azcomputerguru/claudetools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sync: auto-sync from HOWARD-HOME at 2026-07-14 11:14:46

Browse Source 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-14 11:14:46
This commit is contained in:
Howard Enos
2026-07-14 11:15:25 -07:00
parent 4ab8137daa
commit 22503149ce
11 changed files with 3498 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files

774
.bill.json Normal file
View File

@@ -0,0 +1,774 @@
{
"CurrentSpaceUsed": 88433429895985,
"AverageSpaceUsed": 88104088032015,
"TotalRestore": 93051040061,
"StatisticBilling": [
{
"UserId": "73de908b-6f7a-4bab-9787-fd30549ba71e",
"Email": "AD1-7C7BE300650F",
"FirstName": "AD1",
"LastName": "",
"CompanyName": "Dataforth",
"AverageSpace": 2971611409680,
"TotalVolumeRestore": 0,
"PlanCost": 0.0,
"StorageCost": 13.837643,
"RestoreCost": 0.0,
"TotalCost": 138.376439
},
{
"UserId": "0e6c3190-191b-4c61-8535-f6b694621af8",
"Email": "ad2-7C7BE36FD6EC",
"FirstName": "AD2",
"LastName": "",
"CompanyName": "Dataforth",
"AverageSpace": 1136175720928,
"TotalVolumeRestore": 0,
"PlanCost": 0.0,
"StorageCost": 5.29073,
"RestoreCost": 0.0,
"TotalCost": 52.907304
},
{
"UserId": "af7b687b-4528-4a30-8205-fca4abf98dc9",
"Email": "AD-3-7C7BE3F37268",
"FirstName": "",
"LastName": "",
"CompanyName": "Dataforth",
"AverageSpace": 0,
"TotalVolumeRestore": 0,
"PlanCost": 0.0,
"StorageCost": 0.0,
"RestoreCost": 0.0,
"TotalCost": 0.0
},
{
"UserId": "f1885cea-f62b-4645-9c27-38b51e6e0bf3",
"Email": "admin@azcomputerguru.com",
"FirstName": "Mike",
"LastName": "Swanson",
"CompanyName": null,
"AverageSpace": 15214262052617,
"TotalVolumeRestore": 0,
"PlanCost": 49.0,
"StorageCost": 70.846922,
"RestoreCost": 0.0,
"TotalCost": 757.469281
},
{
"UserId": "27cae1c8-b253-45e1-aafc-cc94801b6a0c",
"Email": "anaisedavid.office@gmail.com",
"FirstName": "David",
"LastName": "Anaise",
"CompanyName": "Anaise, David",
"AverageSpace": 1557150766422,
"TotalVolumeRestore": 0,
"PlanCost": 0.0,
"StorageCost": 7.251048,
"RestoreCost": 0.0,
"TotalCost": 72.510483
},
{
"UserId": "ffa09772-0856-4b63-9a25-b2827d3a86ba",
"Email": "becky@desertrvcenter.com",
"FirstName": "Becky",
"LastName": "Kahn",
"CompanyName": "Desert RV",
"AverageSpace": 44244877358,
"TotalVolumeRestore": 0,
"PlanCost": 49.0,
"StorageCost": 0.206031,
"RestoreCost": 0.0,
"TotalCost": 51.060312
},
{
"UserId": "20e00bf6-56ce-479d-a26c-ca7131df8b3e",
"Email": "beckykahn",
"FirstName": "Becky",
"LastName": "Kahn",
"CompanyName": "Len's Auto",
"AverageSpace": 41654221392,
"TotalVolumeRestore": 0,
"PlanCost": 0.0,
"StorageCost": 0.193967,
"RestoreCost": 0.0,
"TotalCost": 1.939675
},
{
"UserId": "1a591c90-be53-403d-bc88-17289ab2f7b1",
"Email": "bertie@amtransit.com",
"FirstName": "Bertie",
"LastName": "Lozano",
"CompanyName": "Arizona Medical Transit",
"AverageSpace": 148078878816,
"TotalVolumeRestore": 0,
"PlanCost": 49.0,
"StorageCost": 0.689544,
"RestoreCost": 0.0,
"TotalCost": 55.895458
},
{
"UserId": "e2b8868f-05bf-4531-9f02-5e5787d7d6b4",
"Email": "billie.rose@rinconvistavet.com",
"FirstName": "Auburn",
"LastName": "Heist",
"CompanyName": "Rincon Vista Veterinary",
"AverageSpace": 1867243027446,
"TotalVolumeRestore": 0,
"PlanCost": 49.0,
"StorageCost": 8.695027,
"RestoreCost": 0.0,
"TotalCost": 135.950278
},
{
"UserId": "c1dfddd4-f845-43a3-8e40-d5e30c0450e8",
"Email": "CP-QB-7E3C66D32920",
"FirstName": "",
"LastName": "",
"CompanyName": "Curtis Plumbing",
"AverageSpace": 31120333065,
"TotalVolumeRestore": 0,
"PlanCost": 0.0,
"StorageCost": 0.144915,
"RestoreCost": 0.0,
"TotalCost": 1.449153
},
{
"UserId": "5897c22d-e119-44d6-bede-c9428d5925ba",
"Email": "cs@curtisplumbing.net",
"FirstName": "Ken",
"LastName": "Curtis",
"CompanyName": "Curtis Plumbing",
"AverageSpace": 92408986181,
"TotalVolumeRestore": 0,
"PlanCost": 12.0,
"StorageCost": 0.430312,
"RestoreCost": 0.0,
"TotalCost": 16.303128
},
{
"UserId": "08d55d69-bf76-40b5-ae45-b1bbe0064c14",
"Email": "CS-SERVER-9163AEDE7357",
"FirstName": "",
"LastName": "",
"CompanyName": "Cascades of Tucson",
"AverageSpace": 322775715004,
"TotalVolumeRestore": 0,
"PlanCost": 0.0,
"StorageCost": 1.503041,
"RestoreCost": 0.0,
"TotalCost": 15.030415
},
{
"UserId": "e7121651-8fac-456e-b666-6069eb4e33c2",
"Email": "D1-ENGI-010-7C7BE39C36E9",
"FirstName": "D1-ENGI",
"LastName": "",
"CompanyName": "Dataforth",
"AverageSpace": 110050375049,
"TotalVolumeRestore": 0,
"PlanCost": 0.0,
"StorageCost": 0.512461,
"RestoreCost": 0.0,
"TotalCost": 5.124619
},
{
"UserId": "69f65bfa-3bdc-49e0-96a3-e59241a95cef",
"Email": "DESKTOP-9T0UAON-64BD1EB86A99",
"FirstName": "DESKTOP-9T0UAON",
"LastName": "",
"CompanyName": "Desert RV",
"AverageSpace": 0,
"TotalVolumeRestore": 0,
"PlanCost": 0.0,
"StorageCost": 0.0,
"RestoreCost": 0.0,
"TotalCost": 0.0
},
{
"UserId": "06109a61-2ba2-4547-8294-f88d5e1799ba",
"Email": "DESKTOP-BMBTQLI-B16CD561D2DF",
"FirstName": "DESKTOP-BMBTQLI",
"LastName": "",
"CompanyName": "Len's Auto",
"AverageSpace": 0,
"TotalVolumeRestore": 0,
"PlanCost": 0.0,
"StorageCost": 0.0,
"RestoreCost": 0.0,
"TotalCost": 0.0
},
{
"UserId": "ba5547d4-b5f3-411b-91f8-372ecff9703e",
"Email": "DESKTOP-P36LUUN-EC48473C3133",
"FirstName": "",
"LastName": "",
"CompanyName": "Tucson Coin and Autograph",
"AverageSpace": 65406995238,
"TotalVolumeRestore": 0,
"PlanCost": 0.0,
"StorageCost": 0.304575,
"RestoreCost": 0.0,
"TotalCost": 3.04575
},
{
"UserId": "4b8fed90-f5a8-4b67-a802-d213f1bea399",
"Email": "DF-HYPERV-B-7C7BE33DF814",
"FirstName": "DF-HYPERV-B",
"LastName": "",
"CompanyName": "Dataforth",
"AverageSpace": 330077132393,
"TotalVolumeRestore": 0,
"PlanCost": 0.0,
"StorageCost": 1.537041,
"RestoreCost": 0.0,
"TotalCost": 15.370414
},
{
"UserId": "651e4c79-306c-4fc9-908f-3a9538e08db6",
"Email": "diegobuilder300@gmail.com",
"FirstName": "Diego",
"LastName": "Sosa",
"CompanyName": "Air Pros",
"AverageSpace": 449563391715,
"TotalVolumeRestore": 0,
"PlanCost": 12.0,
"StorageCost": 2.093442,
"RestoreCost": 0.0,
"TotalCost": 32.934426
},
{
"UserId": "0e0acb74-319a-40ff-adf3-e1047fc6cc7e",
"Email": "FILES-D1-7C7BE310B197",
"FirstName": "FILES-D1",
"LastName": "",
"CompanyName": "Dataforth",
"AverageSpace": 366553235490,
"TotalVolumeRestore": 0,
"PlanCost": 0.0,
"StorageCost": 1.706896,
"RestoreCost": 0.0,
"TotalCost": 17.068965
},
{
"UserId": "ca27f550-6928-411b-8b5c-2f1754a99107",
"Email": "Gary A Hartman",
"FirstName": "Gary",
"LastName": "Hartman",
"CompanyName": "Hartman",
"AverageSpace": 616800023582,
"TotalVolumeRestore": 0,
"PlanCost": 0.0,
"StorageCost": 2.872198,
"RestoreCost": 0.0,
"TotalCost": 28.721989
},
{
"UserId": "9e377102-a4c4-45e3-b6b3-e6adeaa93db4",
"Email": "GTI-FINANCESVR-5C7487F5EF6B",
"FirstName": "GTI-FINANCESVR",
"LastName": "",
"CompanyName": "Glaztech Industries",
"AverageSpace": 905726974074,
"TotalVolumeRestore": 0,
"PlanCost": 8.0,
"StorageCost": 4.217619,
"RestoreCost": 0.0,
"TotalCost": 50.176198
},
{
"UserId": "019ea151-f10e-4bfb-9a78-71fd38bc469b",
"Email": "GTI-INV-VMHOST-5C7487D16BD2",
"FirstName": "GTI-INV-VMHOST",
"LastName": "",
"CompanyName": "Glaztech Industries",
"AverageSpace": 850669408054,
"TotalVolumeRestore": 0,
"PlanCost": 0.0,
"StorageCost": 3.961238,
"RestoreCost": 0.0,
"TotalCost": 39.612381
},
{
"UserId": "23b9805e-a479-49f4-aa68-0e1c1a424c19",
"Email": "HSM-NewServer-496E31DB4EA2",
"FirstName": "",
"LastName": "",
"CompanyName": "Horseshoe Management",
"AverageSpace": 163048404869,
"TotalVolumeRestore": 0,
"PlanCost": 0.0,
"StorageCost": 0.759253,
"RestoreCost": 0.0,
"TotalCost": 7.592533
},
{
"UserId": "56f80e2d-6ece-4407-8971-92635547ce1d",
"Email": "imcbackups",
"FirstName": "Leslie",
"LastName": "Faltin",
"CompanyName": "Instrumental Music",
"AverageSpace": 5013481114411,
"TotalVolumeRestore": 0,
"PlanCost": 49.0,
"StorageCost": 23.34584,
"RestoreCost": 0.0,
"TotalCost": 282.458406
},
{
"UserId": "54a647a3-b92a-4c7b-8a02-8a8759fd36ff",
"Email": "info@bestmassageintucson.com",
"FirstName": "Mara",
"LastName": "Concordia",
"CompanyName": "Peaceful Spirit",
"AverageSpace": 2827135401516,
"TotalVolumeRestore": 89345985316,
"PlanCost": 12.0,
"StorageCost": 13.164873,
"RestoreCost": 0.832099,
"TotalCost": 144.480849
},
{
"UserId": "5f09e9d3-82ad-42c4-8d68-f208d8e7645d",
"Email": "jgoodman@ridgetopgroup.com",
"FirstName": "RidgeTop",
"LastName": "Group",
"CompanyName": "Ridgetop Group",
"AverageSpace": 2283709312470,
"TotalVolumeRestore": 0,
"PlanCost": 49.0,
"StorageCost": 10.634349,
"RestoreCost": 0.0,
"TotalCost": 155.343501
},
{
"UserId": "d94b286b-d22e-49c3-8bb1-415848f448f4",
"Email": "jimmyco333@gmail.com",
"FirstName": "Jimmy",
"LastName": "Hughes",
"CompanyName": "Jimmy Company",
"AverageSpace": 302018992454,
"TotalVolumeRestore": 0,
"PlanCost": 12.0,
"StorageCost": 1.406385,
"RestoreCost": 0.0,
"TotalCost": 26.063855
},
{
"UserId": "a15b177b-941f-48ab-b502-1240558c0965",
"Email": "jwilliams@grabblaw.com",
"FirstName": "Jeff",
"LastName": "Williams",
"CompanyName": "Grabb and Durando",
"AverageSpace": 6894302077729,
"TotalVolumeRestore": 0,
"PlanCost": 49.0,
"StorageCost": 32.104095,
"RestoreCost": 0.0,
"TotalCost": 370.040958
},
{
"UserId": "004b8770-f635-4ba2-9ff9-b44b2f781428",
"Email": "KAT1-65F649951294",
"FirstName": "",
"LastName": "",
"CompanyName": "Business Services of Tucson",
"AverageSpace": 687746218542,
"TotalVolumeRestore": 0,
"PlanCost": 0.0,
"StorageCost": 3.202567,
"RestoreCost": 0.0,
"TotalCost": 32.025678
},
{
"UserId": "1c527291-fedf-454e-a8cd-a9a1aeb18819",
"Email": "kaytie@tucsonsafety.com",
"FirstName": "Jerry",
"LastName": "Long",
"CompanyName": "Tucson Safety and Medical",
"AverageSpace": 294437644433,
"TotalVolumeRestore": 0,
"PlanCost": 49.0,
"StorageCost": 1.371081,
"RestoreCost": 0.0,
"TotalCost": 62.71082
},
{
"UserId": "76803ea9-d35a-402a-b518-230ed04ed27d",
"Email": "LAB-SVR-B16CD5A3C6AE",
"FirstName": "LAB-SVR",
"LastName": "",
"CompanyName": "Len's Auto",
"AverageSpace": 84230185552,
"TotalVolumeRestore": 0,
"PlanCost": 0.0,
"StorageCost": 0.392227,
"RestoreCost": 0.0,
"TotalCost": 3.922273
},
{
"UserId": "554b8232-1647-480b-99d1-cdefa299343f",
"Email": "lahc",
"FirstName": "Mark",
"LastName": "Fillerup",
"CompanyName": "LaHC",
"AverageSpace": 3399164368765,
"TotalVolumeRestore": 0,
"PlanCost": 0.0,
"StorageCost": 15.828592,
"RestoreCost": 0.0,
"TotalCost": 158.285925
},
{
"UserId": "f20eb24d-fcb1-4754-8d87-4073b83e6a51",
"Email": "LeeAnn",
"FirstName": "LeeAnn",
"LastName": "Parkinson",
"CompanyName": null,
"AverageSpace": 0,
"TotalVolumeRestore": 0,
"PlanCost": 0.0,
"StorageCost": 0.0,
"RestoreCost": 0.0,
"TotalCost": 0.0
},
{
"UserId": "0e1048a1-c068-4f34-98b2-c46daad0c603",
"Email": "lloydhudson@financialsafeguards.us",
"FirstName": "Lloyd",
"LastName": "Hudson",
"CompanyName": "Financial Safeguards",
"AverageSpace": 3913079945904,
"TotalVolumeRestore": 0,
"PlanCost": 12.0,
"StorageCost": 18.221698,
"RestoreCost": 0.0,
"TotalCost": 194.216984
},
{
"UserId": "3f80c65f-ea43-4e40-bd38-e4a5854d2e1d",
"Email": "lulu.camacho@khalsaschools.org",
"FirstName": "Lulu",
"LastName": "Camacho",
"CompanyName": "Khalsa Montessori School",
"AverageSpace": 251015835161,
"TotalVolumeRestore": 0,
"PlanCost": 129.0,
"StorageCost": 1.168883,
"RestoreCost": 0.0,
"TotalCost": 140.688834
},
{
"UserId": "22dd7062-b7d5-4a07-9711-5d910f4edda1",
"Email": "martell@gainusa.com",
"FirstName": "John",
"LastName": "Martell",
"CompanyName": "Martell and Associates",
"AverageSpace": 2185882852434,
"TotalVolumeRestore": 0,
"PlanCost": 49.0,
"StorageCost": 10.17881,
"RestoreCost": 0.0,
"TotalCost": 150.788102
},
{
"UserId": "45225389-9392-4add-9421-f8981e3bd0af",
"Email": "mdiamos@gmail.com",
"FirstName": "Monica",
"LastName": "Diamos",
"CompanyName": null,
"AverageSpace": 60761796781,
"TotalVolumeRestore": 0,
"PlanCost": 12.0,
"StorageCost": 0.282944,
"RestoreCost": 0.0,
"TotalCost": 14.829441
},
{
"UserId": "f6a8e59d-a070-4473-9a53-ec42921dd876",
"Email": "mel.albert@iceinc.us.com",
"FirstName": "ICE",
"LastName": "inc",
"CompanyName": null,
"AverageSpace": 0,
"TotalVolumeRestore": 0,
"PlanCost": 0.0,
"StorageCost": 0.0,
"RestoreCost": 0.0,
"TotalCost": 0.0
},
{
"UserId": "85b4355a-7577-449e-afe4-c7995ded66c1",
"Email": "mike@azcomputerguru.com",
"FirstName": "Michael",
"LastName": "Swanson",
"CompanyName": null,
"AverageSpace": 428191317224,
"TotalVolumeRestore": 0,
"PlanCost": 8.0,
"StorageCost": 1.99392,
"RestoreCost": 0.0,
"TotalCost": 27.93921
},
{
"UserId": "20c09d4b-ef43-44f9-92df-e1b752729bf7",
"Email": "NEPTUNE-15E6653AF349",
"FirstName": null,
"LastName": null,
"CompanyName": "ACG-Internal",
"AverageSpace": 364369247509,
"TotalVolumeRestore": 0,
"PlanCost": 0.0,
"StorageCost": 1.696726,
"RestoreCost": 0.0,
"TotalCost": 16.967265
},
{
"UserId": "d4acd3ae-014c-4f3f-9109-8efee1ca8eda",
"Email": "pbx.intranet.dataforth.com-7C7BE3FE5EBA",
"FirstName": "pbx.intranet",
"LastName": "",
"CompanyName": "Dataforth",
"AverageSpace": 11587187443,
"TotalVolumeRestore": 0,
"PlanCost": 0.0,
"StorageCost": 0.053957,
"RestoreCost": 0.0,
"TotalCost": 0.53957
},
{
"UserId": "43279277-f004-4eb0-ae7c-e2268f160746",
"Email": "rednourcarrievirt-21979DC124A8",
"FirstName": "",
"LastName": "",
"CompanyName": "Rednour Law",
"AverageSpace": 94770838344,
"TotalVolumeRestore": 0,
"PlanCost": 0.0,
"StorageCost": 0.441311,
"RestoreCost": 0.0,
"TotalCost": 4.413111
},
{
"UserId": "14e8071e-2990-4a29-baae-d09f4c386d28",
"Email": "richard@ucryo.com",
"FirstName": "Richard",
"LastName": "Schickling",
"CompanyName": "Universal Cryogenics",
"AverageSpace": 1390383116718,
"TotalVolumeRestore": 0,
"PlanCost": 49.0,
"StorageCost": 6.474475,
"RestoreCost": 0.0,
"TotalCost": 113.744759
},
{
"UserId": "a39b0d4c-51d8-43c9-84db-1f67ac6cf8ad",
"Email": "rohrbach",
"FirstName": "Mike",
"LastName": "Rohrbach",
"CompanyName": "Rohrbach",
"AverageSpace": 14296926585002,
"TotalVolumeRestore": 0,
"PlanCost": 49.0,
"StorageCost": 66.575251,
"RestoreCost": 0.0,
"TotalCost": 714.752523
},
{
"UserId": "26c4d430-9fbd-453d-b4e3-efd4c0f046ff",
"Email": "SAGE-SQL-7C7BE3224F9A",
"FirstName": "SAGE-SQL",
"LastName": "",
"CompanyName": "Dataforth",
"AverageSpace": 618020252591,
"TotalVolumeRestore": 0,
"PlanCost": 0.0,
"StorageCost": 2.877881,
"RestoreCost": 0.0,
"TotalCost": 28.77881
},
{
"UserId": "c064d061-f0ca-45d7-97f4-39ab8b9cdc12",
"Email": "seastman@glaztech.com",
"FirstName": "Steve",
"LastName": "Eastman",
"CompanyName": "Glaztech Industries",
"AverageSpace": 1981984799718,
"TotalVolumeRestore": 0,
"PlanCost": 49.0,
"StorageCost": 9.229335,
"RestoreCost": 0.0,
"TotalCost": 141.293358
},
{
"UserId": "975e31eb-ccfb-474a-8610-1d60e1716638",
"Email": "SERVER-6FB2906AA1E0",
"FirstName": "",
"LastName": "",
"CompanyName": "Sorensen",
"AverageSpace": 0,
"TotalVolumeRestore": 0,
"PlanCost": 0.0,
"StorageCost": 0.0,
"RestoreCost": 0.0,
"TotalCost": 0.0
},
{
"UserId": "2a556356-417d-4434-954c-07d5b361aab0",
"Email": "SERVER-9CA8E3FACB16",
"FirstName": "",
"LastName": "",
"CompanyName": "Martell and Associates",
"AverageSpace": 1088831075045,
"TotalVolumeRestore": 0,
"PlanCost": 0.0,
"StorageCost": 0.0,
"RestoreCost": 0.0,
"TotalCost": 0.0
},
{
"UserId": "46797735-e206-4f87-872d-955224f8a39f",
"Email": "Server-C061FB5C05FD",
"FirstName": "",
"LastName": "",
"CompanyName": "Brett Interiors",
"AverageSpace": 162180926669,
"TotalVolumeRestore": 0,
"PlanCost": 0.0,
"StorageCost": 0.755213,
"RestoreCost": 0.0,
"TotalCost": 7.552137
},
{
"UserId": "e356b1f5-f17b-4a7d-ba0f-bb269cf74366",
"Email": "Seth-PC-EC484706D26F",
"FirstName": "",
"LastName": "",
"CompanyName": "Tucson Coin and Autograph",
"AverageSpace": 63303717705,
"TotalVolumeRestore": 0,
"PlanCost": 0.0,
"StorageCost": 0.29478,
"RestoreCost": 0.0,
"TotalCost": 2.947809
},
{
"UserId": "914908da-7508-4c1e-ae3f-2c2db064e2b4",
"Email": "shannont@rrs-law.com",
"FirstName": "Russo Law",
"LastName": "Firm",
"CompanyName": "Russo Law Firm",
"AverageSpace": 6829452664717,
"TotalVolumeRestore": 0,
"PlanCost": 0.005,
"StorageCost": 31.802117,
"RestoreCost": 0.0,
"TotalCost": 318.026171
},
{
"UserId": "f664f30f-900b-43fd-92f8-c76afe6bd010",
"Email": "sorensen",
"FirstName": "Tom",
"LastName": "Sorensen",
"CompanyName": "Sorensen",
"AverageSpace": 0,
"TotalVolumeRestore": 0,
"PlanCost": 0.0,
"StorageCost": 0.0,
"RestoreCost": 0.0,
"TotalCost": 0.0
},
{
"UserId": "ccb14528-ec07-431b-8cee-17dbaa17d6d7",
"Email": "Stamback",
"FirstName": "",
"LastName": "",
"CompanyName": "Stamback Services",
"AverageSpace": 2996811786965,
"TotalVolumeRestore": 0,
"PlanCost": 0.0,
"StorageCost": 0.0,
"RestoreCost": 0.0,
"TotalCost": 0.0
},
{
"UserId": "f057d04d-c0e9-4ae7-a328-a75c20d5dc3b",
"Email": "susan-think-63AE5E1B7FB2",
"FirstName": "",
"LastName": "",
"CompanyName": "Rohrbach",
"AverageSpace": 345550097052,
"TotalVolumeRestore": 3705054745,
"PlanCost": 0.0,
"StorageCost": 1.609093,
"RestoreCost": 0.034506,
"TotalCost": 16.125436
},
{
"UserId": "38905235-0bb7-48a9-8728-de469d544fed",
"Email": "vwp",
"FirstName": "",
"LastName": "",
"CompanyName": "Valleywide Plastering",
"AverageSpace": 931579945707,
"TotalVolumeRestore": 0,
"PlanCost": 0.0,
"StorageCost": 4.338007,
"RestoreCost": 0.0,
"TotalCost": 43.380071
},
{
"UserId": "634e86db-b3e5-4f4e-ae9b-74d83eeb21de",
"Email": "VWP-FILES-BDC660BB0EB7",
"FirstName": "",
"LastName": "",
"CompanyName": "Valleywide Plastering",
"AverageSpace": 63795608336,
"TotalVolumeRestore": 0,
"PlanCost": 0.0,
"StorageCost": 0.297071,
"RestoreCost": 0.0,
"TotalCost": 2.970714
},
{
"UserId": "5ec66e3f-c90e-4cad-9c74-9c6fb27f09f4",
"Email": "VWP-QBS-BDC660670F99",
"FirstName": "",
"LastName": "",
"CompanyName": "Valleywide Plastering",
"AverageSpace": 16006972692,
"TotalVolumeRestore": 0,
"PlanCost": 0.0,
"StorageCost": 0.074538,
"RestoreCost": 0.0,
"TotalCost": 0.745382
},
{
"UserId": "30d7edce-1d60-4657-abc1-58ad30210e81",
"Email": "WINFileSvr-BDC660835B68",
"FirstName": "",
"LastName": "",
"CompanyName": "Valleywide Plastering",
"AverageSpace": 938754217053,
"TotalVolumeRestore": 0,
"PlanCost": 0.0,
"StorageCost": 4.371414,
"RestoreCost": 0.0,
"TotalCost": 43.714149
},
{
"UserId": "b07ed172-c783-41a6-9506-556b22084335",
"Email": "y226@tedards.net",
"FirstName": "Bill",
"LastName": "Tedards",
"CompanyName": "Tedards",
"AverageSpace": 0,
"TotalVolumeRestore": 0,
"PlanCost": 0.0,
"StorageCost": 0.0,
"RestoreCost": 0.0,
"TotalCost": 0.0
}
]
}

1
.claude/memory/MEMORY.md
View File

@@ -230,3 +230,4 @@
- [Background tasks — no shell `&`](feedback_background_task_no_ampersand.md) — with run_in_background:true, run the command in the foreground of the shell; adding `&`/`disown` forks + exits 0 instantly, orphaning a blocking wait so it never delivers (hit twice building ask-forum)
- [ask-forum — human-in-the-loop via #ct-forum](../skills/ask-forum/SKILL.md) — ask a teammate a question in the private ct-forum Discord forum, get their human answer back in-session; forum-only, any human can answer, run the --wait as a proper background task
- [Claude Code Bun crash -> pin 2.1.110](reference_claude_code_bun_crash_pin.md) - v2.1.114+ segfaults on Win11 at new-session start; npm pin 2.1.110 + DISABLE_AUTOUPDATER=1; unpin on #55219 fix
- [GuruRMM build-server SSH key](reference_gururmm_build_server_ssh.md) — guru@172.16.3.30 key is ~/.ssh/gururmm-physical (not id_*); password fallback vault infrastructure/gururmm-server

12
.claude/memory/reference_gururmm_build_server_ssh.md Normal file
View File

@@ -0,0 +1,12 @@
---
name: GuruRMM build server SSH access
description: How to SSH guru@172.16.3.30 (key file name is non-obvious); saves re-discovery during rmm-audit pipeline passes
type: reference
---
SSH to the GuruRMM build/prod server as `guru@172.16.3.30` works with the key
`~/.ssh/gururmm-physical` (at least on Howard-Home) — there is no id_rsa/id_ed25519,
so tools that assume default key names report "no key / Permission denied (publickey)".
Use: `C:/Windows/System32/OpenSSH/ssh.exe -i ~/.ssh/gururmm-physical -o BatchMode=yes guru@172.16.3.30`.
Password fallback lives in vault `infrastructure/gururmm-server` (credentials.password; sudo same).
The 2026-07-13 rmm-audit Agent E failed on exactly this before the key was found.

821
.lic.json Normal file
View File

@@ -0,0 +1,821 @@
[
{
"ID": "9809bd91-c51c-44c8-b804-965d448ddbb6",
"Number": 17,
"ComputerName": null,
"OperatingSystem": null,
"IsTrial": false,
"IsTaken": false,
"LicenseType": "MS SQL Server",
"DateExpired": "2026-07-01T00:00:00Z",
"Transaction": "dbc23ae9-2010-4e27-863c-37290bcb0db1",
"User": null,
"UserID": null
},
{
"ID": "68de82e6-568c-417d-b67e-d9bbe2fd3d57",
"Number": 31,
"ComputerName": null,
"OperatingSystem": null,
"IsTrial": false,
"IsTaken": false,
"LicenseType": "MS SQL Server",
"DateExpired": "2026-07-01T00:00:00Z",
"Transaction": "dbc23ae9-2010-4e27-863c-37290bcb0db1",
"User": null,
"UserID": null
},
{
"ID": "ee951310-8a6b-45a4-98c3-96baf385ad32",
"Number": 19,
"ComputerName": "GND-SERVER",
"OperatingSystem": "windows",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "MS SQL Server",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "jwilliams@grabblaw.com",
"UserID": "a15b177b-941f-48ab-b502-1240558c0965"
},
{
"ID": "ac2cd006-f83f-432a-83c7-168775881517",
"Number": 17,
"ComputerName": "IMC1",
"OperatingSystem": "windows",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "MS SQL Server",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "imcbackups",
"UserID": "56f80e2d-6ece-4407-8971-92635547ce1d"
},
{
"ID": "cd2e9855-26f4-47ef-b40b-d4c0b1b356df",
"Number": 6,
"ComputerName": "SAGE-SQL",
"OperatingSystem": "windows",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "MS SQL Server",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "SAGE-SQL-7C7BE3224F9A",
"UserID": "26c4d430-9fbd-453d-b4e3-efd4c0f046ff"
},
{
"ID": "ca6f91d2-96b7-44a0-acc5-18f3e2484f4c",
"Number": 54,
"ComputerName": "GTI-FINANCESVR",
"OperatingSystem": "windows",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "MS SQL Server",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "GTI-FINANCESVR-5C7487F5EF6B",
"UserID": "9e377102-a4c4-45e3-b6b3-e6adeaa93db4"
},
{
"ID": "475af0d2-60c2-4610-b140-5439e1a745bf",
"Number": 68,
"ComputerName": null,
"OperatingSystem": null,
"IsTrial": false,
"IsTaken": false,
"LicenseType": "MS Exchange",
"DateExpired": "2026-07-01T00:00:00Z",
"Transaction": "dbc23ae9-2010-4e27-863c-37290bcb0db1",
"User": null,
"UserID": null
},
{
"ID": "12e9587b-074e-4b50-9384-988d7852e2bc",
"Number": 4,
"ComputerName": null,
"OperatingSystem": null,
"IsTrial": false,
"IsTaken": false,
"LicenseType": "MS Exchange",
"DateExpired": "2026-07-01T00:00:00Z",
"Transaction": "dbc23ae9-2010-4e27-863c-37290bcb0db1",
"User": null,
"UserID": null
},
{
"ID": "c27b095d-c783-4d25-a886-e27d9b7c6a20",
"Number": 68,
"ComputerName": null,
"OperatingSystem": null,
"IsTrial": false,
"IsTaken": false,
"LicenseType": "MS Exchange",
"DateExpired": "2026-07-01T00:00:00Z",
"Transaction": "dbc23ae9-2010-4e27-863c-37290bcb0db1",
"User": null,
"UserID": null
},
{
"ID": "232ada35-3a44-47d0-beda-f9c85bb7f4be",
"Number": 17,
"ComputerName": "NEPTUNE",
"OperatingSystem": "Microsoft Windows Server 2022 Datacenter ",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "MS Exchange",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "NEPTUNE-15E6653AF349",
"UserID": "20c09d4b-ef43-44f9-92df-e1b752729bf7"
},
{
"ID": "ee0ee2f0-51b2-4eb6-ac10-e50c98ce1f81",
"Number": 87,
"ComputerName": null,
"OperatingSystem": null,
"IsTrial": false,
"IsTaken": false,
"LicenseType": "MS SQL Server + MS Exchange",
"DateExpired": "2026-07-01T00:00:00Z",
"Transaction": "dbc23ae9-2010-4e27-863c-37290bcb0db1",
"User": null,
"UserID": null
},
{
"ID": "dfb1b1b9-bf99-49e9-ad28-6fca59bd86be",
"Number": 4,
"ComputerName": null,
"OperatingSystem": null,
"IsTrial": false,
"IsTaken": false,
"LicenseType": "Server",
"DateExpired": "2026-07-01T00:00:00Z",
"Transaction": "dbc23ae9-2010-4e27-863c-37290bcb0db1",
"User": "jimmyco333@gmail.com",
"UserID": "d94b286b-d22e-49c3-8bb1-415848f448f4"
},
{
"ID": "e395d5ee-8333-4f7b-8699-73122caee3b3",
"Number": 4,
"ComputerName": null,
"OperatingSystem": null,
"IsTrial": false,
"IsTaken": false,
"LicenseType": "Server",
"DateExpired": "2026-07-01T00:00:00Z",
"Transaction": "dbc23ae9-2010-4e27-863c-37290bcb0db1",
"User": "jimmyco333@gmail.com",
"UserID": "d94b286b-d22e-49c3-8bb1-415848f448f4"
},
{
"ID": "02fc5d96-0b0e-42d1-9c07-7910c3eaedc2",
"Number": 64,
"ComputerName": null,
"OperatingSystem": null,
"IsTrial": false,
"IsTaken": false,
"LicenseType": "Server",
"DateExpired": "2026-07-01T00:00:00Z",
"Transaction": "dbc23ae9-2010-4e27-863c-37290bcb0db1",
"User": "jimmyco333@gmail.com",
"UserID": "d94b286b-d22e-49c3-8bb1-415848f448f4"
},
{
"ID": "18d40dec-5a60-4367-a40b-82ce1aa73d4f",
"Number": 31,
"ComputerName": null,
"OperatingSystem": null,
"IsTrial": false,
"IsTaken": false,
"LicenseType": "Server",
"DateExpired": "2026-07-01T00:00:00Z",
"Transaction": "dbc23ae9-2010-4e27-863c-37290bcb0db1",
"User": "jimmyco333@gmail.com",
"UserID": "d94b286b-d22e-49c3-8bb1-415848f448f4"
},
{
"ID": "d6f83222-a45b-4ebb-b311-941bf6f7f9bb",
"Number": 84,
"ComputerName": null,
"OperatingSystem": null,
"IsTrial": false,
"IsTaken": false,
"LicenseType": "Server",
"DateExpired": "2026-07-01T00:00:00Z",
"Transaction": "dbc23ae9-2010-4e27-863c-37290bcb0db1",
"User": "jimmyco333@gmail.com",
"UserID": "d94b286b-d22e-49c3-8bb1-415848f448f4"
},
{
"ID": "210b7e3c-5872-4ccc-9f6d-9b0bf8af09d0",
"Number": 40,
"ComputerName": null,
"OperatingSystem": null,
"IsTrial": false,
"IsTaken": false,
"LicenseType": "Server",
"DateExpired": "2026-07-01T00:00:00Z",
"Transaction": "dbc23ae9-2010-4e27-863c-37290bcb0db1",
"User": "jimmyco333@gmail.com",
"UserID": "d94b286b-d22e-49c3-8bb1-415848f448f4"
},
{
"ID": "5f8360e4-16b5-42a4-88bc-9cbcefe6b096",
"Number": 6,
"ComputerName": null,
"OperatingSystem": null,
"IsTrial": false,
"IsTaken": false,
"LicenseType": "Server",
"DateExpired": "2026-07-01T00:00:00Z",
"Transaction": "dbc23ae9-2010-4e27-863c-37290bcb0db1",
"User": "jimmyco333@gmail.com",
"UserID": "d94b286b-d22e-49c3-8bb1-415848f448f4"
},
{
"ID": "1660948e-11ff-40a4-ad14-b85c26e17fbd",
"Number": 83,
"ComputerName": null,
"OperatingSystem": null,
"IsTrial": false,
"IsTaken": false,
"LicenseType": "Server",
"DateExpired": "2026-07-01T00:00:00Z",
"Transaction": "dbc23ae9-2010-4e27-863c-37290bcb0db1",
"User": "jimmyco333@gmail.com",
"UserID": "d94b286b-d22e-49c3-8bb1-415848f448f4"
},
{
"ID": "caf36366-9e6f-4907-97d6-bd42e1f6a920",
"Number": 18,
"ComputerName": null,
"OperatingSystem": null,
"IsTrial": false,
"IsTaken": false,
"LicenseType": "Server",
"DateExpired": "2026-07-01T00:00:00Z",
"Transaction": "dbc23ae9-2010-4e27-863c-37290bcb0db1",
"User": "jimmyco333@gmail.com",
"UserID": "d94b286b-d22e-49c3-8bb1-415848f448f4"
},
{
"ID": "0a120352-aa4a-4785-bfdb-4e0c2980dd3c",
"Number": 18,
"ComputerName": "VWP-FILES",
"OperatingSystem": "Microsoft Windows Server 2019 Standard ",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "Server",
"DateExpired": "2026-07-01T00:00:00Z",
"Transaction": "dbc23ae9-2010-4e27-863c-37290bcb0db1",
"User": "VWP-FILES-BDC660BB0EB7",
"UserID": "634e86db-b3e5-4f4e-ae9b-74d83eeb21de"
},
{
"ID": "93b3412b-9746-4949-a592-5369cd29d1c7",
"Number": 6,
"ComputerName": "WINFileSvr",
"OperatingSystem": "Microsoft Windows Server 2019 Standard ",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "Server",
"DateExpired": "2026-07-01T00:00:00Z",
"Transaction": "dbc23ae9-2010-4e27-863c-37290bcb0db1",
"User": "WINFileSvr-BDC660835B68",
"UserID": "30d7edce-1d60-4657-abc1-58ad30210e81"
},
{
"ID": "52e2b4a4-da50-4980-bfad-61f3b397e559",
"Number": 115,
"ComputerName": "DESKTOP-BMBTQLI",
"OperatingSystem": "Microsoft Windows 11 Pro ",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "Server",
"DateExpired": "2026-07-01T00:00:00Z",
"Transaction": "dbc23ae9-2010-4e27-863c-37290bcb0db1",
"User": "DESKTOP-BMBTQLI-B16CD561D2DF",
"UserID": "06109a61-2ba2-4547-8294-f88d5e1799ba"
},
{
"ID": "7d26ae45-8af9-4fd0-8bed-011d18e82631",
"Number": 28,
"ComputerName": "CS-SERVER",
"OperatingSystem": "Microsoft Windows Server 2019 Standard ",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "Server",
"DateExpired": "2026-07-01T00:00:00Z",
"Transaction": "dbc23ae9-2010-4e27-863c-37290bcb0db1",
"User": "CS-SERVER-9163AEDE7357",
"UserID": "08d55d69-bf76-40b5-ae45-b1bbe0064c14"
},
{
"ID": "8d60d555-ad23-40e8-8962-29c7d0c143ce",
"Number": 102,
"ComputerName": "Mac-mini.localdomain",
"OperatingSystem": "",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "Server",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "lahc",
"UserID": "554b8232-1647-480b-99d1-cdefa299343f"
},
{
"ID": "72416dbf-6b4b-43a0-8816-30305a86c2b9",
"Number": 111,
"ComputerName": "PST-SERVER",
"OperatingSystem": "",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "Server",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "info@bestmassageintucson.com",
"UserID": "54a647a3-b92a-4c7b-8a02-8a8759fd36ff"
},
{
"ID": "f6632bf8-377d-4c0f-9e16-c8cc00045fe7",
"Number": 106,
"ComputerName": "SERVER",
"OperatingSystem": "",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "Server",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "SERVER-6FB2906AA1E0",
"UserID": "975e31eb-ccfb-474a-8610-1d60e1716638"
},
{
"ID": "9328f717-3233-4af6-a031-0b13a0e71a49",
"Number": 72,
"ComputerName": "rednourcarrievirt",
"OperatingSystem": "Microsoft Windows 10 Pro ",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "Server",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "rednourcarrievirt-21979DC124A8",
"UserID": "43279277-f004-4eb0-ae7c-e2268f160746"
},
{
"ID": "57e62034-1802-4c79-8a02-57a40beab872",
"Number": 17,
"ComputerName": "DRV-SERVER",
"OperatingSystem": "Microsoft Windows Server 2016 Essentials ",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "Server",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "becky@desertrvcenter.com",
"UserID": "ffa09772-0856-4b63-9a25-b2827d3a86ba"
},
{
"ID": "e8a28fa2-2e09-4c4c-aeef-5faf21f44105",
"Number": 18,
"ComputerName": "DRV-BECKY",
"OperatingSystem": "Microsoft Windows NT 6.3.9600.0",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "Server",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "becky@desertrvcenter.com",
"UserID": "ffa09772-0856-4b63-9a25-b2827d3a86ba"
},
{
"ID": "099b1024-776d-44a1-bbfa-d28e37dfe21d",
"Number": 81,
"ComputerName": "DESKTOP-9T0UAON",
"OperatingSystem": "Microsoft Windows NT 6.3.9600.0",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "Server",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "DESKTOP-9T0UAON-64BD1EB86A99",
"UserID": "69f65bfa-3bdc-49e0-96a3-e59241a95cef"
},
{
"ID": "74ec5858-0159-4a77-a9a5-44f71251d985",
"Number": 6,
"ComputerName": "BLASTER2",
"OperatingSystem": "Microsoft Windows NT 6.3.9600.0",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "Server",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "jimmyco333@gmail.com",
"UserID": "d94b286b-d22e-49c3-8bb1-415848f448f4"
},
{
"ID": "41d01c05-9892-419b-8057-aa022c5a91a4",
"Number": 116,
"ComputerName": "KAT1",
"OperatingSystem": "Microsoft Windows 11 Home ",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "Server",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "KAT1-65F649951294",
"UserID": "004b8770-f635-4ba2-9ff9-b44b2f781428"
},
{
"ID": "00745d9a-0c03-4277-9994-28c680dd5f6e",
"Number": 77,
"ComputerName": "RUSSO-SRV",
"OperatingSystem": "windows",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "Server",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "shannont@rrs-law.com",
"UserID": "914908da-7508-4c1e-ae3f-2c2db064e2b4"
},
{
"ID": "8f4148f5-0ed3-4a1c-aebc-4badccd580ce",
"Number": 40,
"ComputerName": "RGI-DC",
"OperatingSystem": "Microsoft Windows Server 2016 Standard ",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "Server",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "jgoodman@ridgetopgroup.com",
"UserID": "5f09e9d3-82ad-42c4-8d68-f208d8e7645d"
},
{
"ID": "e1bd55e7-8da0-491d-9a90-4e3c9fb23a26",
"Number": 64,
"ComputerName": "DROBO",
"OperatingSystem": "windows",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "Server",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "anaisedavid.office@gmail.com",
"UserID": "27cae1c8-b253-45e1-aafc-cc94801b6a0c"
},
{
"ID": "7454b8e3-5aa7-43a1-b3c1-eb7605bad6c2",
"Number": 6,
"ComputerName": "SERVER",
"OperatingSystem": "Microsoft Windows NT 6.3.9600.0",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "Server",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "SERVER-9CA8E3FACB16",
"UserID": "2a556356-417d-4434-954c-07d5b361aab0"
},
{
"ID": "44d8a11c-0215-4e60-9fd2-814cf62b7e10",
"Number": 4,
"ComputerName": "DESKTOP-SUFJR0J",
"OperatingSystem": "Microsoft Windows 10 Home ",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "Server",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "y226@tedards.net",
"UserID": "b07ed172-c783-41a6-9506-556b22084335"
},
{
"ID": "aed55e4b-8bc2-4f60-ac64-6fc64fa22309",
"Number": 6,
"ComputerName": "MIKE-THINK",
"OperatingSystem": "Microsoft Windows NT 6.3.9600.0",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "Server",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "rohrbach",
"UserID": "a39b0d4c-51d8-43c9-84db-1f67ac6cf8ad"
},
{
"ID": "d39934ca-a255-4d04-aeea-f610f74f1d5f",
"Number": 105,
"ComputerName": "susan-think",
"OperatingSystem": "",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "Server",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "susan-think-63AE5E1B7FB2",
"UserID": "f057d04d-c0e9-4ae7-a328-a75c20d5dc3b"
},
{
"ID": "c0cc9268-ec86-46b2-b046-3b09f834c92d",
"Number": 133,
"ComputerName": "VWP-QBS",
"OperatingSystem": "",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "Server",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "VWP-QBS-BDC660670F99",
"UserID": "5ec66e3f-c90e-4cad-9c74-9c6fb27f09f4"
},
{
"ID": "c7e34768-f64a-4597-a8f6-5650e022ba8e",
"Number": 64,
"ComputerName": "VWP-SERVER",
"OperatingSystem": "Microsoft Windows NT 6.3.9600.0",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "Server",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "vwp",
"UserID": "38905235-0bb7-48a9-8728-de469d544fed"
},
{
"ID": "7c1a1758-52a7-4c4e-8caa-426ebb776ab4",
"Number": 136,
"ComputerName": "Seth-PC",
"OperatingSystem": "",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "Server",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "Seth-PC-EC484706D26F",
"UserID": "e356b1f5-f17b-4a7d-ba0f-bb269cf74366"
},
{
"ID": "fdd5384f-093d-49b4-b1c2-e04d05612fef",
"Number": 28,
"ComputerName": "DESKTOP-P36LUUN",
"OperatingSystem": "Microsoft Windows 11 Home ",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "Server",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "DESKTOP-P36LUUN-EC48473C3133",
"UserID": "ba5547d4-b5f3-411b-91f8-372ecff9703e"
},
{
"ID": "d146d89e-f07e-417b-8106-33153d04bb6d",
"Number": 40,
"ComputerName": "DESKTOP-EVA4H1A",
"OperatingSystem": "Microsoft Windows 10 Home ",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "Server",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "Gary A Hartman",
"UserID": "ca27f550-6928-411b-8b5c-2f1754a99107"
},
{
"ID": "ed8f0500-22ec-4ec8-8108-17769a92124b",
"Number": 110,
"ComputerName": "CP-QB",
"OperatingSystem": "Microsoft Windows NT 6.3.9600.0",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "Server",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "CP-QB-7E3C66D32920",
"UserID": "c1dfddd4-f845-43a3-8e40-d5e30c0450e8"
},
{
"ID": "13b186af-7257-472c-93d4-9b45d1f9c678",
"Number": 31,
"ComputerName": "SRV02",
"OperatingSystem": "windows",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "Server",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "cs@curtisplumbing.net",
"UserID": "5897c22d-e119-44d6-bede-c9428d5925ba"
},
{
"ID": "4bde8f6d-a186-40f6-91fc-36c5d22875bf",
"Number": 66,
"ComputerName": "LAB-BECKY",
"OperatingSystem": "Microsoft Windows 10 Pro ",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "Server",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "beckykahn",
"UserID": "20e00bf6-56ce-479d-a26c-ca7131df8b3e"
},
{
"ID": "f31aa7ce-1ded-4a7f-a332-449d1d804eb4",
"Number": 134,
"ComputerName": "LAB-SVR",
"OperatingSystem": "",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "Server",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "LAB-SVR-B16CD5A3C6AE",
"UserID": "76803ea9-d35a-402a-b518-230ed04ed27d"
},
{
"ID": "c827f092-5c52-4714-9d23-67a3d73c080b",
"Number": 117,
"ComputerName": "Server",
"OperatingSystem": "Microsoft Windows Server 2016 Datacenter ",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "Server",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "Server-C061FB5C05FD",
"UserID": "46797735-e206-4f87-872d-955224f8a39f"
},
{
"ID": "d783ca4b-102b-4bf1-96df-c971dc202625",
"Number": 18,
"ComputerName": "TROUT",
"OperatingSystem": "Microsoft Windows Server 2012 Standard ",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "Server",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "lulu.camacho@khalsaschools.org",
"UserID": "3f80c65f-ea43-4e40-bd38-e4a5854d2e1d"
},
{
"ID": "53f1df9f-72f8-4b89-b7e8-5e717184d645",
"Number": 82,
"ComputerName": "HSM-NewServer",
"OperatingSystem": "Microsoft Windows Server 2019 Essentials ",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "Server",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "HSM-NewServer-496E31DB4EA2",
"UserID": "23b9805e-a479-49f4-aa68-0e1c1a424c19"
},
{
"ID": "4cc5969d-5876-44b3-8303-3847e2add440",
"Number": 123,
"ComputerName": "pbx.intranet.dataforth.com",
"OperatingSystem": "",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "Server",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "pbx.intranet.dataforth.com-7C7BE3FE5EBA",
"UserID": "d4acd3ae-014c-4f3f-9109-8efee1ca8eda"
},
{
"ID": "5b4d628c-0edc-414c-8a48-48e39a95a7f7",
"Number": 125,
"ComputerName": "AD2",
"OperatingSystem": "",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "Server",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "ad2-7C7BE36FD6EC",
"UserID": "0e6c3190-191b-4c61-8535-f6b694621af8"
},
{
"ID": "8066ad98-d0aa-42f1-8b9f-580e8967a57c",
"Number": 126,
"ComputerName": "AD1",
"OperatingSystem": "",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "Server",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "AD1-7C7BE300650F",
"UserID": "73de908b-6f7a-4bab-9787-fd30549ba71e"
},
{
"ID": "3757d318-de1b-4a54-8a21-628e7a17eabc",
"Number": 124,
"ComputerName": "FILES-D1",
"OperatingSystem": "",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "Server",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "FILES-D1-7C7BE310B197",
"UserID": "0e0acb74-319a-40ff-adf3-e1047fc6cc7e"
},
{
"ID": "25b8a489-d1ec-46e6-8c25-64c0a19b95ec",
"Number": 40,
"ComputerName": "D1-ENGI-010",
"OperatingSystem": "Microsoft Windows 11 Pro ",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "Server",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "D1-ENGI-010-7C7BE39C36E9",
"UserID": "e7121651-8fac-456e-b666-6069eb4e33c2"
},
{
"ID": "58b323b7-7bd8-4ecf-a5d6-1004d27c26d0",
"Number": 40,
"ComputerName": "FSG-SRV-02",
"OperatingSystem": "Microsoft Windows Server 2016 Standard ",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "Server",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "lloydhudson@financialsafeguards.us",
"UserID": "0e1048a1-c068-4f34-98b2-c46daad0c603"
},
{
"ID": "c06167a5-c851-4f7f-9f54-d43d5d870062",
"Number": 64,
"ComputerName": "TSAM-SERVER",
"OperatingSystem": "Microsoft Windows Server 2016 Essentials ",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "Server",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "kaytie@tucsonsafety.com",
"UserID": "1c527291-fedf-454e-a8cd-a9a1aeb18819"
},
{
"ID": "31df3a1a-a093-4aee-a2f2-424eb8f707ec",
"Number": 64,
"ComputerName": "UC2-SERVER",
"OperatingSystem": "Microsoft Windows Server 2012 R2 Essentials ",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "Server",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "richard@ucryo.com",
"UserID": "14e8071e-2990-4a29-baae-d09f4c386d28"
},
{
"ID": "8908dbe6-a632-45d4-819c-3fb292d7ab43",
"Number": 127,
"ComputerName": "DF-HYPERV-B",
"OperatingSystem": "",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "VM Server",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "DF-HYPERV-B-7C7BE33DF814",
"UserID": "4b8fed90-f5a8-4b67-a802-d213f1bea399"
},
{
"ID": "acadb096-fc1e-48be-ac68-eac2f6c73325",
"Number": 16,
"ComputerName": "GTI-INV-VMHOST",
"OperatingSystem": "windows",
"IsTrial": false,
"IsTaken": true,
"LicenseType": "VM Server",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": "GTI-INV-VMHOST-5C7487D16BD2",
"UserID": "019ea151-f10e-4bfb-9a78-71fd38bc469b"
},
{
"ID": "f68d2a8a-a74e-46d3-95b5-13f632ae5978",
"Number": 1,
"ComputerName": null,
"OperatingSystem": null,
"IsTrial": false,
"IsTaken": false,
"LicenseType": "Advanced Rebranding & Custom SSL",
"DateExpired": "2026-08-01T00:00:00Z",
"Transaction": "9fff9d71-0db7-4b66-9c9c-b0fafff28cc9",
"User": null,
"UserID": null
}
]

1677
.mon.json Normal file
View File

File diff suppressed because it is too large Load Diff

1
.signins.json Normal file
View File

File diff suppressed because one or more lines are too long

111
clients/cascades-tucson/docs/REMAINING-WORK-PLAN.md
View File

@@ -3,8 +3,14 @@
> Consolidated execution plan tying the open Syncro tickets to the broader migration
> workstreams (workstations -> domain, users/departments, HIPAA caregiver lockdown).
> Built 2026-06-24 (Howard) from a live AD+RMM diff. Companion to `PROJECT_STATE.md`
> and `wiki/clients/cascades-tucson.md` (current truth, compiled 2026-06-23).
> and `wiki/clients/cascades-tucson.md` (current truth).
> Goal: finish the migration quickly by working it as one sequenced plan.
>
> **REFRESHED 2026-07-13** (reconcile pass vs wiki + live state): caregiver CA posture
> updated to the 7/1 interim cutover, roster 35, Home->Pro completions folded in,
> CS-SERVER EDR installed, ticket table reconciled against Syncro (0 open as of 7/10).
> The "Live snapshot" below is still the 6/24 AD-vs-RMM diff -- domain-join states are
> per-machine current in the wiki's "Migration phase status" table.
---
@@ -33,7 +39,7 @@ ASSISTNURSE-PC, NURSESTATION-PC, RECEPTIONIST-PC, MEGAN.
| Health-Services-Director | vs AD `HEALTH-SERVICES` | Verify dup/rename before acting |
| **CHEF-PC** | Culinary (Chef JD) | **Ticket #32254** — reinstall Windows, THEN join -> OU=Culinary |
| DESKTOP-TRCIEJA | Lupe Sanchez | EOL — **replace machine** (decision 2026-06-18), join the replacement |
| DESKTOP-KQSL232 | Lois Lane | Resistant to migration; coordinate via John Trozzi |
| DESKTOP-KQSL232 | Lois Lane | **DECOMMISSIONED 6/26** (her HEALTH-SERVICES box is already domain-joined) |
| CascadesProxess | Proxess access-control appliance | Likely leave un-joined — verify it's an appliance |
| Laptop2, LAPTOP-DRQ5L558, LAPTOP-E0STJJE8, Laptop4 | Caregiver shared laptops | Join via the **Caregiver Devices** path (Workstream 3), not the staff path |
@@ -75,8 +81,8 @@ retire per-PC Synology Drive Client.
| LAPTOP-8P7HDSEI | User | **Win10 Home** | BLOCKED: Home->Pro + OneDrive KFM ON |
| MDIRECTOR-PC | Shelby Trozzi | **Win11 Home** | BLOCKED: Home->Pro + reboot |
| MEMRECEPT-PC | memfrtdesk | **Win10 Home** | BLOCKED: Home->Pro + reboot |
| NurseAssist | Veronica | **Win11 Home** | BLOCKED: Home->Pro + KFM ON + reboot |
| SALES4-PC | Tamra (departing) | **Win11 Home** | BLOCKED: Home->Pro; Tamra leaving — repurpose? |
| NurseAssist | Veronica | ~~Win11 Home~~ **Pro WS (upgraded 6/26)** | READY-ish: KFM ON (unlink) + reboot; confirmed distinct from ASSISTNURSE-PC |
| SALES4-PC | Tamra (OFFBOARDED 6/30) | ~~Win11 Home~~ **Pro (supplier upgrade)** | Repurpose TBD; join when reassigned |
| LAPTOP-DRQ5L558 | caregiver | Win11 Pro WS | BLOCKED: off-network (public DNS, no DC reach) |
| DESKTOP-TRCIEJA | Lupe Sanchez | Win11 Pro | SKIP — EOL, being replaced |
| Health-Services-Director | Lois Lane | Win11 Pro WS | already domain-joined (= AD `HEALTH-SERVICES`) |
@@ -99,8 +105,10 @@ retire per-PC Synology Drive Client.
the edition to `ProfessionalWorkstation` (higher SKU, fine for domain join), `/dli` = Licensed,
VOLUME_MAK channel. **2 MAK counts consumed -> bill 2x $99 = $198 to Cascades** (line items name each
machine). MEMRECEPT needed an `/ato` retry (first attempt hit transient `0x8004FE92`).
- **Still pending:** NurseAssist (OFFLINE — and flagged as a possible dupe of `Assistnurse-pc`, verify
before upgrading) and SALES4-PC (bypassed — Tamra departing, repurpose TBD).
- **[RESOLVED 6/26-6/30]** NurseAssist + DESKTOP-MD6UQI3 upgraded to Pro for Workstations 6/26
(2 x $99 to bill — Syncro product 23571919, not yet invoiced as of 7/10); NurseAssist confirmed
a distinct machine from ASSISTNURSE-PC. SALES4-PC upgraded to Pro by its supplier (no ACG
charge); Tamra offboarded 6/30, machine repurpose TBD.
- Next step for the 3 upgraded boxes = **domain-join** (they now read `EditionID=Professional`/PfW).
- **OneDrive KFM ON** (unlink before folder-redirect GPO): LAPTOP-8P7HDSEI, NurseAssist.
- **Pending reboots + KFM unlinks: held for onsite** (Howard) — disruptive to clear remotely.
@@ -135,24 +143,52 @@ access matrix; Synology retired as primary.
## Workstream 3 — HIPAA caregiver lockdown — GO-LIVE (highest value, mostly built)
Everything is built + validated on the pilot (NURSESTATION + pilot.test). Go-live = flip from
test scope to real caregivers, one device at a time. (Detail: wiki "Entra Access Architecture".)
**[UPDATED 2026-07-13]** The 7/1 CA cutover put caregivers in an **interim posture**: all 35
`SG-Caregivers` may sign in on desktops AND phones, **on-network only** (`e35614e1` off-network
block + `7d491c7a` 8h sign-in frequency enforced; `SG-Caregivers` excluded from MFA-for-all).
The compliance-block policy `ede985e2` was **DISABLED 2026-07-01 — do not re-enable** (superseded
by the allow-list). Temp passwords are live for phone sign-in (must-change cleared fleet-wide 7/2;
`PSO-Caregivers` never-expire FGPP in place). Roster = **35** after the 7/1 reconcile.
**Juan Andrade offboards 2026-07-16 afternoon** (coord todo `80716a98`).
Final lockdown = flip from test scope to real caregivers, one device at a time
(detail: wiki "Entra Access Architecture"):
1. Swap GPO `CSC - Caregiver Workstation` security filter `SG-Caregivers-Test` -> `SG-Caregivers`.
2. CA allow-list policy `1b7fd025`: test group `SG-Caregivers-DeviceTest` -> `SG-Caregivers`; disable the compliance-block policy `ede985e2`.
2. CA allow-list policy `1b7fd025`: **two changes** — retarget test group `SG-Caregivers-DeviceTest`
-> `SG-Caregivers` AND flip from report-only (`enabledForReportingButNotEnforced`) to enforced.
Prereqs: `SG-Break-Glass` + GDAP/service-provider exclusions in place (break-glass accounts still
NOT created — do this first).
3. Move each caregiver machine into `OU=Caregiver Devices` + `SG-PC-MainTower`/`SG-PC-MemoryCare`
one at a time: Laptop2, LAPTOP-DRQ5L558, LAPTOP-E0STJJE8, ASSISTNURSE-PC, NURSESTATION-PC (+ verify NurseAssist/Laptop4).
4. ALIS email-match the 38 caregivers + medtechs (ALIS staff Email = Entra UPN); turn off ALIS-native 2FA per user.
one at a time: Laptop2, LAPTOP-DRQ5L558, LAPTOP-E0STJJE8, ASSISTNURSE-PC (needs re-join + re-tag
after Win11 reinstall), NURSESTATION-PC (+ verify NurseAssist/Laptop4). NOTE: the device-lockdown
(auto-logoff) GPO only applies once machines are in `OU=Caregiver Devices` — until then desktops
caregivers use under the interim posture have NO auto-logoff enforcement.
4. ALIS email-match the 35 caregivers + medtechs (ALIS staff Email = Entra UPN); ALIS records still
to create for Munezero/Cota/Robinson; Vallejo email-match; 7 discharged-record decisions;
turn off ALIS-native 2FA per user, then move to SSO-only (native login is a CA bypass path).
5. Lower ALIS app session timeout 20 -> 15 min (Howard, ALIS admin).
6. **Reboot NURSESTATION-PC** to activate + verify the device-lockdown GPO (lock @3min, 90s warn, sign-out @15min).
7. Phones-only lockdown cohort: deferred to end of rollout — `docs/cloud/caretaker-phones-only-list.md`.
8. Pilot cleanup: delete `pilot.test`, remove stale `SG-Caregivers-Pilot` exclude from the MFA policy,
delete the pilot/test groups.
---
## Workstream 4 — M365
- **Relicense 31 users Business Standard -> Business Premium** (Standard is SUSPENDED — time-sensitive).
- Create break-glass accounts (`breakglass1/2-csc@`) + enroll FIDO2 YubiKeys.
- Build audit retention (Log Analytics 90d + Storage 6yr) in `rg-audit-cascadestucson`.
- **Relicense remaining suspended Business Standard users -> Business Premium** (Standard SKU is
SUSPENDED — time-sensitive). SPB now 45 seats enabled (Howard bought 11 on 6/30); 41 consumed as
of 7/1 — count seats before relicensing.
- **Create break-glass accounts (`breakglass1/2-csc@`) + enroll FIDO2 YubiKeys** — still not created
(confirmed 5/27); now a **prerequisite for the WS3 allow-list enforcement flip**.
- **Remove the standing Privileged Authentication Administrator role from the
`ComputerGuru - Tenant Admin` SP** (stranded by Alma's 6/25 offboarding; needs a Global Admin;
keep its Conditional Access Administrator role). Pending Mike.
- Build audit retention (Log Analytics 90d + Storage 6yr) in `rg-audit-cascadestucson` — approved
2026-04-29, still unbuilt (HIPAA SS164.312(b) gap, includes D:\Homes object-access auditing).
- Zeke Huerta: register Authenticator MFA (under MFA-for-all with no method since 7/1).
- Megan Hiatt: re-verify the April credential-stuffing remediation held (flagged 6/30).
---
@@ -160,7 +196,11 @@ test scope to real caregivers, one device at a time. (Detail: wiki "Entra Access
- **Cloud backup (MSP360 -> ACG-backup): VERIFIED running 2026-06-24** (last run Success, 0 failed, 575 GB baseline in cloud, incrementals working). Still confirm it is image/bare-metal/system-state (looks file-level) + set retention. [GATE for any drive work]
- **CS-SERVER RAID -- CORRECTED 2026-06-24: HEALTHY, not degraded** (live OMSA: both mirrors Ok, all 5 disks Online, all LEDs green; the 6/15 degraded self-recovered). **NO emergency drive swap.** 1:0:4 = global hot spare (do not remove). **Planned** reliability upgrade: replace the 2 consumer 320 GB drives (esp. flaky WD 0:0:3) with the 2x enterprise SSD **already purchased**, on a scheduled window w/ confirmed image/system-state backup. **[WARN] PSU redundancy lost** -- one PSU not delivering, check onsite. Service Tag 9MQFTK1. Real fix = DC migration off the 16-yr-old R610.
- Clean up old-MSP agent sprawl (Datto RMM/CentraStage + Datto EDR/Infocyte) thrashing the spindle.
- ~~Clean up old-MSP agent sprawl (Datto RMM/CentraStage + Datto EDR/Infocyte) thrashing the spindle~~
— **DONE on CS-SERVER 2026-06-26** (full legacy Datto stack removed). **Current Datto EDR installed
on CS-SERVER 2026-07-13** (HUNTAgent=Running, cmd `0a60cac7`) — the DC is back under managed
endpoint protection. Fleet stragglers tracked in the wiki (DESKTOP-TRCIEJA BD_ACTIVE, laptop3/laptop1/
cascades-laptop reconcile, Syncro BD-deployment removal, GravityZone portal cleanup).
- Synology -> backup-only (Team Folder migration of the real shares; close the workgroup/Kerberos quirk).
- Rotate the Synology signin-portal credential (was committed plaintext historically).
@@ -203,29 +243,36 @@ test scope to real caregivers, one device at a time. (Detail: wiki "Entra Access
---
## Suggested sequence (fastest path)
## Suggested sequence (fastest path) — re-cut 2026-07-13
1. **Today's onsite batch (Howard, on-site):** #32342 (Copy Room switch), #32319 (Room 343 AP),
#32370 (eFax + scanner), #32194 (spare machine for new hire), #32254 (Chef-PC reinstall+join);
#32230 (Karen -> ALDOCS) once she's in. **While onsite: verify per-room 5 GHz coverage** for the
CSC ENT device-island consolidation (Workstream 6) so the band flip can be scheduled with the
vendors.
2. **Caregiver lockdown go-live** (Workstream 3) — remote, highest HIPAA value, just needs the flip + per-device moves.
3. **M365 relicense 31 users** (Workstream 4) — time-sensitive.
4. **Backup verify -> RAID replacement** (Workstream 5) — critical single-DC risk.
5. **Remaining staff domain joins + dept drives** (Workstreams 1+2) — batch the ~17 un-joined PCs, OU + drives per machine.
6. Network tail (Vertical 5 GHz, 100 Mbps ports) + M365 break-glass/audit retention.
1. **2026-07-16 afternoon: offboard Juan Andrade** (disable + SG-Caregivers removal + license
reclaim) — coord todo `80716a98`. Do NOT disable before then.
2. **Break-glass accounts + strip the stranded PAA role** (Workstream 4) — prerequisite for the
allow-list enforcement flip; the tenant currently has live block policies and no break-glass.
3. **Caregiver lockdown go-live** (Workstream 3) — highest HIPAA value; the interim posture's real
control (device allow-list) is still report-only/test-scoped.
4. **M365 relicense remaining suspended-Standard users** (Workstream 4) — time-sensitive.
5. **Backup image/system-state confirm -> planned SSD swap** (Workstream 5) — single-DC risk.
6. **Remaining staff domain joins + dept drives** (Workstreams 1+2) + printer-share repoints /
Point-and-Print GPO fleet-wide (see wiki VLAN 20 section).
7. Network tail (CSC ENT device island, 100 Mbps ports) + audit-retention build.
---
## Open Syncro tickets -> workstream map
**[RECONCILE 2026-07-13] Syncro showed 0 open tickets as of 7/10**, but the 6 tickets below were
"Open — onsite" in the 6/24 plan and no completion is recorded in the wiki/session logs.
**VERIFY with Howard: completed-and-closed, or closed-without-work?** Any not actually done go back
on the board as workstream items (the underlying work — Chef-PC reinstall+join, Room 343 AP,
Copy Room switch, eFax/scanner, spare machine, Karen ALDOCS — is still required by WS1/2/6/7).
| Ticket | Workstream | Status |
|---|---|---|
| #32193 Executive restricted share | 2 | **DONE 2026-06-24** (E: both machines, billed 0.5h block) |
| #32194 spare machine for new hire | 1 | Open — onsite |
| #32230 Karen -> ALDOCS | 2 | Open — recheck when she's in |
| #32254 Chef-PC reinstall | 1 | Open — onsite (then domain-join) |
| #32319 WiFi Room 343 | 6 | Open — onsite |
| #32342 Copy Room switch | 6 | Open — onsite |
| #32370 eFax + scanner | 7 | Open — onsite |
| #32194 spare machine for new hire | 1 | Closed in Syncro — **verify work done** |
| #32230 Karen -> ALDOCS | 2 | Closed in Syncro — Karen's ALDocs shortcut WAS set 6/26 (drive-map); likely done |
| #32254 Chef-PC reinstall | 1 | Closed in Syncro — **verify reinstall + domain-join happened** |
| #32319 WiFi Room 343 | 6 | Closed in Syncro — **verify AP relocation done** |
| #32342 Copy Room switch | 6 | Closed in Syncro — **verify switch installed/adopted** |
| #32370 eFax + scanner | 7 | Closed in Syncro — **verify eFax + scanner delivered** |

2
clients/cascades-tucson/docs/cloud/caretaker-phones-only-list.md
View File

@@ -32,7 +32,7 @@ Transportation drivers, who do not get ALIS/M365 caregiver access at all.
| Erica Sanchez | e.sanchez | D+P | TBD |
| Ederick Yuzon | e.yuzon | D+P | TBD |
| Gina Williams | g.williams | D+P | TBD |
| Juan Andrade | j.andrade | D+P | **LEAVING** — last day 2026-07-11; held active until then, offboard on 07-11 |
| Juan Andrade | j.andrade | D+P | **LEAVING** — offboard **2026-07-16 afternoon** (moved from 07-11 per Howard 2026-07-13); held active until then. Coord todo `80716a98`. |
| Jahmeka Clarke | j.clarke | D+P | TBD |
| Jinnelle Dittbenner | j.dittbenner | D+P | TBD |
| Jen Higdon | j.higdon | D+P | TBD |

109
clients/dataforth/session-logs/2026-07/2026-07-14-howard-sage-printing-guru-user.md Normal file
View File

@@ -0,0 +1,109 @@
# 2026-07-14 — Dataforth: Sage GURU credential + Sage printing fix (DESKTOP-U8PHS72 / SAGE-SQL)
## User
- **User:** Howard Enos (howard)
- **Machine:** Howard-Home
- **Role:** tech
## Session Summary
Started with a lookup for a Sage application login for Dataforth. No entry existed in the SOPS
vault (`clients/dataforth/` had only server/infra creds) or wiki. Dataforth staff reset the
password on their Sage `guru` user; the credential was vaulted at `clients/dataforth/sage`
(username `guru`). Initial value was corrected twice per user updates — final password is
`Itword26!` (confirmed intentional, not a typo). Login later verified working.
The real issue then surfaced: DESKTOP-U8PHS72 could not print from Sage — Sage showed no
printers. Investigation via GuruRMM: Sage Pro 200 ERP 2010 (`S:\sbt\sbtw.exe`, Visual
FoxPro-based) is NOT installed on the workstation; users RDP to SAGE-SQL (192.168.0.153, RDS
Session Host) and run Sage there, so Sage printers = RDP-redirected printers. The affected user
dlopez (new AD account created 2026-07-06) had two long-running RDP sessions on SAGE-SQL
(session 4 active since 7/13 + session 9 stale disconnected) with ZERO redirected printers —
each reconnect re-entered the stale sessions. His client-side `Default.rdp` correctly had
`redirectprinters:i:1`. Mike noted a registry change to RDP behavior had been made previously
(before this session) that required a fresh logon to take effect.
Fix: logged off both dlopez sessions on SAGE-SQL via GuruRMM. Fresh RDP connection brought
printer redirection up correctly; Mike verified in Sage as the `guru` user — printers listed
and selectable. Resolved.
Wrote Syncro ticket #32552 (Dataforth Corp), resolution comment (registry-fix detail
intentionally omitted per Mike), billed 0.5 hr remote labor against the prepaid block
(25.75 → 25.25 hrs), invoice 1651043602 ($0.00 prepaid), ticket marked Invoiced, block-hours
note set on invoice, bot alert posted.
## Key Decisions
- Vaulted the Sage credential at `clients/dataforth/sage` even before testing — capture-first
policy; updated in place when the username/password were corrected.
- Diagnosis order: workstation recon → server-side RDS policy/printers → per-user RDP files →
session source IPs → Sage process identification. Ruled out server policy (fDisableCpm=0, no
printer cap), client config (redirectprinters:i:1 present), and driver-level issues before
landing on stale sessions.
- Registry fix left out of ticket notes per Mike's explicit request.
- Ticket created directly in Resolved status (work already complete), then Invoiced after billing.
## Problems Encountered
- Inline JSON dispatch to RMM failed on `\\` escapes ("invalid escape") — switched to
`ps-encoded.sh` file-based encoded dispatch per the /rmm skill guidance.
- Vault push rejected (remote ahead) — `git pull --rebase` then push, clean.
- Initial theory (VFP/Sage Pro can't use Easy Print queues) was plausible but superseded:
Mike reproduced the failure in a session that HAD Easy Print printers, then revealed the
prior registry change; stale sessions predating it were the actual blocker. Note: session
defaults on SAGE-SQL are all "Microsoft Print to PDF" and native Brother/HP drivers are NOT
installed server-side (event 1111s) — may resurface as a future issue.
## Configuration Changes
- Vault: created `clients/dataforth/sage.sops.yaml` (then updated username/password) — pushed
(final vault commit 73cf333).
- SAGE-SQL: logged off dlopez sessions 4 and 9 (only change made this session — no
settings/drivers/registry touched today).
- Scratch recon .ps1 files created and deleted in repo root.
## Credentials & Secrets
- **Sage Pro ERP login (Dataforth):** username `guru`, password `Itword26!` — vaulted at
`clients/dataforth/sage` (kind generic, notes describe SAGE-SQL usage). Password reset by
Dataforth staff 2026-07-14; verified working by Mike in Sage. NOTE: password is `Itword26!`
("Itword", NOT "Itworks") — confirmed intentional.
## Infrastructure & Servers
- DESKTOP-U8PHS72 = 192.168.0.48, Dataforth D2, GuruRMM agent 25a75932-31cf-4b33-b94b-f4c404830877.
Users: dlopez (console), kellynwackerly. Local printers: Brother DCP-L2550DW (USB002, default
for both users), HP LaserJet Pro 400 M401n "Kellyn Desk" (USB001), ASSEMBLY-LJD2 + NPI3EDBF9
HPs (WSD/network).
- SAGE-SQL = 192.168.0.153, RDS Session Host, GuruRMM agent 120ba7bf-8544-48a0-98a1-40ed5cdd3e1f.
Sage Pro 200 ERP 2010 at `S:\sbt\sbtw.exe` (share C:\sage). ~10 concurrent RDP users.
Kellyn connects from 192.168.0.68 (different machine than U8PHS72).
- RDS printer redirection: enabled, no policy key, no MaxPrintersPerSession set. All redirected
queues use "Remote Desktop Easy Print". Native Brother/HP Universal drivers NOT installed on
server (event 1111 "driver unknown"). Every user's session default printer = Microsoft Print
to PDF.
## Commands & Outputs
- Vault: `vault-helper.sh new/set clients/dataforth/sage`; read with
`vault.sh get-field clients/dataforth/sage credentials.password`.
- RMM quote-safe dispatch: `bash .claude/scripts/ps-encoded.sh rmm <agent-id> <script.ps1> --timeout 120`
(inline JSON with `\\` fails the API's JSON parse).
- Session logoff (SAGE-SQL): `logoff 9 /v; logoff 4 /v` — logoff returns nonzero exit (status
"failed") but works; verify with `query user`.
- Session source IPs: TerminalServices-LocalSessionManager/Operational events 21/25.
- Per-user default printer: `HKU\<SID>\Software\Microsoft\Windows NT\CurrentVersion\Windows\Device`.
## Pending / Incomplete Tasks
- None for this issue. Watch-item: if Sage printing complaints recur (esp. for the VFP app vs
Easy Print queues), next step is installing native Brother DCP-L2550DW + HP Universal PCL 6
drivers on SAGE-SQL. Also `staff` share still missing on FILES-D1 (pre-existing note).
## Reference Information
- Syncro ticket #32552 (id 113826861) — https://computerguru.syncromsp.com/tickets/113826861
- Invoice 1651043602, $0.00 prepaid, line 43262662 (0.5 hr Labor - Remote Business), Dataforth
prepay block 25.75 → 25.25 hrs.
- Vault: `clients/dataforth/sage` (vault repo commit 73cf333).
- Related session log: `2026-07-06-mike-sage-sql-peter-session-reset.md` (prior SAGE-SQL session work).

16
errorlog.md
View File

@@ -21,6 +21,22 @@ Categories (the `[type]` tag): _(none)_ = skill/command execution failure ·
2026-07-14 | GURU-BEAST-ROG | bash/ssh-tooling | [friction] plink.exe hangs indefinitely in headless bot bash env (both hostkey and password prompts read from console, echo y| insufficient); OpenSSH BatchMode fails fast but no password support. Fix that worked: paramiko (py) for password + keyboard-interactive SSH, incl. jump via direct-tcpip channel [ctx: host=BEAST target=dataforth-pbx/udm]
2026-07-14 | Howard-Home | packetdial/nimbus-qr | [correction] user asked a question (can I keep my extension); I treated it as authorization and sent welcome emails without confirming — questions are not action approval; outward actions need explicit per-action confirm
2026-07-14 | Howard-Home | packetdial/nimbus-qr | [correction] assumed user was Mike (ext 3003) from session userEmail; correct is Howard per identity.json — Howard has no extension on arizonacomputerguru and needs one created
2026-07-14 | Howard-Home | msp360 | Licenses Grant/Release blocked: 'Licensing API methods are not enabled for your account' (HTTP 400); also release-license cmd omits required LicenseID field [ctx: task=fix expired VWP-FILES license]
2026-07-14 | Howard-Home | msp360 | POST /api/Licenses/Release -> HTTP 400: {'Message': 'Licensing API methods are not enabled for your account'} [ctx: command=raw]
2026-07-14 | Howard-Home | msp360 | POST /api/Licenses/Grant -> HTTP 400: {'Message': 'Licensing API methods are not enabled for your account'} [ctx: command=grant-license]
2026-07-14 | Howard-Home | msp360 | POST /api/Licenses/Release -> HTTP 400: {'Message': 'The request is invalid.', 'ModelState': {'releaseLicense.LicenseID': ['The LicenseID field is required.']}} [ctx: command=release-license] (x2)
2026-07-14 | Howard-Home | ampipit-build/agents | [friction] parallel coding agent ran 'git checkout --' mid-run and wiped sibling agents' uncommitted changes; one sibling re-applied, another (pipeline.rs/collect_logs.rs) lost silently. Fix: isolate parallel coding agents via worktrees or forbid destructive git in shared-tree prompts [ctx: project=ampipit]
2026-07-14 | Howard-Home | roadmap-triage | [correction] assumed Howard would take BUG-026/next big items; correct is BUG-026 is Mike's work
2026-07-13 | Howard-Home | bash/env | [friction] local Windows Defender killed /mingw64/bin/curl (Permission denied) mid-session on HOWARD-HOME; user disabled Defender to continue - RMM dispatch loop needs curl; consider Defender exclusion for Git-for-Windows mingw64 bin
2026-07-13 | Howard-Home | mailbox/link-extraction | picked wrong INKY-wrapped link from Anthropic sign-in email - selected the url8792.mail.anthropic.com tracker (the Contact Support link, lands on support.claude.com) instead of the domain=claude.ai magic link; fix = decode ALL inky blobs and select the claude.ai/magic-link URL [ctx: email=secure-link-login mailbox=mike@azcomputerguru.com]

13
wiki/clients/cascades-tucson.md
View File

@@ -219,7 +219,7 @@ Because per-user **Intune** never provisioned tenant-wide (`INTUNE_A = PendingIn
### Status (as of 2026-07-02)
- **[ROSTER 2026-07-02] 7 already-disabled leavers HARD-DELETED from AD** (client roster update): `b.mendoza`, `c.tate`, `g.williford`, `k.flores`, `d.fierros`, `m.baker`, `m.kariuki` -- all disabled/never-logged-in since the 7/1 reconcile; now removed (cloud objects soft-delete on next Entra Connect sync, 30-day recycle bin). **`SG-Caregivers` stays 35** (they were already out of the group; deleting disabled non-members doesn't change the count). Live-verified gone (RMM cmd `a5f337fd`).
- **[ROSTER 2026-07-02] Juan Andrade (`j.andrade`) gave 2-week notice** -- still active and in `SG-Caregivers`, deliberately **HELD** (do NOT disable while he's working). **Last day 2026-07-11 -- offboard that day:** disable + remove from `SG-Caregivers` + reclaim Business Premium. Tracked in `docs/cloud/caretaker-phones-only-list.md` + coord todo.
- **[ROSTER 2026-07-13] Juan Andrade (`j.andrade`) -- offboard date moved to 2026-07-16 AFTERNOON** (was 07-11; per Howard 2026-07-13). Still active and in `SG-Caregivers`, deliberately **HELD** (do NOT disable while he's working). On 7/16 PM: disable + remove from `SG-Caregivers` + reclaim Business Premium. Tracked in `docs/cloud/caretaker-phones-only-list.md` + coord todo `80716a98` (created 2026-07-13 -- no todo existed before that despite the earlier note).
- **Caregiver phone SSO -- Entra/identity side COMPLETE for the current 35-member roster** (group + Business Premium license + AD temp passwords, **must-change flag cleared fleet-wide 2026-07-02** -- see the forced-change gotcha above; temp passwords now valid for phone sign-in). Remaining gate is the ALIS Email=UPN match (Howard) + creating ALIS records for the 3 brand-new hires (Munezero, Cota, Robinson) + setting Vallejo's ALIS Email=UPN + the outstanding items from 6/30 (7 discharged-record decisions, Kariuki ALIS dup 429856/429858 dedupe if she returns).
- **Caregiver CA lockdown is LIVE (interim posture, 2026-07-01):** caretakers sign in on desktops and phones, on-network only -- see the 7/1 update above and Conditional Access / Caregiver Policies. Phones-only lockdown deferred to end of rollout.
- **Proven working end-to-end on a hybrid-joined desktop (NURSESTATION + pilot.test):** caregiver lockdown (CA off-network block + device allow-list) **and** silent ALIS SSO. The allow-list policy `1b7fd025` carries NURSESTATION's current deviceId `d3bf931f-f128-4261-8398-b46c34a4b342` and the device is tagged `extensionAttribute1=CSCCaregiverDevice`.
@@ -265,7 +265,7 @@ Because per-user **Intune** never provisioned tenant-wide (`INTUNE_A = PendingIn
| Host | IP | Role | OS | Notes |
|---|---|---|---|---|
| CS-SERVER | 192.168.2.254 | DC, DNS, DHCP (no scopes), File Server, Hyper-V host, Print Server | Windows Server 2019 Standard | Dell PowerEdge R610 (~2009 hardware, 16+ years old). **Single DC -- CRITICAL risk.** GuruRMM agent ID: `c39f1de7-d5b6-45ae-b132-e06977ab1713` (re-enrolled; always resolve live by hostname, never hardcode the UUID). Clients reach SMB at **192.168.2.248** (registered DNS / Ethernet); .254 is the Hyper-V vEthernet NIC. **RAID HEALTHY per live OMSA 2026-06-24 -- see hardware note below.** **All Datto software fully removed 2026-06-26 (was DattoAV/EDR/RMM leftover, not GravityZone).** |
| CS-SERVER | 192.168.2.254 | DC, DNS, DHCP (no scopes), File Server, Hyper-V host, Print Server | Windows Server 2019 Standard | Dell PowerEdge R610 (~2009 hardware, 16+ years old). **Single DC -- CRITICAL risk.** GuruRMM agent ID: `c39f1de7-d5b6-45ae-b132-e06977ab1713` (re-enrolled; always resolve live by hostname, never hardcode the UUID). Clients reach SMB at **192.168.2.248** (registered DNS / Ethernet); .254 is the Hyper-V vEthernet NIC. **RAID HEALTHY per live OMSA 2026-06-24 -- see hardware note below.** **All legacy Datto software removed 2026-06-26 (was DattoAV/EDR/RMM leftover, not GravityZone); current Datto EDR (HUNTAgent) installed 2026-07-13.** |
| CS-SERVER iDRAC | 192.168.2.65 | Out-of-band management | -- | Dell OOB interface |
| CS-QB (Hyper-V VM on CS-SERVER) | 192.168.2.228 | (label "VoIP server" -- STALE) | -- | **2026-06-16 recon: SMB/445 only, no SIP response -- NOT a live SIP PBX.** Phones appear cloud-registered (Vertical). Label predates the wireless-phone transition; revisit/retire. |
| cascadesDS (Synology NAS) | 192.168.0.120 | NAS / legacy file storage | DSM 7.2.1-69057 | Port 5000 HTTP. Workgroup name is "CASCADES" -- same as AD short name, causing Kerberos auth failures from domain-joined machines. Slated to become backup-only. **Synology Drive Server 3.5.0-26088** (active, port 6690 SSL). Current Drive sync: CS-SERVER Drive Client (v7.5.0.16085, runs as sysadmin) syncs Sync-user My Drive (`/volume1/homes/Sync/Drive/`) -> `D:\Shares\Main` (one-way download). Real shared folders (Server 1.9 G, Management 5.5 G, Public ~50 G, SalesDept ~23 G, etc.) are NOT in scope -- Team Folder migration pending. |
@@ -290,7 +290,7 @@ Because per-user **Intune** never provisioned tenant-wide (`INTUNE_A = PendingIn
**[INFO] Backup -- gap closed (2026-06-15); verified running 2026-06-24.** Mike installed ACG cloud backup (MSP360/CloudBerry -> ACG-backup server) on CS-SERVER, addressing the longstanding SS164.308(a)(7) "no backup" HIPAA gap. **Live check 2026-06-24:** last run (6/24 00:10) = "Plan status: Success", 0 failed; 575.7 GB / 248k-file dataset already in the cloud (only 465 MB changed -> full baseline exists, incrementals working). **Still to confirm: this looks FILE-LEVEL, not image/bare-metal/system-state -- for a DC that is a DR gap; confirm with Mike whether a separate image/system-state backup exists before treating it as full disaster coverage.** Set/confirm retention.
**[INFO] Endpoint security -- Datto EDR/AV is the ACG-managed stack (migration off Bitdefender substantially complete).** Cascades migrated from Syncro-deployed **Bitdefender GravityZone BEST** to **Datto EDR + Datto AV** (Infocyte/azcomp4587.infocyte.com). Datto EDR org `2d5ea96e-3228-461b-9c60-13ae464b61d8`, target group `1dbd2b02-f7df-45d0-a7f2-18667f48447f`, reg key `6qw68y2rwl`. **State as of 2026-06-26:** ~34 agents enrolled. Datto EDR installed on 7 machines 6/25 (org 27->34). **Bitdefender REMOVED from RECEPTIONIST-PC** (both physical boxes, serials MJ0KQH4R + MJ0KQHNP) via GravityZone console "Uninstall client" task -- the GravityZone Public API `createUninstallTask` is DEAD in this version and BEST anti-tampering (no uninstall password on policy "GPS Default") blocks endpoint-side uninstall, so removal is **console-only**. 6 orphaned `C:\Program Files\Bitdefender` folders deleted (safety-checked). **RECEPTIONIST-PC is two distinct physical machines sharing a hostname** -- dedup-by-hostname masks the second box. **Straggler pass 2026-06-26:** BD-checked reconnected machines -- DESKTOP-MD6UQI3, Laptop4, SALES4-PC all NO_BITDEFENDER (clean); **DESKTOP-TRCIEJA = BD_ACTIVE** (needs the GravityZone console uninstall; slated for replacement anyway). NurseAssist got its queued EDR install confirmed (agent `23c3c36e`, AV on, v3.17.1.5552) after its Home->Pro upgrade. DESKTOP-F94M8UT (Alma Montt's, powered off) BD-aware EDR install queued (cmd `a4623704`, auto-fires on reconnect); DESKTOP-KQSL232 (Lois Lane's old box) decommissioned -- removed from list. **CS-SERVER's endpoint AV was DattoAV, NOT GravityZone Bitdefender** (see SMB/AV pattern) -- all Datto software fully removed from CS-SERVER 2026-06-26. **Pending:** DESKTOP-TRCIEJA GravityZone console uninstall; confirm Cascades removed from Syncro's Bitdefender deployment (GUI-only) so BD doesn't redeploy; GravityZone portal cleanup of stale RECEPTIONIST-PC endpoint records; reconcile `laptop3` (EDR agent, no RMM agent); confirm/remove stale EDR agents laptop1 + cascades-laptop.
**[INFO] Endpoint security -- Datto EDR/AV is the ACG-managed stack (migration off Bitdefender substantially complete).** Cascades migrated from Syncro-deployed **Bitdefender GravityZone BEST** to **Datto EDR + Datto AV** (Infocyte/azcomp4587.infocyte.com). Datto EDR org `2d5ea96e-3228-461b-9c60-13ae464b61d8`, target group `1dbd2b02-f7df-45d0-a7f2-18667f48447f`, reg key `6qw68y2rwl`. **State as of 2026-06-26:** ~34 agents enrolled. Datto EDR installed on 7 machines 6/25 (org 27->34). **Bitdefender REMOVED from RECEPTIONIST-PC** (both physical boxes, serials MJ0KQH4R + MJ0KQHNP) via GravityZone console "Uninstall client" task -- the GravityZone Public API `createUninstallTask` is DEAD in this version and BEST anti-tampering (no uninstall password on policy "GPS Default") blocks endpoint-side uninstall, so removal is **console-only**. 6 orphaned `C:\Program Files\Bitdefender` folders deleted (safety-checked). **RECEPTIONIST-PC is two distinct physical machines sharing a hostname** -- dedup-by-hostname masks the second box. **Straggler pass 2026-06-26:** BD-checked reconnected machines -- DESKTOP-MD6UQI3, Laptop4, SALES4-PC all NO_BITDEFENDER (clean); **DESKTOP-TRCIEJA = BD_ACTIVE** (needs the GravityZone console uninstall; slated for replacement anyway). NurseAssist got its queued EDR install confirmed (agent `23c3c36e`, AV on, v3.17.1.5552) after its Home->Pro upgrade. DESKTOP-F94M8UT (Alma Montt's, powered off) BD-aware EDR install queued (cmd `a4623704`, auto-fires on reconnect); DESKTOP-KQSL232 (Lois Lane's old box) decommissioned -- removed from list. **CS-SERVER's endpoint AV was DattoAV, NOT GravityZone Bitdefender** (see SMB/AV pattern) -- all legacy Datto software fully removed from CS-SERVER 2026-06-26, which left the DC with NO managed endpoint protection until **Datto EDR (Infocyte HUNT agent) was installed on CS-SERVER 2026-07-13** (RMM cmd `0a60cac7`, precheck clean, HUNTAgent=Running, org `2d5ea96e`, key `6qw68y2rwl`). **Pending:** DESKTOP-TRCIEJA GravityZone console uninstall; confirm Cascades removed from Syncro's Bitdefender deployment (GUI-only) so BD doesn't redeploy; GravityZone portal cleanup of stale RECEPTIONIST-PC endpoint records; reconcile `laptop3` (EDR agent, no RMM agent); confirm/remove stale EDR agents laptop1 + cascades-laptop.
**[WARN] Power outage (2026-06-17):** Building power outage took the entire Cascades network down. Root cause: pfSense was plugged into the **surge-only side of the UPS** (no battery) -- it hard-powered-off uncleanly. ZFS survived. Dirty boot caused a **duplicate dhcpd** and a **2nd-floor switch (USL24PB, 192.168.2.193) with one-way L2 forwarding** blocking DHCP OFFERs. Howard killed the duplicate dhcpd remotely; Mike re-seated pfSense onto battery outlets, restored config from on-box auto-backup (12:20 version, VLAN30 intact), reset+re-adopted Switch 2nd Floor #2. Network fully restored. Post-recovery casualties: devices that booted during DHCP-down window cached disconnected state (kitchen thermal printer fixed by power-cycle). Incident report: `clients/cascades-tucson/reports/2026-06-17-power-outage-incident.md`.
@@ -580,7 +580,7 @@ Full design: `docs/network/phase1-voice-qos-design.md`. Status DESIGN -- nothing
- **[WARN] ~25 switch ports at 100 Mbps but gig-capable.** Investigate after WiFi optimization is stable.
- **[WARN] 3 offline switches** (Switch 4th Floor #2, USW Pro Max 16 -- root cause unknown; Switch 2nd Floor #2 was reset+re-adopted 2026-06-17). Investigate onsite.
- **[SECURITY] Synology Cloud Signin Portal credential exposed in vault git history (commit 1fbc0e1).** Encrypted go-forward but credential must be rotated.
- **[FLEET] Endpoint security migration substantially complete (2026-06-30).** Datto EDR/AV (Infocyte/azcomp4587) is the ACG-managed endpoint stack -- ~34 agents enrolled. Bitdefender removed from RECEPTIONIST-PC (both boxes); orphaned BD folders cleaned; CS-SERVER fully Datto-free. **Pending:** DESKTOP-TRCIEJA BD_ACTIVE (needs GravityZone console uninstall; box slated for replacement); DESKTOP-F94M8UT (Alma's, powered off) queued EDR install; confirm Cascades removed from Syncro's BD deployment; GravityZone portal cleanup of stale RECEPTIONIST-PC records; reconcile laptop3 (EDR, no RMM agent); confirm/remove stale EDR agents laptop1 + cascades-laptop.
- **[FLEET] Endpoint security migration substantially complete (2026-06-30; CS-SERVER covered 2026-07-13).** Datto EDR/AV (Infocyte/azcomp4587) is the ACG-managed endpoint stack -- ~35 agents enrolled. Bitdefender removed from RECEPTIONIST-PC (both boxes); orphaned BD folders cleaned; CS-SERVER cleaned of legacy Datto 6/26 and **re-enrolled in Datto EDR 2026-07-13 (HUNTAgent=Running, cmd `0a60cac7`)** -- the DC had been unprotected in between. **Pending:** DESKTOP-TRCIEJA BD_ACTIVE (needs GravityZone console uninstall; box slated for replacement); DESKTOP-F94M8UT (Alma's, powered off) queued EDR install; confirm Cascades removed from Syncro's BD deployment; GravityZone portal cleanup of stale RECEPTIONIST-PC records; reconcile laptop3 (EDR, no RMM agent); confirm/remove stale EDR agents laptop1 + cascades-laptop.
### Security Incidents (historical)
@@ -617,7 +617,7 @@ Syncro live pull 2026-07-10: **0 open Syncro tickets; 37.5 prepaid hours; 29 man
- **[FOLLOW-UP 2026-06-30] Megan Hiatt breach re-check.** Her account carried a `CREDENTIAL_STUFFING_ACTIVE` marker in the April tenant inventory; verify the April remediation held (`/remediation-tool check megan.hiatt@`).
- **[PLANNED -- CARF accreditation] Technology and System Plan deliverable** (requested by Ashley Jensen 2026-06-24). One of the five required CARF Section-1 plans (Aging Services); must be an action document covering 8 canonical areas with per-area current tech + projected need + timeline + vendor + cost + responsible person + target/completion date, annual dated leadership sign-off. Done: gap analysis, project memory `project_cascades_carf_tech_plan`, an on-brand PDF first pass (via `impeccable`), and a pre-filled CARF intake worksheet. **Next: gather Cascades' inputs, then build the final plan branded as Cascades' (ACG as preparer); confirm the exact standard citation + review cadence.** Standing rule: all client/vendor-facing deliverables run through the `impeccable` skill before delivery.
- **[URGENT] Order replacement workstation for Lupe Sanchez (DESKTOP-TRCIEJA).** Decision made 2026-06-18. EOL Gateway ZX6971 / i3-2120 / 8 GB / Win11-unsupported. On new machine: provision GuruRMM + Datto EDR/AV only; do NOT install Bitdefender. Do not carry over any prior-MSP Datto RMM/CentraStage artifacts. (TRCIEJA is currently BD_ACTIVE -- needs GravityZone console uninstall if kept in service before replacement.)
- **[IN PROGRESS] Datto EDR/AV rollout + Bitdefender decommission.** ~34 agents enrolled (org `2d5ea96e`). Remaining: DESKTOP-TRCIEJA GravityZone console uninstall (BD_ACTIVE); DESKTOP-F94M8UT (Alma's, powered off) queued BD-aware EDR install (cmd `a4623704`); (1) Remove Cascades from Syncro's Bitdefender deployment (GUI-only). (2) GravityZone portal cleanup of stale RECEPTIONIST-PC endpoint records (company `66b0448e`). (3) Reconcile laptop3 (EDR active, no RMM agent). (4) Confirm/remove stale EDR agents laptop1 + cascades-laptop. CS-SERVER Datto stack already fully removed 2026-06-26.
- **[IN PROGRESS] Datto EDR/AV rollout + Bitdefender decommission.** ~35 agents enrolled (org `2d5ea96e`); **CS-SERVER EDR installed 2026-07-13** (HUNTAgent=Running, cmd `0a60cac7`) closing the DC coverage gap left by the 6/26 legacy-Datto removal. Remaining: DESKTOP-TRCIEJA GravityZone console uninstall (BD_ACTIVE); DESKTOP-F94M8UT (Alma's, powered off) queued BD-aware EDR install (cmd `a4623704`); (1) Remove Cascades from Syncro's Bitdefender deployment (GUI-only). (2) GravityZone portal cleanup of stale RECEPTIONIST-PC endpoint records (company `66b0448e`). (3) Reconcile laptop3 (EDR active, no RMM agent). (4) Confirm/remove stale EDR agents laptop1 + cascades-laptop. CS-SERVER Datto stack already fully removed 2026-06-26.
- **[URGENT] Rotate exposed Synology Cloud Signin Portal credential.** Vault commit 1fbc0e1 committed it plaintext; encrypted go-forward but exposed in git history. Also verify MDM service account + WiFi CSCNet from that commit were never plaintext.
- **[DONE 2026-06-19] Voice VLAN (VLAN 30) migration COMPLETE -- 37 devices on VOICE.** All Poly re-keyed. RF optimized (2.4 power->medium, 5 GHz clean DFS, retry halved). Billed ticket #32444 (7h prepaid).
- **[PENDING - hardware] Bistro phone replacement.** Kitchen server phone was bad (John pulled it 2026-06-19); Bistro phone relocated to Kitchen, so the **Bistro has no phone**. Set up + re-key the replacement to the voice PPSK when it arrives.
@@ -642,7 +642,7 @@ Syncro live pull 2026-07-10: **0 open Syncro tickets; 37.5 prepaid hours; 29 man
- **BLOCKED -- Windows Home (until Pro):** LAPTOP-8P7HDSEI, MDIRECTOR-PC (Shelby), MEMREct-PC. CascadesProxess deferred (appliance, late-night).
- **OneDrive KFM ON** (unlink before folder-redirect): LAPTOP-8P7HDSEI, NurseAssist.
- **LAPTOP-DRQ5L558** is off the Cascades LAN -- get on-site before join.
- **Decision 2026-06-24:** caregivers stay TEST-scoped -- do NOT flip the lockdown to go-live until all devices are domain-ready first.
- **Decision 2026-06-24 [SUPERSEDED 2026-07-01]:** the "caregivers stay TEST-scoped until all devices domain-ready" hold was replaced by the interim CA posture (desktops + phones, on-network only -- see Conditional Access section). The device allow-list (`1b7fd025`) remains TEST-scoped **and report-only**; final lockdown = scope to `SG-Caregivers` + set to enforced.
**Migration phase status (as of 2026-06-30):**
@@ -742,6 +742,7 @@ Syncro live pull 2026-07-10: **0 open Syncro tickets; 37.5 prepaid hours; 29 man
| 2026-07-02 | **Shelby Trozzi "Company Web Docs" share + mapped drive.** Made `D:\Shares\Public\Company Web Docs` on CS-SERVER an SMB share gated at the share ACL (Shelby = Change, Admins = Full; NTFS left inherited), so the `Public` NTFS tree stayed untouched. Shelby had never logged into her domain account (`logonCount = 0`) and had no vaulted password; confirmed her OU is outside Entra Connect sync scope, so an on-prem reset was safe -- reset, set never-expires, vaulted. RMM could not push the drive map (`user_session` double-hop -> SMB error 67); worked around with `cmdkey` + a persistent `HKCU:\Network\W` map that mounts at next logon, then mapped it interactively to confirm. |
| 2026-07-09 | **Charity Menle caregiver rename (rename, never re-create).** Resolved that Charity Sika (CSV) and Bariffa Sika (ALIS 309045) are the same person, since legally renamed to Charity Menle; renamed the AD/Entra account to match rather than creating a new object. Established the procedure: `Set-ADUser` for Surname/DisplayName/UPN/EmailAddress, `Rename-ADObject` for the CN, `Set-ADUser -SamAccountName`, then a delta `Start-ADSyncSyncCycle`. Entra export is async -- poll before concluding the sync failed. |
| 2026-07-09 | **Chris Knight granted access to the accounting mailbox.** Added FullAccess (AutoMapping) + SendAs on the `accounting@cascadestucson.com` SharedMailbox via EXO REST `InvokeCommand` (`exchange-op` tier), matching the existing Lauren/Ashley/Zachary delegate tier. Two harness defects surfaced: `consent-audit.sh` graded the tenant RED "app NOT consented" when the real fault was a local vault-path lookup (the tenant was fully consented -- a false negative that points at emailing the client a needless consent link), and a post-write `Get-RecipientPermission` omitted the new SendAs trustee due to EXO replication lag. Both logged to `errorlog.md`. |
| 2026-07-13 | **Datto EDR installed on CS-SERVER (closing the DC's post-cleanup coverage gap)** -- HUNTAgent=Running, RMM cmd `0a60cac7`; the DC had been without managed endpoint protection since the 6/26 legacy-Datto removal. Full wiki+plan recheck/reconcile pass (this page + `REMAINING-WORK-PLAN.md` refreshed to live state). **Juan Andrade offboard moved to 2026-07-16 afternoon** (coord todo `80716a98` created -- none existed despite the prior note claiming one). |
---