azcomputerguru/claudetools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sync: auto-sync from HOWARD-HOME at 2026-07-14 11:14:46

Browse Source 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-14 11:14:46
This commit is contained in:
Howard Enos
2026-07-14 11:15:25 -07:00
parent 4ab8137daa
commit 22503149ce
11 changed files with 3498 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
wiki/clients/cascades-tucson.md
View File

@@ -219,7 +219,7 @@ Because per-user **Intune** never provisioned tenant-wide (`INTUNE_A = PendingIn
### Status (as of 2026-07-02)
- **[ROSTER 2026-07-02] 7 already-disabled leavers HARD-DELETED from AD** (client roster update): `b.mendoza`, `c.tate`, `g.williford`, `k.flores`, `d.fierros`, `m.baker`, `m.kariuki` -- all disabled/never-logged-in since the 7/1 reconcile; now removed (cloud objects soft-delete on next Entra Connect sync, 30-day recycle bin). **`SG-Caregivers` stays 35** (they were already out of the group; deleting disabled non-members doesn't change the count). Live-verified gone (RMM cmd `a5f337fd`).
- **[ROSTER 2026-07-02] Juan Andrade (`j.andrade`) gave 2-week notice** -- still active and in `SG-Caregivers`, deliberately **HELD** (do NOT disable while he's working). **Last day 2026-07-11 -- offboard that day:** disable + remove from `SG-Caregivers` + reclaim Business Premium. Tracked in `docs/cloud/caretaker-phones-only-list.md` + coord todo.
- **[ROSTER 2026-07-13] Juan Andrade (`j.andrade`) -- offboard date moved to 2026-07-16 AFTERNOON** (was 07-11; per Howard 2026-07-13). Still active and in `SG-Caregivers`, deliberately **HELD** (do NOT disable while he's working). On 7/16 PM: disable + remove from `SG-Caregivers` + reclaim Business Premium. Tracked in `docs/cloud/caretaker-phones-only-list.md` + coord todo `80716a98` (created 2026-07-13 -- no todo existed before that despite the earlier note).
- **Caregiver phone SSO -- Entra/identity side COMPLETE for the current 35-member roster** (group + Business Premium license + AD temp passwords, **must-change flag cleared fleet-wide 2026-07-02** -- see the forced-change gotcha above; temp passwords now valid for phone sign-in). Remaining gate is the ALIS Email=UPN match (Howard) + creating ALIS records for the 3 brand-new hires (Munezero, Cota, Robinson) + setting Vallejo's ALIS Email=UPN + the outstanding items from 6/30 (7 discharged-record decisions, Kariuki ALIS dup 429856/429858 dedupe if she returns).
- **Caregiver CA lockdown is LIVE (interim posture, 2026-07-01):** caretakers sign in on desktops and phones, on-network only -- see the 7/1 update above and Conditional Access / Caregiver Policies. Phones-only lockdown deferred to end of rollout.
- **Proven working end-to-end on a hybrid-joined desktop (NURSESTATION + pilot.test):** caregiver lockdown (CA off-network block + device allow-list) **and** silent ALIS SSO. The allow-list policy `1b7fd025` carries NURSESTATION's current deviceId `d3bf931f-f128-4261-8398-b46c34a4b342` and the device is tagged `extensionAttribute1=CSCCaregiverDevice`.
@@ -265,7 +265,7 @@ Because per-user **Intune** never provisioned tenant-wide (`INTUNE_A = PendingIn
| Host | IP | Role | OS | Notes |
|---|---|---|---|---|
| CS-SERVER | 192.168.2.254 | DC, DNS, DHCP (no scopes), File Server, Hyper-V host, Print Server | Windows Server 2019 Standard | Dell PowerEdge R610 (~2009 hardware, 16+ years old). **Single DC -- CRITICAL risk.** GuruRMM agent ID: `c39f1de7-d5b6-45ae-b132-e06977ab1713` (re-enrolled; always resolve live by hostname, never hardcode the UUID). Clients reach SMB at **192.168.2.248** (registered DNS / Ethernet); .254 is the Hyper-V vEthernet NIC. **RAID HEALTHY per live OMSA 2026-06-24 -- see hardware note below.** **All Datto software fully removed 2026-06-26 (was DattoAV/EDR/RMM leftover, not GravityZone).** |
| CS-SERVER | 192.168.2.254 | DC, DNS, DHCP (no scopes), File Server, Hyper-V host, Print Server | Windows Server 2019 Standard | Dell PowerEdge R610 (~2009 hardware, 16+ years old). **Single DC -- CRITICAL risk.** GuruRMM agent ID: `c39f1de7-d5b6-45ae-b132-e06977ab1713` (re-enrolled; always resolve live by hostname, never hardcode the UUID). Clients reach SMB at **192.168.2.248** (registered DNS / Ethernet); .254 is the Hyper-V vEthernet NIC. **RAID HEALTHY per live OMSA 2026-06-24 -- see hardware note below.** **All legacy Datto software removed 2026-06-26 (was DattoAV/EDR/RMM leftover, not GravityZone); current Datto EDR (HUNTAgent) installed 2026-07-13.** |
| CS-SERVER iDRAC | 192.168.2.65 | Out-of-band management | -- | Dell OOB interface |
| CS-QB (Hyper-V VM on CS-SERVER) | 192.168.2.228 | (label "VoIP server" -- STALE) | -- | **2026-06-16 recon: SMB/445 only, no SIP response -- NOT a live SIP PBX.** Phones appear cloud-registered (Vertical). Label predates the wireless-phone transition; revisit/retire. |
| cascadesDS (Synology NAS) | 192.168.0.120 | NAS / legacy file storage | DSM 7.2.1-69057 | Port 5000 HTTP. Workgroup name is "CASCADES" -- same as AD short name, causing Kerberos auth failures from domain-joined machines. Slated to become backup-only. **Synology Drive Server 3.5.0-26088** (active, port 6690 SSL). Current Drive sync: CS-SERVER Drive Client (v7.5.0.16085, runs as sysadmin) syncs Sync-user My Drive (`/volume1/homes/Sync/Drive/`) -> `D:\Shares\Main` (one-way download). Real shared folders (Server 1.9 G, Management 5.5 G, Public ~50 G, SalesDept ~23 G, etc.) are NOT in scope -- Team Folder migration pending. |
@@ -290,7 +290,7 @@ Because per-user **Intune** never provisioned tenant-wide (`INTUNE_A = PendingIn
**[INFO] Backup -- gap closed (2026-06-15); verified running 2026-06-24.** Mike installed ACG cloud backup (MSP360/CloudBerry -> ACG-backup server) on CS-SERVER, addressing the longstanding SS164.308(a)(7) "no backup" HIPAA gap. **Live check 2026-06-24:** last run (6/24 00:10) = "Plan status: Success", 0 failed; 575.7 GB / 248k-file dataset already in the cloud (only 465 MB changed -> full baseline exists, incrementals working). **Still to confirm: this looks FILE-LEVEL, not image/bare-metal/system-state -- for a DC that is a DR gap; confirm with Mike whether a separate image/system-state backup exists before treating it as full disaster coverage.** Set/confirm retention.
**[INFO] Endpoint security -- Datto EDR/AV is the ACG-managed stack (migration off Bitdefender substantially complete).** Cascades migrated from Syncro-deployed **Bitdefender GravityZone BEST** to **Datto EDR + Datto AV** (Infocyte/azcomp4587.infocyte.com). Datto EDR org `2d5ea96e-3228-461b-9c60-13ae464b61d8`, target group `1dbd2b02-f7df-45d0-a7f2-18667f48447f`, reg key `6qw68y2rwl`. **State as of 2026-06-26:** ~34 agents enrolled. Datto EDR installed on 7 machines 6/25 (org 27->34). **Bitdefender REMOVED from RECEPTIONIST-PC** (both physical boxes, serials MJ0KQH4R + MJ0KQHNP) via GravityZone console "Uninstall client" task -- the GravityZone Public API `createUninstallTask` is DEAD in this version and BEST anti-tampering (no uninstall password on policy "GPS Default") blocks endpoint-side uninstall, so removal is **console-only**. 6 orphaned `C:\Program Files\Bitdefender` folders deleted (safety-checked). **RECEPTIONIST-PC is two distinct physical machines sharing a hostname** -- dedup-by-hostname masks the second box. **Straggler pass 2026-06-26:** BD-checked reconnected machines -- DESKTOP-MD6UQI3, Laptop4, SALES4-PC all NO_BITDEFENDER (clean); **DESKTOP-TRCIEJA = BD_ACTIVE** (needs the GravityZone console uninstall; slated for replacement anyway). NurseAssist got its queued EDR install confirmed (agent `23c3c36e`, AV on, v3.17.1.5552) after its Home->Pro upgrade. DESKTOP-F94M8UT (Alma Montt's, powered off) BD-aware EDR install queued (cmd `a4623704`, auto-fires on reconnect); DESKTOP-KQSL232 (Lois Lane's old box) decommissioned -- removed from list. **CS-SERVER's endpoint AV was DattoAV, NOT GravityZone Bitdefender** (see SMB/AV pattern) -- all Datto software fully removed from CS-SERVER 2026-06-26. **Pending:** DESKTOP-TRCIEJA GravityZone console uninstall; confirm Cascades removed from Syncro's Bitdefender deployment (GUI-only) so BD doesn't redeploy; GravityZone portal cleanup of stale RECEPTIONIST-PC endpoint records; reconcile `laptop3` (EDR agent, no RMM agent); confirm/remove stale EDR agents laptop1 + cascades-laptop.
**[INFO] Endpoint security -- Datto EDR/AV is the ACG-managed stack (migration off Bitdefender substantially complete).** Cascades migrated from Syncro-deployed **Bitdefender GravityZone BEST** to **Datto EDR + Datto AV** (Infocyte/azcomp4587.infocyte.com). Datto EDR org `2d5ea96e-3228-461b-9c60-13ae464b61d8`, target group `1dbd2b02-f7df-45d0-a7f2-18667f48447f`, reg key `6qw68y2rwl`. **State as of 2026-06-26:** ~34 agents enrolled. Datto EDR installed on 7 machines 6/25 (org 27->34). **Bitdefender REMOVED from RECEPTIONIST-PC** (both physical boxes, serials MJ0KQH4R + MJ0KQHNP) via GravityZone console "Uninstall client" task -- the GravityZone Public API `createUninstallTask` is DEAD in this version and BEST anti-tampering (no uninstall password on policy "GPS Default") blocks endpoint-side uninstall, so removal is **console-only**. 6 orphaned `C:\Program Files\Bitdefender` folders deleted (safety-checked). **RECEPTIONIST-PC is two distinct physical machines sharing a hostname** -- dedup-by-hostname masks the second box. **Straggler pass 2026-06-26:** BD-checked reconnected machines -- DESKTOP-MD6UQI3, Laptop4, SALES4-PC all NO_BITDEFENDER (clean); **DESKTOP-TRCIEJA = BD_ACTIVE** (needs the GravityZone console uninstall; slated for replacement anyway). NurseAssist got its queued EDR install confirmed (agent `23c3c36e`, AV on, v3.17.1.5552) after its Home->Pro upgrade. DESKTOP-F94M8UT (Alma Montt's, powered off) BD-aware EDR install queued (cmd `a4623704`, auto-fires on reconnect); DESKTOP-KQSL232 (Lois Lane's old box) decommissioned -- removed from list. **CS-SERVER's endpoint AV was DattoAV, NOT GravityZone Bitdefender** (see SMB/AV pattern) -- all legacy Datto software fully removed from CS-SERVER 2026-06-26, which left the DC with NO managed endpoint protection until **Datto EDR (Infocyte HUNT agent) was installed on CS-SERVER 2026-07-13** (RMM cmd `0a60cac7`, precheck clean, HUNTAgent=Running, org `2d5ea96e`, key `6qw68y2rwl`). **Pending:** DESKTOP-TRCIEJA GravityZone console uninstall; confirm Cascades removed from Syncro's Bitdefender deployment (GUI-only) so BD doesn't redeploy; GravityZone portal cleanup of stale RECEPTIONIST-PC endpoint records; reconcile `laptop3` (EDR agent, no RMM agent); confirm/remove stale EDR agents laptop1 + cascades-laptop.
**[WARN] Power outage (2026-06-17):** Building power outage took the entire Cascades network down. Root cause: pfSense was plugged into the **surge-only side of the UPS** (no battery) -- it hard-powered-off uncleanly. ZFS survived. Dirty boot caused a **duplicate dhcpd** and a **2nd-floor switch (USL24PB, 192.168.2.193) with one-way L2 forwarding** blocking DHCP OFFERs. Howard killed the duplicate dhcpd remotely; Mike re-seated pfSense onto battery outlets, restored config from on-box auto-backup (12:20 version, VLAN30 intact), reset+re-adopted Switch 2nd Floor #2. Network fully restored. Post-recovery casualties: devices that booted during DHCP-down window cached disconnected state (kitchen thermal printer fixed by power-cycle). Incident report: `clients/cascades-tucson/reports/2026-06-17-power-outage-incident.md`.
@@ -580,7 +580,7 @@ Full design: `docs/network/phase1-voice-qos-design.md`. Status DESIGN -- nothing
- **[WARN] ~25 switch ports at 100 Mbps but gig-capable.** Investigate after WiFi optimization is stable.
- **[WARN] 3 offline switches** (Switch 4th Floor #2, USW Pro Max 16 -- root cause unknown; Switch 2nd Floor #2 was reset+re-adopted 2026-06-17). Investigate onsite.
- **[SECURITY] Synology Cloud Signin Portal credential exposed in vault git history (commit 1fbc0e1).** Encrypted go-forward but credential must be rotated.
- **[FLEET] Endpoint security migration substantially complete (2026-06-30).** Datto EDR/AV (Infocyte/azcomp4587) is the ACG-managed endpoint stack -- ~34 agents enrolled. Bitdefender removed from RECEPTIONIST-PC (both boxes); orphaned BD folders cleaned; CS-SERVER fully Datto-free. **Pending:** DESKTOP-TRCIEJA BD_ACTIVE (needs GravityZone console uninstall; box slated for replacement); DESKTOP-F94M8UT (Alma's, powered off) queued EDR install; confirm Cascades removed from Syncro's BD deployment; GravityZone portal cleanup of stale RECEPTIONIST-PC records; reconcile laptop3 (EDR, no RMM agent); confirm/remove stale EDR agents laptop1 + cascades-laptop.
- **[FLEET] Endpoint security migration substantially complete (2026-06-30; CS-SERVER covered 2026-07-13).** Datto EDR/AV (Infocyte/azcomp4587) is the ACG-managed endpoint stack -- ~35 agents enrolled. Bitdefender removed from RECEPTIONIST-PC (both boxes); orphaned BD folders cleaned; CS-SERVER cleaned of legacy Datto 6/26 and **re-enrolled in Datto EDR 2026-07-13 (HUNTAgent=Running, cmd `0a60cac7`)** -- the DC had been unprotected in between. **Pending:** DESKTOP-TRCIEJA BD_ACTIVE (needs GravityZone console uninstall; box slated for replacement); DESKTOP-F94M8UT (Alma's, powered off) queued EDR install; confirm Cascades removed from Syncro's BD deployment; GravityZone portal cleanup of stale RECEPTIONIST-PC records; reconcile laptop3 (EDR, no RMM agent); confirm/remove stale EDR agents laptop1 + cascades-laptop.
### Security Incidents (historical)
@@ -617,7 +617,7 @@ Syncro live pull 2026-07-10: **0 open Syncro tickets; 37.5 prepaid hours; 29 man
- **[FOLLOW-UP 2026-06-30] Megan Hiatt breach re-check.** Her account carried a `CREDENTIAL_STUFFING_ACTIVE` marker in the April tenant inventory; verify the April remediation held (`/remediation-tool check megan.hiatt@`).
- **[PLANNED -- CARF accreditation] Technology and System Plan deliverable** (requested by Ashley Jensen 2026-06-24). One of the five required CARF Section-1 plans (Aging Services); must be an action document covering 8 canonical areas with per-area current tech + projected need + timeline + vendor + cost + responsible person + target/completion date, annual dated leadership sign-off. Done: gap analysis, project memory `project_cascades_carf_tech_plan`, an on-brand PDF first pass (via `impeccable`), and a pre-filled CARF intake worksheet. **Next: gather Cascades' inputs, then build the final plan branded as Cascades' (ACG as preparer); confirm the exact standard citation + review cadence.** Standing rule: all client/vendor-facing deliverables run through the `impeccable` skill before delivery.
- **[URGENT] Order replacement workstation for Lupe Sanchez (DESKTOP-TRCIEJA).** Decision made 2026-06-18. EOL Gateway ZX6971 / i3-2120 / 8 GB / Win11-unsupported. On new machine: provision GuruRMM + Datto EDR/AV only; do NOT install Bitdefender. Do not carry over any prior-MSP Datto RMM/CentraStage artifacts. (TRCIEJA is currently BD_ACTIVE -- needs GravityZone console uninstall if kept in service before replacement.)
- **[IN PROGRESS] Datto EDR/AV rollout + Bitdefender decommission.** ~34 agents enrolled (org `2d5ea96e`). Remaining: DESKTOP-TRCIEJA GravityZone console uninstall (BD_ACTIVE); DESKTOP-F94M8UT (Alma's, powered off) queued BD-aware EDR install (cmd `a4623704`); (1) Remove Cascades from Syncro's Bitdefender deployment (GUI-only). (2) GravityZone portal cleanup of stale RECEPTIONIST-PC endpoint records (company `66b0448e`). (3) Reconcile laptop3 (EDR active, no RMM agent). (4) Confirm/remove stale EDR agents laptop1 + cascades-laptop. CS-SERVER Datto stack already fully removed 2026-06-26.
- **[IN PROGRESS] Datto EDR/AV rollout + Bitdefender decommission.** ~35 agents enrolled (org `2d5ea96e`); **CS-SERVER EDR installed 2026-07-13** (HUNTAgent=Running, cmd `0a60cac7`) closing the DC coverage gap left by the 6/26 legacy-Datto removal. Remaining: DESKTOP-TRCIEJA GravityZone console uninstall (BD_ACTIVE); DESKTOP-F94M8UT (Alma's, powered off) queued BD-aware EDR install (cmd `a4623704`); (1) Remove Cascades from Syncro's Bitdefender deployment (GUI-only). (2) GravityZone portal cleanup of stale RECEPTIONIST-PC endpoint records (company `66b0448e`). (3) Reconcile laptop3 (EDR active, no RMM agent). (4) Confirm/remove stale EDR agents laptop1 + cascades-laptop. CS-SERVER Datto stack already fully removed 2026-06-26.
- **[URGENT] Rotate exposed Synology Cloud Signin Portal credential.** Vault commit 1fbc0e1 committed it plaintext; encrypted go-forward but exposed in git history. Also verify MDM service account + WiFi CSCNet from that commit were never plaintext.
- **[DONE 2026-06-19] Voice VLAN (VLAN 30) migration COMPLETE -- 37 devices on VOICE.** All Poly re-keyed. RF optimized (2.4 power->medium, 5 GHz clean DFS, retry halved). Billed ticket #32444 (7h prepaid).
- **[PENDING - hardware] Bistro phone replacement.** Kitchen server phone was bad (John pulled it 2026-06-19); Bistro phone relocated to Kitchen, so the **Bistro has no phone**. Set up + re-key the replacement to the voice PPSK when it arrives.
@@ -642,7 +642,7 @@ Syncro live pull 2026-07-10: **0 open Syncro tickets; 37.5 prepaid hours; 29 man
- **BLOCKED -- Windows Home (until Pro):** LAPTOP-8P7HDSEI, MDIRECTOR-PC (Shelby), MEMREct-PC. CascadesProxess deferred (appliance, late-night).
- **OneDrive KFM ON** (unlink before folder-redirect): LAPTOP-8P7HDSEI, NurseAssist.
- **LAPTOP-DRQ5L558** is off the Cascades LAN -- get on-site before join.
- **Decision 2026-06-24:** caregivers stay TEST-scoped -- do NOT flip the lockdown to go-live until all devices are domain-ready first.
- **Decision 2026-06-24 [SUPERSEDED 2026-07-01]:** the "caregivers stay TEST-scoped until all devices domain-ready" hold was replaced by the interim CA posture (desktops + phones, on-network only -- see Conditional Access section). The device allow-list (`1b7fd025`) remains TEST-scoped **and report-only**; final lockdown = scope to `SG-Caregivers` + set to enforced.
**Migration phase status (as of 2026-06-30):**
@@ -742,6 +742,7 @@ Syncro live pull 2026-07-10: **0 open Syncro tickets; 37.5 prepaid hours; 29 man
| 2026-07-02 | **Shelby Trozzi "Company Web Docs" share + mapped drive.** Made `D:\Shares\Public\Company Web Docs` on CS-SERVER an SMB share gated at the share ACL (Shelby = Change, Admins = Full; NTFS left inherited), so the `Public` NTFS tree stayed untouched. Shelby had never logged into her domain account (`logonCount = 0`) and had no vaulted password; confirmed her OU is outside Entra Connect sync scope, so an on-prem reset was safe -- reset, set never-expires, vaulted. RMM could not push the drive map (`user_session` double-hop -> SMB error 67); worked around with `cmdkey` + a persistent `HKCU:\Network\W` map that mounts at next logon, then mapped it interactively to confirm. |
| 2026-07-09 | **Charity Menle caregiver rename (rename, never re-create).** Resolved that Charity Sika (CSV) and Bariffa Sika (ALIS 309045) are the same person, since legally renamed to Charity Menle; renamed the AD/Entra account to match rather than creating a new object. Established the procedure: `Set-ADUser` for Surname/DisplayName/UPN/EmailAddress, `Rename-ADObject` for the CN, `Set-ADUser -SamAccountName`, then a delta `Start-ADSyncSyncCycle`. Entra export is async -- poll before concluding the sync failed. |
| 2026-07-09 | **Chris Knight granted access to the accounting mailbox.** Added FullAccess (AutoMapping) + SendAs on the `accounting@cascadestucson.com` SharedMailbox via EXO REST `InvokeCommand` (`exchange-op` tier), matching the existing Lauren/Ashley/Zachary delegate tier. Two harness defects surfaced: `consent-audit.sh` graded the tenant RED "app NOT consented" when the real fault was a local vault-path lookup (the tenant was fully consented -- a false negative that points at emailing the client a needless consent link), and a post-write `Get-RecipientPermission` omitted the new SendAs trustee due to EXO replication lag. Both logged to `errorlog.md`. |
| 2026-07-13 | **Datto EDR installed on CS-SERVER (closing the DC's post-cleanup coverage gap)** -- HUNTAgent=Running, RMM cmd `0a60cac7`; the DC had been without managed endpoint protection since the 6/26 legacy-Datto removal. Full wiki+plan recheck/reconcile pass (this page + `REMAINING-WORK-PLAN.md` refreshed to live state). **Juan Andrade offboard moved to 2026-07-16 afternoon** (coord todo `80716a98` created -- none existed despite the prior note claiming one). |
---