sync: auto-sync from HOWARD-HOME at 2026-07-22 16:24:03

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-22 16:24:03

.claude/memory/feedback_cascades.md

@@ -14,12 +14,14 @@ Current-state context: [[project_cascades]]. Root cause / incident detail: [[pro
 
 fdeploy caches failures and never retries if subfolders don't exist at first logon. "No changes detected" = stuck forever without manual intervention.
 
-**Mandatory order for every new user:**
+**Mandatory order for every new OFFICE/ADMIN user (NOT caregivers):**
 1. Create AD user.
 2. Run `New-HomeFolder -Username "<sam>"` on **CS-SERVER** — creates root + Desktop / Documents / Downloads / Music / Pictures subfolders with correct ACL.
 3. Add user to `SG-FolderRedirect`.
 4. THEN first domain logon.
 
+**Caregivers do NOT get `SG-FolderRedirect` or `New-HomeFolder`.** They use shared Android phones (Intune Shared Device Mode) and kiosk-mode domain desktops (nothing persists between sessions). Caregiver setup: AD user in `OU=Caregivers` + `SG-Caregivers` + Entra sync + M365 license + ALIS staff record. No folder redirection, no home folder.
+
 **Recovery (fdeploy already cached a failure):**
 - Run `clients/cascades-tucson/scripts/fix-shell-redirect.ps1` via GuruRMM on the client **while the user is logged in**.
 - Script sets both GUID-based and legacy-name registry keys (`Personal`, `My Music`, `My Pictures`) in `HKU\<SID>`.

clients/cascades-tucson/session-logs/2026-07/2026-07-22-howard-caregiver-onboard-rwhite.md

@@ -0,0 +1,70 @@
+# 2026-07-22 — Caregiver Onboard: Ronesha White
+
+## User
+- **User:** Howard Enos (howard)
+- **Machine:** Howard-Home
+- **Role:** tech
+
+## Session Summary
+
+Created a new caregiver account for Ronesha White at Cascades of Tucson. Following the established caregiver onboarding process: AD user created in `OU=Caregivers` on CS-SERVER via GuruRMM, added to `SG-Caregivers`, Entra Connect delta sync triggered, and M365 Business Premium license assigned via Graph API (user-manager tier). Temp password vaulted and synced.
+
+Initial script attempted to run `New-HomeFolder` and add to `SG-FolderRedirect`, both of which are office/admin-staff steps, not caregiver steps. Howard corrected: caregivers use shared Android phones (Intune Shared Device Mode) and kiosk-mode domain desktops where nothing persists between sessions -- no folder redirection, no home folders. The `SG-FolderRedirect` add was reversed. The `New-HomeFolder` had already run (created `D:\Homes\r.white` with subfolders) but is inert since the user will never log into a non-kiosk desktop with redirection enabled.
+
+Password emailed to Cascades by Howard. ALIS staff record to be created by Howard manually to match username `r.white@cascadestucson.com`.
+
+## Key Decisions
+
+- **Username:** `r.white` per standard `firstinitial.lastname` convention.
+- **Password:** `Cactus7341` -- follows the July 2026 `Word####` pattern (human-typeable, no special chars, safe for Android Auth Broker which cannot render forced-change screens).
+- **No SG-FolderRedirect:** caregivers use kiosk desktops and shared phones; folder redirection does not apply.
+- **No ChangePasswordAtLogon:** `$false` per established rule -- Auth Broker on shared phones cannot render the forced-change screen (root-caused 2026-07-02 fleet-wide).
+- **PasswordNeverExpires:** `$true` -- `PSO-Caregivers` FGPP (precedence 10, `MaxPasswordAge=00:00:00`) covers `SG-Caregivers`; rotation is on-event only per NIST 800-63B.
+
+## Problems Encountered
+
+- **`New-HomeFolder` not recognized:** The function is defined in `clients/cascades-tucson/scripts/new-home-folder.ps1` but not loaded as a module on CS-SERVER. Resolved by inlining the function body in a second dispatch. (Same issue hit on 2026-05-27 session.)
+- **M365 license assignment failed on first try:** `usageLocation` PATCH returned 204 but Graph had not propagated it yet. Second `assignLicense` call 5 seconds later with `usageLocation=US` confirmed succeeded.
+- **Incorrectly added to SG-FolderRedirect:** Removed after Howard's correction. Memory updated to clarify caregivers do not get folder redirection.
+
+## Configuration Changes
+
+- **Created:** AD user `r.white` in `OU=Caregivers,OU=Departments,DC=cascades,DC=local` on CS-SERVER
+- **Created:** `D:\Homes\r.white` + 5 subfolders on CS-SERVER (inert for kiosk users)
+- **Group membership:** `SG-Caregivers` (added), `SG-FolderRedirect` (added then removed)
+- **Entra:** user synced, `usageLocation=US`, M365 Business Premium license assigned
+- **Vault:** `clients/cascades-tucson/caregiver-temp-passwords-2026-07-22.sops.yaml` created + synced
+- **Wiki:** `wiki/clients/cascades-tucson.md` updated (roster count 35->36, timeline entry, vault ref, clarified caregivers do not get SG-FolderRedirect)
+- **Memory:** `feedback_cascades.md` updated to document that caregivers do not get SG-FolderRedirect or home folders
+
+## Credentials & Secrets
+
+- **r.white temp password:** vault `clients/cascades-tucson/caregiver-temp-passwords-2026-07-22.sops.yaml`, key `r.white`
+- Emailed to Cascades by Howard.
+
+## Infrastructure & Servers
+
+- **CS-SERVER:** `c39f1de7-d5b6-45ae-b132-e06977ab1713` (GuruRMM agent, Cascades of Tucson, Windows)
+- **Cascades tenant:** `207fa277-e9d8-4eb7-ada1-1064d2221498`
+- **Entra user ID (r.white):** `9c307afd-c548-478c-801c-28e577147e28`
+- **M365 Business Premium SKU:** `cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46`
+
+## Commands & Outputs
+
+- AD user creation: `New-ADUser` -- exit 0, user created in correct OU
+- Group adds: `Add-ADGroupMember SG-Caregivers` -- exit 0
+- `SG-FolderRedirect` removal: `Remove-ADGroupMember` -- exit 0
+- Home folder: inline `New-HomeFolder` -- exit 0, `D:\Homes\r.white` + 5 subfolders created
+- Delta sync: `Start-ADSyncSyncCycle -PolicyType Delta` -- Result: Success
+- Graph: `PATCH /users/{id}` usageLocation=US -- HTTP 204
+- Graph: `POST /users/{id}/assignLicense` Business Premium -- success (second attempt after propagation delay)
+
+## Pending / Incomplete Tasks
+
+- **ALIS staff record:** Howard creating manually. Email must equal `r.white@cascadestucson.com` exactly. Disable ALIS-native 2FA (conflicts with SSO).
+
+## Reference Information
+
+- RMM command IDs: `571bf547` (AD create), `40942426` (groups+sync), `e089d593` (home folder)
+- Bot alert posted to #dev-alerts: message_id `1529623374714769480`
+- Vault commit: `ca4a6dd` on vault main

errorlog.md

@@ -24,6 +24,7 @@ Categories (the `[type]` tag): _(none)_ = skill/command execution failure ·
 2026-07-22 | GURU-5070 | grok | grok review returned no result [ctx: mode=review-files session= stopReason=]
 
 2026-07-22 | GURU-5070 | grok | grok returned no text [ctx: mode=text stopReason=]
+2026-07-22 | Howard-Home | rmm/caregiver-create | [correction] assumed caregivers get SG-FolderRedirect; they do not - only office/admin staff with domain-joined desktops get folder redirection [ctx: ref=feedback_cascades]
 
 2026-07-22 | GURU-5070 | syncro | add_line_item returns {"errors":"Description can't be blank"} when only 'name' is sent - the 'description' field is ALSO required (skill hard-rules only mention name + price_retail). Include description on every add_line_item. No partial line created on the clean validation error. [ctx: ticket=32574 endpoint=add_line_item]
 

wiki/clients/cascades-tucson.md

@@ -151,7 +151,7 @@ On-prem AD `cascades.local` synced to Entra/M365 via Entra Connect (PHS + Seamle
 
 ### Caregiver roster & FGPP
 
-- **`SG-Caregivers` = frontline caregivers ONLY.** Roster: 35 as of 2026-07-01 (8 offboarded, 4 new hires added, Zeke Huerta moved to front desk). Admin-adjacent staff, `pilot.test`, disabled accounts excluded. All writes via CS-SERVER/RMM (Cloud/Graph writes fail HTTP 400).
+- **`SG-Caregivers` = frontline caregivers ONLY.** Roster: 36 as of 2026-07-22 (8 offboarded, 5 new hires added, Zeke Huerta moved to front desk). Admin-adjacent staff, `pilot.test`, disabled accounts excluded. All writes via CS-SERVER/RMM (Cloud/Graph writes fail HTTP 400). **Caregivers do NOT get `SG-FolderRedirect` or home folders** -- they use shared Android phones (Intune Shared Device Mode) and kiosk-mode domain desktops (nothing persists between sessions).
 - **`PSO-Caregivers` (Fine-Grained Password Policy, created 2026-07-02):** Precedence 10, `MaxPasswordAge=00:00:00` (never expires). Applies to `SG-Caregivers`; removal reverts cohort to 42-day domain default.
 - **Juan Andrade (`j.andrade`):** offboard pending as of 7/17 (was due 2026-07-16 PM per coord todo `80716a98`). Verify status — if not done, disable + remove from `SG-Caregivers` + reclaim Business Premium.
 
@@ -247,6 +247,7 @@ Established 2026-07-09 (Bariffa Sika -> Charity Menle). **Rename, never re-creat
 - **ALIS API user:** vault: `clients/cascades-tucson/alis-api-howard-user.sops.yaml`
 - **Caregiver temp passwords (2026-06-30):** vault: `clients/cascades-tucson/caregiver-temp-passwords-2026-06-30.sops.yaml`. Retrieve with `vault get` (NOT `get-field`). Do NOT inline values.
 - **Caregiver temp passwords (2026-07-01, 4 new hires):** vault: `clients/cascades-tucson/caregiver-temp-passwords-2026-07-01.sops.yaml`. Same retrieval rules.
+- **Caregiver temp passwords (2026-07-22, Ronesha White):** vault: `clients/cascades-tucson/caregiver-temp-passwords-2026-07-22.sops.yaml`. Same retrieval rules.
 - **Shelby Trozzi (domain account):** vault: `clients/cascades-tucson/shelby-trozzi.sops.yaml`. Not Entra-synced (safe to reset on-prem without M365 impact).
 - **pilot.test AD account (test identity for kiosk work):** vault: `clients/cascades-tucson/pilot-test-ad.sops.yaml`. Added to SG-Caregivers 2026-07-17 for kiosk testing. Reclaim when WS3 pilot complete.
 - **UOS controller SSH (root):** vault: `infrastructure/uos-server-ssh-key`
@@ -471,6 +472,7 @@ Established 2026-07-09 (Bariffa Sika -> Charity Menle). **Rename, never re-creat
 | 2026-07-15 | BEC/vendor-fraud phish (info@syufway.com, fake W-9 "AMYSH Solutions") investigated and remediated. syufway.com + steqm.com blocked in Tenant Allow/Block List. |
 | 2026-07-17 | 10 functional/role-based mailboxes converted to shared mailboxes; 6x O365_BUSINESS_PREMIUM + 4x EXCHANGE_S_ESSENTIALS licenses reclaimed. SPB 40 consumed (5 free); O365BP suspended now 23 consumed. |
 | 2026-07-17 | NURSESTATION-PC nurse-station kiosk GPO built (WS3 step 3b): Edge SSO via PRT, GPP shortcuts (ALIS/PharmCare/Helpany), AppLocker Packaged App Deny rules for SG-Caregivers, UI restrictions, machine-level printers. ASSISTNURSE-PC pending. |
+| 2026-07-22 | New caregiver onboarded: Ronesha White (`r.white@cascadestucson.com`). AD + SG-Caregivers + Entra sync + M365 Business Premium. No SG-FolderRedirect (caregivers use kiosk desktops + shared phones). ALIS record pending (Howard creating manually). SG-Caregivers now 36. |
 
 ---