azcomputerguru/claudetools
1
0
Fork 0
Code Issues 59 Pull Requests Actions Packages Projects Releases Wiki Activity

sync: auto-sync from HOWARD-HOME at 2026-04-21 15:07:39

Browse Source 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-04-21 15:07:39
This commit is contained in:
Howard Enos
2026-04-21 15:07:41 -07:00
parent 67d9cd8f5b
commit 1fd68c11da
3 changed files with 257 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
clients/cascades-tucson/PROJECT_STATE.md
View File

@@ -2,7 +2,7 @@
> READ THIS before starting work on this client.
> UPDATE THIS when you begin work (claim a lock) and when you finish (release lock + log changes).
> Last updated: 2026-04-20
> Last updated: 2026-04-21
---
@@ -10,7 +10,7 @@
| Session | Working On | Status | Started |
|---------|-----------|--------|---------|
| ACG-TECH03L/Claude (Howard) | Intune Phase B-1: Android compliance policy | IN_PROGRESS | 14:20 UTC 2026-04-20 (resumed) |
| Howard-Home/Claude (Howard) | Intune Phase B-1: Android compliance policy | IN_PROGRESS | 20:40 UTC 2026-04-21 |
**How to claim a lock:** Add a row before starting work. Remove it when done. Locks older than 2 hours with no update are considered stale.
@@ -61,21 +61,23 @@ Senior living community. Active project: HIPAA-compliant folder redirection GPO
- [ ] Matching GPOs for remaining departments
- [ ] Folder redirection GPO verification across all enrolled machines
**Intune MDM Rollout (started 2026-04-19, paused end of day 2026-04-20):**
**Intune MDM Rollout (started 2026-04-19):**
- [x] Prereq gap check (`reports/2026-04-19-intune-mdm-prereq-gap.md`)
- [x] Create `MDMS@cascadestucson.com` service account - Business Premium, MFA, forwarding to howard@azcomputerguru.com (vault: `clients/cascades-tucson/mdm-service-account.sops.yaml`). Replaced an earlier mdm@ attempt that hit a Managed Play enterprise/consumer Google account collision.
- [x] Managed Google Play enterprise bound (bindStatus=boundAndValidated, owner mdms@)
- [x] Apple MDM Push Cert uploaded (Apple ID mdms@cascadestucson.com, serial 16FA0CAED8EEB74F, expires 2027-04-20). Renewal reminder task #9.
- [x] CSCNet Wi-Fi password vaulted (`clients/cascades-tucson/wifi-cscnet.sops.yaml`)
- [x] Entra group `Cascades - Shared Phones` + Android enrollment profile `CSC - Android Shared Phones` (token MVDVVDMPSHYJAGDAJOCN, expires 2026-06-22, linked to the Entra group)
- [ ] **NEXT:** Android compliance policy (Phase B-1 in progress — walkthrough ready, Howard to execute)
- [ ] Android configuration profile (CSCNet Wi-Fi + dedicated-device restrictions)
- [ ] Required apps from Managed Play (Company Portal, Authenticator, Edge, Teams)
- [ ] ALIS web shortcut (https://cascadestucson.alisonline.com/Login)
- [ ] Microsoft Shared Device Mode app-configuration policy (for Authenticator/Teams)
- [ ] Test-enroll first Samsung A15, validate, then roll the remaining 24
- [x] Entra group `Cascades - Shared Phones` + Android enrollment profile `CSC - Android Shared Phones` (token MVDVVDMPSHYJAGDAJOCN, expires 2026-06-22, linked to the Entra group). **Converted to dynamic 2026-04-21** with rule `(device.enrollmentProfileName -eq "CSC - Android Shared Phones")` — any phone enrolled via that QR auto-joins within 5-30 min (was the root cause of Phone 1 not receiving any policies: enrolled via correct profile but never added to the static group).
- [x] **B-1 Android compliance policy** `CSC - Android Compliance` (id `27eeaeda-8390-462e-a514-7d2a558f412c`) — Android 14+, 6-digit numericComplex PIN, 1-min inactivity lock, encryption required, block rooted, SafetyNet certified, Intune App Integrity. Assigned to Shared Phones. Patched 2026-04-21 to spec.
- [x] **B-2 Config profiles** — `CSC - Android Shared Phones Restrictions` (factoryResetBlocked, no USB, no unknown sources, screenCaptureBlocked, no developer settings, system updates windowed 02:00-06:00 UTC) + `CSC - CSCNet Wi-Fi (WPA2-Personal)`. Both assigned.
- [x] **B-3 Required apps** — Company Portal, Managed Home Screen, Authenticator, Edge, Microsoft Intune, Teams (+ ALIS web app). All 7 required-assigned to Shared Phones. Company Portal assignment gap closed 2026-04-21.
- [x] **B-4 ALIS web app** (id `fcbf803d-ceb7-4f4e-93ed-2be1b91a05f3`) — https://cascadestucson.alisonline.com/Login, required-assigned.
- [x] **B-5 MSDM app config** — `CSC - Microsoft Shared Device Mode (Authenticator)` + `CSC - Microsoft Shared Device Mode (Teams)` (id `3c6a354c-1616-434b-ac81-4dad7795e67b`, created 2026-04-21). Both `shared_device_mode_enabled=true`, assigned to Shared Phones.
- [x] **B-6 Test enrollment** — Samsung SM-A146U (Galaxy A15 5G) serial R9TWB0WM55R, Android 15, enrolled 2026-04-20 18:17Z, showing compliant and syncing daily.
- [ ] **NEXT:** Roll remaining 24 Samsung A15 phones (factory reset each, enroll via QR from `CSC - Android Shared Phones` profile, verify caregiver sign-in via MSDM)
- [ ] Rotate MDMS@ password (post-rollout hygiene, task #8)
- [ ] iPads are on a generic Apple ID currently — bringing them into Intune is low-priority; ABM + DEM deferred until after phones are live
- [ ] **DEFERRED:** 2-hour inactivity auto-logout — not achievable via MSDM app config (no inactivity knob). Real options: Conditional Access sign-in frequency (Mike's call — tenant-wide sensitivity) or rely on 1-min screen lock + explicit caregiver sign-out. Current posture accepted.
---
@@ -83,6 +85,8 @@ Senior living community. Active project: HIPAA-compliant folder redirection GPO
| Date | By | Change | Status |
|------|-----|--------|--------|
| 2026-04-21 | Howard | Post-DMARC spoofing recheck — Mike's `p=quarantine` fix confirmed working (26h clean window). Purged 2 missed phishes (`accounting@` Inbox + `jd.martin` Deleted Items) via Graph permanentDelete. IP blocks skipped (DMARC covering). | DONE |
| 2026-04-21 | Mike | DMARC policy published as `p=quarantine; pct=100` (was `p=none`). Enforcement propagated sometime after 18:28Z on 4/20. | DEPLOYED |
| 2026-04-20 | Howard | Intune MDM rollout - service account MDMS@ + Google Play bind + Apple push cert + Entra group + Android enrollment profile (QR code) all live. Phone policies next session. | IN PROGRESS |
| 2026-04-17 | Howard | Folder redirection validated on DESKTOP-DLTAGOI (Sharon Edwards); GPO `CSC - Folder Redirection (LE)` active | DEPLOYED |