sync: auto-sync from GURU-BEAST-ROG at 2026-07-10 17:45:57

Author: Mike Swanson
Machine: GURU-BEAST-ROG
Timestamp: 2026-07-10 17:45:57

clients/goldstein/session-logs/2026-07/2026-07-10-bot-mike-asus2024-dallas-rdp-local-account.md

@@ -0,0 +1,100 @@
+# Session Log — Goldstein: ASUS-2024 -> DALLAS RDP completion + Sheldon local account
+
+## User
+- **Executed by:** ClaudeTools Discord Bot (GURU-BEAST-ROG)
+- **Requested by:** Mike Swanson (@azcomputerguru, via Discord) - admin
+- **Role:** automation (acting on the requester's behalf)
+
+## Session Summary
+
+Follow-up to Howard's #32490 work (DALLAS Home->Pro upgrade + RDP enablement, 2026-07-07). Mike
+reported via Discord (thread 1525291727911653530) that Sheldon Goldstein's staff couldn't RDP from
+ASUS-2024 to DALLAS because DALLAS was signed in with a Microsoft account — MSA + Windows Hello PIN
+blocks RDP password logon under NLA.
+
+Verified connectivity first via GuruRMM: ASUS-2024 (Goldstein/Dallas site, traveling laptop,
+currently in Phoenix on 192.168.0.200 Wi-Fi) reached DALLAS 192.168.1.226:3389 with
+TcpTestSucceeded=True over the OpenVPN Connect tunnel Mike and Howard set up earlier the same day.
+Network path confirmed good; the blocker was purely MSA authentication.
+
+With Mike's go-ahead, dispatched two RMM commands: (1) on DALLAS, set
+`HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device\DevicePasswordLessBuildVersion=0`
+to allow Microsoft-account password sign-in (re-verified fDenyTSConnections=0, TermService running);
+(2) on ASUS-2024, created `C:\Users\Public\Desktop\RDP DALLAS.rdp` (full address 192.168.1.226,
+username hint, prompt for credentials, NLA-compatible).
+
+Mike then superseded the MSA-password route: he used **Profwiz to migrate Michelle's
+Microsoft-account profile on DALLAS to a local account `Sheldon`** and created a matching `Sheldon`
+local account on GS-BACKUP so its SMB shares authenticate with the same credentials. Password set
+to never expire on both machines. Bot vaulted the credential and updated the Goldstein wiki article
+(endpoints, access, patterns, history).
+
+## Key Decisions
+
+- **Verified connectivity before touching auth** — a single Test-NetConnection from ASUS-2024 proved
+  the new OpenVPN tunnel carried 3389 fine, isolating the problem to MSA/NLA authentication.
+- **Local-account migration (Profwiz) chosen over the MSA-password dance** — Mike's call; avoids the
+  fragile "type the MSA password once to cache it" prerequisite and any future Hello/passwordless
+  regressions. The registry fix remains in place but is superseded (harmless).
+- **Matching `Sheldon` account on GS-BACKUP** — same username/password means Windows SMB auth to the
+  Tucson share box works without stored-credential juggling.
+- **Password never expires on both** — deliberate for an unattended RDP target; noted in vault entry.
+
+## Problems Encountered
+
+- **DALLAS agent hostname is `Dallas` (not `DALLAS`)** in GuruRMM — exact-match jq filter missed it
+  on first resolve; found via client-scoped listing.
+- None otherwise; both RMM dispatches exited 0 (stderr contained only benign CLIXML progress noise).
+
+## Configuration Changes
+
+- **DALLAS:** `DevicePasswordLessBuildVersion=0` (HKLM ...\PasswordLess\Device) via RMM cmd
+  136e69fd. By Mike (manual): profile migrated MSA -> local `Sheldon` via Profwiz; password never
+  expires.
+- **GS-BACKUP:** local account `Sheldon` created (matches DALLAS, for SMB shares); password never
+  expires. (By Mike, manual.)
+- **ASUS-2024:** `C:\Users\Public\Desktop\RDP DALLAS.rdp` created via RMM cmd cb533e62.
+- **Repo:** `wiki/clients/goldstein.md` updated (endpoints table, Access, Patterns, History,
+  sources/last_compiled).
+
+## Credentials & Secrets
+
+- **Vault:** `clients/goldstein/windows-sheldon-local.sops.yaml` — local Windows account `Sheldon`,
+  password `Gerdrude788!`, valid on DALLAS and GS-BACKUP, never expires. Documented use: RDP from
+  ASUS-2024 (over OpenVPN) to DALLAS; SMB share auth on GS-BACKUP. Created + verified this session.
+- Referenced (not modified): `clients/goldstein/openvpn-remote-access.sops.yaml`.
+
+## Infrastructure & Servers
+
+- **DALLAS** — 192.168.1.226; agent `36c7bbc8-504f-4b4a-8995-3b3e5cdc0f02` (hostname `Dallas` in RMM);
+  RDP host 3389/NLA; primary logon now `DALLAS\Sheldon`.
+- **ASUS-2024** — agent `f50b17c1-a711-4e80-89c2-03cb630f5622`; traveling laptop, seen in Phoenix
+  (192.168.0.200 Wi-Fi); OpenVPN Connect DCO adapter to Goldstein network; reaches DALLAS 3389.
+- **GS-Backup (Tucson)** — agent `4f52ef22-89ae-4124-a2b4-d339aaf42f53`; hosts SMB shares; new local
+  `Sheldon` account.
+- DalRes10 (Tucson) offline at time of session.
+
+## Commands & Outputs
+
+- Recon (ASUS-2024, cmd cdbeeddd): IPv4 list + `Test-NetConnection 192.168.1.226 -Port 3389` ->
+  `TcpTestSucceeded=True` (via OpenVPN, from Phoenix).
+- DALLAS (cmd 136e69fd): `DevicePasswordLessBuildVersion=0`, `fDenyTSConnections=0 TermService=Running`.
+- ASUS-2024 (cmd cb533e62): `Created C:\Users\Public\Desktop\RDP DALLAS.rdp (129 bytes)`.
+- All dispatched via `ps-encoded.sh` (quote-safe); alerts posted to #dev-alerts.
+
+## Pending / Incomplete Tasks
+
+- **User click-test:** Sheldon/staff to RDP from ASUS-2024 as `DALLAS\Sheldon` and confirm the
+  migrated profile looks right (desktop, files, Outlook). Not yet human-verified.
+- **Syncro:** Mike did not request a ticket; #32490 already invoiced/closed. Open question whether
+  today's work (VPN + this) gets billed separately — Mike/Winter to decide.
+- Prior open items stand: DALLAS Windows updates + reboot pending; no backup agent on DALLAS.
+
+## Reference Information
+
+- Discord thread: 1525291727911653530 (#botmagic, Mike).
+- RMM command IDs: cdbeeddd (recon), 136e69fd (registry), cb533e62 (shortcut).
+- Vault: `clients/goldstein/windows-sheldon-local.sops.yaml`.
+- Prior logs: `clients/goldstein/session-logs/2026-07/2026-07-07-howard-dallas-rdp-pro-upgrade.md`,
+  `2026-07-06-howard-dallas-rmm-onboard.md`.
+- Wiki: `wiki/clients/goldstein.md`.

wiki/clients/goldstein.md

@@ -3,14 +3,15 @@ type: client
 name: goldstein
 display_name: Goldstein (Sheldon Goldstein)
 last_compiled: 2026-07-10
-compiled_by: HOWARD/claude-main (live UniFi + RMM investigation)
+compiled_by: HOWARD/claude-main + BEAST/discord-bot (merged 2026-07-10)
 sources:
   - clients/goldstein/session-logs/2026-07/2026-07-06-howard-dallas-rmm-onboard.md
   - clients/goldstein/session-logs/2026-07/2026-07-07-howard-dallas-rdp-pro-upgrade.md
   - clients/goldstein/onboarding-baselines/DALLAS-20260706T233936.md
   - clients/goldstein/session-logs/2026-07/2026-07-10-howard-openvpn-remote-access-sitemagic.md
   - Live UniFi Site Manager + GuruRMM investigation 2026-07-10 (tickets #32490, #32384)
-  - Howard report 2026-07-10 — DALLAS MSA->local account via ProfWiz (Mike) to fix RDP
+  - clients/goldstein/session-logs/2026-07/2026-07-10-bot-mike-asus2024-dallas-rdp-local-account.md
+  - Discord thread 1525291727911653530 (2026-07-10, Mike — ASUS-2024 RDP + Profwiz local account)
 backlinks: []
 ---
 
@@ -109,17 +110,21 @@ part of the move to OpenVPN.
 ### Endpoints
 | Host | Site | IP (RDP target) | Role / Notes |
 |---|---|---|---|
-| **DALLAS** | Dallas | **192.168.1.226** (Wi-Fi) | Michelle's Lenovo Yoga Slim 7, Win 11 **Pro for Workstations** (upgraded from Home 2026-07-07, MAK). **RDP host** (fDenyTS=0, NLA, TermService Auto). Public 99.127.21.4. Modern-Standby — kept AC-no-sleep. The machine staff RDP **into**. **Login account: local `Dallas\miche`, NO password — migrated from a Microsoft account via ProfWiz (Mike, 2026-07-10) because the MSA login was BLOCKING RDP; RDP verified working after.** Agent `36c7bbc8-504f-4b4a-8995-3b3e5cdc0f02`; SC `29c62473-a5cb-4e94-a190-c91f05031809`. |
+| **DALLAS** | Dallas | **192.168.1.226** (Wi-Fi) | Michelle's Lenovo Yoga Slim 7, Win 11 **Pro for Workstations** (upgraded from Home 2026-07-07, MAK). **RDP host** (fDenyTS=0, NLA, TermService Auto). Public 99.127.21.4. Modern-Standby — kept AC-no-sleep. The machine staff RDP **into**. **Login account: local `Sheldon` — ProfWiz-migrated from Michelle's Microsoft account (Mike, 2026-07-10) because the MSA login was BLOCKING RDP. Password in vault `clients/goldstein/windows-sheldon-local`, set to never expire.** Agent `36c7bbc8-504f-4b4a-8995-3b3e5cdc0f02`; SC `29c62473-a5cb-4e94-a190-c91f05031809`. |
 | **DalRes10** | Tucson | **10.1.10.170** (Wi-Fi) | Sheldon's desktop. **RDP host** (fDenyTS=0, NLA) — but **TermService StartType = Manual** (won't auto-start RDP after reboot). Target IP is on **Wi-Fi** (also Ethernet 10.10.1.149 on a *different* segment) so RDP reachability tracks Wi-Fi. Agent `81cde315-013b-4acd-80d7-5ec2b9b5f084`. |
-| **ASUS-2024** | Dallas (tag) | roams — Cox `192.168.0.200` when on `Gold-Scop` | **Roaming laptop (Michelle, user `miche`).** Has the OpenVPN client + RDP shortcuts to both targets. Agent `f50b17c1-a711-4e80-89c2-03cb630f5622`; SC `cfddaed7-b6b9-463c-b210-384dec88e0f8`. |
+| **ASUS-2024** | Dallas (tag) | roams — Cox `192.168.0.200` when on `Gold-Scop`; seen in Phoenix 2026-07-10 | **Roaming laptop (Michelle, user `miche`).** Has the OpenVPN client + RDP shortcuts to both targets, plus `RDP DALLAS.rdp` on the Public Desktop (pushed via RMM 2026-07-10). Agent `f50b17c1-a711-4e80-89c2-03cb630f5622`; SC `cfddaed7-b6b9-463c-b210-384dec88e0f8`. |
-| **GS-Backup** | Tucson | — | Tucson box (name implies backup). Agent `4f52ef22-89ae-4124-a2b4-d339aaf42f53`. |
+| **GS-Backup** | Tucson | — | Tucson backup/file-share box. **Local account `Sheldon` added 2026-07-10** (matches the DALLAS account so SMB shares auth seamlessly; same vaulted password, never expires). Agent `4f52ef22-89ae-4124-a2b4-d339aaf42f53`. |
 
 ## Access
 - **UniFi:** ui.com Site Manager (both Goldstein consoles are "owner") — see Network section.
 - **ScreenConnect:** DALLAS `29c62473-…`, DalRes10 `a8b53a73-ff0e-42c9-b51f-4ff71aff45f7`,
   ASUS-2024 `cfddaed7-…`, GS-Backup `75f4ee70-…` (all Company=Goldstein).
 - **GuruRMM install (Dallas site):** https://rmm.azcomputerguru.com/install/SILVER-PEAK-3739
-- **Vault:** `clients/goldstein/openvpn-remote-access.sops.yaml` (OpenVPN/RADIUS).
+- **RDP into DALLAS:** local account `DALLAS\Sheldon` (password never expires) — creds in vault.
+  Works from ASUS-2024 offsite via the Dallas OpenVPN profile, and from the Tucson LAN over Site Magic.
+- **Vault:**
+  - `clients/goldstein/windows-sheldon-local.sops.yaml` — local `Sheldon` account on DALLAS + GS-Backup
+  - `clients/goldstein/openvpn-remote-access.sops.yaml` — OpenVPN/RADIUS (Tucson + Dallas UCG)
 
 ## Patterns & Known Issues
 - **Multi-site, one Syncro customer** — Dallas (TX) + Tucson (Armory Park). New endpoints must
@@ -129,15 +134,17 @@ part of the move to OpenVPN.
 - **`Gold-Scop` WiFi ≠ UniFi LAN** — it's a separate Cox line (192.168.0.x); a device on it can't
   reach either site's internal machines. Use the UniFi "Goldstein" WiFi (10.1.10.x) at the office.
 - **DALLAS is Modern-Standby** — kept AC-no-sleep + lid-does-nothing so it stays RDP-reachable.
-  RDP into DALLAS is single-session (signs Michelle out locally).
+  RDP into DALLAS is single-session (signs the local user out).
 - **DalRes10 target IP is on Wi-Fi** and **TermService is Manual** — RDP can vanish if Wi-Fi drops
   or after a reboot until the service is started.
 - **No backup agent** detected on DALLAS (2026-07-06) — confirm cloud/local backup need.
-- **Microsoft-account login blocked RDP on DALLAS** — RDP/NLA against an MSA-backed account
+- **Microsoft-account login blocked RDP on DALLAS** — RDP/NLA against an MSA-backed account (Hello
-  failed to authenticate. Fixed by migrating the profile to a **local account (no password)**
+  PIN, no cached password) failed to authenticate. Fixed by ProfWiz-migrating the profile to
-  with **ProfWiz** (ForensiT User Profile Wizard). Pattern: for RDP hosts, prefer a local
+  **local account `Sheldon`** (same profile, local auth; vaulted never-expiring password — Mike,
-  account over a Microsoft/Azure-AD account. (A blank-password local account only accepts RDP
+  2026-07-10). A matching `Sheldon` account was created on **GS-Backup** so its SMB shares
-  if `LimitBlankPasswordUse` is disabled — verify that policy if a no-password RDP host recurs.)
+  authenticate with the same credentials. Pattern: for RDP hosts, prefer a local account over a
+  Microsoft/Azure-AD account. (A registry fix `DevicePasswordLessBuildVersion=0` was also applied
+  to DALLAS the same day while pursuing the MSA-password route — harmless, superseded.)
 
 ## Active Work
 *No open tickets in Syncro as of 2026-07-10 (#32384 "Remote - Issues with remote access" is
@@ -153,8 +160,12 @@ Resolved/invoiced). Break-fix, no prepaid block. Follow-ups below are open work,
 - **Billing:** OpenVPN remote-access work (2026-07-10) not yet billed — confirm with Mike.
 
 ## History Highlights
-- **2026-07-10** — DALLAS RDP fix: the machine was on a **Microsoft account** which blocked RDP;
+- **2026-07-10** — DALLAS RDP fix completed: the machine was on a **Microsoft account** which
-  **Mike migrated it to a local account (no password) with ProfWiz** and verified everything works.
+  blocked RDP; **Mike ProfWiz-migrated it to local account `Sheldon`** (never-expiring password,
+  vaulted) and created a matching `Sheldon` account on **GS-Backup** for SMB share access. Earlier
+  same day the bot set `DevicePasswordLessBuildVersion=0` on DALLAS (superseded), verified
+  ASUS-2024 → DALLAS 3389 over OpenVPN from Phoenix, and pushed `RDP DALLAS.rdp` to ASUS-2024's
+  Public Desktop.
 - **2026-07-10** — Stood up OpenVPN remote access (both UCGs, RADIUS, users Michelle/Sheldon);
   mapped the full UniFi/Site-Magic topology; confirmed Site Magic is LAN-only + locked; DALLAS
   offsite RDP working; DalRes10 taken offline by a stray WireGuard tunnel (pending console fix).