sync: auto-sync from HOWARD-HOME at 2026-07-22 16:24:03
Author: Howard Enos Machine: HOWARD-HOME Timestamp: 2026-07-22 16:24:03
This commit is contained in:
@@ -0,0 +1,70 @@
|
||||
# 2026-07-22 — Caregiver Onboard: Ronesha White
|
||||
|
||||
## User
|
||||
- **User:** Howard Enos (howard)
|
||||
- **Machine:** Howard-Home
|
||||
- **Role:** tech
|
||||
|
||||
## Session Summary
|
||||
|
||||
Created a new caregiver account for Ronesha White at Cascades of Tucson. Following the established caregiver onboarding process: AD user created in `OU=Caregivers` on CS-SERVER via GuruRMM, added to `SG-Caregivers`, Entra Connect delta sync triggered, and M365 Business Premium license assigned via Graph API (user-manager tier). Temp password vaulted and synced.
|
||||
|
||||
Initial script attempted to run `New-HomeFolder` and add to `SG-FolderRedirect`, both of which are office/admin-staff steps, not caregiver steps. Howard corrected: caregivers use shared Android phones (Intune Shared Device Mode) and kiosk-mode domain desktops where nothing persists between sessions -- no folder redirection, no home folders. The `SG-FolderRedirect` add was reversed. The `New-HomeFolder` had already run (created `D:\Homes\r.white` with subfolders) but is inert since the user will never log into a non-kiosk desktop with redirection enabled.
|
||||
|
||||
Password emailed to Cascades by Howard. ALIS staff record to be created by Howard manually to match username `r.white@cascadestucson.com`.
|
||||
|
||||
## Key Decisions
|
||||
|
||||
- **Username:** `r.white` per standard `firstinitial.lastname` convention.
|
||||
- **Password:** `Cactus7341` -- follows the July 2026 `Word####` pattern (human-typeable, no special chars, safe for Android Auth Broker which cannot render forced-change screens).
|
||||
- **No SG-FolderRedirect:** caregivers use kiosk desktops and shared phones; folder redirection does not apply.
|
||||
- **No ChangePasswordAtLogon:** `$false` per established rule -- Auth Broker on shared phones cannot render the forced-change screen (root-caused 2026-07-02 fleet-wide).
|
||||
- **PasswordNeverExpires:** `$true` -- `PSO-Caregivers` FGPP (precedence 10, `MaxPasswordAge=00:00:00`) covers `SG-Caregivers`; rotation is on-event only per NIST 800-63B.
|
||||
|
||||
## Problems Encountered
|
||||
|
||||
- **`New-HomeFolder` not recognized:** The function is defined in `clients/cascades-tucson/scripts/new-home-folder.ps1` but not loaded as a module on CS-SERVER. Resolved by inlining the function body in a second dispatch. (Same issue hit on 2026-05-27 session.)
|
||||
- **M365 license assignment failed on first try:** `usageLocation` PATCH returned 204 but Graph had not propagated it yet. Second `assignLicense` call 5 seconds later with `usageLocation=US` confirmed succeeded.
|
||||
- **Incorrectly added to SG-FolderRedirect:** Removed after Howard's correction. Memory updated to clarify caregivers do not get folder redirection.
|
||||
|
||||
## Configuration Changes
|
||||
|
||||
- **Created:** AD user `r.white` in `OU=Caregivers,OU=Departments,DC=cascades,DC=local` on CS-SERVER
|
||||
- **Created:** `D:\Homes\r.white` + 5 subfolders on CS-SERVER (inert for kiosk users)
|
||||
- **Group membership:** `SG-Caregivers` (added), `SG-FolderRedirect` (added then removed)
|
||||
- **Entra:** user synced, `usageLocation=US`, M365 Business Premium license assigned
|
||||
- **Vault:** `clients/cascades-tucson/caregiver-temp-passwords-2026-07-22.sops.yaml` created + synced
|
||||
- **Wiki:** `wiki/clients/cascades-tucson.md` updated (roster count 35->36, timeline entry, vault ref, clarified caregivers do not get SG-FolderRedirect)
|
||||
- **Memory:** `feedback_cascades.md` updated to document that caregivers do not get SG-FolderRedirect or home folders
|
||||
|
||||
## Credentials & Secrets
|
||||
|
||||
- **r.white temp password:** vault `clients/cascades-tucson/caregiver-temp-passwords-2026-07-22.sops.yaml`, key `r.white`
|
||||
- Emailed to Cascades by Howard.
|
||||
|
||||
## Infrastructure & Servers
|
||||
|
||||
- **CS-SERVER:** `c39f1de7-d5b6-45ae-b132-e06977ab1713` (GuruRMM agent, Cascades of Tucson, Windows)
|
||||
- **Cascades tenant:** `207fa277-e9d8-4eb7-ada1-1064d2221498`
|
||||
- **Entra user ID (r.white):** `9c307afd-c548-478c-801c-28e577147e28`
|
||||
- **M365 Business Premium SKU:** `cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46`
|
||||
|
||||
## Commands & Outputs
|
||||
|
||||
- AD user creation: `New-ADUser` -- exit 0, user created in correct OU
|
||||
- Group adds: `Add-ADGroupMember SG-Caregivers` -- exit 0
|
||||
- `SG-FolderRedirect` removal: `Remove-ADGroupMember` -- exit 0
|
||||
- Home folder: inline `New-HomeFolder` -- exit 0, `D:\Homes\r.white` + 5 subfolders created
|
||||
- Delta sync: `Start-ADSyncSyncCycle -PolicyType Delta` -- Result: Success
|
||||
- Graph: `PATCH /users/{id}` usageLocation=US -- HTTP 204
|
||||
- Graph: `POST /users/{id}/assignLicense` Business Premium -- success (second attempt after propagation delay)
|
||||
|
||||
## Pending / Incomplete Tasks
|
||||
|
||||
- **ALIS staff record:** Howard creating manually. Email must equal `r.white@cascadestucson.com` exactly. Disable ALIS-native 2FA (conflicts with SSO).
|
||||
|
||||
## Reference Information
|
||||
|
||||
- RMM command IDs: `571bf547` (AD create), `40942426` (groups+sync), `e089d593` (home folder)
|
||||
- Bot alert posted to #dev-alerts: message_id `1529623374714769480`
|
||||
- Vault commit: `ca4a6dd` on vault main
|
||||
Reference in New Issue
Block a user