From 12c3d83f75fd4f735435373f4bf0e89f08a38f19 Mon Sep 17 00:00:00 2001 From: Howard Enos Date: Mon, 6 Jul 2026 16:41:48 -0700 Subject: [PATCH] sync: auto-sync from HOWARD-HOME at 2026-07-06 16:41:20 Author: Howard Enos Machine: HOWARD-HOME Timestamp: 2026-07-06 16:41:20 --- .claude/skills/screenconnect/scripts/sc.py | 49 +- .../skills/screenconnect/scripts/sc_client.py | 11 +- .../skills/screenconnect/scripts/selftest.py | 17 +- .../DALLAS-20260706T233936.json | 734 ++++++++++++++++++ .../DALLAS-20260706T233936.md | 235 ++++++ .../2026-07-06-howard-dallas-rmm-onboard.md | 116 +++ 6 files changed, 1140 insertions(+), 22 deletions(-) create mode 100644 clients/goldstein/onboarding-baselines/DALLAS-20260706T233936.json create mode 100644 clients/goldstein/onboarding-baselines/DALLAS-20260706T233936.md create mode 100644 clients/goldstein/session-logs/2026-07/2026-07-06-howard-dallas-rmm-onboard.md diff --git a/.claude/skills/screenconnect/scripts/sc.py b/.claude/skills/screenconnect/scripts/sc.py index 03872956..f2351580 100644 --- a/.claude/skills/screenconnect/scripts/sc.py +++ b/.claude/skills/screenconnect/scripts/sc.py @@ -101,18 +101,37 @@ def _gated(action_desc: str, confirm: bool) -> bool: # --- handlers --- def cmd_status(client, args): - # Auth check via the fleet filter; report instance + custom-property map + counts. - access = client.list_sessions(session_type="access") - support = client.list_sessions(session_type="support") - na = len(access) if isinstance(access, list) else 0 - ns = len(support) if isinstance(support, list) else 0 + # Auth check via the most basic verified method (GetSessionsByName), so status + # confirms credentials even on an extension version without GetSessionsByFilter. + client.get_sessions_by_name("") print(f"[OK] Authenticated to {SC_BASE_URL}") print(f" extension: {client.extension_guid}") print(f" custom properties: {CUSTOM_PROPERTIES}") - print(f" fleet: {na} Access (unattended) + {ns} Support session(s)") + # Fleet counts are a best-effort add-on: the filter method may be absent, and it + # must never fail the auth check that status exists to perform. + try: + access = client.list_sessions(session_type="access") + support = client.list_sessions(session_type="support") + na = len(access) if isinstance(access, list) else 0 + ns = len(support) if isinstance(support, list) else 0 + print(f" fleet: {na} Access (unattended) + {ns} Support session(s)") + except ScreenConnectError as exc: + print(f" fleet: (listing unavailable via GetSessionsByFilter: {exc})") return 0 +def _effective_type(args) -> str: + """Resolve the SessionType filter for `sessions`. Explicit --type wins. Otherwise + a bare listing defaults to the Access fleet, but a TARGETED search (by name/like/ + company/site/tag) spans all types - matching the old GetSessionsByName behavior, + where a by-name lookup found Support sessions too.""" + if args.type is not None: + return args.type + if any([args.name, args.like, args.company, args.site, args.tag]): + return "all" + return "access" + + def cmd_sessions(client, args): # Full-fleet listing is the default (no selector -> every Access session). # A raw --filter wins; otherwise build a filter from the structured flags. @@ -120,20 +139,17 @@ def cmd_sessions(client, args): data = client.get_sessions_by_filter(args.filter) else: data = client.list_sessions( - session_type=args.type, + session_type=_effective_type(args), name=args.name or None, name_like=args.like, company=args.company, site=args.site, tag=args.tag, ) - if isinstance(data, list) and args.limit and len(data) > args.limit: - shown = data[: args.limit] - if args.json: - _emit(shown, True) - else: - _print_sessions(shown) - print(f" ... {len(data) - args.limit} more (raise --limit or use --json)") + # --limit only caps the human-readable print; --json is always the full set. + if not args.json and isinstance(data, list) and args.limit and len(data) > args.limit: + _print_sessions(data[: args.limit]) + print(f" ... {len(data) - args.limit} more (raise --limit or use --json)") return 0 _emit(data, True) if args.json else _print_sessions(data) return 0 @@ -225,8 +241,9 @@ def build_parser() -> argparse.ArgumentParser: sp.add_argument("--company", help="Filter by CP1 = Company.") sp.add_argument("--site", help="Filter by CP2 = Site.") sp.add_argument("--tag", help="Filter by CP3 = Tag.") - sp.add_argument("--type", default="access", - help="access (default) | support | meeting | all.") + sp.add_argument("--type", default=None, + help="access | support | meeting | all. Default: access for a " + "bare listing, all when a name/company/etc selector is given.") sp.add_argument("--filter", help="Raw session-filter expression (overrides the flags).") sp.add_argument("--limit", type=int, default=0, help="Cap rows printed (0 = no cap; --json is always full).") diff --git a/.claude/skills/screenconnect/scripts/sc_client.py b/.claude/skills/screenconnect/scripts/sc_client.py index b1396498..be2423cc 100644 --- a/.claude/skills/screenconnect/scripts/sc_client.py +++ b/.claude/skills/screenconnect/scripts/sc_client.py @@ -230,7 +230,9 @@ class ScreenConnectClient: @staticmethod def _filter_literal(value: str) -> str: """Single-quote a value for the session-filter language, escaping any - embedded single quote by doubling it (SQL-style).""" + embedded single quote by doubling it. VERIFIED LIVE 2026-07-06: + `CustomProperty1 LIKE '*Andy''s*'` matched the "Andy's Mobile Fuel" session, + so doubling is the correct escape for this filter grammar.""" return "'" + str(value).replace("'", "''") + "'" def build_session_filter( @@ -249,7 +251,12 @@ class ScreenConnectClient: CP1/CP2/CP3, `extra` is a raw clause appended verbatim. Defaults to the whole Access fleet when nothing else is specified.""" clauses: list[str] = [] - if session_type and session_type.lower() != "all": + if session_type and session_type.lower() == "all": + # 'all' = every session type. Only Access + Support exist on this + # instance; an OR clause is the verified match-all (a bare '*' matches + # nothing). VERIFIED LIVE 2026-07-06 -> 982 = 958 Access + 24 Support. + clauses.append("(SessionType = 'Access' OR SessionType = 'Support')") + elif session_type: literal = SESSION_TYPE_LITERALS.get(session_type.lower(), session_type) clauses.append(f"SessionType = {self._filter_literal(literal)}") if name: diff --git a/.claude/skills/screenconnect/scripts/selftest.py b/.claude/skills/screenconnect/scripts/selftest.py index 64bbb7a5..d5ab5a7a 100644 --- a/.claude/skills/screenconnect/scripts/selftest.py +++ b/.claude/skills/screenconnect/scripts/selftest.py @@ -27,31 +27,40 @@ def run(args): return p.returncode, p.stdout, p.stderr -def check(name, args, *, want_rc=None, out_has=None, out_json_ok=False): +def check(name, args, *, want_rc=None, out_has=None, out_json_ok=False, out_json_min_len=None): rc, out, err = run(args) problems = [] if want_rc is not None and rc != want_rc: problems.append(f"rc={rc} want {want_rc}") if out_has and out_has not in out: problems.append(f"stdout missing {out_has!r}") - if out_json_ok: + if out_json_ok or out_json_min_len is not None: try: - json.loads(out) + parsed = json.loads(out) + if out_json_min_len is not None and len(parsed) < out_json_min_len: + problems.append(f"json len {len(parsed)} < {out_json_min_len}") except Exception as e: problems.append(f"stdout not JSON: {e}") results.append(("PASS" if not problems else "FAIL", name, "; ".join(problems))) # --- reads: succeed (rc 0) [hit the live instance] --- -check("status", ["status"], want_rc=0, out_has="fleet:") +check("status", ["status"], want_rc=0, out_has="Authenticated") +check("status shows fleet", ["status"], want_rc=0, out_has="fleet:") check("sessions (full fleet)", ["sessions"], want_rc=0, out_has="Sessions:") check("sessions json", ["sessions", "--json"], want_rc=0, out_json_ok=True) check("sessions --limit", ["sessions", "--limit", "5"], want_rc=0, out_has="Sessions:") check("sessions --like", ["sessions", "--like", "DELL", "--json"], want_rc=0, out_json_ok=True) +check("sessions --type all", ["sessions", "--type", "all", "--json"], want_rc=0, out_json_ok=True) check("sessions --filter", ["sessions", "--filter", "SessionType = 'Access'", "--json"], want_rc=0, out_json_ok=True) check("sessions --company", ["sessions", "--company", "Safesite", "--json"], want_rc=0, out_json_ok=True) +# --limit must NOT truncate --json (documented "--json is always full" contract): +# Safesite has 62 machines; even with --limit 1 the JSON must return them all. +check("sessions --limit does not truncate json", + ["sessions", "--company", "Safesite", "--limit", "1", "--json"], + want_rc=0, out_json_min_len=10) # --- build-installer: pure URL build (no network) --- check("build-installer", ["build-installer", "--name", "HOST", "--company", "AZ Computer Guru", diff --git a/clients/goldstein/onboarding-baselines/DALLAS-20260706T233936.json b/clients/goldstein/onboarding-baselines/DALLAS-20260706T233936.json new file mode 100644 index 00000000..24a3a152 --- /dev/null +++ b/clients/goldstein/onboarding-baselines/DALLAS-20260706T233936.json @@ -0,0 +1,734 @@ +{ + "host": "DALLAS", + "collected_at_utc": "2026-07-06T23:38:29Z", + "os": { + "caption": "Microsoft Windows 11 Home", + "version": "10.0.26200", + "build": "26200", + "install_date": "2025-02-04T20:12:28Z", + "last_boot_utc": "2026-06-11T20:41:51Z", + "architecture": "64-bit" + }, + "facts": { + "builtin_admin_enabled": false, + "os_eol": { + "eol_date": "2027-10-12", + "release": "Win11 25H2" + }, + "pending_updates": 1, + "pending_reboot": true, + "uptime_days": 25.1, + "acg_managed_tools": "ScreenConnect / ConnectWise Control", + "hardware": { + "model": "83HM", + "manufacturer": "LENOVO", + "bios_date": "2025-09-15", + "cpu_logical": 8, + "bios_version": "NYCN73WW", + "cpu_cores": 8, + "ram_gb": 15.6, + "serial": "PF570RZ0", + "cpu": "Intel(R) Core(TM) Ultra 7 256V" + }, + "third_party_av_active": false, + "os_build": "26200", + "secure_boot": true, + "backup_agents": null, + "autoruns_run_keys": [ + { + "key": "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run", + "name": "SecurityHealth", + "value": "C:\\Windows\\system32\\SecurityHealthSystray.exe" + }, + { + "key": "HKLM:\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run", + "name": "Adobe Acrobat Speed Launcher", + "value": "\"C:\\Program Files (x86)\\Adobe\\Acrobat 9.0\\Acrobat\\Acrobat_sl.exe\"" + }, + { + "key": "HKLM:\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run", + "name": "(default)", + "value": "" + }, + { + "key": "HKLM:\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run", + "name": "Acrobat Assistant 8.0", + "value": "\"C:\\Program Files (x86)\\Adobe\\Acrobat 9.0\\Acrobat\\Acrotray.exe\"" + }, + { + "key": "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", + "name": "msedge_cleanup_{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}", + "value": "\"C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\149.0.4022.98\\Installer\\setup.exe\" --msedgewebview --delete-old-versions --system-level --verbose-logging --on-logon" + } + ], + "physical_disks": [ + { + "health": "Healthy", + "model": "SAMSUNG MZAL81T0HDLB-00BL2", + "media_type": "SSD" + } + ], + "local_users": [ + { + "last_logon": "2024-10-10", + "name": "Administrator", + "password_never_expires": false, + "enabled": false + }, + { + "last_logon": "", + "name": "DefaultAccount", + "password_never_expires": false, + "enabled": false + }, + { + "last_logon": "", + "name": "Guest", + "password_never_expires": false, + "enabled": false + }, + { + "last_logon": "", + "name": "miche", + "password_never_expires": false, + "enabled": true + }, + { + "last_logon": "", + "name": "WDAGUtilityAccount", + "password_never_expires": false, + "enabled": false + }, + { + "last_logon": "2026-07-06", + "name": "WsiAccount", + "password_never_expires": false, + "enabled": false + } + ], + "scheduled_tasks_count": 44, + "volumes": [ + { + "drive": "[SYSTEM_DRV]", + "size_gb": 0.2, + "free_pct": 81.7, + "free_gb": 0.2 + }, + { + "drive": "[WINRE_DRV]", + "size_gb": 2, + "free_pct": 59, + "free_gb": 1.2 + }, + { + "drive": "C:", + "size_gb": 951.6, + "free_pct": 87.5, + "free_gb": 832.4 + } + ], + "network_adapters": [ + { + "dhcp": true, + "description": "Intel(R) Wi-Fi 7 BE201 320MHz", + "gateway": [ + "192.168.1.1" + ], + "mac": "68:C6:AC:BB:9E:C3", + "ip": [ + "192.168.1.226", + "fe80::4ffb:5716:9793:3369", + "fd73:cb91:29c4:645b:46ad:58ba:ac7e:dab" + ], + "dns": [ + "192.168.1.1" + ] + } + ], + "failed_autostart_services": [ + { + "name": "GoogleUpdaterInternalService150.0.7863.0", + "display": "Google Updater Internal Service (GoogleUpdaterInternalService150.0.7863.0)", + "state": "Stopped" + }, + { + "name": "GoogleUpdaterService150.0.7863.0", + "display": "Google Updater Service (GoogleUpdaterService150.0.7863.0)", + "state": "Stopped" + }, + { + "name": "Intel(R) Platform License Manager Service", + "display": "Intel(R) Platform License Manager Service", + "state": "Stopped" + }, + { + "name": "IntelDisplayUMService", + "display": "Intel(R) Graphics Display Service", + "state": "Stopped" + } + ], + "stability_14d": { + "unexpected_shutdowns": 0, + "disk_errors": 0, + "bugchecks": 0 + }, + "exposure": { + "smb1_enabled": false, + "laps_present": true, + "rdp_enabled": false, + "uac_enabled": true, + "rdp_nla": true + }, + "accounts_password_never_expires": [], + "installed_software": [ + { + "publisher": "Adobe Systems", + "name": "Adobe Acrobat 9 Pro", + "version": "9.0.0" + }, + { + "publisher": "Microsoft Corporation", + "name": "Copilot", + "version": "150.0.4078.48" + }, + { + "publisher": "Google LLC", + "name": "Google Chrome", + "version": "149.0.7827.158" + }, + { + "publisher": "Intel Corporation", + "name": "Intel? Unison? Launcher", + "version": "1.2.10.0" + }, + { + "publisher": "Lenovo", + "name": "Lenovo Now", + "version": "4.7.0.48" + }, + { + "publisher": "Lenovo Group Ltd.", + "name": "Lenovo Vantage Service", + "version": "5.1.2606.17" + }, + { + "publisher": "Microsoft Corporation", + "name": "Microsoft 365 - en-us", + "version": "16.0.20026.20168" + }, + { + "publisher": "Microsoft Corporation", + "name": "Microsoft Edge", + "version": "150.0.4078.48" + }, + { + "publisher": "Microsoft Corporation", + "name": "Microsoft Edge WebView2 Runtime", + "version": "149.0.4022.98" + }, + { + "publisher": "Microsoft Corporation", + "name": "Microsoft OneNote - en-us", + "version": "16.0.20026.20168" + }, + { + "publisher": "Microsoft Corporation", + "name": "Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.44.35211", + "version": "14.44.35211.0" + }, + { + "publisher": "Microsoft Corporation", + "name": "Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.44.35211", + "version": "14.44.35211.0" + }, + { + "publisher": "Microsoft Corporation", + "name": "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.44.35211", + "version": "14.44.35211" + }, + { + "publisher": "Microsoft Corporation", + "name": "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.44.35211", + "version": "14.44.35211" + }, + { + "publisher": "Microsoft Corporation", + "name": "Microsoft Visual C++ 2022 X86 Additional Runtime - 14.44.35211", + "version": "14.44.35211" + }, + { + "publisher": "Microsoft Corporation", + "name": "Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.44.35211", + "version": "14.44.35211" + }, + { + "publisher": "Microsoft Corporation", + "name": "Office 16 Click-to-Run Extensibility Component", + "version": "16.0.20026.20076" + }, + { + "publisher": "ScreenConnect Software", + "name": "ScreenConnect Client (1912bf3444b41a08)", + "version": "26.4.3.9662" + }, + { + "publisher": "McAfee, LLC", + "name": "WebAdvisor by McAfee", + "version": "4.1.1.1127" + } + ], + "tpm": { + "enabled": true, + "ready": true, + "present": true + }, + "local_groups": [ + "Administrators", + "Device Owners", + "Distributed COM Users", + "Event Log Readers", + "Guests", + "Hyper-V Administrators", + "IIS_IUSRS", + "OpenSSH Users", + "Performance Log Users", + "Performance Monitor Users", + "Remote Management Users", + "System Managed Accounts Group", + "User Mode Hardware Operators", + "Users" + ], + "battery": { + "estimated_charge_remaining": "68", + "status": "2", + "present": true + }, + "activation": { + "edition": "Microsoft Windows 11 Home", + "description": "Windows(R) Operating System, OEM_DM channel", + "licensed": true, + "license_status_code": 1 + }, + "time_source": "Local CMOS Clock", + "chassis_types": [ + 10 + ], + "last_hotfix": { + "hotfix_id": "KB5094126", + "installed_on": "2026-06-10T05:00:00Z" + }, + "scheduled_tasks": [ + { + "path": "\\", + "name": "MicrosoftEdgeUpdateTaskMachineCore{D2799CF4-E121-4922-8B77-AD0646920725}", + "state": "Ready" + }, + { + "path": "\\", + "name": "MicrosoftEdgeUpdateTaskMachineUA{883A5E2A-0595-480E-A4EC-536F847650F5}", + "state": "Ready" + }, + { + "path": "\\", + "name": "OneDrive Reporting Task-S-1-5-21-798687102-2643481075-3203483788-1001", + "state": "Ready" + }, + { + "path": "\\", + "name": "OneDrive Standalone Update Task-S-1-5-21-798687102-2643481075-3203483788-1001", + "state": "Ready" + }, + { + "path": "\\", + "name": "OneDrive Startup Task-S-1-5-21-798687102-2643481075-3203483788-1001", + "state": "Ready" + }, + { + "path": "\\GoogleSystem\\GoogleUpdater\\", + "name": "GoogleUpdaterTaskSystem150.0.7863.0{AF68D4B1-A697-4CA6-AB8D-DB75E0658376}", + "state": "Ready" + }, + { + "path": "\\GoogleUserPEH\\", + "name": "RunPlatformExperienceHelperOnUnlock", + "state": "Ready" + }, + { + "path": "\\GoogleUserPEH\\", + "name": "RunPlatformExperienceHelper_Daily", + "state": "Ready" + }, + { + "path": "\\GoogleUserPEH\\", + "name": "RunPlatformExperienceHelper_Metrics", + "state": "Ready" + }, + { + "path": "\\Intel\\Unison\\", + "name": "UPIETask", + "state": "Ready" + }, + { + "path": "\\Lenovo\\", + "name": "LenovoMachineFixUser_OOBE_AUTO_Notification", + "state": "Ready" + }, + { + "path": "\\Lenovo\\", + "name": "LenovoNowLauncher", + "state": "Ready" + }, + { + "path": "\\Lenovo\\", + "name": "LenovoNowQuarterlyLaunch", + "state": "Ready" + }, + { + "path": "\\Lenovo\\", + "name": "LenovoNowTask", + "state": "Ready" + }, + { + "path": "\\Lenovo\\ImController\\", + "name": "Lenovo iM Controller Monitor", + "state": "Ready" + }, + { + "path": "\\Lenovo\\ImController\\", + "name": "Lenovo iM Controller Scheduled Maintenance", + "state": "Ready" + }, + { + "path": "\\Lenovo\\ImController\\TimeBasedEvents\\", + "name": "6000a3b3-4b13-442f-a10d-a97e9b83f7ab", + "state": "Ready" + }, + { + "path": "\\Lenovo\\LenovoVisionService\\", + "name": "Uninstall Monitor", + "state": "Ready" + }, + { + "path": "\\Lenovo\\UDC\\", + "name": "Lenovo UDC Lazy Deployment", + "state": "Ready" + }, + { + "path": "\\Lenovo\\UDC\\", + "name": "Lenovo UDC Maintainance Task", + "state": "Ready" + }, + { + "path": "\\Lenovo\\UDC\\", + "name": "Lenovo UDC Monitor", + "state": "Ready" + }, + { + "path": "\\Lenovo\\Vantage\\", + "name": "Lenovo.Vantage.ServiceMaintainance", + "state": "Ready" + }, + { + "path": "\\Lenovo\\Vantage\\", + "name": "StartupFixPlan", + "state": "Ready" + }, + { + "path": "\\Lenovo\\Vantage\\Schedule\\", + "name": "BatteryGaugeAddinDailyScheduleTask", + "state": "Ready" + }, + { + "path": "\\Lenovo\\Vantage\\Schedule\\", + "name": "ConsumerAddinDailyScheduleTask", + "state": "Ready" + }, + { + "path": "\\Lenovo\\Vantage\\Schedule\\", + "name": "DailyTelemetryTransmission", + "state": "Ready" + }, + { + "path": "\\Lenovo\\Vantage\\Schedule\\", + "name": "GenericMessagingAddin", + "state": "Ready" + }, + { + "path": "\\Lenovo\\Vantage\\Schedule\\", + "name": "GenericMessagingAddin_Pulsation", + "state": "Ready" + }, + { + "path": "\\Lenovo\\Vantage\\Schedule\\", + "name": "HeartbeatAddinDailyScheduleTask", + "state": "Ready" + }, + { + "path": "\\Lenovo\\Vantage\\Schedule\\", + "name": "IdeaNotebookAddinDailyEvent", + "state": "Ready" + }, + { + "path": "\\Lenovo\\Vantage\\Schedule\\", + "name": "Lenovo.Vantage.SmartPerformance.MonthlyReport", + "state": "Ready" + }, + { + "path": "\\Lenovo\\Vantage\\Schedule\\", + "name": "Lenovo.Vantage.VirtualExpert.VppScan", + "state": "Ready" + }, + { + "path": "\\Lenovo\\Vantage\\Schedule\\", + "name": "LenovoCompanionAppAddinDailyScheduleTask", + "state": "Ready" + }, + { + "path": "\\Lenovo\\Vantage\\Schedule\\", + "name": "LenovoSupportHealthReportSchedule", + "state": "Ready" + }, + { + "path": "\\Lenovo\\Vantage\\Schedule\\", + "name": "LenovoSystemUpdateAddin_WeeklyTask", + "state": "Ready" + }, + { + "path": "\\Lenovo\\Vantage\\Schedule\\", + "name": "SettingsWidgetAddinDailyScheduleTask", + "state": "Ready" + }, + { + "path": "\\Lenovo\\Vantage\\Schedule\\", + "name": "SmartLock.ExpireReminder", + "state": "Ready" + }, + { + "path": "\\Lenovo\\Vantage\\Schedule\\", + "name": "SmartPerformance.ExpireReminder", + "state": "Ready" + }, + { + "path": "\\Lenovo\\Vantage\\Schedule\\", + "name": "VantageCoreAddinDailyScheduleTask", + "state": "Ready" + }, + { + "path": "\\Lenovo\\Vantage\\Schedule\\", + "name": "VantageCoreAddinIdleScheduleTask", + "state": "Running" + }, + { + "path": "\\Lenovo\\Vantage\\Schedule\\", + "name": "VantageCoreAddinWeekScheduleTask", + "state": "Ready" + }, + { + "path": "\\SoftLanding\\S-1-5-21-798687102-2643481075-3203483788-1001\\", + "name": "SoftLandingCreativeManagementTask", + "state": "Ready" + }, + { + "path": "\\SoftLanding\\S-1-5-21-798687102-2643481075-3203483788-1001\\", + "name": "SoftLandingDeferralTask-{69bb119c-0a87-4a4d-a3f7-6445cce5e474}", + "state": "Ready" + }, + { + "path": "\\SoftLanding\\S-1-5-21-798687102-2643481075-3203483788-1002\\", + "name": "SoftLandingCreativeManagementTask", + "state": "Ready" + } + ], + "antivirus_products": [ + "Windows Defender" + ], + "domain_joined": false, + "defender": { + "antispyware_signature_age": 0, + "tamper_protected": true, + "real_time_protection": true, + "nis_enabled": true, + "available": true, + "antivirus_enabled": true, + "am_service_enabled": true + }, + "bitlocker": { + "os_volume": "C:", + "key_protectors": [ + "RecoveryPassword", + "Tpm" + ], + "recovery_key_present": true, + "available": true, + "encryption_percent": 100, + "protection_status": "On" + }, + "is_laptop": true, + "installed_software_count": 19, + "local_administrators": [ + "Dallas\\Administrator", + "Dallas\\miche" + ], + "firewall_profiles": { + "Private": true, + "Domain": true, + "Public": true + }, + "domain": "WORKGROUP", + "foreign_agents": null + }, + "findings": [ + { + "id": "sec.defender.ok", + "category": "security", + "severity": "info", + "title": "Defender active and current", + "detail": "Real-time protection on, service running, signatures current.", + "evidence": "RealTimeProtectionEnabled=True; AMServiceEnabled=True; AntispywareSignatureAge=0 days; IsTamperProtected=True" + }, + { + "id": "sec.av_products.defender_only", + "category": "security", + "severity": "info", + "title": "Defender is the only registered AV", + "detail": "Only Microsoft/Windows Defender is registered in Security Center.", + "evidence": "Windows Defender" + }, + { + "id": "sec.foreign_agents.none", + "category": "security", + "severity": "info", + "title": "No competitor/leftover management agents detected", + "detail": "No known competitor RMM or unmanaged remote-access agents found in installed programs or services.", + "evidence": "Scanned uninstall hives (HKLM + WOW6432Node) and Win32_Service" + }, + { + "id": "sec.foreign_agents.acg.screenconnect_connectwise_control", + "category": "security", + "severity": "info", + "title": "Expected ACG management tooling present: ScreenConnect / ConnectWise Control", + "detail": "This is Arizona Computer Guru managed/remote-access tooling that we deploy. Its presence is expected and not a foreign-agent risk.", + "evidence": "program: ScreenConnect Client (1912bf3444b41a08) 26.4.3.9662\nservice: ScreenConnect Client (34180592-0226-4f51-b896-74ca49e004b1) (ScreenConnect Client (34180592-0226-4f51-b896-74ca49e004b1)) Running\nservice: ScreenConnect Client (1912bf3444b41a08) (ScreenConnect Client (1912bf3444b41a08)) Running" + }, + { + "id": "sec.firewall.ok", + "category": "security", + "severity": "info", + "title": "All firewall profiles enabled", + "detail": "Domain, Private, and Public firewall profiles are all enabled.", + "evidence": "Private=True; Domain=True; Public=True" + }, + { + "id": "sec.bitlocker.ok", + "category": "security", + "severity": "info", + "title": "OS volume encrypted with recovery protector present", + "detail": "BitLocker is on for the OS volume and a recovery password protector exists.", + "evidence": "Volume=C:; ProtectionStatus=On; EncryptionPercentage=100; KeyProtectors=RecoveryPassword,Tpm" + }, + { + "id": "sec.local_admins.list", + "category": "security", + "severity": "info", + "title": "Local administrators (2)", + "detail": "Members of the local Administrators group. Review for unexpected or unknown accounts (especially leftover MSP/vendor accounts from a prior provider).", + "evidence": "Dallas\\Administrator\nDallas\\miche" + }, + { + "id": "sec.patch.os_supported", + "category": "security", + "severity": "info", + "title": "OS build supported: Win11 25H2", + "detail": "Build 26200 (Win11 25H2) is in support until 2027-10-12.", + "evidence": "Microsoft Windows 11 Home build 26200" + }, + { + "id": "sec.patch.pending", + "category": "security", + "severity": "warning", + "title": "1 pending Windows updates", + "detail": "Windows Update reports pending (not installed, not hidden) updates. Some may be security updates. Approve/install on the next maintenance window.", + "evidence": "Microsoft.Update.Session search IsInstalled=0 and IsHidden=0 -> 1" + }, + { + "id": "sec.patch.last_hotfix", + "category": "security", + "severity": "info", + "title": "Last hotfix: KB5094126", + "detail": "Most recently installed update (from Get-HotFix; reflects CBS/MSU packages, not all cumulative metadata).", + "evidence": "KB5094126 installed 2026-06-10T05:00:00Z" + }, + { + "id": "sec.exposure.smb1_off", + "category": "security", + "severity": "info", + "title": "SMBv1 disabled", + "detail": "SMBv1 server protocol is disabled.", + "evidence": "EnableSMB1Protocol=False" + }, + { + "id": "sec.exposure.laps_present", + "category": "security", + "severity": "info", + "title": "LAPS detected", + "detail": "A LAPS mechanism is present.", + "evidence": "Windows LAPS reg key" + }, + { + "id": "health.stability.clean", + "category": "health", + "severity": "info", + "title": "No stability events in the last 14 days", + "detail": "No unexpected shutdowns, BSODs, or disk errors logged.", + "evidence": "Unexpected shutdowns (id 41)=0; Bugchecks/BSOD (id 1001)=0; Disk errors (id 7/51/153)=0" + }, + { + "id": "health.reboot_uptime.pending", + "category": "health", + "severity": "warning", + "title": "Reboot pending", + "detail": "A reboot is pending. Pending reboots can block patches and leave the system in a half-updated state. Schedule a restart.", + "evidence": "PendingFileRenameOperations" + }, + { + "id": "health.failed_services.stopped", + "category": "health", + "severity": "warning", + "title": "4 auto-start service(s) not running", + "detail": "These services are set to start automatically but are not running. Some may be benign; review for security agents, backup agents, or AV that should be running.", + "evidence": "GoogleUpdaterInternalService150.0.7863.0 (Google Updater Internal Service (GoogleUpdaterInternalService150.0.7863.0)) = Stopped\nGoogleUpdaterService150.0.7863.0 (Google Updater Service (GoogleUpdaterService150.0.7863.0)) = Stopped\nIntel(R) Platform License Manager Service (Intel(R) Platform License Manager Service) = Stopped\nIntelDisplayUMService (Intel(R) Graphics Display Service) = Stopped" + }, + { + "id": "health.domain.workgroup", + "category": "health", + "severity": "info", + "title": "Not domain-joined (workgroup)", + "detail": "This machine is in workgroup/Azure AD only mode (Domain=WORKGROUP). No on-prem AD secure channel applies.", + "evidence": "PartOfDomain=False; Domain=WORKGROUP" + }, + { + "id": "health.time.local_cmos", + "category": "health", + "severity": "warning", + "title": "Time source is local CMOS clock (not NTP)", + "detail": "The system is not syncing time from an NTP source. Clock drift breaks Kerberos and certificate validation. Configure a reliable time source (domain hierarchy or pool.ntp.org).", + "evidence": "Source=Local CMOS Clock" + }, + { + "id": "health.battery.present", + "category": "health", + "severity": "info", + "title": "Battery present", + "detail": "Battery detected. (Wear-level / design-vs-full-capacity requires a powercfg battery report, not collected here.)", + "evidence": "EstimatedChargeRemaining=68%; BatteryStatus=2" + }, + { + "id": "health.backup.none", + "category": "health", + "severity": "info", + "title": "No backup agent detected", + "detail": "No known backup agent service found. Backup expectation varies by endpoint; confirm whether this machine is supposed to have local/cloud backup and whether server-side or M365 backup covers it.", + "evidence": "No matching backup service in Win32_Service" + } + ] +} diff --git a/clients/goldstein/onboarding-baselines/DALLAS-20260706T233936.md b/clients/goldstein/onboarding-baselines/DALLAS-20260706T233936.md new file mode 100644 index 00000000..32b69d60 --- /dev/null +++ b/clients/goldstein/onboarding-baselines/DALLAS-20260706T233936.md @@ -0,0 +1,235 @@ +# Onboarding Diagnostic Baseline - DALLAS + +- **Grade:** AMBER +- **Host:** DALLAS +- **Client:** Goldstein (`goldstein`) +- **Collected (UTC):** 2026-07-06T23:38:29Z +- **Agent ID:** 36c7bbc8-504f-4b4a-8995-3b3e5cdc0f02 +- **Command ID:** f973b3f9-8d63-404c-86d4-2539307aad59 +- **Findings:** 0 critical / 4 warning / 15 info / 0 unknown + +- **OS:** Microsoft Windows 11 Home (build 26200) + +--- + +## WARNING (4) + +### 1 pending Windows updates +- **Category:** security +- **ID:** `sec.patch.pending` +- Windows Update reports pending (not installed, not hidden) updates. Some may be security updates. Approve/install on the next maintenance window. + +``` +Microsoft.Update.Session search IsInstalled=0 and IsHidden=0 -> 1 +``` + +### Reboot pending +- **Category:** health +- **ID:** `health.reboot_uptime.pending` +- A reboot is pending. Pending reboots can block patches and leave the system in a half-updated state. Schedule a restart. + +``` +PendingFileRenameOperations +``` + +### 4 auto-start service(s) not running +- **Category:** health +- **ID:** `health.failed_services.stopped` +- These services are set to start automatically but are not running. Some may be benign; review for security agents, backup agents, or AV that should be running. + +``` +GoogleUpdaterInternalService150.0.7863.0 (Google Updater Internal Service (GoogleUpdaterInternalService150.0.7863.0)) = Stopped +GoogleUpdaterService150.0.7863.0 (Google Updater Service (GoogleUpdaterService150.0.7863.0)) = Stopped +Intel(R) Platform License Manager Service (Intel(R) Platform License Manager Service) = Stopped +IntelDisplayUMService (Intel(R) Graphics Display Service) = Stopped +``` + +### Time source is local CMOS clock (not NTP) +- **Category:** health +- **ID:** `health.time.local_cmos` +- The system is not syncing time from an NTP source. Clock drift breaks Kerberos and certificate validation. Configure a reliable time source (domain hierarchy or pool.ntp.org). + +``` +Source=Local CMOS Clock +``` + + +## INFO (15) + +### Defender active and current +- **Category:** security +- **ID:** `sec.defender.ok` +- Real-time protection on, service running, signatures current. + +``` +RealTimeProtectionEnabled=True; AMServiceEnabled=True; AntispywareSignatureAge=0 days; IsTamperProtected=True +``` + +### Defender is the only registered AV +- **Category:** security +- **ID:** `sec.av_products.defender_only` +- Only Microsoft/Windows Defender is registered in Security Center. + +``` +Windows Defender +``` + +### No competitor/leftover management agents detected +- **Category:** security +- **ID:** `sec.foreign_agents.none` +- No known competitor RMM or unmanaged remote-access agents found in installed programs or services. + +``` +Scanned uninstall hives (HKLM + WOW6432Node) and Win32_Service +``` + +### Expected ACG management tooling present: ScreenConnect / ConnectWise Control +- **Category:** security +- **ID:** `sec.foreign_agents.acg.screenconnect_connectwise_control` +- This is Arizona Computer Guru managed/remote-access tooling that we deploy. Its presence is expected and not a foreign-agent risk. + +``` +program: ScreenConnect Client (1912bf3444b41a08) 26.4.3.9662 +service: ScreenConnect Client (34180592-0226-4f51-b896-74ca49e004b1) (ScreenConnect Client (34180592-0226-4f51-b896-74ca49e004b1)) Running +service: ScreenConnect Client (1912bf3444b41a08) (ScreenConnect Client (1912bf3444b41a08)) Running +``` + +### All firewall profiles enabled +- **Category:** security +- **ID:** `sec.firewall.ok` +- Domain, Private, and Public firewall profiles are all enabled. + +``` +Private=True; Domain=True; Public=True +``` + +### OS volume encrypted with recovery protector present +- **Category:** security +- **ID:** `sec.bitlocker.ok` +- BitLocker is on for the OS volume and a recovery password protector exists. + +``` +Volume=C:; ProtectionStatus=On; EncryptionPercentage=100; KeyProtectors=RecoveryPassword,Tpm +``` + +### Local administrators (2) +- **Category:** security +- **ID:** `sec.local_admins.list` +- Members of the local Administrators group. Review for unexpected or unknown accounts (especially leftover MSP/vendor accounts from a prior provider). + +``` +Dallas\Administrator +Dallas\miche +``` + +### OS build supported: Win11 25H2 +- **Category:** security +- **ID:** `sec.patch.os_supported` +- Build 26200 (Win11 25H2) is in support until 2027-10-12. + +``` +Microsoft Windows 11 Home build 26200 +``` + +### Last hotfix: KB5094126 +- **Category:** security +- **ID:** `sec.patch.last_hotfix` +- Most recently installed update (from Get-HotFix; reflects CBS/MSU packages, not all cumulative metadata). + +``` +KB5094126 installed 2026-06-10T05:00:00Z +``` + +### SMBv1 disabled +- **Category:** security +- **ID:** `sec.exposure.smb1_off` +- SMBv1 server protocol is disabled. + +``` +EnableSMB1Protocol=False +``` + +### LAPS detected +- **Category:** security +- **ID:** `sec.exposure.laps_present` +- A LAPS mechanism is present. + +``` +Windows LAPS reg key +``` + +### No stability events in the last 14 days +- **Category:** health +- **ID:** `health.stability.clean` +- No unexpected shutdowns, BSODs, or disk errors logged. + +``` +Unexpected shutdowns (id 41)=0; Bugchecks/BSOD (id 1001)=0; Disk errors (id 7/51/153)=0 +``` + +### Not domain-joined (workgroup) +- **Category:** health +- **ID:** `health.domain.workgroup` +- This machine is in workgroup/Azure AD only mode (Domain=WORKGROUP). No on-prem AD secure channel applies. + +``` +PartOfDomain=False; Domain=WORKGROUP +``` + +### Battery present +- **Category:** health +- **ID:** `health.battery.present` +- Battery detected. (Wear-level / design-vs-full-capacity requires a powercfg battery report, not collected here.) + +``` +EstimatedChargeRemaining=68%; BatteryStatus=2 +``` + +### No backup agent detected +- **Category:** health +- **ID:** `health.backup.none` +- No known backup agent service found. Backup expectation varies by endpoint; confirm whether this machine is supposed to have local/cloud backup and whether server-side or M365 backup covers it. + +``` +No matching backup service in Win32_Service +``` + + +--- + +## Inventory Baseline Summary + +- **Manufacturer / Model:** LENOVO / 83HM +- **Serial:** PF570RZ0 +- **CPU:** Intel(R) Core(TM) Ultra 7 256V (8 cores / 8 logical) +- **RAM (GB):** 15.6 +- **BIOS:** NYCN73WW (2025-09-15) +- **Chassis is laptop:** true +- **TPM present / Secure Boot:** true / true +- **Domain joined:** false (WORKGROUP) +- **OS activation licensed:** true +- **Uptime (days):** 25.1 +- **Pending reboot:** true +- **Installed software count:** 19 +- **Scheduled tasks (non-MS, enabled):** 44 +- **Local administrators:** Dallas\Administrator, Dallas\miche + +### Fixed volumes + +- [SYSTEM_DRV] - 0.2 GB free of 0.2 GB (81.7%) +- [WINRE_DRV] - 1.2 GB free of 2 GB (59%) +- C: - 832.4 GB free of 951.6 GB (87.5%) + +### Network adapters + +- Intel(R) Wi-Fi 7 BE201 320MHz - IP: 192.168.1.226, fe80::4ffb:5716:9793:3369, fd73:cb91:29c4:645b:46ad:58ba:ac7e:dab - DNS: 192.168.1.1 - DHCP: true + +--- + +## Diff vs Prior Baseline + +- No prior baseline found for this host. This is the first baseline. + +--- + +_Generated by run-onboarding-diagnostic.sh (GuruRMM onboarding diagnostic, Phase 1). Raw snapshot: `DALLAS-20260706T233936.json` (immutable)._ diff --git a/clients/goldstein/session-logs/2026-07/2026-07-06-howard-dallas-rmm-onboard.md b/clients/goldstein/session-logs/2026-07/2026-07-06-howard-dallas-rmm-onboard.md new file mode 100644 index 00000000..b84fe554 --- /dev/null +++ b/clients/goldstein/session-logs/2026-07/2026-07-06-howard-dallas-rmm-onboard.md @@ -0,0 +1,116 @@ +# Session Log — Goldstein: DALLAS RMM Onboarding + +## User +- **User:** Howard Enos (howard) +- **Machine:** Howard-Home +- **Role:** tech + +## Session Summary + +Onboarded a new Goldstein endpoint — the DALLAS laptop (Michelle Goldstein's Lenovo Yoga Slim 7, +logged-on user `Dallas\miche`) — to remote management under Syncro ticket #32490 ("Remote - Unable +to remote access to the computers in Dallas"). Work began after ScreenConnect had already been +installed on the machine manually; this session documented that in the ticket, then deployed the +GuruRMM agent and ran the onboarding security/health baseline. + +First added a private (internal) note to Syncro ticket #32490 recording that Howard spoke with +Ashly and installed ScreenConnect on the Dallas machine. Then confirmed the GuruRMM client/site +target: the "Goldstein" client already existed (id 7eed26be-4126-40a5-8414-3c0c28b9d182) with two +sites — Dallas (SILVER-PEAK-3739) and Tucson (RED-LION-9255). The DALLAS machine belongs in the +Dallas, TX site (confirmed with the user), which already holds agent ASUS-2024, so no site creation +was needed — the machine was enrolled into the existing Dallas site. + +Deployed the GuruRMM agent by pushing the official site-keyed install one-liner +(`irm https://rmm.azcomputerguru.com/install/SILVER-PEAK-3739/windows | iex`) to the DALLAS +ScreenConnect session via `send-command` (SC backstage, runs as the agent/SYSTEM). The SC session +was also tagged Company=Goldstein / Site=Dallas. Enrollment was verified against the RMM API — the +agent came up as hostname "Dallas", client Goldstein, site Dallas (agent id +36c7bbc8-504f-4b4a-8995-3b3e5cdc0f02). + +Finally ran the onboarding diagnostic probe against the new agent. Result: **AMBER** grade +(0 critical / 4 warning / 15 info). No critical security findings — Defender active and +tamper-protected, BitLocker 100% with recovery protector, all firewall profiles on, SMBv1 off, +LAPS present, no competitor/leftover RMM agents. The four warnings are routine post-provision +hygiene items (pending Windows updates, pending reboot, benign stopped Google/Intel auto-start +services, clock on local CMOS instead of NTP). One health note worth follow-up: no backup agent +detected on this laptop. Immutable baseline written to +`clients/goldstein/onboarding-baselines/DALLAS-20260706T233936.{json,md}`. + +## Key Decisions + +- **Enrolled into the existing Goldstein/Dallas site rather than creating a new client or site.** + A "Goldstein" client with a "Dallas" site (SILVER-PEAK-3739) already existed and already held + ASUS-2024. Creating a duplicate would have fragmented the client. User confirmed the DALLAS + machine belongs in Dallas, TX. +- **Deployed the agent via ScreenConnect `send-command`, not an RMM push.** The machine was not yet + an RMM agent, so `/rmm run` was unavailable; ScreenConnect was the existing access path. Used the + official site-keyed install script so enrollment/self-tagging is handled by GuruRMM. +- **Verified enrollment against the RMM API rather than SC command output.** SC `send-command` + returns `{}` and the install runs asynchronously, so success was confirmed by polling + `GET /api/agents` for the new Dallas agent. +- **Ticket note set to private (hidden).** Internal record of the ScreenConnect install and the + conversation with Ashly; not customer-facing. + +## Problems Encountered + +- None blocking. The SC `send-command` empty-`{}` response is expected (async queue), and RMM + enrollment confirmed the install succeeded within ~2 minutes. + +## Configuration Changes + +- **Created:** `clients/goldstein/onboarding-baselines/DALLAS-20260706T233936.json` (immutable raw snapshot) +- **Created:** `clients/goldstein/onboarding-baselines/DALLAS-20260706T233936.md` (human report) +- **Created:** this session log +- **Endpoint (DALLAS):** GuruRMM agent installed (`C:\Program Files\...\gururmm-agent.exe`, service); + ScreenConnect client already present (two SC services running). +- **ScreenConnect:** DALLAS session custom properties set — CP1=Goldstein, CP2=Dallas, CP3=(blank). +- **Syncro:** private comment added to ticket #32490. + +## Credentials & Secrets + +- No new credentials created or discovered this session. The Goldstein/Dallas site enrollment key + (site code SILVER-PEAK-3739) is server-managed; agent enrolled via the public site-keyed installer + URL (no secret handled locally). + +## Infrastructure & Servers + +- **Endpoint DALLAS** — LENOVO 83HM (Yoga Slim 7 15ILL9), serial PF570RZ0; Intel Core Ultra 7 256V, + 15.6 GB RAM; Windows 11 Home build 26200 (25H2); workgroup (WORKGROUP), not domain-joined. + Public IP 99.127.21.4; private 192.168.1.226 (Intel Wi-Fi 7 BE201); DNS/gateway 192.168.1.1. + Logged-on user `Dallas\miche` (Michelle Goldstein). Local admins: `Dallas\Administrator`, `Dallas\miche`. + TPM + Secure Boot present; BitLocker on C: 100% (RecoveryPassword + TPM). Uptime ~25 days at scan. +- **GuruRMM** — server `http://172.16.3.30:3001`; client "Goldstein" id 7eed26be-4126-40a5-8414-3c0c28b9d182; + Dallas site id 653b7e39-5e5e-4b93-b135-c70fc12ececa (code SILVER-PEAK-3739); Tucson site + 4526ef0e-31d6-48f1-8df4-40d3a16519c1 (code RED-LION-9255). + New agent "Dallas" id 36c7bbc8-504f-4b4a-8995-3b3e5cdc0f02. + Other Goldstein agents: ASUS-2024 (Dallas site), DalRes10 + GS-Backup (Tucson site). +- **ScreenConnect** — DALLAS session id 29c62473-a5cb-4e94-a190-c91f05031809; client 26.4.3.9662. + +## Commands & Outputs + +- Install push (SC backstage → DALLAS): + `powershell -NoProfile -ExecutionPolicy Bypass -Command "irm https://rmm.azcomputerguru.com/install/SILVER-PEAK-3739/windows | iex"` +- Enrollment verify: `GET /api/agents` → + `host=Dallas os=windows client=Goldstein site=Dallas status=online last=2026-07-06T23:37:21Z` +- Diagnostic: `bash .claude/scripts/run-onboarding-diagnostic.sh Dallas goldstein` → + `Grade=AMBER critical=0 warning=4 unknown=0 info=15` +- Diagnostic warnings: pending Windows updates (`sec.patch.pending`); pending reboot + (`health.reboot_uptime.pending`); 4 stopped auto-start services (Google Updater x2, Intel + Platform License Manager, Intel Display UM — benign); time source = Local CMOS Clock, not NTP + (`health.time.local_cmos`). + +## Pending / Incomplete Tasks + +- **Windows updates + reboot pending** on DALLAS — approve/install and reboot on next maintenance window. +- **No backup agent on DALLAS** — confirm whether this laptop should have MSP360/cloud backup; + it currently has none detected. +- **Time source on local CMOS** — set a reliable NTP source (workgroup laptop, no domain hierarchy). +- **Ticket #32490** still New, owner Mike (1735) — status/ownership left unchanged; close/bill as appropriate. +- Wiki: no Goldstein article exists yet — compile one from this log (command emitted post-sync). + +## Reference Information + +- Syncro ticket: https://computerguru.syncromsp.com/tickets/113249206 (#32490); customer Sheldon + Goldstein, cust id 25307933 (sheldon@lawyersdallas.com); Dallas contact Michelle Goldstein (972-814-5677). +- GuruRMM install page (Dallas site): https://rmm.azcomputerguru.com/install/SILVER-PEAK-3739 +- Baseline files: `clients/goldstein/onboarding-baselines/DALLAS-20260706T233936.{json,md}`