}` response is expected (async queue), and RMM
+  enrollment confirmed the install succeeded within ~2 minutes.
+
+## Configuration Changes
+
+- **Created:** `clients/goldstein/onboarding-baselines/DALLAS-20260706T233936.json` (immutable raw snapshot)
+- **Created:** `clients/goldstein/onboarding-baselines/DALLAS-20260706T233936.md` (human report)
+- **Created:** this session log
+- **Endpoint (DALLAS):** GuruRMM agent installed (`C:\Program Files\...\gururmm-agent.exe`, service);
+  ScreenConnect client already present (two SC services running).
+- **ScreenConnect:** DALLAS session custom properties set — CP1=Goldstein, CP2=Dallas, CP3=(blank).
+- **Syncro:** private comment added to ticket #32490.
+
+## Credentials & Secrets
+
+- No new credentials created or discovered this session. The Goldstein/Dallas site enrollment key
+  (site code SILVER-PEAK-3739) is server-managed; agent enrolled via the public site-keyed installer
+  URL (no secret handled locally).
+
+## Infrastructure & Servers
+
+- **Endpoint DALLAS** — LENOVO 83HM (Yoga Slim 7 15ILL9), serial PF570RZ0; Intel Core Ultra 7 256V,
+  15.6 GB RAM; Windows 11 Home build 26200 (25H2); workgroup (WORKGROUP), not domain-joined.
+  Public IP 99.127.21.4; private 192.168.1.226 (Intel Wi-Fi 7 BE201); DNS/gateway 192.168.1.1.
+  Logged-on user `Dallas\miche` (Michelle Goldstein). Local admins: `Dallas\Administrator`, `Dallas\miche`.
+  TPM + Secure Boot present; BitLocker on C: 100% (RecoveryPassword + TPM). Uptime ~25 days at scan.
+- **GuruRMM** — server `http://172.16.3.30:3001`; client "Goldstein" id 7eed26be-4126-40a5-8414-3c0c28b9d182;
+  Dallas site id 653b7e39-5e5e-4b93-b135-c70fc12ececa (code SILVER-PEAK-3739); Tucson site
+  4526ef0e-31d6-48f1-8df4-40d3a16519c1 (code RED-LION-9255).
+  New agent "Dallas" id 36c7bbc8-504f-4b4a-8995-3b3e5cdc0f02.
+  Other Goldstein agents: ASUS-2024 (Dallas site), DalRes10 + GS-Backup (Tucson site).
+- **ScreenConnect** — DALLAS session id 29c62473-a5cb-4e94-a190-c91f05031809; client 26.4.3.9662.
+
+## Commands & Outputs
+
+- Install push (SC backstage → DALLAS):
+  `powershell -NoProfile -ExecutionPolicy Bypass -Command "irm https://rmm.azcomputerguru.com/install/SILVER-PEAK-3739/windows | iex"`
+- Enrollment verify: `GET /api/agents` →
+  `host=Dallas os=windows client=Goldstein site=Dallas status=online last=2026-07-06T23:37:21Z`
+- Diagnostic: `bash .claude/scripts/run-onboarding-diagnostic.sh Dallas goldstein` →
+  `Grade=AMBER  critical=0 warning=4 unknown=0 info=15`
+- Diagnostic warnings: pending Windows updates (`sec.patch.pending`); pending reboot
+  (`health.reboot_uptime.pending`); 4 stopped auto-start services (Google Updater x2, Intel
+  Platform License Manager, Intel Display UM — benign); time source = Local CMOS Clock, not NTP
+  (`health.time.local_cmos`).
+
+## Pending / Incomplete Tasks
+
+- **Windows updates + reboot pending** on DALLAS — approve/install and reboot on next maintenance window.
+- **No backup agent on DALLAS** — confirm whether this laptop should have MSP360/cloud backup;
+  it currently has none detected.
+- **Time source on local CMOS** — set a reliable NTP source (workgroup laptop, no domain hierarchy).
+- **Ticket #32490** still New, owner Mike (1735) — status/ownership left unchanged; close/bill as appropriate.
+- Wiki: no Goldstein article exists yet — compile one from this log (command emitted post-sync).
+
+## Reference Information
+
+- Syncro ticket: https://computerguru.syncromsp.com/tickets/113249206 (#32490); customer Sheldon
+  Goldstein, cust id 25307933 (sheldon@lawyersdallas.com); Dallas contact Michelle Goldstein (972-814-5677).
+- GuruRMM install page (Dallas site): https://rmm.azcomputerguru.com/install/SILVER-PEAK-3739
+- Baseline files: `clients/goldstein/onboarding-baselines/DALLAS-20260706T233936.{json,md}`