azcomputerguru/claudetools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sync: auto-sync from HOWARD-HOME at 2026-07-14 11:14:46

Browse Source 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-14 11:14:46
This commit is contained in:
Howard Enos
2026-07-14 11:15:25 -07:00
parent 4ab8137daa
commit 22503149ce
11 changed files with 3498 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files

111
clients/cascades-tucson/docs/REMAINING-WORK-PLAN.md
View File

@@ -3,8 +3,14 @@
> Consolidated execution plan tying the open Syncro tickets to the broader migration
> workstreams (workstations -> domain, users/departments, HIPAA caregiver lockdown).
> Built 2026-06-24 (Howard) from a live AD+RMM diff. Companion to `PROJECT_STATE.md`
> and `wiki/clients/cascades-tucson.md` (current truth, compiled 2026-06-23).
> and `wiki/clients/cascades-tucson.md` (current truth).
> Goal: finish the migration quickly by working it as one sequenced plan.
>
> **REFRESHED 2026-07-13** (reconcile pass vs wiki + live state): caregiver CA posture
> updated to the 7/1 interim cutover, roster 35, Home->Pro completions folded in,
> CS-SERVER EDR installed, ticket table reconciled against Syncro (0 open as of 7/10).
> The "Live snapshot" below is still the 6/24 AD-vs-RMM diff -- domain-join states are
> per-machine current in the wiki's "Migration phase status" table.
---
@@ -33,7 +39,7 @@ ASSISTNURSE-PC, NURSESTATION-PC, RECEPTIONIST-PC, MEGAN.
| Health-Services-Director | vs AD `HEALTH-SERVICES` | Verify dup/rename before acting |
| **CHEF-PC** | Culinary (Chef JD) | **Ticket #32254** — reinstall Windows, THEN join -> OU=Culinary |
| DESKTOP-TRCIEJA | Lupe Sanchez | EOL — **replace machine** (decision 2026-06-18), join the replacement |
| DESKTOP-KQSL232 | Lois Lane | Resistant to migration; coordinate via John Trozzi |
| DESKTOP-KQSL232 | Lois Lane | **DECOMMISSIONED 6/26** (her HEALTH-SERVICES box is already domain-joined) |
| CascadesProxess | Proxess access-control appliance | Likely leave un-joined — verify it's an appliance |
| Laptop2, LAPTOP-DRQ5L558, LAPTOP-E0STJJE8, Laptop4 | Caregiver shared laptops | Join via the **Caregiver Devices** path (Workstream 3), not the staff path |
@@ -75,8 +81,8 @@ retire per-PC Synology Drive Client.
| LAPTOP-8P7HDSEI | User | **Win10 Home** | BLOCKED: Home->Pro + OneDrive KFM ON |
| MDIRECTOR-PC | Shelby Trozzi | **Win11 Home** | BLOCKED: Home->Pro + reboot |
| MEMRECEPT-PC | memfrtdesk | **Win10 Home** | BLOCKED: Home->Pro + reboot |
| NurseAssist | Veronica | **Win11 Home** | BLOCKED: Home->Pro + KFM ON + reboot |
| SALES4-PC | Tamra (departing) | **Win11 Home** | BLOCKED: Home->Pro; Tamra leaving — repurpose? |
| NurseAssist | Veronica | ~~Win11 Home~~ **Pro WS (upgraded 6/26)** | READY-ish: KFM ON (unlink) + reboot; confirmed distinct from ASSISTNURSE-PC |
| SALES4-PC | Tamra (OFFBOARDED 6/30) | ~~Win11 Home~~ **Pro (supplier upgrade)** | Repurpose TBD; join when reassigned |
| LAPTOP-DRQ5L558 | caregiver | Win11 Pro WS | BLOCKED: off-network (public DNS, no DC reach) |
| DESKTOP-TRCIEJA | Lupe Sanchez | Win11 Pro | SKIP — EOL, being replaced |
| Health-Services-Director | Lois Lane | Win11 Pro WS | already domain-joined (= AD `HEALTH-SERVICES`) |
@@ -99,8 +105,10 @@ retire per-PC Synology Drive Client.
the edition to `ProfessionalWorkstation` (higher SKU, fine for domain join), `/dli` = Licensed,
VOLUME_MAK channel. **2 MAK counts consumed -> bill 2x $99 = $198 to Cascades** (line items name each
machine). MEMRECEPT needed an `/ato` retry (first attempt hit transient `0x8004FE92`).
- **Still pending:** NurseAssist (OFFLINE — and flagged as a possible dupe of `Assistnurse-pc`, verify
before upgrading) and SALES4-PC (bypassed — Tamra departing, repurpose TBD).
- **[RESOLVED 6/26-6/30]** NurseAssist + DESKTOP-MD6UQI3 upgraded to Pro for Workstations 6/26
(2 x $99 to bill — Syncro product 23571919, not yet invoiced as of 7/10); NurseAssist confirmed
a distinct machine from ASSISTNURSE-PC. SALES4-PC upgraded to Pro by its supplier (no ACG
charge); Tamra offboarded 6/30, machine repurpose TBD.
- Next step for the 3 upgraded boxes = **domain-join** (they now read `EditionID=Professional`/PfW).
- **OneDrive KFM ON** (unlink before folder-redirect GPO): LAPTOP-8P7HDSEI, NurseAssist.
- **Pending reboots + KFM unlinks: held for onsite** (Howard) — disruptive to clear remotely.
@@ -135,24 +143,52 @@ access matrix; Synology retired as primary.
## Workstream 3 — HIPAA caregiver lockdown — GO-LIVE (highest value, mostly built)
Everything is built + validated on the pilot (NURSESTATION + pilot.test). Go-live = flip from
test scope to real caregivers, one device at a time. (Detail: wiki "Entra Access Architecture".)
**[UPDATED 2026-07-13]** The 7/1 CA cutover put caregivers in an **interim posture**: all 35
`SG-Caregivers` may sign in on desktops AND phones, **on-network only** (`e35614e1` off-network
block + `7d491c7a` 8h sign-in frequency enforced; `SG-Caregivers` excluded from MFA-for-all).
The compliance-block policy `ede985e2` was **DISABLED 2026-07-01 — do not re-enable** (superseded
by the allow-list). Temp passwords are live for phone sign-in (must-change cleared fleet-wide 7/2;
`PSO-Caregivers` never-expire FGPP in place). Roster = **35** after the 7/1 reconcile.
**Juan Andrade offboards 2026-07-16 afternoon** (coord todo `80716a98`).
Final lockdown = flip from test scope to real caregivers, one device at a time
(detail: wiki "Entra Access Architecture"):
1. Swap GPO `CSC - Caregiver Workstation` security filter `SG-Caregivers-Test` -> `SG-Caregivers`.
2. CA allow-list policy `1b7fd025`: test group `SG-Caregivers-DeviceTest` -> `SG-Caregivers`; disable the compliance-block policy `ede985e2`.
2. CA allow-list policy `1b7fd025`: **two changes** — retarget test group `SG-Caregivers-DeviceTest`
-> `SG-Caregivers` AND flip from report-only (`enabledForReportingButNotEnforced`) to enforced.
Prereqs: `SG-Break-Glass` + GDAP/service-provider exclusions in place (break-glass accounts still
NOT created — do this first).
3. Move each caregiver machine into `OU=Caregiver Devices` + `SG-PC-MainTower`/`SG-PC-MemoryCare`
one at a time: Laptop2, LAPTOP-DRQ5L558, LAPTOP-E0STJJE8, ASSISTNURSE-PC, NURSESTATION-PC (+ verify NurseAssist/Laptop4).
4. ALIS email-match the 38 caregivers + medtechs (ALIS staff Email = Entra UPN); turn off ALIS-native 2FA per user.
one at a time: Laptop2, LAPTOP-DRQ5L558, LAPTOP-E0STJJE8, ASSISTNURSE-PC (needs re-join + re-tag
after Win11 reinstall), NURSESTATION-PC (+ verify NurseAssist/Laptop4). NOTE: the device-lockdown
(auto-logoff) GPO only applies once machines are in `OU=Caregiver Devices` — until then desktops
caregivers use under the interim posture have NO auto-logoff enforcement.
4. ALIS email-match the 35 caregivers + medtechs (ALIS staff Email = Entra UPN); ALIS records still
to create for Munezero/Cota/Robinson; Vallejo email-match; 7 discharged-record decisions;
turn off ALIS-native 2FA per user, then move to SSO-only (native login is a CA bypass path).
5. Lower ALIS app session timeout 20 -> 15 min (Howard, ALIS admin).
6. **Reboot NURSESTATION-PC** to activate + verify the device-lockdown GPO (lock @3min, 90s warn, sign-out @15min).
7. Phones-only lockdown cohort: deferred to end of rollout — `docs/cloud/caretaker-phones-only-list.md`.
8. Pilot cleanup: delete `pilot.test`, remove stale `SG-Caregivers-Pilot` exclude from the MFA policy,
delete the pilot/test groups.
---
## Workstream 4 — M365
- **Relicense 31 users Business Standard -> Business Premium** (Standard is SUSPENDED — time-sensitive).
- Create break-glass accounts (`breakglass1/2-csc@`) + enroll FIDO2 YubiKeys.
- Build audit retention (Log Analytics 90d + Storage 6yr) in `rg-audit-cascadestucson`.
- **Relicense remaining suspended Business Standard users -> Business Premium** (Standard SKU is
SUSPENDED — time-sensitive). SPB now 45 seats enabled (Howard bought 11 on 6/30); 41 consumed as
of 7/1 — count seats before relicensing.
- **Create break-glass accounts (`breakglass1/2-csc@`) + enroll FIDO2 YubiKeys** — still not created
(confirmed 5/27); now a **prerequisite for the WS3 allow-list enforcement flip**.
- **Remove the standing Privileged Authentication Administrator role from the
`ComputerGuru - Tenant Admin` SP** (stranded by Alma's 6/25 offboarding; needs a Global Admin;
keep its Conditional Access Administrator role). Pending Mike.
- Build audit retention (Log Analytics 90d + Storage 6yr) in `rg-audit-cascadestucson` — approved
2026-04-29, still unbuilt (HIPAA SS164.312(b) gap, includes D:\Homes object-access auditing).
- Zeke Huerta: register Authenticator MFA (under MFA-for-all with no method since 7/1).
- Megan Hiatt: re-verify the April credential-stuffing remediation held (flagged 6/30).
---
@@ -160,7 +196,11 @@ test scope to real caregivers, one device at a time. (Detail: wiki "Entra Access
- **Cloud backup (MSP360 -> ACG-backup): VERIFIED running 2026-06-24** (last run Success, 0 failed, 575 GB baseline in cloud, incrementals working). Still confirm it is image/bare-metal/system-state (looks file-level) + set retention. [GATE for any drive work]
- **CS-SERVER RAID -- CORRECTED 2026-06-24: HEALTHY, not degraded** (live OMSA: both mirrors Ok, all 5 disks Online, all LEDs green; the 6/15 degraded self-recovered). **NO emergency drive swap.** 1:0:4 = global hot spare (do not remove). **Planned** reliability upgrade: replace the 2 consumer 320 GB drives (esp. flaky WD 0:0:3) with the 2x enterprise SSD **already purchased**, on a scheduled window w/ confirmed image/system-state backup. **[WARN] PSU redundancy lost** -- one PSU not delivering, check onsite. Service Tag 9MQFTK1. Real fix = DC migration off the 16-yr-old R610.
- Clean up old-MSP agent sprawl (Datto RMM/CentraStage + Datto EDR/Infocyte) thrashing the spindle.
- ~~Clean up old-MSP agent sprawl (Datto RMM/CentraStage + Datto EDR/Infocyte) thrashing the spindle~~
— **DONE on CS-SERVER 2026-06-26** (full legacy Datto stack removed). **Current Datto EDR installed
on CS-SERVER 2026-07-13** (HUNTAgent=Running, cmd `0a60cac7`) — the DC is back under managed
endpoint protection. Fleet stragglers tracked in the wiki (DESKTOP-TRCIEJA BD_ACTIVE, laptop3/laptop1/
cascades-laptop reconcile, Syncro BD-deployment removal, GravityZone portal cleanup).
- Synology -> backup-only (Team Folder migration of the real shares; close the workgroup/Kerberos quirk).
- Rotate the Synology signin-portal credential (was committed plaintext historically).
@@ -203,29 +243,36 @@ test scope to real caregivers, one device at a time. (Detail: wiki "Entra Access
---
## Suggested sequence (fastest path)
## Suggested sequence (fastest path) — re-cut 2026-07-13
1. **Today's onsite batch (Howard, on-site):** #32342 (Copy Room switch), #32319 (Room 343 AP),
#32370 (eFax + scanner), #32194 (spare machine for new hire), #32254 (Chef-PC reinstall+join);
#32230 (Karen -> ALDOCS) once she's in. **While onsite: verify per-room 5 GHz coverage** for the
CSC ENT device-island consolidation (Workstream 6) so the band flip can be scheduled with the
vendors.
2. **Caregiver lockdown go-live** (Workstream 3) — remote, highest HIPAA value, just needs the flip + per-device moves.
3. **M365 relicense 31 users** (Workstream 4) — time-sensitive.
4. **Backup verify -> RAID replacement** (Workstream 5) — critical single-DC risk.
5. **Remaining staff domain joins + dept drives** (Workstreams 1+2) — batch the ~17 un-joined PCs, OU + drives per machine.
6. Network tail (Vertical 5 GHz, 100 Mbps ports) + M365 break-glass/audit retention.
1. **2026-07-16 afternoon: offboard Juan Andrade** (disable + SG-Caregivers removal + license
reclaim) — coord todo `80716a98`. Do NOT disable before then.
2. **Break-glass accounts + strip the stranded PAA role** (Workstream 4) — prerequisite for the
allow-list enforcement flip; the tenant currently has live block policies and no break-glass.
3. **Caregiver lockdown go-live** (Workstream 3) — highest HIPAA value; the interim posture's real
control (device allow-list) is still report-only/test-scoped.
4. **M365 relicense remaining suspended-Standard users** (Workstream 4) — time-sensitive.
5. **Backup image/system-state confirm -> planned SSD swap** (Workstream 5) — single-DC risk.
6. **Remaining staff domain joins + dept drives** (Workstreams 1+2) + printer-share repoints /
Point-and-Print GPO fleet-wide (see wiki VLAN 20 section).
7. Network tail (CSC ENT device island, 100 Mbps ports) + audit-retention build.
---
## Open Syncro tickets -> workstream map
**[RECONCILE 2026-07-13] Syncro showed 0 open tickets as of 7/10**, but the 6 tickets below were
"Open — onsite" in the 6/24 plan and no completion is recorded in the wiki/session logs.
**VERIFY with Howard: completed-and-closed, or closed-without-work?** Any not actually done go back
on the board as workstream items (the underlying work — Chef-PC reinstall+join, Room 343 AP,
Copy Room switch, eFax/scanner, spare machine, Karen ALDOCS — is still required by WS1/2/6/7).
| Ticket | Workstream | Status |
|---|---|---|
| #32193 Executive restricted share | 2 | **DONE 2026-06-24** (E: both machines, billed 0.5h block) |
| #32194 spare machine for new hire | 1 | Open — onsite |
| #32230 Karen -> ALDOCS | 2 | Open — recheck when she's in |
| #32254 Chef-PC reinstall | 1 | Open — onsite (then domain-join) |
| #32319 WiFi Room 343 | 6 | Open — onsite |
| #32342 Copy Room switch | 6 | Open — onsite |
| #32370 eFax + scanner | 7 | Open — onsite |
| #32194 spare machine for new hire | 1 | Closed in Syncro — **verify work done** |
| #32230 Karen -> ALDOCS | 2 | Closed in Syncro — Karen's ALDocs shortcut WAS set 6/26 (drive-map); likely done |
| #32254 Chef-PC reinstall | 1 | Closed in Syncro — **verify reinstall + domain-join happened** |
| #32319 WiFi Room 343 | 6 | Closed in Syncro — **verify AP relocation done** |
| #32342 Copy Room switch | 6 | Closed in Syncro — **verify switch installed/adopted** |
| #32370 eFax + scanner | 7 | Closed in Syncro — **verify eFax + scanner delivered** |

2
clients/cascades-tucson/docs/cloud/caretaker-phones-only-list.md
View File

@@ -32,7 +32,7 @@ Transportation drivers, who do not get ALIS/M365 caregiver access at all.
| Erica Sanchez | e.sanchez | D+P | TBD |
| Ederick Yuzon | e.yuzon | D+P | TBD |
| Gina Williams | g.williams | D+P | TBD |
| Juan Andrade | j.andrade | D+P | **LEAVING** — last day 2026-07-11; held active until then, offboard on 07-11 |
| Juan Andrade | j.andrade | D+P | **LEAVING** — offboard **2026-07-16 afternoon** (moved from 07-11 per Howard 2026-07-13); held active until then. Coord todo `80716a98`. |
| Jahmeka Clarke | j.clarke | D+P | TBD |
| Jinnelle Dittbenner | j.dittbenner | D+P | TBD |
| Jen Higdon | j.higdon | D+P | TBD |