azcomputerguru/claudetools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sync: auto-sync from GURU-BEAST-ROG at 2026-07-10 17:45:57

Browse Source 
Author: Mike Swanson
Machine: GURU-BEAST-ROG
Timestamp: 2026-07-10 17:45:57
This commit is contained in:
Mike Swanson
2026-07-10 17:46:47 -07:00
parent c72048d4d7
commit 285687d48d
2 changed files with 125 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
wiki/clients/goldstein.md
View File

@@ -3,14 +3,15 @@ type: client
name: goldstein
display_name: Goldstein (Sheldon Goldstein)
last_compiled: 2026-07-10
compiled_by: HOWARD/claude-main (live UniFi + RMM investigation)
compiled_by: HOWARD/claude-main + BEAST/discord-bot (merged 2026-07-10)
sources:
- clients/goldstein/session-logs/2026-07/2026-07-06-howard-dallas-rmm-onboard.md
- clients/goldstein/session-logs/2026-07/2026-07-07-howard-dallas-rdp-pro-upgrade.md
- clients/goldstein/onboarding-baselines/DALLAS-20260706T233936.md
- clients/goldstein/session-logs/2026-07/2026-07-10-howard-openvpn-remote-access-sitemagic.md
- Live UniFi Site Manager + GuruRMM investigation 2026-07-10 (tickets #32490, #32384)
- Howard report 2026-07-10 — DALLAS MSA->local account via ProfWiz (Mike) to fix RDP
- clients/goldstein/session-logs/2026-07/2026-07-10-bot-mike-asus2024-dallas-rdp-local-account.md
- Discord thread 1525291727911653530 (2026-07-10, Mike — ASUS-2024 RDP + Profwiz local account)
backlinks: []
---
@@ -109,17 +110,21 @@ part of the move to OpenVPN.
### Endpoints
| Host | Site | IP (RDP target) | Role / Notes |
|---|---|---|---|
| **DALLAS** | Dallas | **192.168.1.226** (Wi-Fi) | Michelle's Lenovo Yoga Slim 7, Win 11 **Pro for Workstations** (upgraded from Home 2026-07-07, MAK). **RDP host** (fDenyTS=0, NLA, TermService Auto). Public 99.127.21.4. Modern-Standby — kept AC-no-sleep. The machine staff RDP **into**. **Login account: local `Dallas\miche`, NO password — migrated from a Microsoft account via ProfWiz (Mike, 2026-07-10) because the MSA login was BLOCKING RDP; RDP verified working after.** Agent `36c7bbc8-504f-4b4a-8995-3b3e5cdc0f02`; SC `29c62473-a5cb-4e94-a190-c91f05031809`. |
| **DALLAS** | Dallas | **192.168.1.226** (Wi-Fi) | Michelle's Lenovo Yoga Slim 7, Win 11 **Pro for Workstations** (upgraded from Home 2026-07-07, MAK). **RDP host** (fDenyTS=0, NLA, TermService Auto). Public 99.127.21.4. Modern-Standby — kept AC-no-sleep. The machine staff RDP **into**. **Login account: local `Sheldon` — ProfWiz-migrated from Michelle's Microsoft account (Mike, 2026-07-10) because the MSA login was BLOCKING RDP. Password in vault `clients/goldstein/windows-sheldon-local`, set to never expire.** Agent `36c7bbc8-504f-4b4a-8995-3b3e5cdc0f02`; SC `29c62473-a5cb-4e94-a190-c91f05031809`. |
| **DalRes10** | Tucson | **10.1.10.170** (Wi-Fi) | Sheldon's desktop. **RDP host** (fDenyTS=0, NLA) — but **TermService StartType = Manual** (won't auto-start RDP after reboot). Target IP is on **Wi-Fi** (also Ethernet 10.10.1.149 on a *different* segment) so RDP reachability tracks Wi-Fi. Agent `81cde315-013b-4acd-80d7-5ec2b9b5f084`. |
| **ASUS-2024** | Dallas (tag) | roams — Cox `192.168.0.200` when on `Gold-Scop` | **Roaming laptop (Michelle, user `miche`).** Has the OpenVPN client + RDP shortcuts to both targets. Agent `f50b17c1-a711-4e80-89c2-03cb630f5622`; SC `cfddaed7-b6b9-463c-b210-384dec88e0f8`. |
| **GS-Backup** | Tucson | — | Tucson box (name implies backup). Agent `4f52ef22-89ae-4124-a2b4-d339aaf42f53`. |
| **ASUS-2024** | Dallas (tag) | roams — Cox `192.168.0.200` when on `Gold-Scop`; seen in Phoenix 2026-07-10 | **Roaming laptop (Michelle, user `miche`).** Has the OpenVPN client + RDP shortcuts to both targets, plus `RDP DALLAS.rdp` on the Public Desktop (pushed via RMM 2026-07-10). Agent `f50b17c1-a711-4e80-89c2-03cb630f5622`; SC `cfddaed7-b6b9-463c-b210-384dec88e0f8`. |
| **GS-Backup** | Tucson | — | Tucson backup/file-share box. **Local account `Sheldon` added 2026-07-10** (matches the DALLAS account so SMB shares auth seamlessly; same vaulted password, never expires). Agent `4f52ef22-89ae-4124-a2b4-d339aaf42f53`. |
## Access
- **UniFi:** ui.com Site Manager (both Goldstein consoles are "owner") — see Network section.
- **ScreenConnect:** DALLAS `29c62473-…`, DalRes10 `a8b53a73-ff0e-42c9-b51f-4ff71aff45f7`,
ASUS-2024 `cfddaed7-…`, GS-Backup `75f4ee70-…` (all Company=Goldstein).
- **GuruRMM install (Dallas site):** https://rmm.azcomputerguru.com/install/SILVER-PEAK-3739
- **Vault:** `clients/goldstein/openvpn-remote-access.sops.yaml` (OpenVPN/RADIUS).
- **RDP into DALLAS:** local account `DALLAS\Sheldon` (password never expires) — creds in vault.
Works from ASUS-2024 offsite via the Dallas OpenVPN profile, and from the Tucson LAN over Site Magic.
- **Vault:**
- `clients/goldstein/windows-sheldon-local.sops.yaml` — local `Sheldon` account on DALLAS + GS-Backup
- `clients/goldstein/openvpn-remote-access.sops.yaml` — OpenVPN/RADIUS (Tucson + Dallas UCG)
## Patterns & Known Issues
- **Multi-site, one Syncro customer** — Dallas (TX) + Tucson (Armory Park). New endpoints must
@@ -129,15 +134,17 @@ part of the move to OpenVPN.
- **`Gold-Scop` WiFi ≠ UniFi LAN** — it's a separate Cox line (192.168.0.x); a device on it can't
reach either site's internal machines. Use the UniFi "Goldstein" WiFi (10.1.10.x) at the office.
- **DALLAS is Modern-Standby** — kept AC-no-sleep + lid-does-nothing so it stays RDP-reachable.
RDP into DALLAS is single-session (signs Michelle out locally).
RDP into DALLAS is single-session (signs the local user out).
- **DalRes10 target IP is on Wi-Fi** and **TermService is Manual** — RDP can vanish if Wi-Fi drops
or after a reboot until the service is started.
- **No backup agent** detected on DALLAS (2026-07-06) — confirm cloud/local backup need.
- **Microsoft-account login blocked RDP on DALLAS** — RDP/NLA against an MSA-backed account
failed to authenticate. Fixed by migrating the profile to a **local account (no password)**
with **ProfWiz** (ForensiT User Profile Wizard). Pattern: for RDP hosts, prefer a local
account over a Microsoft/Azure-AD account. (A blank-password local account only accepts RDP
if `LimitBlankPasswordUse` is disabled — verify that policy if a no-password RDP host recurs.)
- **Microsoft-account login blocked RDP on DALLAS** — RDP/NLA against an MSA-backed account (Hello
PIN, no cached password) failed to authenticate. Fixed by ProfWiz-migrating the profile to
**local account `Sheldon`** (same profile, local auth; vaulted never-expiring password — Mike,
2026-07-10). A matching `Sheldon` account was created on **GS-Backup** so its SMB shares
authenticate with the same credentials. Pattern: for RDP hosts, prefer a local account over a
Microsoft/Azure-AD account. (A registry fix `DevicePasswordLessBuildVersion=0` was also applied
to DALLAS the same day while pursuing the MSA-password route — harmless, superseded.)
## Active Work
*No open tickets in Syncro as of 2026-07-10 (#32384 "Remote - Issues with remote access" is
@@ -153,8 +160,12 @@ Resolved/invoiced). Break-fix, no prepaid block. Follow-ups below are open work,
- **Billing:** OpenVPN remote-access work (2026-07-10) not yet billed — confirm with Mike.
## History Highlights
- **2026-07-10** — DALLAS RDP fix: the machine was on a **Microsoft account** which blocked RDP;
**Mike migrated it to a local account (no password) with ProfWiz** and verified everything works.
- **2026-07-10** — DALLAS RDP fix completed: the machine was on a **Microsoft account** which
blocked RDP; **Mike ProfWiz-migrated it to local account `Sheldon`** (never-expiring password,
vaulted) and created a matching `Sheldon` account on **GS-Backup** for SMB share access. Earlier
same day the bot set `DevicePasswordLessBuildVersion=0` on DALLAS (superseded), verified
ASUS-2024 → DALLAS 3389 over OpenVPN from Phoenix, and pushed `RDP DALLAS.rdp` to ASUS-2024's
Public Desktop.
- **2026-07-10** — Stood up OpenVPN remote access (both UCGs, RADIUS, users Michelle/Sheldon);
mapped the full UniFi/Site-Magic topology; confirmed Site Magic is LAN-only + locked; DALLAS
offsite RDP working; DalRes10 taken offline by a stray WireGuard tunnel (pending console fix).