From 1768a76d82fad068f2410c9bfde88279716fcd8f Mon Sep 17 00:00:00 2001 From: Howard Enos Date: Wed, 22 Jul 2026 16:24:36 -0700 Subject: [PATCH] sync: auto-sync from HOWARD-HOME at 2026-07-22 16:24:03 Author: Howard Enos Machine: HOWARD-HOME Timestamp: 2026-07-22 16:24:03 --- .claude/memory/feedback_cascades.md | 4 +- ...6-07-22-howard-caregiver-onboard-rwhite.md | 70 +++++++++++++++++++ errorlog.md | 1 + wiki/clients/cascades-tucson.md | 4 +- 4 files changed, 77 insertions(+), 2 deletions(-) create mode 100644 clients/cascades-tucson/session-logs/2026-07/2026-07-22-howard-caregiver-onboard-rwhite.md diff --git a/.claude/memory/feedback_cascades.md b/.claude/memory/feedback_cascades.md index b8319f8a..22780110 100644 --- a/.claude/memory/feedback_cascades.md +++ b/.claude/memory/feedback_cascades.md @@ -14,12 +14,14 @@ Current-state context: [[project_cascades]]. Root cause / incident detail: [[pro fdeploy caches failures and never retries if subfolders don't exist at first logon. "No changes detected" = stuck forever without manual intervention. -**Mandatory order for every new user:** +**Mandatory order for every new OFFICE/ADMIN user (NOT caregivers):** 1. Create AD user. 2. Run `New-HomeFolder -Username ""` on **CS-SERVER** โ€” creates root + Desktop / Documents / Downloads / Music / Pictures subfolders with correct ACL. 3. Add user to `SG-FolderRedirect`. 4. THEN first domain logon. +**Caregivers do NOT get `SG-FolderRedirect` or `New-HomeFolder`.** They use shared Android phones (Intune Shared Device Mode) and kiosk-mode domain desktops (nothing persists between sessions). Caregiver setup: AD user in `OU=Caregivers` + `SG-Caregivers` + Entra sync + M365 license + ALIS staff record. No folder redirection, no home folder. + **Recovery (fdeploy already cached a failure):** - Run `clients/cascades-tucson/scripts/fix-shell-redirect.ps1` via GuruRMM on the client **while the user is logged in**. - Script sets both GUID-based and legacy-name registry keys (`Personal`, `My Music`, `My Pictures`) in `HKU\`. diff --git a/clients/cascades-tucson/session-logs/2026-07/2026-07-22-howard-caregiver-onboard-rwhite.md b/clients/cascades-tucson/session-logs/2026-07/2026-07-22-howard-caregiver-onboard-rwhite.md new file mode 100644 index 00000000..993abb6e --- /dev/null +++ b/clients/cascades-tucson/session-logs/2026-07/2026-07-22-howard-caregiver-onboard-rwhite.md @@ -0,0 +1,70 @@ +# 2026-07-22 โ€” Caregiver Onboard: Ronesha White + +## User +- **User:** Howard Enos (howard) +- **Machine:** Howard-Home +- **Role:** tech + +## Session Summary + +Created a new caregiver account for Ronesha White at Cascades of Tucson. Following the established caregiver onboarding process: AD user created in `OU=Caregivers` on CS-SERVER via GuruRMM, added to `SG-Caregivers`, Entra Connect delta sync triggered, and M365 Business Premium license assigned via Graph API (user-manager tier). Temp password vaulted and synced. + +Initial script attempted to run `New-HomeFolder` and add to `SG-FolderRedirect`, both of which are office/admin-staff steps, not caregiver steps. Howard corrected: caregivers use shared Android phones (Intune Shared Device Mode) and kiosk-mode domain desktops where nothing persists between sessions -- no folder redirection, no home folders. The `SG-FolderRedirect` add was reversed. The `New-HomeFolder` had already run (created `D:\Homes\r.white` with subfolders) but is inert since the user will never log into a non-kiosk desktop with redirection enabled. + +Password emailed to Cascades by Howard. ALIS staff record to be created by Howard manually to match username `r.white@cascadestucson.com`. + +## Key Decisions + +- **Username:** `r.white` per standard `firstinitial.lastname` convention. +- **Password:** `Cactus7341` -- follows the July 2026 `Word####` pattern (human-typeable, no special chars, safe for Android Auth Broker which cannot render forced-change screens). +- **No SG-FolderRedirect:** caregivers use kiosk desktops and shared phones; folder redirection does not apply. +- **No ChangePasswordAtLogon:** `$false` per established rule -- Auth Broker on shared phones cannot render the forced-change screen (root-caused 2026-07-02 fleet-wide). +- **PasswordNeverExpires:** `$true` -- `PSO-Caregivers` FGPP (precedence 10, `MaxPasswordAge=00:00:00`) covers `SG-Caregivers`; rotation is on-event only per NIST 800-63B. + +## Problems Encountered + +- **`New-HomeFolder` not recognized:** The function is defined in `clients/cascades-tucson/scripts/new-home-folder.ps1` but not loaded as a module on CS-SERVER. Resolved by inlining the function body in a second dispatch. (Same issue hit on 2026-05-27 session.) +- **M365 license assignment failed on first try:** `usageLocation` PATCH returned 204 but Graph had not propagated it yet. Second `assignLicense` call 5 seconds later with `usageLocation=US` confirmed succeeded. +- **Incorrectly added to SG-FolderRedirect:** Removed after Howard's correction. Memory updated to clarify caregivers do not get folder redirection. + +## Configuration Changes + +- **Created:** AD user `r.white` in `OU=Caregivers,OU=Departments,DC=cascades,DC=local` on CS-SERVER +- **Created:** `D:\Homes\r.white` + 5 subfolders on CS-SERVER (inert for kiosk users) +- **Group membership:** `SG-Caregivers` (added), `SG-FolderRedirect` (added then removed) +- **Entra:** user synced, `usageLocation=US`, M365 Business Premium license assigned +- **Vault:** `clients/cascades-tucson/caregiver-temp-passwords-2026-07-22.sops.yaml` created + synced +- **Wiki:** `wiki/clients/cascades-tucson.md` updated (roster count 35->36, timeline entry, vault ref, clarified caregivers do not get SG-FolderRedirect) +- **Memory:** `feedback_cascades.md` updated to document that caregivers do not get SG-FolderRedirect or home folders + +## Credentials & Secrets + +- **r.white temp password:** vault `clients/cascades-tucson/caregiver-temp-passwords-2026-07-22.sops.yaml`, key `r.white` +- Emailed to Cascades by Howard. + +## Infrastructure & Servers + +- **CS-SERVER:** `c39f1de7-d5b6-45ae-b132-e06977ab1713` (GuruRMM agent, Cascades of Tucson, Windows) +- **Cascades tenant:** `207fa277-e9d8-4eb7-ada1-1064d2221498` +- **Entra user ID (r.white):** `9c307afd-c548-478c-801c-28e577147e28` +- **M365 Business Premium SKU:** `cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46` + +## Commands & Outputs + +- AD user creation: `New-ADUser` -- exit 0, user created in correct OU +- Group adds: `Add-ADGroupMember SG-Caregivers` -- exit 0 +- `SG-FolderRedirect` removal: `Remove-ADGroupMember` -- exit 0 +- Home folder: inline `New-HomeFolder` -- exit 0, `D:\Homes\r.white` + 5 subfolders created +- Delta sync: `Start-ADSyncSyncCycle -PolicyType Delta` -- Result: Success +- Graph: `PATCH /users/{id}` usageLocation=US -- HTTP 204 +- Graph: `POST /users/{id}/assignLicense` Business Premium -- success (second attempt after propagation delay) + +## Pending / Incomplete Tasks + +- **ALIS staff record:** Howard creating manually. Email must equal `r.white@cascadestucson.com` exactly. Disable ALIS-native 2FA (conflicts with SSO). + +## Reference Information + +- RMM command IDs: `571bf547` (AD create), `40942426` (groups+sync), `e089d593` (home folder) +- Bot alert posted to #dev-alerts: message_id `1529623374714769480` +- Vault commit: `ca4a6dd` on vault main diff --git a/errorlog.md b/errorlog.md index 73f51991..2b76007d 100644 --- a/errorlog.md +++ b/errorlog.md @@ -24,6 +24,7 @@ Categories (the `[type]` tag): _(none)_ = skill/command execution failure ยท 2026-07-22 | GURU-5070 | grok | grok review returned no result [ctx: mode=review-files session= stopReason=] 2026-07-22 | GURU-5070 | grok | grok returned no text [ctx: mode=text stopReason=] +2026-07-22 | Howard-Home | rmm/caregiver-create | [correction] assumed caregivers get SG-FolderRedirect; they do not - only office/admin staff with domain-joined desktops get folder redirection [ctx: ref=feedback_cascades] 2026-07-22 | GURU-5070 | syncro | add_line_item returns {"errors":"Description can't be blank"} when only 'name' is sent - the 'description' field is ALSO required (skill hard-rules only mention name + price_retail). Include description on every add_line_item. No partial line created on the clean validation error. [ctx: ticket=32574 endpoint=add_line_item] diff --git a/wiki/clients/cascades-tucson.md b/wiki/clients/cascades-tucson.md index 13d7e392..daf62457 100644 --- a/wiki/clients/cascades-tucson.md +++ b/wiki/clients/cascades-tucson.md @@ -151,7 +151,7 @@ On-prem AD `cascades.local` synced to Entra/M365 via Entra Connect (PHS + Seamle ### Caregiver roster & FGPP -- **`SG-Caregivers` = frontline caregivers ONLY.** Roster: 35 as of 2026-07-01 (8 offboarded, 4 new hires added, Zeke Huerta moved to front desk). Admin-adjacent staff, `pilot.test`, disabled accounts excluded. All writes via CS-SERVER/RMM (Cloud/Graph writes fail HTTP 400). +- **`SG-Caregivers` = frontline caregivers ONLY.** Roster: 36 as of 2026-07-22 (8 offboarded, 5 new hires added, Zeke Huerta moved to front desk). Admin-adjacent staff, `pilot.test`, disabled accounts excluded. All writes via CS-SERVER/RMM (Cloud/Graph writes fail HTTP 400). **Caregivers do NOT get `SG-FolderRedirect` or home folders** -- they use shared Android phones (Intune Shared Device Mode) and kiosk-mode domain desktops (nothing persists between sessions). - **`PSO-Caregivers` (Fine-Grained Password Policy, created 2026-07-02):** Precedence 10, `MaxPasswordAge=00:00:00` (never expires). Applies to `SG-Caregivers`; removal reverts cohort to 42-day domain default. - **Juan Andrade (`j.andrade`):** offboard pending as of 7/17 (was due 2026-07-16 PM per coord todo `80716a98`). Verify status โ€” if not done, disable + remove from `SG-Caregivers` + reclaim Business Premium. @@ -247,6 +247,7 @@ Established 2026-07-09 (Bariffa Sika -> Charity Menle). **Rename, never re-creat - **ALIS API user:** vault: `clients/cascades-tucson/alis-api-howard-user.sops.yaml` - **Caregiver temp passwords (2026-06-30):** vault: `clients/cascades-tucson/caregiver-temp-passwords-2026-06-30.sops.yaml`. Retrieve with `vault get` (NOT `get-field`). Do NOT inline values. - **Caregiver temp passwords (2026-07-01, 4 new hires):** vault: `clients/cascades-tucson/caregiver-temp-passwords-2026-07-01.sops.yaml`. Same retrieval rules. +- **Caregiver temp passwords (2026-07-22, Ronesha White):** vault: `clients/cascades-tucson/caregiver-temp-passwords-2026-07-22.sops.yaml`. Same retrieval rules. - **Shelby Trozzi (domain account):** vault: `clients/cascades-tucson/shelby-trozzi.sops.yaml`. Not Entra-synced (safe to reset on-prem without M365 impact). - **pilot.test AD account (test identity for kiosk work):** vault: `clients/cascades-tucson/pilot-test-ad.sops.yaml`. Added to SG-Caregivers 2026-07-17 for kiosk testing. Reclaim when WS3 pilot complete. - **UOS controller SSH (root):** vault: `infrastructure/uos-server-ssh-key` @@ -471,6 +472,7 @@ Established 2026-07-09 (Bariffa Sika -> Charity Menle). **Rename, never re-creat | 2026-07-15 | BEC/vendor-fraud phish (info@syufway.com, fake W-9 "AMYSH Solutions") investigated and remediated. syufway.com + steqm.com blocked in Tenant Allow/Block List. | | 2026-07-17 | 10 functional/role-based mailboxes converted to shared mailboxes; 6x O365_BUSINESS_PREMIUM + 4x EXCHANGE_S_ESSENTIALS licenses reclaimed. SPB 40 consumed (5 free); O365BP suspended now 23 consumed. | | 2026-07-17 | NURSESTATION-PC nurse-station kiosk GPO built (WS3 step 3b): Edge SSO via PRT, GPP shortcuts (ALIS/PharmCare/Helpany), AppLocker Packaged App Deny rules for SG-Caregivers, UI restrictions, machine-level printers. ASSISTNURSE-PC pending. | +| 2026-07-22 | New caregiver onboarded: Ronesha White (`r.white@cascadestucson.com`). AD + SG-Caregivers + Entra sync + M365 Business Premium. No SG-FolderRedirect (caregivers use kiosk desktops + shared phones). ALIS record pending (Howard creating manually). SG-Caregivers now 36. | ---