From 285687d48d968b7f7e3ef3d03b7f22e6123d837f Mon Sep 17 00:00:00 2001 From: Mike Swanson Date: Fri, 10 Jul 2026 17:46:47 -0700 Subject: [PATCH] sync: auto-sync from GURU-BEAST-ROG at 2026-07-10 17:45:57 Author: Mike Swanson Machine: GURU-BEAST-ROG Timestamp: 2026-07-10 17:45:57 --- ...-mike-asus2024-dallas-rdp-local-account.md | 100 ++++++++++++++++++ wiki/clients/goldstein.md | 39 ++++--- 2 files changed, 125 insertions(+), 14 deletions(-) create mode 100644 clients/goldstein/session-logs/2026-07/2026-07-10-bot-mike-asus2024-dallas-rdp-local-account.md diff --git a/clients/goldstein/session-logs/2026-07/2026-07-10-bot-mike-asus2024-dallas-rdp-local-account.md b/clients/goldstein/session-logs/2026-07/2026-07-10-bot-mike-asus2024-dallas-rdp-local-account.md new file mode 100644 index 00000000..362c4a8f --- /dev/null +++ b/clients/goldstein/session-logs/2026-07/2026-07-10-bot-mike-asus2024-dallas-rdp-local-account.md @@ -0,0 +1,100 @@ +# Session Log — Goldstein: ASUS-2024 -> DALLAS RDP completion + Sheldon local account + +## User +- **Executed by:** ClaudeTools Discord Bot (GURU-BEAST-ROG) +- **Requested by:** Mike Swanson (@azcomputerguru, via Discord) - admin +- **Role:** automation (acting on the requester's behalf) + +## Session Summary + +Follow-up to Howard's #32490 work (DALLAS Home->Pro upgrade + RDP enablement, 2026-07-07). Mike +reported via Discord (thread 1525291727911653530) that Sheldon Goldstein's staff couldn't RDP from +ASUS-2024 to DALLAS because DALLAS was signed in with a Microsoft account — MSA + Windows Hello PIN +blocks RDP password logon under NLA. + +Verified connectivity first via GuruRMM: ASUS-2024 (Goldstein/Dallas site, traveling laptop, +currently in Phoenix on 192.168.0.200 Wi-Fi) reached DALLAS 192.168.1.226:3389 with +TcpTestSucceeded=True over the OpenVPN Connect tunnel Mike and Howard set up earlier the same day. +Network path confirmed good; the blocker was purely MSA authentication. + +With Mike's go-ahead, dispatched two RMM commands: (1) on DALLAS, set +`HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device\DevicePasswordLessBuildVersion=0` +to allow Microsoft-account password sign-in (re-verified fDenyTSConnections=0, TermService running); +(2) on ASUS-2024, created `C:\Users\Public\Desktop\RDP DALLAS.rdp` (full address 192.168.1.226, +username hint, prompt for credentials, NLA-compatible). + +Mike then superseded the MSA-password route: he used **Profwiz to migrate Michelle's +Microsoft-account profile on DALLAS to a local account `Sheldon`** and created a matching `Sheldon` +local account on GS-BACKUP so its SMB shares authenticate with the same credentials. Password set +to never expire on both machines. Bot vaulted the credential and updated the Goldstein wiki article +(endpoints, access, patterns, history). + +## Key Decisions + +- **Verified connectivity before touching auth** — a single Test-NetConnection from ASUS-2024 proved + the new OpenVPN tunnel carried 3389 fine, isolating the problem to MSA/NLA authentication. +- **Local-account migration (Profwiz) chosen over the MSA-password dance** — Mike's call; avoids the + fragile "type the MSA password once to cache it" prerequisite and any future Hello/passwordless + regressions. The registry fix remains in place but is superseded (harmless). +- **Matching `Sheldon` account on GS-BACKUP** — same username/password means Windows SMB auth to the + Tucson share box works without stored-credential juggling. +- **Password never expires on both** — deliberate for an unattended RDP target; noted in vault entry. + +## Problems Encountered + +- **DALLAS agent hostname is `Dallas` (not `DALLAS`)** in GuruRMM — exact-match jq filter missed it + on first resolve; found via client-scoped listing. +- None otherwise; both RMM dispatches exited 0 (stderr contained only benign CLIXML progress noise). + +## Configuration Changes + +- **DALLAS:** `DevicePasswordLessBuildVersion=0` (HKLM ...\PasswordLess\Device) via RMM cmd + 136e69fd. By Mike (manual): profile migrated MSA -> local `Sheldon` via Profwiz; password never + expires. +- **GS-BACKUP:** local account `Sheldon` created (matches DALLAS, for SMB shares); password never + expires. (By Mike, manual.) +- **ASUS-2024:** `C:\Users\Public\Desktop\RDP DALLAS.rdp` created via RMM cmd cb533e62. +- **Repo:** `wiki/clients/goldstein.md` updated (endpoints table, Access, Patterns, History, + sources/last_compiled). + +## Credentials & Secrets + +- **Vault:** `clients/goldstein/windows-sheldon-local.sops.yaml` — local Windows account `Sheldon`, + password `Gerdrude788!`, valid on DALLAS and GS-BACKUP, never expires. Documented use: RDP from + ASUS-2024 (over OpenVPN) to DALLAS; SMB share auth on GS-BACKUP. Created + verified this session. +- Referenced (not modified): `clients/goldstein/openvpn-remote-access.sops.yaml`. + +## Infrastructure & Servers + +- **DALLAS** — 192.168.1.226; agent `36c7bbc8-504f-4b4a-8995-3b3e5cdc0f02` (hostname `Dallas` in RMM); + RDP host 3389/NLA; primary logon now `DALLAS\Sheldon`. +- **ASUS-2024** — agent `f50b17c1-a711-4e80-89c2-03cb630f5622`; traveling laptop, seen in Phoenix + (192.168.0.200 Wi-Fi); OpenVPN Connect DCO adapter to Goldstein network; reaches DALLAS 3389. +- **GS-Backup (Tucson)** — agent `4f52ef22-89ae-4124-a2b4-d339aaf42f53`; hosts SMB shares; new local + `Sheldon` account. +- DalRes10 (Tucson) offline at time of session. + +## Commands & Outputs + +- Recon (ASUS-2024, cmd cdbeeddd): IPv4 list + `Test-NetConnection 192.168.1.226 -Port 3389` -> + `TcpTestSucceeded=True` (via OpenVPN, from Phoenix). +- DALLAS (cmd 136e69fd): `DevicePasswordLessBuildVersion=0`, `fDenyTSConnections=0 TermService=Running`. +- ASUS-2024 (cmd cb533e62): `Created C:\Users\Public\Desktop\RDP DALLAS.rdp (129 bytes)`. +- All dispatched via `ps-encoded.sh` (quote-safe); alerts posted to #dev-alerts. + +## Pending / Incomplete Tasks + +- **User click-test:** Sheldon/staff to RDP from ASUS-2024 as `DALLAS\Sheldon` and confirm the + migrated profile looks right (desktop, files, Outlook). Not yet human-verified. +- **Syncro:** Mike did not request a ticket; #32490 already invoiced/closed. Open question whether + today's work (VPN + this) gets billed separately — Mike/Winter to decide. +- Prior open items stand: DALLAS Windows updates + reboot pending; no backup agent on DALLAS. + +## Reference Information + +- Discord thread: 1525291727911653530 (#botmagic, Mike). +- RMM command IDs: cdbeeddd (recon), 136e69fd (registry), cb533e62 (shortcut). +- Vault: `clients/goldstein/windows-sheldon-local.sops.yaml`. +- Prior logs: `clients/goldstein/session-logs/2026-07/2026-07-07-howard-dallas-rdp-pro-upgrade.md`, + `2026-07-06-howard-dallas-rmm-onboard.md`. +- Wiki: `wiki/clients/goldstein.md`. diff --git a/wiki/clients/goldstein.md b/wiki/clients/goldstein.md index a45bb79e..1dc3de28 100644 --- a/wiki/clients/goldstein.md +++ b/wiki/clients/goldstein.md @@ -3,14 +3,15 @@ type: client name: goldstein display_name: Goldstein (Sheldon Goldstein) last_compiled: 2026-07-10 -compiled_by: HOWARD/claude-main (live UniFi + RMM investigation) +compiled_by: HOWARD/claude-main + BEAST/discord-bot (merged 2026-07-10) sources: - clients/goldstein/session-logs/2026-07/2026-07-06-howard-dallas-rmm-onboard.md - clients/goldstein/session-logs/2026-07/2026-07-07-howard-dallas-rdp-pro-upgrade.md - clients/goldstein/onboarding-baselines/DALLAS-20260706T233936.md - clients/goldstein/session-logs/2026-07/2026-07-10-howard-openvpn-remote-access-sitemagic.md - Live UniFi Site Manager + GuruRMM investigation 2026-07-10 (tickets #32490, #32384) - - Howard report 2026-07-10 — DALLAS MSA->local account via ProfWiz (Mike) to fix RDP + - clients/goldstein/session-logs/2026-07/2026-07-10-bot-mike-asus2024-dallas-rdp-local-account.md + - Discord thread 1525291727911653530 (2026-07-10, Mike — ASUS-2024 RDP + Profwiz local account) backlinks: [] --- @@ -109,17 +110,21 @@ part of the move to OpenVPN. ### Endpoints | Host | Site | IP (RDP target) | Role / Notes | |---|---|---|---| -| **DALLAS** | Dallas | **192.168.1.226** (Wi-Fi) | Michelle's Lenovo Yoga Slim 7, Win 11 **Pro for Workstations** (upgraded from Home 2026-07-07, MAK). **RDP host** (fDenyTS=0, NLA, TermService Auto). Public 99.127.21.4. Modern-Standby — kept AC-no-sleep. The machine staff RDP **into**. **Login account: local `Dallas\miche`, NO password — migrated from a Microsoft account via ProfWiz (Mike, 2026-07-10) because the MSA login was BLOCKING RDP; RDP verified working after.** Agent `36c7bbc8-504f-4b4a-8995-3b3e5cdc0f02`; SC `29c62473-a5cb-4e94-a190-c91f05031809`. | +| **DALLAS** | Dallas | **192.168.1.226** (Wi-Fi) | Michelle's Lenovo Yoga Slim 7, Win 11 **Pro for Workstations** (upgraded from Home 2026-07-07, MAK). **RDP host** (fDenyTS=0, NLA, TermService Auto). Public 99.127.21.4. Modern-Standby — kept AC-no-sleep. The machine staff RDP **into**. **Login account: local `Sheldon` — ProfWiz-migrated from Michelle's Microsoft account (Mike, 2026-07-10) because the MSA login was BLOCKING RDP. Password in vault `clients/goldstein/windows-sheldon-local`, set to never expire.** Agent `36c7bbc8-504f-4b4a-8995-3b3e5cdc0f02`; SC `29c62473-a5cb-4e94-a190-c91f05031809`. | | **DalRes10** | Tucson | **10.1.10.170** (Wi-Fi) | Sheldon's desktop. **RDP host** (fDenyTS=0, NLA) — but **TermService StartType = Manual** (won't auto-start RDP after reboot). Target IP is on **Wi-Fi** (also Ethernet 10.10.1.149 on a *different* segment) so RDP reachability tracks Wi-Fi. Agent `81cde315-013b-4acd-80d7-5ec2b9b5f084`. | -| **ASUS-2024** | Dallas (tag) | roams — Cox `192.168.0.200` when on `Gold-Scop` | **Roaming laptop (Michelle, user `miche`).** Has the OpenVPN client + RDP shortcuts to both targets. Agent `f50b17c1-a711-4e80-89c2-03cb630f5622`; SC `cfddaed7-b6b9-463c-b210-384dec88e0f8`. | -| **GS-Backup** | Tucson | — | Tucson box (name implies backup). Agent `4f52ef22-89ae-4124-a2b4-d339aaf42f53`. | +| **ASUS-2024** | Dallas (tag) | roams — Cox `192.168.0.200` when on `Gold-Scop`; seen in Phoenix 2026-07-10 | **Roaming laptop (Michelle, user `miche`).** Has the OpenVPN client + RDP shortcuts to both targets, plus `RDP DALLAS.rdp` on the Public Desktop (pushed via RMM 2026-07-10). Agent `f50b17c1-a711-4e80-89c2-03cb630f5622`; SC `cfddaed7-b6b9-463c-b210-384dec88e0f8`. | +| **GS-Backup** | Tucson | — | Tucson backup/file-share box. **Local account `Sheldon` added 2026-07-10** (matches the DALLAS account so SMB shares auth seamlessly; same vaulted password, never expires). Agent `4f52ef22-89ae-4124-a2b4-d339aaf42f53`. | ## Access - **UniFi:** ui.com Site Manager (both Goldstein consoles are "owner") — see Network section. - **ScreenConnect:** DALLAS `29c62473-…`, DalRes10 `a8b53a73-ff0e-42c9-b51f-4ff71aff45f7`, ASUS-2024 `cfddaed7-…`, GS-Backup `75f4ee70-…` (all Company=Goldstein). - **GuruRMM install (Dallas site):** https://rmm.azcomputerguru.com/install/SILVER-PEAK-3739 -- **Vault:** `clients/goldstein/openvpn-remote-access.sops.yaml` (OpenVPN/RADIUS). +- **RDP into DALLAS:** local account `DALLAS\Sheldon` (password never expires) — creds in vault. + Works from ASUS-2024 offsite via the Dallas OpenVPN profile, and from the Tucson LAN over Site Magic. +- **Vault:** + - `clients/goldstein/windows-sheldon-local.sops.yaml` — local `Sheldon` account on DALLAS + GS-Backup + - `clients/goldstein/openvpn-remote-access.sops.yaml` — OpenVPN/RADIUS (Tucson + Dallas UCG) ## Patterns & Known Issues - **Multi-site, one Syncro customer** — Dallas (TX) + Tucson (Armory Park). New endpoints must @@ -129,15 +134,17 @@ part of the move to OpenVPN. - **`Gold-Scop` WiFi ≠ UniFi LAN** — it's a separate Cox line (192.168.0.x); a device on it can't reach either site's internal machines. Use the UniFi "Goldstein" WiFi (10.1.10.x) at the office. - **DALLAS is Modern-Standby** — kept AC-no-sleep + lid-does-nothing so it stays RDP-reachable. - RDP into DALLAS is single-session (signs Michelle out locally). + RDP into DALLAS is single-session (signs the local user out). - **DalRes10 target IP is on Wi-Fi** and **TermService is Manual** — RDP can vanish if Wi-Fi drops or after a reboot until the service is started. - **No backup agent** detected on DALLAS (2026-07-06) — confirm cloud/local backup need. -- **Microsoft-account login blocked RDP on DALLAS** — RDP/NLA against an MSA-backed account - failed to authenticate. Fixed by migrating the profile to a **local account (no password)** - with **ProfWiz** (ForensiT User Profile Wizard). Pattern: for RDP hosts, prefer a local - account over a Microsoft/Azure-AD account. (A blank-password local account only accepts RDP - if `LimitBlankPasswordUse` is disabled — verify that policy if a no-password RDP host recurs.) +- **Microsoft-account login blocked RDP on DALLAS** — RDP/NLA against an MSA-backed account (Hello + PIN, no cached password) failed to authenticate. Fixed by ProfWiz-migrating the profile to + **local account `Sheldon`** (same profile, local auth; vaulted never-expiring password — Mike, + 2026-07-10). A matching `Sheldon` account was created on **GS-Backup** so its SMB shares + authenticate with the same credentials. Pattern: for RDP hosts, prefer a local account over a + Microsoft/Azure-AD account. (A registry fix `DevicePasswordLessBuildVersion=0` was also applied + to DALLAS the same day while pursuing the MSA-password route — harmless, superseded.) ## Active Work *No open tickets in Syncro as of 2026-07-10 (#32384 "Remote - Issues with remote access" is @@ -153,8 +160,12 @@ Resolved/invoiced). Break-fix, no prepaid block. Follow-ups below are open work, - **Billing:** OpenVPN remote-access work (2026-07-10) not yet billed — confirm with Mike. ## History Highlights -- **2026-07-10** — DALLAS RDP fix: the machine was on a **Microsoft account** which blocked RDP; - **Mike migrated it to a local account (no password) with ProfWiz** and verified everything works. +- **2026-07-10** — DALLAS RDP fix completed: the machine was on a **Microsoft account** which + blocked RDP; **Mike ProfWiz-migrated it to local account `Sheldon`** (never-expiring password, + vaulted) and created a matching `Sheldon` account on **GS-Backup** for SMB share access. Earlier + same day the bot set `DevicePasswordLessBuildVersion=0` on DALLAS (superseded), verified + ASUS-2024 → DALLAS 3389 over OpenVPN from Phoenix, and pushed `RDP DALLAS.rdp` to ASUS-2024's + Public Desktop. - **2026-07-10** — Stood up OpenVPN remote access (both UCGs, RADIUS, users Michelle/Sheldon); mapped the full UniFi/Site-Magic topology; confirmed Site Magic is LAN-only + locked; DALLAS offsite RDP working; DalRes10 taken offline by a stray WireGuard tunnel (pending console fix).