sync: auto-sync from HOWARD-HOME at 2026-06-29 22:38:53

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-06-29 22:38:53

clients/rednour/session-logs/2026-06/2026-06-29-howard-legalasst-win11-upgrade-activation-billing.md

@@ -0,0 +1,68 @@
+## User
+- **User:** Howard Enos (howard)
+- **Machine:** Howard-Home
+- **Role:** tech
+
+## Session Summary
+
+Completed and documented the Windows 11 in-place upgrade of LEGALASST (Carla Skinner's box) at Rednour Law Offices. The machine is an unsupported whitebox (generic OEM, AMD Ryzen 3 3200G, 5.9 GB RAM, no TPM enabled, Secure Boot off), so the upgrade required the Microsoft in-place bypass. Set `HKLM\SYSTEM\Setup\MoSetup\AllowUpgradesWithUnsupportedTPMOrCPU = 1` via GuruRMM (agent 18825ea7-df58-47bb-b492-822cb16fb5ec) and verified read-back = 1. Because the box has zero TPM and Secure Boot off, the MoSetup key alone is insufficient; the upgrade was carried out from a mounted ISO using `setup.exe /product server` (Server appraiser skips all consumer hardware gates) with keep-files-and-apps. The upgrade was the only remaining way to clear the corrupted Windows install — SFC had found corruption that in-place repair had not fully resolved, and a feature upgrade rebuilds the whole shell/system-file set (effectively a repair-in-place short of wipe-and-reload).
+
+Post-upgrade the machine reported as Win11 Pro but unactivated ("Notification", reason 0xC004F034). Investigated activation per request to recover the old key from windows.old: loaded the windows.old SOFTWARE hive and decoded the DigitalProductId, which returned only the generic placeholder Pro key (VK7JG-NPHTM-... family) — i.e. no real key to recover. `slmgr /ato` failed with 0x803F7001 (no digital entitlement for this hardware), confirming the prior activation was non-genuine (consistent with the prior MSP's leftover agents). Per Mike/Howard decision, activation was put on HOLD — no MAK applied yet. The ACG Windows Pro MAK (vault `infrastructure/windows-pro-mak.sops.yaml`) is the standard fix but carries a $99/machine charge and consumes a MAK seat; deferred.
+
+Both long-standing LEGALASST issues look resolved after the upgrade: the built-in Compressed-Folders handler hang on opening local `.zip` files, and the WordPerfect 5 "not enough free space" save error. The WordPerfect resolution contradicts the earlier hypothesis that an OS upgrade would not fix a legacy free-space-overflow bug — flagged as observed-resolved, confirm in normal use.
+
+Updated the Rednour wiki article (LEGALASST now Win11; both issues marked resolved; upgrade-as-only-fix rationale; recommend machine replacement due to age; activation deliberately omitted per request) and validated backlinks/frontmatter. Billed 1.5 hr remote labor to Syncro #32368 as a line item only — did NOT invoice (more billing being added in another session).
+
+## Key Decisions
+
+- Used `setup.exe /product server` rather than only the MoSetup key: the box has no TPM at all and Secure Boot off, which the MoSetup key does not cover. `/product server` is a pure-software path that skips all consumer checks and still performs a normal Win11 (not Server) in-place upgrade keeping files/apps.
+- Held off on activation. The recovered "key" was the generic placeholder and there is no MS digital entitlement (0x803F7001), so the only legitimate path is the ACG MAK ($99 billable + MAK seat). Left as a HOLD decision for Mike/Howard.
+- Recommended replacing LEGALASST rather than investing further: 2019-era Ryzen 3 3200G APU, 5.9 GB RAM, unsupported for Win11, end of useful life.
+- Billed the 1.5 hr remote as a line item without invoicing, because additional billing for this ticket is being entered in a separate session; invoicing now would split the work across invoices.
+- Line item attributed to Howard (user_id 1750, work done by Howard); did not change ticket owner (currently Winter, 1737).
+
+## Problems Encountered
+
+- Activation could not be restored from windows.old — the DigitalProductId held only the generic Pro key and MS reported no entitlement (0x803F7001 / 0xC004F034). Resolved by identifying it as a non-genuine prior activation; real licensing deferred to the ACG MAK decision (on hold).
+- `bc` not available in this Git Bash — line total computed manually (1.5 x $150 = $225.00). Minor; no impact.
+
+## Configuration Changes
+
+- Modified: `wiki/clients/rednour.md` — LEGALASST OS -> Win 11; new history entry (Win11 upgrade completed, ~1.5 hr remote, upgrade-as-only-fix for corrupted Windows, both issues resolved, replacement recommendation); Active Work rows updated (upgrade DONE, WordPerfect DONE, zip-handler DONE, added P2 replace-LEGALASST row); Patterns entries marked [RESOLVED 2026-06-29 after Win11 upgrade]; EOL note updated. Activation status intentionally omitted.
+- Remote registry change on LEGALASST (via RMM): created `HKLM\SYSTEM\Setup\MoSetup\AllowUpgradesWithUnsupportedTPMOrCPU` (DWORD) = 1.
+- Syncro #32368: added one line item (Labor - Remote Business, 1.5h, $150/hr, $225.00, taxable false). No invoice created; ticket status unchanged (Customer Reply).
+
+## Credentials & Secrets
+
+- No new credentials discovered or created. ACG Windows Pro MAK already vaulted at `infrastructure/windows-pro-mak.sops.yaml` (key `BP2XJ-CGNYY-7K8TK-GWXXJ-HMJ4K`; $99/machine billing rule; consumes a MAK count) — referenced only, not applied this session.
+- Recovered LEGALASST windows.old key decoded to the generic placeholder Pro key (VK7JG-NPHTM-C97JM-9MPGT-3V66T family) — not a real/usable license, not vaulted.
+
+## Infrastructure & Servers
+
+- LEGALASST — Rednour Law Offices, GuruRMM agent `18825ea7-df58-47bb-b492-822cb16fb5ec`, IP 192.168.10.213. Now Win 11 Pro (upgraded 2026-06-29). Generic OEM whitebox, AMD Ryzen 3 3200G 4c/4t, 5.9 GB RAM, no TPM, Secure Boot off.
+- GuruRMM API: http://172.16.3.30:3001 ; RMM agent worked for LEGALASST this session (contradicts the wiki's broader "GuruRMM not working for Rednour" note — that note still stands for the Mac and for interactive feature-upgrade work).
+- Rednour Law — Syncro customer 1224246; GuruRMM site Main Office GREEN-FALCON-7214 (site UUID c7f5787c-8e71-45b3-841f-fa52436f7d26, client UUID 85f7cff4-d4db-48a8-b477-b8788122a361).
+
+## Commands & Outputs
+
+- Set bypass + verify (RMM PowerShell as SYSTEM): `New-ItemProperty HKLM:\SYSTEM\Setup\MoSetup -Name AllowUpgradesWithUnsupportedTPMOrCPU -Value 1 -PropertyType DWord -Force` -> read-back `= 1`; TPM Present=False; OS Win10 Pro 19045 (pre-upgrade probe).
+- Activation state post-upgrade: `Windows(R), Professional edition | Notification | reason=0xC004F034`, channel Retail, partial ...3V66T; OA3 firmware key: none.
+- windows.old key decode: loaded `C:\Windows.old\Windows\System32\config\SOFTWARE` -> DigitalProductId decoded to generic Pro key; old edition Windows 10 Pro, old ProductId 00330-80000-00000-AA002.
+- `cscript slmgr.vbs /ato` -> `Error: 0x803F7001` (no product key / digital license found for this device).
+- Syncro add_line_item -> id 43069980, qty 1.5, price_retail 150.0, taxable false, user_id 1750.
+
+## Pending / Incomplete Tasks
+
+- ACTIVATION (HOLD): LEGALASST is on Win11 but unactivated. To activate, apply ACG MAK: `slmgr /ipk BP2XJ-CGNYY-7K8TK-GWXXJ-HMJ4K` then `slmgr /ato`; verify Licensed; then $99 line item (machine = LEGALASST) on #32368 via /syncro. Decision pending.
+- BILLING: #32368 has the 1.5 hr remote LEGALASST line ($225.00) plus 2 hardware lines, NOT invoiced — more billing being added in another session; invoice from there.
+- Recommend quoting a replacement workstation for LEGALASST (age/unsupported hardware).
+- REDNOURCARRIEVI still on Win10 22H2 (EOL); in-place upgrade fails at SAFE_OS/APPLY_IMAGE — separate open item.
+- Confirm WordPerfect + zip fixes hold in normal use.
+
+## Reference Information
+
+- Syncro ticket #32368 (id 111999527): https://computerguru.syncromsp.com/tickets/111999527 — subject "New machine for Carrie to act as a central hub/file share. Upgrade for reception computer that is running slow." Status Customer Reply. Owner Winter (1737).
+- Bot alerts: RMM dispatch msg 1521359336188678164; Syncro line-item msg 1521389269082443846.
+- Vault: `infrastructure/windows-pro-mak.sops.yaml` (ACG Windows Pro MAK, $99/machine billing rule).
+- MoSetup bypass key: `HKLM\SYSTEM\Setup\MoSetup\AllowUpgradesWithUnsupportedTPMOrCPU` (DWORD 1).
+- Activation errors: 0x803F7001 (no entitlement for device), 0xC004F034 (license not found/invalid).

wiki/clients/rednour.md

@@ -61,7 +61,7 @@ All three machines were enrolled by 2026-05-29. Onboarding diagnostic grade: RED
 | Hostname | Model | CPU | RAM | OS | IP | Agent ID | Grade |
 |---|---|---|---|---|---|---|---|
 | FRONTDESKRECEPT | Dell OptiPlex 3080 | i5-10505 6c/12t | 15.8 GB | Win 11 Pro build 26200 | 192.168.10.115 | 04765560-3e8a-46e5-a507-c5f5f4ead6eb | RED |
-| LEGALASST | Generic OEM | AMD Ryzen 3 3200G 4c/4t | 5.9 GB | Win 10 Pro build 19045 | 192.168.10.213 | 18825ea7-df58-47bb-b492-822cb16fb5ec | RED |
+| LEGALASST | Generic OEM | AMD Ryzen 3 3200G 4c/4t | 5.9 GB | Win 11 Pro (upgraded 2026-06-29) | 192.168.10.213 | 18825ea7-df58-47bb-b492-822cb16fb5ec | RED |
 | REDNOURCARRIEVI (rednourcarrievirt) | Generic OEM | i3-9100 4c/4t | 7.7 GB | Win 10 Pro build 19045 | 192.168.10.194 | 8e4e2221-7e2a-4a6f-9eda-864568539961 | RED |
 
 **Common issues across all three at onboarding:**
@@ -241,6 +241,18 @@ Mike was flagged via Discord DM (message_id 1521264675965374656) that the macOS
 
 All diagnostic changes were reverted (Adobe/7-Zip Blocked-list test entries removed; an orphaned RMM diagnostic process killed) — the box was left clean.
 
+### 2026-06-29 (evening) — LEGALASST upgraded to Windows 11 (completed, ~1.5 hr remote)
+
+**Operator: Howard Enos** (remote, ~1.5 hr). Completed the in-place Windows 10 -> 11 upgrade on LEGALASST. The box is an unsupported config (no TPM enabled, Secure Boot off, AMD Ryzen 3 3200G not on the Win11 CPU list), so the upgrade used the TPM/CPU bypass (`HKLM\SYSTEM\Setup\MoSetup\AllowUpgradesWithUnsupportedTPMOrCPU = 1`) plus `setup.exe /product server` from a mounted ISO with **keep personal files + apps**. Files, apps, and settings migrated intact.
+
+**The upgrade was the only remaining way to fix the corrupted Windows install.** The system files were corrupt (SFC had found and flagged corruption), which is what drove the explorer-on-`.zip` hangs and the misbehaving saves; in-place repair/SFC alone had not fully cleared it. A feature upgrade rebuilds the entire shell/system-file set, so upgrading to Win11 was effectively a full OS repair-in-place and the only practical path short of a wipe-and-reload — which is why both long-standing issues cleared once it completed.
+
+**Both prior LEGALASST issues look resolved after the upgrade:**
+- **Explorer-on-`.zip` hang** (built-in Compressed Folders handler) — no longer reproduces post-upgrade, as anticipated (the feature upgrade rebuilt the shell/system files and applied the pending SFC repair).
+- **WordPerfect 5 "not enough free space" on save** — reported resolved after the upgrade. This contradicts the earlier hypothesis that an OS upgrade would not fix a legacy free-space-overflow bug; treat as observed-resolved and confirm in normal use.
+
+**Recommendation: replace LEGALASST due to age.** Generic OEM whitebox on a 2019-era AMD Ryzen 3 3200G APU with only 5.9 GB RAM and no TPM/Secure Boot — outside Win11 hardware support and at the end of its useful service life. Recommend quoting a replacement workstation rather than investing further in this machine.
+
 ### 2026-06-29 — Carrie's machine Win10 -> Win11 upgrade fails at SAFE_OS / APPLY_IMAGE
 
 **Operator: Howard Enos** (diagnostic only; no remote action). The in-place Windows 10 -> 11 upgrade on **Carrie's machine** (REDNOURCARRIEVI / rednourcarrievirt) rolled back with `0x8007000D - 0x2000C` — "The installation failed in the SAFE_OS phase with an error during APPLY_IMAGE operation."
@@ -260,13 +272,13 @@ Howard reported driver updates and OS repairs were already done. He will attempt
 - **No MDE license — skip Defender tier.** Defender Add-on is consented but ATP endpoints 650052. Do not attempt Defender-tier calls for this tenant.
 - **Prior MSP agents still installed.** ScreenConnect, Splashtop, and Syncro on all workstations; Datto RMM on REDNOURCARRIEVI. Not yet remediated as of 2026-06-29.
 - **macOS RMM agent installs but does not enroll (site code vs UUID bug).** The macOS install script writes the site enrollment CODE (`GREEN-FALCON-7214`) into `site.plist` as `site_id`. The server's `EnrollRequest.site_id` is typed `uuid::Uuid` — posting the code string causes a 422 UUID deserialization error; the agent retries enrollment forever without connecting. Fix: overwrite `site.plist` with the site UUID `c7f5787c-8e71-45b3-841f-fa52436f7d26` and reload the LaunchDaemon. The paste-block fix was delivered to Howard's Discord DMs (2026-06-26) but has not been applied to Nick's Mac (blocked: no onsite access + no Mac password as of 2026-06-29). Root code fix for Mike: either the install script should stamp the UUID (like the `.pkg` postinstall), or `/api/enroll` should accept a site code. Secondary: add a macOS branch to `default_config_path()` in `agent/src/config.rs`. Coord todo: 6f2d22be-e653-48c8-9f9b-0155420b315d (project gururmm).
-- **LEGALASST and REDNOURCARRIEVI are on Win 10 22H2 (EOL).** No security updates since 2025-10-14. Plan OS upgrade to Win 11.
+- **LEGALASST upgraded to Win 11 (2026-06-29); REDNOURCARRIEVI still on Win 10 22H2 (EOL).** LEGALASST is now on Win 11 (unsupported-hardware bypass). REDNOURCARRIEVI remains on Win 10 22H2 with no security updates since 2025-10-14 — still needs the upgrade.
 - **GuruRMM is not working for Rednour.** As of 2026-06-29 remote management/remediation via GuruRMM is not usable for this client — any assist must be hands-on / on-site. (Scope verify: whether the agents are offline fleet-wide for Rednour or RMM is simply not a viable path for interactive feature-upgrade work. Note this contradicts earlier live-over-RMM diagnostics on LEGALASST — confirm current agent state before relying on RMM here.)
 - **Win11 in-place upgrade on REDNOURCARRIEVI fails at SAFE_OS / APPLY_IMAGE (`0x8007000D - 0x2000C`).** ERROR_INVALID_DATA while applying the image in the offline phase — points at media/download corruption, storage/disk, or driver/AV/external-device interference, NOT a hardware-compat block. Fix path: fresh ISO via Media Creation Tool + `setup.exe` from mounted ISO, externals unplugged, AV off, upgrade cache cleared, DISM/SFC/chkdsk done. If it recurs, pull the first error from `C:\$WINDOWS.~BT\Sources\Panther\setuperr.log` around APPLY_IMAGE. Drivers + repairs already done by Howard; manual attempt scheduled 2026-06-29 evening.
 - **REDNOURCARRIEVI: Defender was off at onboarding.** Confirm it has been re-enabled; it is a critical finding.
 - **REDNOURCARRIEVI: RDP enabled without NLA at onboarding.** Restrict RDP to VPN-only or require NLA.
-- **LEGALASST: built-in Compressed Folders handler hangs explorer on `.zip` open.** Local zips; Word/PDF fine. `zipfldr.dll` intact (environmental, not a corrupt DLL). AppHang Event 1002, no faulting module. Workaround = 7-Zip as default for `.zip`. Win11 upgrade planned to resolve. If it persists post-upgrade, suspect Defender archive-scan + cloud (MAPS) lookup stalling the shell. To test-disable any shell extension reversibly, add its CLSID to `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Blocked` (delete to restore).
+- **[RESOLVED 2026-06-29 after Win11 upgrade] LEGALASST: built-in Compressed Folders handler hangs explorer on `.zip` open.** Local zips; Word/PDF fine. `zipfldr.dll` intact (environmental, not a corrupt DLL). AppHang Event 1002, no faulting module. The Win11 in-place upgrade rebuilt the shell/system files and the hang no longer reproduces. 7-Zip 26.02 remains installed as a fallback. If it ever recurs, suspect Defender archive-scan + cloud (MAPS) lookup stalling the shell; to test-disable any shell extension reversibly, add its CLSID to `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Blocked` (delete to restore).
-- **LEGALASST: WordPerfect 5 "not enough free space" on save** despite verified free space and regardless of save location. Likely legacy free-space overflow on large-capacity volumes; **OS upgrade will not fix it**; mitigate via DOSBox / SUBST small-capacity drive. Confirm WP version/edition.
+- **[RESOLVED 2026-06-29 after Win11 upgrade] LEGALASST: WordPerfect 5 "not enough free space" on save** despite verified free space and regardless of save location. Originally hypothesized as a legacy free-space overflow on large-capacity volumes that an OS upgrade would not fix — but it looks resolved after the Win11 upgrade (confirm in normal use). If it recurs, mitigate via DOSBox / SUBST small-capacity drive and confirm WP version/edition.
 - **`.NET Runtime 1022` "profiling API attach" errors are noise** unless a `COR_PROFILER` env var is actually set — do not chase them as a hang cause.
 - **Plaintext local-account passwords in Syncro customer notes.** Accounts `carrie` and `ale` appear in Syncro notes in plaintext — vault migration pending. Do not rely on Syncro notes as the authoritative credential store for these accounts.
 
@@ -276,14 +288,15 @@ Howard reported driver updates and OS repairs were already done. He will attempt
 |---|---|---|---|
 | P1 | Re-enable Defender on REDNOURCARRIEVI | Howard/Mike | Was off at onboarding 2026-05-29; confirm current state |
 | P1 | Remove prior MSP agents (ScreenConnect, Splashtop, Syncro, Datto RMM) | Mike/Howard | Present on all 3 machines; Datto RMM on REDNOURCARRIEVI only |
-| P1 | Upgrade LEGALASST to Windows 11 | Mike/Howard | Expected to resolve the explorer-on-.zip hang (rebuilds shell/system files) + applies pending SFC repair. Pre-reqs: enable fTPM + Secure Boot (Ryzen 3 3200G is Win11-supported), bump RAM from 5.9 GB, remove leftover Syncro agent. Test a local `.zip` with the built-in handler post-upgrade |
+| DONE | Upgrade LEGALASST to Windows 11 | Howard | 2026-06-29 (remote, ~1.5 hr): in-place upgrade completed via TPM/CPU bypass + `setup.exe /product server`, keep files + apps. Explorer-on-.zip hang and WordPerfect save error both look resolved post-upgrade. Machine is aged/unsupported (Ryzen 3 3200G, 5.9 GB RAM) -> recommend replacement (see below) |
+| P2 | Recommend replacing LEGALASST (age / unsupported hardware) | Howard/Mike | Generic OEM whitebox, AMD Ryzen 3 3200G (2019-era APU), 5.9 GB RAM, no TPM/Secure Boot - outside Win11 support and at end of useful life. Quote a replacement workstation rather than investing further |
 | P1 | Upgrade REDNOURCARRIEVI (Carrie's machine) to Windows 11 | Howard | Win 10 22H2 (EOL 2025-10-14). In-place upgrade fails at SAFE_OS / APPLY_IMAGE `0x8007000D - 0x2000C` (ERROR_INVALID_DATA). Drivers + DISM/SFC/chkdsk already done. Manual attempt scheduled 2026-06-29 evening (fresh ISO, externals unplugged, AV off, cache cleared). RMM not usable for Rednour — hands-on only. If it fails, pull `C:\$WINDOWS.~BT\Sources\Panther\setuperr.log` around APPLY_IMAGE |
 | P1 | Restore/verify GuruRMM functionality for Rednour | Howard/Mike | 2026-06-29: RMM reported not working for this client — confirm scope (agents offline vs not a path for upgrades) and restore remote management |
 | P2 | Bill Carrie-machine / reception-upgrade work to Syncro #32368 | Howard/Mike | Ticket id 111999527, "New machine for Carrie as central hub/file share + reception upgrade" (created 2026-06-02, status Customer Reply). Bill when work complete — route through `/syncro`, do not free-hand |
 | P1 | Fix GuruRMM macOS agent enrollment on Nick's Apple Silicon Mac | Howard/Mike | Agent installs but does not enroll. Root cause: install script writes site CODE not UUID; server expects UUID. Fix = overwrite `/usr/local/etc/gururmm/site.plist` with `site_id = c7f5787c-8e71-45b3-841f-fa52436f7d26` and reload LaunchDaemon. Paste-block delivered to Howard's Discord DMs (2026-06-26). Blocked: need onsite access + Mac password. Code fix for Mike: enroll.rs accept site code OR install script stamp UUID. Coord todo 6f2d22be |
 | P1 | Vault migration of plaintext local-account passwords in Syncro customer notes | Howard/Mike | Accounts carrie, ale; not yet vaulted |
-| P2 | LEGALASST: WordPerfect 5 "not enough free space" on save | Howard | 2026-06-29: error on save regardless of location; ample free space verified. Likely legacy free-space overflow on large volume; OS upgrade will NOT fix. Mitigate via DOSBox / SUBST small-capacity drive; confirm WP version/edition |
+| DONE | LEGALASST: WordPerfect 5 "not enough free space" on save | Howard | 2026-06-29: looks resolved after the Win11 upgrade (contradicts earlier "OS upgrade won't fix" hypothesis - confirm in normal use). If it recurs, mitigate via DOSBox / SUBST small-capacity drive |
-| INTERIM | LEGALASST: set 7-Zip as default for `.zip`/`.7z`/`.rar` | Howard | 2026-06-29: 7-Zip 26.02 installed as workaround for the built-in zip-handler hang; set defaults via 7-Zip GUI (Tools -> Options -> System) |
+| DONE | LEGALASST: built-in zip-handler explorer hang | Howard | 2026-06-29: looks resolved after the Win11 upgrade (shell/system files rebuilt). 7-Zip 26.02 remains installed as a fallback; setting it default for `.zip` is now optional |
 | P2 | Return visit: phone + printer setup at Rednour | Howard | 2026-06-25: pending; may require running a new wire / installing a switch |
 | P2 | Final invoice on Syncro #32343 | Mike | 0.5h remote labor (line item 42654682) sitting on Invoiced ticket; additional onsite labor from 2026-06-25 SMB share work deferred by Howard |
 | P2 | Address BitLocker gap on FRONTDESKRECEPT | Mike/Howard | OS volume unencrypted at onboarding |