diff --git a/clients/cascades/session-logs/2026-07/2026-07-20-howard-rok7vnm-edge-download-fix.md b/clients/cascades/session-logs/2026-07/2026-07-20-howard-rok7vnm-edge-download-fix.md new file mode 100644 index 00000000..20f43b2f --- /dev/null +++ b/clients/cascades/session-logs/2026-07/2026-07-20-howard-rok7vnm-edge-download-fix.md @@ -0,0 +1,75 @@ +# Cascades Life Enrichment DESKTOP-ROK7VNM — Edge Download Failure Fix + +## User +- **User:** Howard Enos (howard) +- **Machine:** Howard-Home +- **Role:** tech + +## Session Summary + +Howard reported that the Cascades Life Enrichment machine DESKTOP-ROK7VNM (logged-on user Susan Hicks) could not download files in Edge. The error was a generic "can't download, try again later" with a retry loop that would start the download, flash, retry repeatedly, then fail. + +Initial investigation via GuruRMM confirmed the machine was online, had good internet connectivity (test downloads via PowerShell succeeded), 67 GB free disk space, current Edge version (150.0.4078.83), no proxy, no restrictive download policies, and no Defender blocks. The SusanH Edge profile was found to be severely bloated at 2.1 GB (Code Cache 735 MB, Cache 305 MB, Service Workers 365 MB, Snapshots 93 MB). Cleaned approximately 1.7 GB of cache/temp data while preserving passwords, bookmarks, cookies, and history. Remaining Edge data dropped from 2,082 MB to 385 MB. + +The download issue persisted after cache cleanup. Howard confirmed it also failed in Chrome and only affected files from a specific site (Walmart gas portal), while the same files downloaded fine on another machine. This pointed to a machine-specific security or permissions issue rather than a browser problem. + +Investigation of the user profile revealed all shell folders (Documents, Music, Pictures, Videos, Favorites, Downloads, Desktop) were redirected to `\\CS-SERVER\homes\Susan.Hicks\` via folder redirection. Checking NTFS permissions on CS-SERVER (`D:\homes\Susan.Hicks\`) revealed that the Downloads and Desktop subfolders had `CASCADES\Susan.Hicks:(I)(F)` (inherited full control), but Documents, Music, Pictures, Videos, and Favorites were missing Susan's ACE entirely -- only Administrators and SYSTEM had access. The root cause was the parent folder had `(F)` for Susan but without `(OI)(CI)` inheritance flags, so newly created subfolders did not inherit her permissions. + +Fixed by granting `CASCADES\Susan.Hicks:(OI)(CI)(F)` on all five broken subfolders via icacls on CS-SERVER, and updated the parent folder's ACL to include inheritance flags. The Documents folder icacls took over a minute due to file volume. After the fix, downloads worked immediately. + +## Key Decisions + +- Investigated Edge sync error ("account not allowed to use sync") but Howard confirmed sync was actually working after a retry -- the license difference (Business Standard vs Business Premium) was not the blocking issue. +- Cleaned the bloated Edge profile proactively even though it was not the root cause, since 2.1 GB of cache data is unhealthy and could cause other performance issues. +- Applied `(OI)(CI)(F)` on subfolders without `/T` recursive flag to avoid timeouts on large folders -- the inheritance flags ensure new files/subfolders get proper permissions going forward. +- Fixed parent folder ACL to include `(OI)(CI)` so any future subfolders will inherit Susan's permissions correctly. + +## Problems Encountered + +- The `get-token.sh` remediation tool script had a bug where `read_field` was wrapping cert values in `['REDACTED']` markers, causing cert-based auth to fail with "MalformedFraming" on the PEM key decode. Worked around by decrypting the vault file directly via `sops -d` and extracting fields with PyYAML. +- PowerShell scripts with regex patterns containing parentheses caused bash shell escaping failures when passed inline. Resolved by writing scripts to `.ps1` files and staging them on the endpoint via base64 encoding. +- The `ps-encoded.sh` helper refused scripts over 6KB encoded. Split into staging (base64 decode to `C:\Windows\Temp`) then execution as a separate command. +- The icacls command on the parent folder `D:\homes\Susan.Hicks` timed out even at 120 seconds due to the volume of files. The subfolder fixes (which completed successfully) were sufficient to resolve the issue. + +## Configuration Changes + +- `D:\homes\Susan.Hicks\Documents` on CS-SERVER: added `CASCADES\Susan.Hicks:(OI)(CI)(F)` +- `D:\homes\Susan.Hicks\Music` on CS-SERVER: added `CASCADES\Susan.Hicks:(OI)(CI)(F)` +- `D:\homes\Susan.Hicks\Pictures` on CS-SERVER: added `CASCADES\Susan.Hicks:(OI)(CI)(F)` +- `D:\homes\Susan.Hicks\Videos` on CS-SERVER: added `CASCADES\Susan.Hicks:(OI)(CI)(F)` +- `D:\homes\Susan.Hicks\Favorites` on CS-SERVER: added `CASCADES\Susan.Hicks:(OI)(CI)(F)` +- DESKTOP-ROK7VNM: cleared ~1.7 GB of Edge cache/temp data from `C:\Users\SusanH\AppData\Local\Microsoft\Edge\User Data` + +## Credentials & Secrets + +None discovered or created. + +## Infrastructure & Servers + +- **DESKTOP-ROK7VNM** — Cascades Life Enrichment machine, Windows, domain-joined to `cascades.local`, active user `susan.hicks` (profile path `C:\Users\SusanH`), GuruRMM agent ID `4832ff97-196d-4de5-a3b9-dadf9adb2c7a` +- **CS-SERVER** — Cascades file server, Windows, GuruRMM agent ID `c39f1de7-d5b6-45ae-b132-e06977ab1713`, homes share at `D:\homes\` +- **Cascades M365 tenant** — Tenant ID `207fa277-e9d8-4eb7-ada1-1064d2221498`, domain `cascadestucson.com` +- Susan Hicks UPN: `susan.hicks@cascadestucson.com`, SID `S-1-5-21-388235164-2207693853-3666415804-1117` +- Folder redirection target: `\\CS-SERVER\homes\Susan.Hicks\` (Downloads, Desktop, Documents, Music, Pictures, Videos, Favorites) +- Security products on ROK7VNM: Datto AV (Endpoint Protection, Avira-based) + Datto EDR Agent + Windows Defender + +## Commands & Outputs + +- `icacls D:\homes\Susan.Hicks` revealed parent had `CASCADES\Susan.Hicks:(F)` without `(OI)(CI)` -- no inheritance to children +- `icacls D:\homes\Susan.Hicks\Documents` showed only Administrators and SYSTEM -- Susan's ACE was missing +- `icacls D:\homes\Susan.Hicks\Downloads` showed Susan had `(I)(F)` -- working correctly (as did Desktop) +- Fix applied: `icacls /grant 'CASCADES\Susan.Hicks:(OI)(CI)(F)'` on Documents, Music, Pictures, Videos, Favorites + +## Pending / Incomplete Tasks + +- [WARNING] Other Cascades users may have the same broken inheritance on their home folders -- worth auditing `D:\homes\*` subfolders for missing user ACEs. +- The parent folder `D:\homes\Susan.Hicks` icacls with `(OI)(CI)` timed out -- may want to run manually or via ScreenConnect with a longer timeout. +- The `get-token.sh` `read_field` function has a bug with `['REDACTED']` wrapping on cert values -- should be investigated and fixed (affects cert-based auth on this machine). +- Susan has Microsoft 365 Business Standard while most of the tenant (40 users) is on Business Premium. 22 other users are also on Business Standard. Not currently causing issues but worth noting for future license alignment. + +## Reference Information + +- GuruRMM command IDs (key ones): edge cleanup `be0666ef`, Documents ACL fix `862fd85d`, remaining folders fix `dd745121` +- Edge version on ROK7VNM: 150.0.4078.83 +- Datto AV version: 3.17.1.5606 (Endpoint Protection SDK 1.0.2510.6851) +- Cascades M365 SKUs: SPB (Business Premium, 40/45 used), O365_BUSINESS_PREMIUM (Business Standard, 23/0 -- legacy) diff --git a/errorlog.md b/errorlog.md index 09176fa3..5408a199 100644 --- a/errorlog.md +++ b/errorlog.md @@ -19,6 +19,8 @@ Categories (the `[type]` tag): _(none)_ = skill/command execution failure · +2026-07-20 | Howard-Home | remediation-tool | get-token: token request failed (no access_token) [ctx: tenant=207fa277-e9d8-4eb7-ada1-1064d2221498 tier=investigator auth=secret err=7000215] + 2026-07-20 | Howard-Home | rmm | [correction] Misidentified Datto AV kernel drivers (rtp1/rtp2/rtp_elam/BdNet/BdSentry/netprotection_network_filter*) as orphan Avira/Bitdefender leftovers. Datto AV uses the Bitdefender Endpoint Protection SDK under the hood, so these drivers are signed by Avira Operations GmbH but belong to Datto AV. Disabled and deleted them, breaking Datto AV. Had to restore from the SDK backup dir. Always check C:Program Filesinfocytegentdattoav before assuming BD/Avira drivers are orphans. [ctx: ref=maintenance-pc-cascades machine=MAINTENANCE-PC] 2026-07-20 | Howard-Home | rmm | [friction] Rebooted MAINTENANCE-PC (Wi-Fi only, no ethernet) into Safe Mode minimal -- agent lost connectivity, requires on-site visit to recover. Should have checked network adapter type before choosing safeboot. Wi-Fi devices cannot use Safe Mode for remote driver cleanup. [ctx: ref=maintenance-pc-cascades machine=MAINTENANCE-PC]