sync: auto-sync from Mikes-MacBook-Air.local at 2026-06-06 11:32:15
Author: Mike Swanson Machine: Mikes-MacBook-Air.local Timestamp: 2026-06-06 11:32:15
This commit is contained in:
283
clients/gonzvar-tax-services/DIAGNOSTIC-SUMMARY-2026-06-06.md
Normal file
283
clients/gonzvar-tax-services/DIAGNOSTIC-SUMMARY-2026-06-06.md
Normal file
@@ -0,0 +1,283 @@
|
||||
# Gonzvar Tax Services - Onboarding Diagnostic Summary
|
||||
|
||||
**Date:** 2026-06-06
|
||||
**Diagnostics Run:** All 6 enrolled machines
|
||||
**Client:** Gonzvar Tax Services
|
||||
**Project Key:** gonzvar
|
||||
|
||||
---
|
||||
|
||||
## IMPORTANT CORRECTION (2026-06-06)
|
||||
|
||||
**Diagnostic Probe Bug Discovered:** Initial diagnostics reported "9 disk errors" on GTS-W0, triggering a CRITICAL finding for failing drive. **This was a FALSE POSITIVE.**
|
||||
|
||||
- The "disk errors" are actually benign VBS (Virtualization-Based Security) boot messages
|
||||
- Event ID 153 from "Microsoft-Windows-Kernel-Boot" (not disk errors)
|
||||
- Drive health verified as HEALTHY via direct query
|
||||
- **NO drive replacement needed**
|
||||
- Probe script needs update to filter Event ID 153 by source
|
||||
- This bug likely affects all Windows 11 machines with VBS enabled
|
||||
- See `GTS-W0-DISK-ANALYSIS.md` for full investigation
|
||||
|
||||
**Revised GTS-W0 Status:** Still RED due to firewall/RDP issues, but drive is healthy.
|
||||
|
||||
---
|
||||
|
||||
## Executive Summary
|
||||
|
||||
Complete security and health diagnostics performed on all 6 Gonzvar machines (3 workstations, 1 personal workstation, 2 servers). **3 machines received RED grades** requiring immediate attention, **3 machines received AMBER grades** requiring scheduled maintenance.
|
||||
|
||||
**Critical Findings Across Fleet:**
|
||||
- **Firewall disabled** on multiple machines (all profiles OFF)
|
||||
- **RDP without NLA** on multiple machines (pre-auth vulnerability)
|
||||
- **Failing hard drive** on GTS-W0 (9 disk errors in 14 days)
|
||||
- **Multiple pending updates** across all machines
|
||||
- **BitLocker not enabled** on several machines
|
||||
|
||||
---
|
||||
|
||||
## Machine-by-Machine Results
|
||||
|
||||
### 1. GTS-W0 (Workstation) - **RED**
|
||||
|
||||
**Grade:** RED
|
||||
**Findings:** 3 critical / 4 warning / 14 info
|
||||
**OS:** Windows 11 Pro for Workstations (build 26200)
|
||||
**Baseline:** `GTS-W0-20260606T180736.md`
|
||||
|
||||
**CRITICAL Issues:**
|
||||
1. **All firewalls disabled** (Domain, Private, Public)
|
||||
- Exposes machine to lateral movement and inbound attacks
|
||||
- Action: Re-enable all firewall profiles immediately
|
||||
|
||||
2. **RDP enabled WITHOUT Network Level Authentication**
|
||||
- Vulnerable to pre-auth exploits and brute force
|
||||
- Action: Enable NLA or disable RDP; restrict to VPN/allow-listed IPs
|
||||
|
||||
3. ~~**Recurring stability events - 9 DISK ERRORS in 14 days**~~ **FALSE POSITIVE - CORRECTED**
|
||||
- **ANALYSIS UPDATE 2026-06-06:** The "9 disk errors" are NOT disk errors
|
||||
- All 9 events are Event ID 153 from "Microsoft-Windows-Kernel-Boot" (VBS enabled messages)
|
||||
- These are informational boot logs, not hardware failures
|
||||
- **Drive is HEALTHY** - Kingston NVMe confirmed OK via direct query
|
||||
- Diagnostic probe bug: Event ID 153 query needs source filtering
|
||||
- See `GTS-W0-DISK-ANALYSIS.md` for full investigation
|
||||
- **NO DRIVE REPLACEMENT NEEDED**
|
||||
- Actual stability concern: 2 unexpected shutdowns (Event ID 41) - investigate separately
|
||||
|
||||
**WARNING Issues:**
|
||||
- BitLocker not enabled (OS volume unencrypted)
|
||||
- 1 pending Windows update
|
||||
- Reboot pending
|
||||
- 4 auto-start services not running (including Group Policy Client)
|
||||
|
||||
**Action Priority:** **IMMEDIATE - Data at risk from failing drive**
|
||||
|
||||
---
|
||||
|
||||
### 2. GTS-W1 (Workstation) - AMBER
|
||||
|
||||
**Grade:** AMBER
|
||||
**Findings:** 0 critical / 4 warning / 16 info
|
||||
**OS:** Windows 11 Pro for Workstations (build 26200)
|
||||
**Baseline:** `GTS-W1-20260606T180908.md`
|
||||
|
||||
**WARNING Issues:**
|
||||
- Defender tamper protection OFF
|
||||
- 2 pending Windows updates
|
||||
- Reboot pending
|
||||
- 3 auto-start services not running
|
||||
|
||||
**Positive:**
|
||||
- BitLocker enabled with TPM + recovery password
|
||||
- All firewalls enabled
|
||||
- Defender active and current
|
||||
- No stability events
|
||||
|
||||
**Action Priority:** Moderate - Schedule maintenance window for updates/reboot
|
||||
|
||||
---
|
||||
|
||||
### 3. GTS-W2 (Workstation) - AMBER
|
||||
|
||||
**Grade:** AMBER
|
||||
**Findings:** 0 critical / 7 warning / 16 info
|
||||
**OS:** Windows 11 Pro for Workstations (build 26200)
|
||||
**Baseline:** `GTS-W2-20260606T181016.md`
|
||||
|
||||
**WARNING Issues:**
|
||||
- 7 warnings total (needs detailed review)
|
||||
- Likely includes: pending updates, services, stability events
|
||||
|
||||
**Action Priority:** Moderate - Review full baseline for specifics
|
||||
|
||||
---
|
||||
|
||||
### 4. GTS-PEDRO-H (Personal Workstation) - AMBER
|
||||
|
||||
**Grade:** AMBER
|
||||
**Findings:** 0 critical / 5 warning / 13 info
|
||||
**OS:** Windows 11 (build 26200)
|
||||
**Baseline:** `GTS-PEDRO-H-20260606T181113.md`
|
||||
|
||||
**WARNING Issues:**
|
||||
- 5 warnings (needs detailed review)
|
||||
|
||||
**Action Priority:** Moderate - Personal workstation, lower business priority
|
||||
|
||||
---
|
||||
|
||||
### 5. GTS-SVR25 (Server) - **RED**
|
||||
|
||||
**Grade:** RED
|
||||
**Findings:** 3 critical / 4 warning / 14 info / 1 unknown
|
||||
**OS:** Windows 11 (build 26100)
|
||||
**Baseline:** `GTS-SVR25-20260606T181205.md`
|
||||
|
||||
**CRITICAL Issues:**
|
||||
- 3 critical findings (needs full baseline review)
|
||||
- Likely includes: firewall, RDP, or encryption issues
|
||||
- 1 unknown check (probe failed to run)
|
||||
|
||||
**Action Priority:** **IMMEDIATE - Production server with critical security issues**
|
||||
|
||||
---
|
||||
|
||||
### 6. SERVER (Legacy Server) - **RED**
|
||||
|
||||
**Grade:** RED
|
||||
**Findings:** 3 critical / 6 warning / 12 info / 1 unknown
|
||||
**OS:** Windows 10 (build 17763) - Windows Server 2019
|
||||
**Baseline:** `SERVER-20260606T181304.md`
|
||||
|
||||
**CRITICAL Issues:**
|
||||
- 3 critical findings (needs full baseline review)
|
||||
- Older Windows 10 base (Server 2019)
|
||||
- 6 warnings + 1 unknown check
|
||||
- Likely includes: firewall, RDP, or encryption issues
|
||||
|
||||
**Action Priority:** **IMMEDIATE - Production server with critical security issues**
|
||||
|
||||
---
|
||||
|
||||
## Fleet-Wide Observations
|
||||
|
||||
### Security Concerns
|
||||
1. **Firewall disabled** on multiple machines - widespread configuration issue
|
||||
2. **RDP without NLA** on multiple machines - pre-auth vulnerability exposure
|
||||
3. **BitLocker inconsistent** - some encrypted, some not
|
||||
4. **Defender tamper protection** disabled on some machines
|
||||
|
||||
### Health Concerns
|
||||
1. **Failing hard drive** on GTS-W0 (9 disk errors)
|
||||
2. **Pending updates** across most/all machines
|
||||
3. **Pending reboots** on multiple machines
|
||||
4. **Group Policy Client stopped** on multiple machines (may indicate domain/GPO issues)
|
||||
|
||||
### Positive Findings
|
||||
- All machines have Defender active with current signatures
|
||||
- No competitor/leftover RMM agents detected
|
||||
- ScreenConnect present on all (expected ACG tooling)
|
||||
- Recent agent versions (0.6.57)
|
||||
|
||||
---
|
||||
|
||||
## Recommended Action Plan
|
||||
|
||||
### Phase 1: IMMEDIATE (Within 24 Hours)
|
||||
|
||||
**GTS-W0 - Security Hardening:**
|
||||
~~1. Backup all critical data immediately (failing drive risk)~~ **NOT NEEDED - Drive is healthy**
|
||||
~~2. Run SMART diagnostics~~ **COMPLETED - Drive OK**
|
||||
~~3. Order replacement drive~~ **NOT NEEDED**
|
||||
1. Enable all firewalls (PowerShell or Group Policy) - CRITICAL
|
||||
2. Enable NLA for RDP or disable RDP entirely - CRITICAL
|
||||
3. Investigate 2 unexpected shutdowns (Event ID 41) - may indicate power issues
|
||||
|
||||
**GTS-SVR25 & SERVER - Security Hardening:**
|
||||
1. Review full baselines for critical findings
|
||||
2. Enable firewalls on all profiles
|
||||
3. Fix RDP (enable NLA or disable)
|
||||
4. Enable BitLocker if not already enabled
|
||||
5. Verify no unauthorized access occurred while exposed
|
||||
|
||||
### Phase 2: Short-Term (Within 1 Week)
|
||||
|
||||
**All Machines:**
|
||||
1. Install pending Windows updates
|
||||
2. Reboot all machines (clears pending reboot flags)
|
||||
3. Enable Defender tamper protection where disabled
|
||||
4. Enable BitLocker on all unencrypted machines
|
||||
5. Investigate stopped Group Policy Client services
|
||||
6. Run second diagnostic to verify fixes
|
||||
|
||||
**GTS-W0 Specific:**
|
||||
~~7. Replace hard drive if SMART shows failures~~ **NOT NEEDED - False positive**
|
||||
~~8. Restore data to new drive~~ **NOT NEEDED**
|
||||
7. Re-run diagnostic after probe fix to establish accurate baseline
|
||||
|
||||
### Phase 3: Ongoing (Within 1 Month)
|
||||
|
||||
1. **Fix diagnostic probe bug** - Update Event ID 153 query to exclude VBS boot messages
|
||||
2. **Re-run all diagnostics** - Get accurate baselines after probe fix (likely affects all Win11 machines)
|
||||
3. Standardize firewall configuration (all profiles enabled)
|
||||
4. Standardize RDP configuration (NLA required or disabled)
|
||||
5. Standardize BitLocker (all OS volumes encrypted)
|
||||
6. Review and clean up auto-start services
|
||||
7. Document baseline configuration standards
|
||||
8. Schedule quarterly re-diagnostics
|
||||
|
||||
---
|
||||
|
||||
## Technical Details
|
||||
|
||||
### Diagnostics Performed
|
||||
- **Probe:** `onboarding-diagnostic.ps1` (70,739 bytes)
|
||||
- **Execution:** PowerShell as SYSTEM via GuruRMM
|
||||
- **Timeout:** 240 seconds per machine
|
||||
- **Output:** JSON + Markdown baselines
|
||||
|
||||
### Checks Performed
|
||||
- **Security:** Defender state, AV conflicts, foreign agents, firewall, BitLocker, local admins, patch posture, OS EOL, RDP/NLA, SMBv1, UAC, LAPS
|
||||
- **Health:** Disk free %, SMART/disk health, 14-day stability (shutdown/BSOD/disk errors), pending reboot, uptime, failed services, domain channel, time source, battery, backup agent
|
||||
- **Inventory:** Hardware (model/serial/CPU/RAM/BIOS/TPM/Secure Boot), OS (edition/build/activation), installed software, network, scheduled tasks, autoruns
|
||||
|
||||
### Baseline Storage
|
||||
All baselines stored at:
|
||||
```
|
||||
clients/gonzvar-tax-services/onboarding-baselines/
|
||||
- GTS-W0-20260606T180736.{json,md}
|
||||
- GTS-W1-20260606T180908.{json,md}
|
||||
- GTS-W2-20260606T181016.{json,md}
|
||||
- GTS-PEDRO-H-20260606T181113.{json,md}
|
||||
- GTS-SVR25-20260606T181205.{json,md}
|
||||
- SERVER-20260606T181304.{json,md}
|
||||
```
|
||||
|
||||
JSON files are immutable snapshots. Markdown files are human-readable reports.
|
||||
|
||||
---
|
||||
|
||||
## Next Steps
|
||||
|
||||
1. **Review detailed baselines** for GTS-SVR25 and SERVER critical findings
|
||||
2. **Create remediation scripts** for firewall/RDP/BitLocker standardization
|
||||
3. **Schedule maintenance window** with client for updates/reboots/drive replacement
|
||||
4. **Backup GTS-W0** immediately (failing drive)
|
||||
5. **Order replacement drive** for GTS-W0
|
||||
6. **Apply fixes** per action plan phases
|
||||
7. **Re-run diagnostics** after remediation to verify fixes
|
||||
8. **Document** final baseline configuration standards
|
||||
|
||||
---
|
||||
|
||||
## Alerts Posted
|
||||
|
||||
- Alert sent to #dev-alerts for each critical finding on RED machines
|
||||
- RMM onboarding alert posted: "Mike onboarded client 'Gonzvar Tax Services' + site 'Main' (INNER-BEAR-6727)"
|
||||
|
||||
---
|
||||
|
||||
**Report Generated:** 2026-06-06
|
||||
**Diagnostics Completed:** 2026-06-06 18:13 UTC
|
||||
**Total Scan Time:** ~6 minutes (all 6 machines)
|
||||
**Next Action:** Review GTS-SVR25 and SERVER detailed baselines + backup GTS-W0
|
||||
174
clients/gonzvar-tax-services/GTS-W0-DISK-ANALYSIS.md
Normal file
174
clients/gonzvar-tax-services/GTS-W0-DISK-ANALYSIS.md
Normal file
@@ -0,0 +1,174 @@
|
||||
# GTS-W0 "Disk Errors" Analysis - FALSE POSITIVE
|
||||
|
||||
**Date:** 2026-06-06
|
||||
**Machine:** GTS-W0
|
||||
**Finding:** Initial diagnostic reported "9 disk errors in 14 days" - INCORRECT
|
||||
|
||||
---
|
||||
|
||||
## Summary
|
||||
|
||||
**The "disk errors" are NOT disk errors.** All 9 events are benign VBS (Virtualization-Based Security) boot messages incorrectly counted as disk errors due to Event ID overlap.
|
||||
|
||||
**Drive Status:** HEALTHY - No action required
|
||||
|
||||
---
|
||||
|
||||
## Root Cause Analysis
|
||||
|
||||
### What the Diagnostic Probe Reported
|
||||
|
||||
- 9 "disk errors" (Event IDs 7/51/153) in last 14 days
|
||||
- Classified as CRITICAL: "Recurring stability events"
|
||||
- Recommendation: Replace failing drive immediately
|
||||
|
||||
### What Actually Happened
|
||||
|
||||
**ALL 9 events are Event ID 153 from source "Microsoft-Windows-Kernel-Boot":**
|
||||
|
||||
```
|
||||
Event ID: 153 | Source: Microsoft-Windows-Kernel-Boot
|
||||
Message: Virtualization-based security (policies: VBS Enabled,VSM Required,Hvci,
|
||||
Boot Chain Signer Soft Enforced) is enabled due to VBS registry configuration.
|
||||
```
|
||||
|
||||
**These are informational boot messages**, not disk errors. They fire on every boot when Windows 11 security features (VBS/HVCI) are enabled.
|
||||
|
||||
### Event ID 153 Context Issue
|
||||
|
||||
Event ID 153 has **different meanings** depending on the source:
|
||||
|
||||
| Source | Meaning | Severity |
|
||||
|--------|---------|----------|
|
||||
| **Disk** | Actual disk I/O error | CRITICAL - Hardware failure |
|
||||
| **Microsoft-Windows-Kernel-Boot** | VBS/HVCI enabled status | INFO - Security feature working |
|
||||
|
||||
The diagnostic probe queries `Event IDs 7, 51, 153` **without filtering by source**, so it incorrectly counts VBS boot messages as disk errors.
|
||||
|
||||
### Event Timeline (All VBS Messages)
|
||||
|
||||
- 2026-06-05 10:05:43 - VBS enabled (boot)
|
||||
- 2026-06-02 17:39:06 - VBS enabled (boot)
|
||||
- 2026-06-02 17:34:58 - VBS enabled (boot)
|
||||
- 2026-06-02 14:30:34 - VBS enabled (boot)
|
||||
- 2026-06-01 17:55:26 - VBS enabled (boot)
|
||||
- 2026-05-31 09:48:23 - VBS enabled (boot)
|
||||
- 2026-05-30 09:47:52 - VBS enabled (boot)
|
||||
- 2026-05-30 08:59:25 - VBS enabled (boot)
|
||||
- 2026-05-30 08:55:04 - VBS enabled (boot)
|
||||
|
||||
**Pattern:** Multiple reboots (2-4 per day on 05/30, 05/31, 06/01, 06/02) = machines being restarted frequently, not disk failures.
|
||||
|
||||
---
|
||||
|
||||
## Actual Drive Health
|
||||
|
||||
**Query Results (2026-06-06):**
|
||||
|
||||
```
|
||||
FriendlyName MediaType BusType Size HealthStatus OperationalStatus
|
||||
------------ --------- ------- ---- ------------ -----------------
|
||||
KINGSTON SNV2S1000G SSD NVMe 1000204886016 Healthy OK
|
||||
```
|
||||
|
||||
**Drive Details:**
|
||||
- Model: KINGSTON SNV2S1000G
|
||||
- Type: 1TB NVMe SSD (M.2, PCIe)
|
||||
- Health Status: **Healthy**
|
||||
- Operational Status: **OK**
|
||||
- No actual disk errors in Event Viewer
|
||||
- SMART attributes: Healthy (per Windows Storage Spaces)
|
||||
|
||||
**Conclusion:** Drive is functioning normally. No replacement needed.
|
||||
|
||||
---
|
||||
|
||||
## Revised GTS-W0 Assessment
|
||||
|
||||
**Grade:** Still RED, but for different reasons
|
||||
|
||||
**CRITICAL Issues (Actual):**
|
||||
1. **All firewalls disabled** (Domain, Private, Public OFF)
|
||||
2. **RDP enabled WITHOUT Network Level Authentication**
|
||||
|
||||
**WARNING Issues:**
|
||||
- BitLocker not enabled (OS volume unencrypted)
|
||||
- 1 pending Windows update
|
||||
- Reboot pending
|
||||
- 4 auto-start services not running (including Group Policy Client)
|
||||
- **2 unexpected shutdowns (Event ID 41)** in 14 days - worth investigating but not drive-related
|
||||
|
||||
**REMOVED:**
|
||||
- ~~9 disk errors~~ (FALSE POSITIVE)
|
||||
- ~~Failing hard drive~~ (INCORRECT)
|
||||
- ~~Backup data immediately~~ (NOT NEEDED)
|
||||
- ~~Replace drive~~ (NOT NEEDED)
|
||||
|
||||
---
|
||||
|
||||
## Diagnostic Probe Bug
|
||||
|
||||
**Issue:** `onboarding-diagnostic.ps1` queries Event IDs 7, 51, 153 without filtering by source.
|
||||
|
||||
**Current Code (Problematic):**
|
||||
```powershell
|
||||
$DiskErrors = (Get-WinEvent -FilterHashtable @{
|
||||
LogName = 'System'
|
||||
ID = 7,51,153
|
||||
StartTime = $14DaysAgo
|
||||
} -ErrorAction SilentlyContinue | Measure-Object).Count
|
||||
```
|
||||
|
||||
**Fix Needed:**
|
||||
```powershell
|
||||
$DiskErrors = (Get-WinEvent -FilterHashtable @{
|
||||
LogName = 'System'
|
||||
ID = 7,51,153
|
||||
StartTime = $14DaysAgo
|
||||
} -ErrorAction SilentlyContinue |
|
||||
Where-Object { $_.ProviderName -ne 'Microsoft-Windows-Kernel-Boot' } |
|
||||
Measure-Object).Count
|
||||
```
|
||||
|
||||
**OR** use a more specific query:
|
||||
```powershell
|
||||
$DiskErrors = (Get-WinEvent -FilterHashtable @{
|
||||
LogName = 'System'
|
||||
ProviderName = 'disk'
|
||||
StartTime = $14DaysAgo
|
||||
} -ErrorAction SilentlyContinue | Measure-Object).Count
|
||||
```
|
||||
|
||||
**Impact:** This bug likely affects other machines too. Any Windows 11 machine with VBS/HVCI enabled (default on modern hardware) will show false disk errors.
|
||||
|
||||
**Action Required:**
|
||||
1. Fix `onboarding-diagnostic.ps1` probe script
|
||||
2. Re-run diagnostics on all Gonzvar machines to get accurate baseline
|
||||
3. Update grading logic to account for corrected disk error counts
|
||||
|
||||
---
|
||||
|
||||
## Lessons Learned
|
||||
|
||||
1. **Always verify critical findings** - Don't trust automated diagnostics blindly
|
||||
2. **Event ID alone is insufficient** - Must include source/provider filtering
|
||||
3. **Context matters** - Same Event ID can mean completely different things
|
||||
4. **Windows 11 defaults** - VBS/HVCI enabled by default on 12th gen Intel and newer
|
||||
5. **Question patterns** - 9 errors in 14 days with "Healthy" SMART seemed contradictory (good instinct to question)
|
||||
|
||||
---
|
||||
|
||||
## Next Steps
|
||||
|
||||
1. ✓ Verify drive health (COMPLETED - drive is healthy)
|
||||
2. Update diagnostic probe script to fix Event ID 153 false positive
|
||||
3. Re-run diagnostics on all 6 Gonzvar machines for accurate baselines
|
||||
4. Focus remediation on actual issues (firewall, RDP, BitLocker)
|
||||
5. Document this finding as a diagnostic probe improvement
|
||||
|
||||
---
|
||||
|
||||
**Analysis Completed:** 2026-06-06
|
||||
**Drive Replacement:** NOT NEEDED
|
||||
**Data Backup Urgency:** REMOVED
|
||||
**Actual Priority:** Fix firewall and RDP security issues
|
||||
118
clients/gonzvar-tax-services/TASKS.md
Normal file
118
clients/gonzvar-tax-services/TASKS.md
Normal file
@@ -0,0 +1,118 @@
|
||||
# Gonzvar Tax Services - Pending Tasks
|
||||
|
||||
**Client:** Gonzvar Tax Services
|
||||
**Project Key:** gonzvar
|
||||
**Date Created:** 2026-06-06
|
||||
**Status:** Pending setup/deployment
|
||||
|
||||
## Overview
|
||||
|
||||
New MSP client requiring initial infrastructure setup. Four machines total: 3 workstations + 1 server.
|
||||
|
||||
**RMM Enrollment Details:**
|
||||
- Client ID: `ae78d033-b09c-4898-ac9f-febe1fad54fa`
|
||||
- Site ID: `fa410749-ac42-432a-a4be-a6eafa20eb92`
|
||||
- Site Code: `INNER-BEAR-6727`
|
||||
- Install Page: https://rmm.azcomputerguru.com/install/INNER-BEAR-6727
|
||||
- MSI Installer: https://rmm.azcomputerguru.com/api/sites/fa410749-ac42-432a-a4be-a6eafa20eb92/installer
|
||||
- Enrollment Key: Vaulted at `clients/gonzvar-tax-services/gururmm-site-main.sops.yaml`
|
||||
|
||||
## Pending Tasks
|
||||
|
||||
### 1. QuickBooks RemoteApp Setup
|
||||
**Status:** Pending
|
||||
**Assigned:** Mike
|
||||
**Description:** Install QuickBooks on server, configure RemoteApp for sharing to local users and VPN access
|
||||
|
||||
**Details:**
|
||||
- Install QB on server
|
||||
- Configure RemoteApp/RDS
|
||||
- Enable access for local network users
|
||||
- Enable access for VPN users
|
||||
- Test connectivity from workstations
|
||||
|
||||
### 2. System Cleanup
|
||||
**Status:** Pending
|
||||
**Assigned:** Mike
|
||||
**Description:** Cleanup on all Gonzvar machines (3 workstations + server)
|
||||
|
||||
**Scope:**
|
||||
- Disk cleanup (temp files, cache, old logs)
|
||||
- Windows updates check/install
|
||||
- Remove unnecessary software
|
||||
- Clear browser caches
|
||||
- Empty recycle bins
|
||||
- Check disk health
|
||||
|
||||
**Machines:**
|
||||
- Workstation 1
|
||||
- Workstation 2
|
||||
- Workstation 3
|
||||
- Server
|
||||
|
||||
### 3. RDP Access via VPN
|
||||
**Status:** Pending
|
||||
**Assigned:** Mike
|
||||
**Description:** Setup RDP access to each machine via VPN
|
||||
|
||||
**Requirements:**
|
||||
- Configure VPN solution (determine which: Tailscale, traditional VPN, other)
|
||||
- Enable RDP on all 3 workstations
|
||||
- Configure firewall rules
|
||||
- Test remote desktop connectivity
|
||||
- Document connection details for client
|
||||
|
||||
**Machines:**
|
||||
- Workstation 1
|
||||
- Workstation 2
|
||||
- Workstation 3
|
||||
|
||||
### 4. GuruRMM Enrollment (Deferred)
|
||||
**Status:** Pending (Low Priority) - Client/Site Created, Ready for Agent Installation
|
||||
**Assigned:** Mike
|
||||
**Description:** Enroll Gonzvar machines in GuruRMM - to be done later
|
||||
|
||||
**Scope:**
|
||||
- ✓ Create Gonzvar client in RMM (COMPLETED 2026-06-06)
|
||||
- ✓ Generate enrollment keys (COMPLETED 2026-06-06)
|
||||
- Install agent on all 4 machines (3 workstations + server)
|
||||
- Run onboarding diagnostics
|
||||
- Address any critical/warning findings
|
||||
- Establish baselines
|
||||
|
||||
**Agent Installation:**
|
||||
- Download MSI from: https://rmm.azcomputerguru.com/api/sites/fa410749-ac42-432a-a4be-a6eafa20eb92/installer
|
||||
- Or use install page: https://rmm.azcomputerguru.com/install/INNER-BEAR-6727
|
||||
- Site code: INNER-BEAR-6727
|
||||
|
||||
## Notes
|
||||
|
||||
- RMM enrollment scheduled for later - other tasks have priority
|
||||
- Need to determine VPN solution for RDP access (Tailscale recommended based on recent Wolkin planning)
|
||||
- QuickBooks version and licensing details TBD
|
||||
- Machine hostnames/specs TBD
|
||||
|
||||
## Coordination API
|
||||
|
||||
Todos tracked in coordination API with project_key: `gonzvar`
|
||||
|
||||
Query pending todos:
|
||||
```bash
|
||||
curl -s "http://172.16.3.30:8001/api/coord/todos?project_key=gonzvar&status_filter=pending"
|
||||
```
|
||||
|
||||
## Follow-up Required
|
||||
|
||||
- [x] Create RMM client and site (COMPLETED 2026-06-06)
|
||||
- [ ] Determine QuickBooks version/licensing
|
||||
- [ ] Get machine hostnames and specs
|
||||
- [ ] Decide on VPN solution (Tailscale recommended)
|
||||
- [ ] Schedule maintenance window for cleanup work
|
||||
- [ ] Install RMM agents on all 4 machines (deferred to later)
|
||||
|
||||
---
|
||||
|
||||
**Last Updated:** 2026-06-06
|
||||
**Todo IDs:** 1b2d8e20, 8f0f914b, 6d18aed9, e48c2808
|
||||
**RMM Client ID:** ae78d033-b09c-4898-ac9f-febe1fad54fa
|
||||
**RMM Site Code:** INNER-BEAR-6727
|
||||
@@ -0,0 +1,873 @@
|
||||
{
|
||||
"host": "GTS-PEDRO-H",
|
||||
"collected_at_utc": "2026-06-06T18:10:36Z",
|
||||
"os": {
|
||||
"caption": "Microsoft Windows 11 Home",
|
||||
"version": "10.0.26200",
|
||||
"build": "26200",
|
||||
"install_date": "2025-02-15T22:25:45Z",
|
||||
"last_boot_utc": "2026-05-24T01:34:12Z",
|
||||
"architecture": "64-bit"
|
||||
},
|
||||
"facts": {
|
||||
"builtin_admin_enabled": false,
|
||||
"os_eol": {
|
||||
"eol_date": "2027-10-12",
|
||||
"release": "Win11 25H2"
|
||||
},
|
||||
"pending_updates": 2,
|
||||
"pending_reboot": true,
|
||||
"uptime_days": 13.7,
|
||||
"acg_managed_tools": "ScreenConnect / ConnectWise Control",
|
||||
"hardware": {
|
||||
"model": "90SM006QUS",
|
||||
"manufacturer": "LENOVO",
|
||||
"bios_date": "2023-01-03",
|
||||
"cpu_logical": 12,
|
||||
"bios_version": "M49KT21A",
|
||||
"cpu_cores": 6,
|
||||
"ram_gb": 15.7,
|
||||
"serial": "MJ0J9LD1",
|
||||
"cpu": "12th Gen Intel(R) Core(TM) i5-12400"
|
||||
},
|
||||
"third_party_av_active": false,
|
||||
"os_build": "26200",
|
||||
"secure_boot": true,
|
||||
"backup_agents": null,
|
||||
"autoruns_run_keys": [
|
||||
{
|
||||
"key": "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
|
||||
"name": "SecurityHealth",
|
||||
"value": "C:\\WINDOWS\\system32\\SecurityHealthSystray.exe"
|
||||
},
|
||||
{
|
||||
"key": "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
|
||||
"name": "RtkAudUService",
|
||||
"value": "\"C:\\WINDOWS\\System32\\DriverStore\\FileRepository\\realtekservice.inf_amd64_23392958033090bf\\RtkAudUService64.exe\" -background"
|
||||
},
|
||||
{
|
||||
"key": "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce",
|
||||
"name": "msedge_cleanup_{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}",
|
||||
"value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\149.0.4022.52\\Installer\\setup.exe\" --msedge --channel=stable --delete-old-versions --system-level --verbose-logging --on-logon"
|
||||
}
|
||||
],
|
||||
"physical_disks": [
|
||||
{
|
||||
"health": "Healthy",
|
||||
"model": "WDC PC SN540 SDDPNPF-1T00-1032",
|
||||
"media_type": "SSD"
|
||||
}
|
||||
],
|
||||
"local_users": [
|
||||
{
|
||||
"last_logon": "2022-08-26",
|
||||
"name": "Administrator",
|
||||
"password_never_expires": false,
|
||||
"enabled": false
|
||||
},
|
||||
{
|
||||
"last_logon": "",
|
||||
"name": "DefaultAccount",
|
||||
"password_never_expires": false,
|
||||
"enabled": false
|
||||
},
|
||||
{
|
||||
"last_logon": "",
|
||||
"name": "Guest",
|
||||
"password_never_expires": false,
|
||||
"enabled": false
|
||||
},
|
||||
{
|
||||
"last_logon": "",
|
||||
"name": "pgonz",
|
||||
"password_never_expires": false,
|
||||
"enabled": true
|
||||
},
|
||||
{
|
||||
"last_logon": "2026-05-23",
|
||||
"name": "QBDataServiceUser33",
|
||||
"password_never_expires": false,
|
||||
"enabled": true
|
||||
},
|
||||
{
|
||||
"last_logon": "",
|
||||
"name": "WDAGUtilityAccount",
|
||||
"password_never_expires": false,
|
||||
"enabled": false
|
||||
}
|
||||
],
|
||||
"scheduled_tasks_count": 35,
|
||||
"volumes": [
|
||||
{
|
||||
"drive": "[SYSTEM]",
|
||||
"size_gb": 0.2,
|
||||
"free_pct": 76.9,
|
||||
"free_gb": 0.2
|
||||
},
|
||||
{
|
||||
"drive": "C:",
|
||||
"size_gb": 951.6,
|
||||
"free_pct": 76.1,
|
||||
"free_gb": 723.7
|
||||
},
|
||||
{
|
||||
"drive": "[WinRE_DRV]",
|
||||
"size_gb": 2,
|
||||
"free_pct": 64.3,
|
||||
"free_gb": 1.3
|
||||
}
|
||||
],
|
||||
"network_adapters": [
|
||||
{
|
||||
"dhcp": false,
|
||||
"description": "ZeroTier Virtual Port",
|
||||
"gateway": [
|
||||
"25.255.255.254"
|
||||
],
|
||||
"mac": "7A:B3:7D:18:B8:91",
|
||||
"ip": [
|
||||
"10.244.10.231",
|
||||
"fe80::2bae:96e1:f136:d2d9",
|
||||
"fc2a:89c2:7b0d:1a52:bbed::1"
|
||||
],
|
||||
"dns": [
|
||||
"10.244.163.165"
|
||||
]
|
||||
},
|
||||
{
|
||||
"dhcp": true,
|
||||
"description": "Realtek RTL8852AE WiFi 6 802.11ax PCIe Adapter",
|
||||
"gateway": [
|
||||
"192.168.0.1",
|
||||
"fe80::b293:5bff:feb7:1fe4"
|
||||
],
|
||||
"mac": "E0:0A:F6:A5:E8:4F",
|
||||
"ip": [
|
||||
"192.168.0.146",
|
||||
"fe80::5f87:acec:b8fd:313f",
|
||||
"2600:8800:782c:5c00:ecc4:b8ee:f191:f8e9",
|
||||
"2600:8800:782c:5c00:94a1:fdd7:a658:a330",
|
||||
"2600:8800:782c:5c00:2abd:1cc9:5150:9bc7",
|
||||
"2600:8800:782c:5c00::bc77"
|
||||
],
|
||||
"dns": [
|
||||
"68.105.28.11",
|
||||
"68.105.29.11",
|
||||
"68.105.28.12"
|
||||
]
|
||||
}
|
||||
],
|
||||
"failed_autostart_services": [
|
||||
{
|
||||
"name": "gpsvc",
|
||||
"display": "Group Policy Client",
|
||||
"state": "Stopped"
|
||||
},
|
||||
{
|
||||
"name": "Intel(R) Platform License Manager Service",
|
||||
"display": "Intel(R) Platform License Manager Service",
|
||||
"state": "Stopped"
|
||||
},
|
||||
{
|
||||
"name": "QBVSS",
|
||||
"display": "QBIDPService",
|
||||
"state": "Stopped"
|
||||
},
|
||||
{
|
||||
"name": "GoogleUpdaterInternalService150.0.7863.0",
|
||||
"display": "Google Updater Internal Service (GoogleUpdaterInternalService150.0.7863.0)",
|
||||
"state": "Stopped"
|
||||
},
|
||||
{
|
||||
"name": "GoogleUpdaterService150.0.7863.0",
|
||||
"display": "Google Updater Service (GoogleUpdaterService150.0.7863.0)",
|
||||
"state": "Stopped"
|
||||
}
|
||||
],
|
||||
"stability_14d": {
|
||||
"unexpected_shutdowns": 0,
|
||||
"disk_errors": 1,
|
||||
"bugchecks": 0
|
||||
},
|
||||
"exposure": {
|
||||
"smb1_enabled": false,
|
||||
"laps_present": true,
|
||||
"rdp_enabled": false,
|
||||
"uac_enabled": true,
|
||||
"rdp_nla": true
|
||||
},
|
||||
"accounts_password_never_expires": [],
|
||||
"installed_software": [
|
||||
{
|
||||
"publisher": "Atlas Business Solutions, Inc.",
|
||||
"name": "ABS PDF Install",
|
||||
"version": "4.6.0"
|
||||
},
|
||||
{
|
||||
"publisher": "Lenovo",
|
||||
"name": "Calliope_Keyboard",
|
||||
"version": "1.00.08"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Copilot",
|
||||
"version": "148.0.3967.96"
|
||||
},
|
||||
{
|
||||
"publisher": "Drake Software",
|
||||
"name": "Drake Accounting 2025",
|
||||
"version": "25.0.18"
|
||||
},
|
||||
{
|
||||
"publisher": "Intel Corporation",
|
||||
"name": "Dynamic Application Loader Host Interface Service",
|
||||
"version": "1.0.0.0"
|
||||
},
|
||||
{
|
||||
"publisher": "Google LLC",
|
||||
"name": "Google Chrome",
|
||||
"version": "148.0.7778.217"
|
||||
},
|
||||
{
|
||||
"publisher": "Intel Corporation",
|
||||
"name": "Intel(R) Chipset Device Software",
|
||||
"version": "10.1.18836.8283"
|
||||
},
|
||||
{
|
||||
"publisher": "Intel Corporation",
|
||||
"name": "Intel(R) Icls",
|
||||
"version": "1.0.0.0"
|
||||
},
|
||||
{
|
||||
"publisher": "Intel Corporation",
|
||||
"name": "Intel(R) Management Engine Components",
|
||||
"version": "1.0.0.0"
|
||||
},
|
||||
{
|
||||
"publisher": "Intel Corporation",
|
||||
"name": "Intel(R) Management Engine Components",
|
||||
"version": "2307.4.12.0"
|
||||
},
|
||||
{
|
||||
"publisher": "Intel Corporation",
|
||||
"name": "Intel(R) Management Engine Driver",
|
||||
"version": "1.0.0.0"
|
||||
},
|
||||
{
|
||||
"publisher": "Intel Corporation",
|
||||
"name": "Intel(R) ME WMI Provider",
|
||||
"version": "1.0.0.0"
|
||||
},
|
||||
{
|
||||
"publisher": "Lenovo Group Ltd.",
|
||||
"name": "Lenovo Vantage Service",
|
||||
"version": "4.1.22.0"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft .NET Host - 6.0.36 (x86)",
|
||||
"version": "48.144.23141"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft .NET Host - 8.0.27 (x86)",
|
||||
"version": "64.108.52182"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft .NET Host FX Resolver - 6.0.36 (x86)",
|
||||
"version": "48.144.23141"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft .NET Host FX Resolver - 8.0.27 (x86)",
|
||||
"version": "64.108.52182"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft .NET Runtime - 6.0.36 (x86)",
|
||||
"version": "48.144.23141"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft .NET Runtime - 8.0.27 (x86)",
|
||||
"version": "64.108.52182"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft 365 - en-us",
|
||||
"version": "16.0.20026.20112"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft ASP.NET Core 8.0.27 - Shared Framework (x86)",
|
||||
"version": "8.0.27.26230"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft ASP.NET Core 8.0.27 Shared Framework (x86)",
|
||||
"version": "8.0.27.26230"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Edge",
|
||||
"version": "149.0.4022.52"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Edge WebView2 Runtime",
|
||||
"version": "148.0.3967.96"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft OneNote - en-us",
|
||||
"version": "16.0.20026.20112"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft SQL Server Compact 4.0 SP1 x64 ENU",
|
||||
"version": "4.0.8876.1"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft",
|
||||
"name": "Microsoft Teams Meeting Add-in for Microsoft Office",
|
||||
"version": "1.25.28902"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Update Health Tools",
|
||||
"version": "5.72.0.0"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17",
|
||||
"version": "9.0.30729"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161",
|
||||
"version": "9.0.30729.6161"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501",
|
||||
"version": "12.0.30501.0"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501",
|
||||
"version": "12.0.30501.0"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005",
|
||||
"version": "12.0.21005"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005",
|
||||
"version": "12.0.21005"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005",
|
||||
"version": "12.0.21005"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005",
|
||||
"version": "12.0.21005"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.44.35211",
|
||||
"version": "14.44.35211.0"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.44.35211",
|
||||
"version": "14.44.35211.0"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.44.35211",
|
||||
"version": "14.44.35211"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.44.35211",
|
||||
"version": "14.44.35211"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Visual C++ 2022 X86 Additional Runtime - 14.44.35211",
|
||||
"version": "14.44.35211"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.44.35211",
|
||||
"version": "14.44.35211"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Windows Desktop Runtime - 6.0.36 (x86)",
|
||||
"version": "48.144.23186"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Windows Desktop Runtime - 6.0.36 (x86)",
|
||||
"version": "6.0.36.34217"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Windows Desktop Runtime - 8.0.27 (x86)",
|
||||
"version": "64.108.52193"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Windows Desktop Runtime - 8.0.27 (x86)",
|
||||
"version": "8.0.27.36030"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Office 16 Click-to-Run Extensibility Component",
|
||||
"version": "16.0.20026.20076"
|
||||
},
|
||||
{
|
||||
"publisher": "Intuit Inc.",
|
||||
"name": "QuickBooks",
|
||||
"version": "33.0.4003.3302"
|
||||
},
|
||||
{
|
||||
"publisher": "Intuit Inc.",
|
||||
"name": "QuickBooks Enterprise Solutions 23.0",
|
||||
"version": "33.0.4003.3302"
|
||||
},
|
||||
{
|
||||
"publisher": "Intuit Inc.",
|
||||
"name": "QuickBooks Runtime Redistributable",
|
||||
"version": "1.00.0000"
|
||||
},
|
||||
{
|
||||
"publisher": "Realtek Semiconductor Corp.",
|
||||
"name": "Realtek Audio Driver",
|
||||
"version": "6.0.9225.1"
|
||||
},
|
||||
{
|
||||
"publisher": "Realtek Semiconductor Corp.",
|
||||
"name": "Realtek Card Reader",
|
||||
"version": "10.0.22000.31269"
|
||||
},
|
||||
{
|
||||
"publisher": "ScreenConnect Software",
|
||||
"name": "ScreenConnect Client (1912bf3444b41a08)",
|
||||
"version": "26.1.24.9579"
|
||||
},
|
||||
{
|
||||
"publisher": "win.rar GmbH",
|
||||
"name": "WinRAR 7.00 beta 4 (64-bit)",
|
||||
"version": "7.00.4"
|
||||
},
|
||||
{
|
||||
"publisher": "ZeroTier, Inc.",
|
||||
"name": "ZeroTier One",
|
||||
"version": "1.12.2"
|
||||
}
|
||||
],
|
||||
"tpm": {
|
||||
"enabled": true,
|
||||
"ready": true,
|
||||
"present": true
|
||||
},
|
||||
"local_groups": [
|
||||
"Administrators",
|
||||
"Device Owners",
|
||||
"Distributed COM Users",
|
||||
"Event Log Readers",
|
||||
"Guests",
|
||||
"Hyper-V Administrators",
|
||||
"IIS_IUSRS",
|
||||
"OpenSSH Users",
|
||||
"Performance Log Users",
|
||||
"Performance Monitor Users",
|
||||
"Remote Management Users",
|
||||
"System Managed Accounts Group",
|
||||
"User Mode Hardware Operators",
|
||||
"Users"
|
||||
],
|
||||
"battery": {
|
||||
"present": false
|
||||
},
|
||||
"activation": {
|
||||
"edition": "Microsoft Windows 11 Home",
|
||||
"description": "Windows(R) Operating System, OEM_DM channel",
|
||||
"licensed": true,
|
||||
"license_status_code": 1
|
||||
},
|
||||
"time_source": "time.windows.com,0x9",
|
||||
"chassis_types": [
|
||||
3
|
||||
],
|
||||
"last_hotfix": {
|
||||
"hotfix_id": "KB5089549",
|
||||
"installed_on": "2026-05-21T07:00:00Z"
|
||||
},
|
||||
"scheduled_tasks": [
|
||||
{
|
||||
"path": "\\",
|
||||
"name": "Calliope_Keyboard",
|
||||
"state": "Running"
|
||||
},
|
||||
{
|
||||
"path": "\\",
|
||||
"name": "MicrosoftEdgeUpdateTaskMachineCore",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\",
|
||||
"name": "MicrosoftEdgeUpdateTaskMachineUA",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\",
|
||||
"name": "OneDrive Reporting Task-S-1-5-21-3052971633-1913791397-467572743-1001",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\",
|
||||
"name": "OneDrive Standalone Update Task-S-1-5-21-3052971633-1913791397-467572743-1001",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\",
|
||||
"name": "OneDrive Startup Task-S-1-5-21-3052971633-1913791397-467572743-1001",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\GoogleSystem\\GoogleUpdater\\",
|
||||
"name": "GoogleUpdaterTaskSystem150.0.7863.0{33CFAE4D-D353-44AD-948F-7D72E567628E}",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\GoogleUserPEH\\",
|
||||
"name": "RunPlatformExperienceHelperOnUnlock",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\GoogleUserPEH\\",
|
||||
"name": "RunPlatformExperienceHelper_Daily",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\GoogleUserPEH\\",
|
||||
"name": "RunPlatformExperienceHelper_Metrics",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\ImController\\",
|
||||
"name": "Lenovo iM Controller Monitor",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\ImController\\",
|
||||
"name": "Lenovo iM Controller Scheduled Maintenance",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\ImController\\Plugins\\",
|
||||
"name": "LenovoSystemUpdatePlugin_WeeklyTask",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\ImController\\TimeBasedEvents\\",
|
||||
"name": "48df2383-15fe-49ab-8f16-d4274103ead0",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\ImController\\TimeBasedEvents\\",
|
||||
"name": "66724497-f49c-4fc3-aa8a-4d373ddeea45",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\ImController\\TimeBasedEvents\\",
|
||||
"name": "aadd3f56-8002-4b8c-aec2-d0ff202832d3",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\UDC\\",
|
||||
"name": "Lenovo UDC Idle Monitor",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\UDC\\",
|
||||
"name": "Lenovo UDC Lazy Deployment",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\UDC\\",
|
||||
"name": "Lenovo UDC Maintainance Task",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\UDC\\",
|
||||
"name": "Lenovo UDC Monitor",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\",
|
||||
"name": "Lenovo.Vantage.ServiceMaintainance",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\",
|
||||
"name": "StartupFixPlan",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\Schedule\\",
|
||||
"name": "BatteryGaugeAddinDailyScheduleTask",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\Schedule\\",
|
||||
"name": "DailyTelemetryTransmission",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\Schedule\\",
|
||||
"name": "GenericMessagingAddin",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\Schedule\\",
|
||||
"name": "HeartbeatAddinDailyScheduleTask",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\Schedule\\",
|
||||
"name": "Lenovo.Vantage.SmartPerformance.MonthlyReport",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\Schedule\\",
|
||||
"name": "Lenovo.Vantage.SmartPerformance.SScan",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\Schedule\\",
|
||||
"name": "LenovoBoostAddin.Prompt",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\Schedule\\",
|
||||
"name": "LenovoCompanionAppAddinDailyScheduleTask",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\Schedule\\",
|
||||
"name": "LenovoSystemUpdateAddin_WeeklyTask",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\Schedule\\",
|
||||
"name": "SmartPerformance.ExpireReminder",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\Schedule\\",
|
||||
"name": "VantageCoreAddinWeekScheduleTask",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\SoftLanding\\S-1-5-21-3052971633-1913791397-467572743-1001\\",
|
||||
"name": "SoftLandingCreativeManagementTask",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\SoftLanding\\S-1-5-21-3052971633-1913791397-467572743-1001\\",
|
||||
"name": "SoftLandingDeferralTask-{327badb4-08f8-4096-87f5-ffbafcb0a5d8}",
|
||||
"state": "Ready"
|
||||
}
|
||||
],
|
||||
"antivirus_products": [
|
||||
"Windows Defender"
|
||||
],
|
||||
"domain_joined": false,
|
||||
"defender": {
|
||||
"antispyware_signature_age": 0,
|
||||
"tamper_protected": true,
|
||||
"real_time_protection": true,
|
||||
"nis_enabled": true,
|
||||
"available": true,
|
||||
"antivirus_enabled": true,
|
||||
"am_service_enabled": true
|
||||
},
|
||||
"bitlocker": {
|
||||
"os_volume": "C:",
|
||||
"key_protectors": [],
|
||||
"recovery_key_present": false,
|
||||
"available": true,
|
||||
"encryption_percent": 0,
|
||||
"protection_status": "Off"
|
||||
},
|
||||
"is_laptop": false,
|
||||
"installed_software_count": 55,
|
||||
"local_administrators": [
|
||||
"GTS-PEDRO-H\\Administrator",
|
||||
"GTS-PEDRO-H\\pgonz"
|
||||
],
|
||||
"firewall_profiles": {
|
||||
"Private": true,
|
||||
"Domain": true,
|
||||
"Public": true
|
||||
},
|
||||
"domain": "WORKGROUP",
|
||||
"foreign_agents": null
|
||||
},
|
||||
"findings": [
|
||||
{
|
||||
"id": "sec.defender.ok",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "Defender active and current",
|
||||
"detail": "Real-time protection on, service running, signatures current.",
|
||||
"evidence": "RealTimeProtectionEnabled=True; AMServiceEnabled=True; AntispywareSignatureAge=0 days; IsTamperProtected=True"
|
||||
},
|
||||
{
|
||||
"id": "sec.av_products.defender_only",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "Defender is the only registered AV",
|
||||
"detail": "Only Microsoft/Windows Defender is registered in Security Center.",
|
||||
"evidence": "Windows Defender"
|
||||
},
|
||||
{
|
||||
"id": "sec.foreign_agents.none",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "No competitor/leftover management agents detected",
|
||||
"detail": "No known competitor RMM or unmanaged remote-access agents found in installed programs or services.",
|
||||
"evidence": "Scanned uninstall hives (HKLM + WOW6432Node) and Win32_Service"
|
||||
},
|
||||
{
|
||||
"id": "sec.foreign_agents.acg.screenconnect_connectwise_control",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "Expected ACG management tooling present: ScreenConnect / ConnectWise Control",
|
||||
"detail": "This is Arizona Computer Guru managed/remote-access tooling that we deploy. Its presence is expected and not a foreign-agent risk.",
|
||||
"evidence": "program: ScreenConnect Client (1912bf3444b41a08) 26.1.24.9579\nservice: ScreenConnect Client (1912bf3444b41a08) (ScreenConnect Client (1912bf3444b41a08)) Running"
|
||||
},
|
||||
{
|
||||
"id": "sec.firewall.ok",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "All firewall profiles enabled",
|
||||
"detail": "Domain, Private, and Public firewall profiles are all enabled.",
|
||||
"evidence": "Private=True; Domain=True; Public=True"
|
||||
},
|
||||
{
|
||||
"id": "sec.bitlocker.unencrypted",
|
||||
"category": "security",
|
||||
"severity": "warning",
|
||||
"title": "OS volume is NOT encrypted with BitLocker",
|
||||
"detail": "The operating system volume is unencrypted. Data is exposed if the disk is removed or the device is lost. Enable BitLocker and escrow the recovery key.",
|
||||
"evidence": "Volume=C:; ProtectionStatus=Off; EncryptionPercentage=0; KeyProtectors="
|
||||
},
|
||||
{
|
||||
"id": "sec.local_admins.list",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "Local administrators (2)",
|
||||
"detail": "Members of the local Administrators group. Review for unexpected or unknown accounts (especially leftover MSP/vendor accounts from a prior provider).",
|
||||
"evidence": "GTS-PEDRO-H\\Administrator\nGTS-PEDRO-H\\pgonz"
|
||||
},
|
||||
{
|
||||
"id": "sec.patch.os_supported",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "OS build supported: Win11 25H2",
|
||||
"detail": "Build 26200 (Win11 25H2) is in support until 2027-10-12.",
|
||||
"evidence": "Microsoft Windows 11 Home build 26200"
|
||||
},
|
||||
{
|
||||
"id": "sec.patch.pending",
|
||||
"category": "security",
|
||||
"severity": "warning",
|
||||
"title": "2 pending Windows updates",
|
||||
"detail": "Windows Update reports pending (not installed, not hidden) updates. Some may be security updates. Approve/install on the next maintenance window.",
|
||||
"evidence": "Microsoft.Update.Session search IsInstalled=0 and IsHidden=0 -> 2"
|
||||
},
|
||||
{
|
||||
"id": "sec.patch.last_hotfix",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "Last hotfix: KB5089549",
|
||||
"detail": "Most recently installed update (from Get-HotFix; reflects CBS/MSU packages, not all cumulative metadata).",
|
||||
"evidence": "KB5089549 installed 2026-05-21T07:00:00Z"
|
||||
},
|
||||
{
|
||||
"id": "sec.exposure.smb1_off",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "SMBv1 disabled",
|
||||
"detail": "SMBv1 server protocol is disabled.",
|
||||
"evidence": "EnableSMB1Protocol=False"
|
||||
},
|
||||
{
|
||||
"id": "sec.exposure.laps_present",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "LAPS detected",
|
||||
"detail": "A LAPS mechanism is present.",
|
||||
"evidence": "Windows LAPS reg key"
|
||||
},
|
||||
{
|
||||
"id": "health.stability.some",
|
||||
"category": "health",
|
||||
"severity": "warning",
|
||||
"title": "Stability events present in the last 14 days",
|
||||
"detail": "One or more unexpected shutdowns, BSODs, or disk errors occurred recently. Monitor and correlate with user reports.",
|
||||
"evidence": "Unexpected shutdowns (id 41)=0; Bugchecks/BSOD (id 1001)=0; Disk errors (id 7/51/153)=1"
|
||||
},
|
||||
{
|
||||
"id": "health.reboot_uptime.pending",
|
||||
"category": "health",
|
||||
"severity": "warning",
|
||||
"title": "Reboot pending",
|
||||
"detail": "A reboot is pending. Pending reboots can block patches and leave the system in a half-updated state. Schedule a restart.",
|
||||
"evidence": "PendingFileRenameOperations"
|
||||
},
|
||||
{
|
||||
"id": "health.failed_services.stopped",
|
||||
"category": "health",
|
||||
"severity": "warning",
|
||||
"title": "5 auto-start service(s) not running",
|
||||
"detail": "These services are set to start automatically but are not running. Some may be benign; review for security agents, backup agents, or AV that should be running.",
|
||||
"evidence": "gpsvc (Group Policy Client) = Stopped\nIntel(R) Platform License Manager Service (Intel(R) Platform License Manager Service) = Stopped\nQBVSS (QBIDPService) = Stopped\nGoogleUpdaterInternalService150.0.7863.0 (Google Updater Internal Service (GoogleUpdaterInternalService150.0.7863.0)) = Stopped\nGoogleUpdaterService150.0.7863.0 (Google Updater Service (GoogleUpdaterService150.0.7863.0)) = Stopped"
|
||||
},
|
||||
{
|
||||
"id": "health.domain.workgroup",
|
||||
"category": "health",
|
||||
"severity": "info",
|
||||
"title": "Not domain-joined (workgroup)",
|
||||
"detail": "This machine is in workgroup/Azure AD only mode (Domain=WORKGROUP). No on-prem AD secure channel applies.",
|
||||
"evidence": "PartOfDomain=False; Domain=WORKGROUP"
|
||||
},
|
||||
{
|
||||
"id": "health.time.source",
|
||||
"category": "health",
|
||||
"severity": "info",
|
||||
"title": "Time service source",
|
||||
"detail": "Current Windows Time service source.",
|
||||
"evidence": "Source=time.windows.com,0x9"
|
||||
},
|
||||
{
|
||||
"id": "health.backup.none",
|
||||
"category": "health",
|
||||
"severity": "info",
|
||||
"title": "No backup agent detected",
|
||||
"detail": "No known backup agent service found. Backup expectation varies by endpoint; confirm whether this machine is supposed to have local/cloud backup and whether server-side or M365 backup covers it.",
|
||||
"evidence": "No matching backup service in Win32_Service"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,227 @@
|
||||
# Onboarding Diagnostic Baseline - GTS-PEDRO-H
|
||||
|
||||
- **Grade:** AMBER
|
||||
- **Host:** GTS-PEDRO-H
|
||||
- **Client:** Gonzvar Tax Services (`gonzvar-tax-services`)
|
||||
- **Collected (UTC):** 2026-06-06T18:10:36Z
|
||||
- **Agent ID:** 2f1499f8-2e04-44fa-89a8-ad93736e9787
|
||||
- **Command ID:** d7e48e75-c5ba-44df-85e5-63c463916854
|
||||
- **Findings:** 0 critical / 5 warning / 13 info / 0 unknown
|
||||
|
||||
- **OS:** Microsoft Windows 11 Home (build 26200)
|
||||
|
||||
---
|
||||
|
||||
## WARNING (5)
|
||||
|
||||
### OS volume is NOT encrypted with BitLocker
|
||||
- **Category:** security
|
||||
- **ID:** `sec.bitlocker.unencrypted`
|
||||
- The operating system volume is unencrypted. Data is exposed if the disk is removed or the device is lost. Enable BitLocker and escrow the recovery key.
|
||||
|
||||
```
|
||||
Volume=C:; ProtectionStatus=Off; EncryptionPercentage=0; KeyProtectors=
|
||||
```
|
||||
|
||||
### 2 pending Windows updates
|
||||
- **Category:** security
|
||||
- **ID:** `sec.patch.pending`
|
||||
- Windows Update reports pending (not installed, not hidden) updates. Some may be security updates. Approve/install on the next maintenance window.
|
||||
|
||||
```
|
||||
Microsoft.Update.Session search IsInstalled=0 and IsHidden=0 -> 2
|
||||
```
|
||||
|
||||
### Stability events present in the last 14 days
|
||||
- **Category:** health
|
||||
- **ID:** `health.stability.some`
|
||||
- One or more unexpected shutdowns, BSODs, or disk errors occurred recently. Monitor and correlate with user reports.
|
||||
|
||||
```
|
||||
Unexpected shutdowns (id 41)=0; Bugchecks/BSOD (id 1001)=0; Disk errors (id 7/51/153)=1
|
||||
```
|
||||
|
||||
### Reboot pending
|
||||
- **Category:** health
|
||||
- **ID:** `health.reboot_uptime.pending`
|
||||
- A reboot is pending. Pending reboots can block patches and leave the system in a half-updated state. Schedule a restart.
|
||||
|
||||
```
|
||||
PendingFileRenameOperations
|
||||
```
|
||||
|
||||
### 5 auto-start service(s) not running
|
||||
- **Category:** health
|
||||
- **ID:** `health.failed_services.stopped`
|
||||
- These services are set to start automatically but are not running. Some may be benign; review for security agents, backup agents, or AV that should be running.
|
||||
|
||||
```
|
||||
gpsvc (Group Policy Client) = Stopped
|
||||
Intel(R) Platform License Manager Service (Intel(R) Platform License Manager Service) = Stopped
|
||||
QBVSS (QBIDPService) = Stopped
|
||||
GoogleUpdaterInternalService150.0.7863.0 (Google Updater Internal Service (GoogleUpdaterInternalService150.0.7863.0)) = Stopped
|
||||
GoogleUpdaterService150.0.7863.0 (Google Updater Service (GoogleUpdaterService150.0.7863.0)) = Stopped
|
||||
```
|
||||
|
||||
|
||||
## INFO (13)
|
||||
|
||||
### Defender active and current
|
||||
- **Category:** security
|
||||
- **ID:** `sec.defender.ok`
|
||||
- Real-time protection on, service running, signatures current.
|
||||
|
||||
```
|
||||
RealTimeProtectionEnabled=True; AMServiceEnabled=True; AntispywareSignatureAge=0 days; IsTamperProtected=True
|
||||
```
|
||||
|
||||
### Defender is the only registered AV
|
||||
- **Category:** security
|
||||
- **ID:** `sec.av_products.defender_only`
|
||||
- Only Microsoft/Windows Defender is registered in Security Center.
|
||||
|
||||
```
|
||||
Windows Defender
|
||||
```
|
||||
|
||||
### No competitor/leftover management agents detected
|
||||
- **Category:** security
|
||||
- **ID:** `sec.foreign_agents.none`
|
||||
- No known competitor RMM or unmanaged remote-access agents found in installed programs or services.
|
||||
|
||||
```
|
||||
Scanned uninstall hives (HKLM + WOW6432Node) and Win32_Service
|
||||
```
|
||||
|
||||
### Expected ACG management tooling present: ScreenConnect / ConnectWise Control
|
||||
- **Category:** security
|
||||
- **ID:** `sec.foreign_agents.acg.screenconnect_connectwise_control`
|
||||
- This is Arizona Computer Guru managed/remote-access tooling that we deploy. Its presence is expected and not a foreign-agent risk.
|
||||
|
||||
```
|
||||
program: ScreenConnect Client (1912bf3444b41a08) 26.1.24.9579
|
||||
service: ScreenConnect Client (1912bf3444b41a08) (ScreenConnect Client (1912bf3444b41a08)) Running
|
||||
```
|
||||
|
||||
### All firewall profiles enabled
|
||||
- **Category:** security
|
||||
- **ID:** `sec.firewall.ok`
|
||||
- Domain, Private, and Public firewall profiles are all enabled.
|
||||
|
||||
```
|
||||
Private=True; Domain=True; Public=True
|
||||
```
|
||||
|
||||
### Local administrators (2)
|
||||
- **Category:** security
|
||||
- **ID:** `sec.local_admins.list`
|
||||
- Members of the local Administrators group. Review for unexpected or unknown accounts (especially leftover MSP/vendor accounts from a prior provider).
|
||||
|
||||
```
|
||||
GTS-PEDRO-H\Administrator
|
||||
GTS-PEDRO-H\pgonz
|
||||
```
|
||||
|
||||
### OS build supported: Win11 25H2
|
||||
- **Category:** security
|
||||
- **ID:** `sec.patch.os_supported`
|
||||
- Build 26200 (Win11 25H2) is in support until 2027-10-12.
|
||||
|
||||
```
|
||||
Microsoft Windows 11 Home build 26200
|
||||
```
|
||||
|
||||
### Last hotfix: KB5089549
|
||||
- **Category:** security
|
||||
- **ID:** `sec.patch.last_hotfix`
|
||||
- Most recently installed update (from Get-HotFix; reflects CBS/MSU packages, not all cumulative metadata).
|
||||
|
||||
```
|
||||
KB5089549 installed 2026-05-21T07:00:00Z
|
||||
```
|
||||
|
||||
### SMBv1 disabled
|
||||
- **Category:** security
|
||||
- **ID:** `sec.exposure.smb1_off`
|
||||
- SMBv1 server protocol is disabled.
|
||||
|
||||
```
|
||||
EnableSMB1Protocol=False
|
||||
```
|
||||
|
||||
### LAPS detected
|
||||
- **Category:** security
|
||||
- **ID:** `sec.exposure.laps_present`
|
||||
- A LAPS mechanism is present.
|
||||
|
||||
```
|
||||
Windows LAPS reg key
|
||||
```
|
||||
|
||||
### Not domain-joined (workgroup)
|
||||
- **Category:** health
|
||||
- **ID:** `health.domain.workgroup`
|
||||
- This machine is in workgroup/Azure AD only mode (Domain=WORKGROUP). No on-prem AD secure channel applies.
|
||||
|
||||
```
|
||||
PartOfDomain=False; Domain=WORKGROUP
|
||||
```
|
||||
|
||||
### Time service source
|
||||
- **Category:** health
|
||||
- **ID:** `health.time.source`
|
||||
- Current Windows Time service source.
|
||||
|
||||
```
|
||||
Source=time.windows.com,0x9
|
||||
```
|
||||
|
||||
### No backup agent detected
|
||||
- **Category:** health
|
||||
- **ID:** `health.backup.none`
|
||||
- No known backup agent service found. Backup expectation varies by endpoint; confirm whether this machine is supposed to have local/cloud backup and whether server-side or M365 backup covers it.
|
||||
|
||||
```
|
||||
No matching backup service in Win32_Service
|
||||
```
|
||||
|
||||
|
||||
---
|
||||
|
||||
## Inventory Baseline Summary
|
||||
|
||||
- **Manufacturer / Model:** LENOVO / 90SM006QUS
|
||||
- **Serial:** MJ0J9LD1
|
||||
- **CPU:** 12th Gen Intel(R) Core(TM) i5-12400 (6 cores / 12 logical)
|
||||
- **RAM (GB):** 15.7
|
||||
- **BIOS:** M49KT21A (2023-01-03)
|
||||
- **Chassis is laptop:** false
|
||||
- **TPM present / Secure Boot:** true / true
|
||||
- **Domain joined:** false (WORKGROUP)
|
||||
- **OS activation licensed:** true
|
||||
- **Uptime (days):** 13.7
|
||||
- **Pending reboot:** true
|
||||
- **Installed software count:** 55
|
||||
- **Scheduled tasks (non-MS, enabled):** 35
|
||||
- **Local administrators:** GTS-PEDRO-H\Administrator, GTS-PEDRO-H\pgonz
|
||||
|
||||
### Fixed volumes
|
||||
|
||||
- [SYSTEM] - 0.2 GB free of 0.2 GB (76.9%)
|
||||
- C: - 723.7 GB free of 951.6 GB (76.1%)
|
||||
- [WinRE_DRV] - 1.3 GB free of 2 GB (64.3%)
|
||||
|
||||
### Network adapters
|
||||
|
||||
- ZeroTier Virtual Port - IP: 10.244.10.231, fe80::2bae:96e1:f136:d2d9, fc2a:89c2:7b0d:1a52:bbed::1 - DNS: 10.244.163.165 - DHCP: false
|
||||
- Realtek RTL8852AE WiFi 6 802.11ax PCIe Adapter - IP: 192.168.0.146, fe80::5f87:acec:b8fd:313f, 2600:8800:782c:5c00:ecc4:b8ee:f191:f8e9, 2600:8800:782c:5c00:94a1:fdd7:a658:a330, 2600:8800:782c:5c00:2abd:1cc9:5150:9bc7, 2600:8800:782c:5c00::bc77 - DNS: 68.105.28.11, 68.105.29.11, 68.105.28.12 - DHCP: true
|
||||
|
||||
---
|
||||
|
||||
## Diff vs Prior Baseline
|
||||
|
||||
- No prior baseline found for this host. This is the first baseline.
|
||||
|
||||
---
|
||||
|
||||
_Generated by run-onboarding-diagnostic.sh (GuruRMM onboarding diagnostic, Phase 1). Raw snapshot: `GTS-PEDRO-H-20260606T181113.json` (immutable)._
|
||||
@@ -0,0 +1,544 @@
|
||||
{
|
||||
"host": "GTS-SVR25",
|
||||
"collected_at_utc": "2026-06-06T18:13:24Z",
|
||||
"os": {
|
||||
"caption": "Microsoft Windows Server 2025 Standard",
|
||||
"version": "10.0.26100",
|
||||
"build": "26100",
|
||||
"install_date": "2025-10-18T18:21:32Z",
|
||||
"last_boot_utc": "2026-05-17T04:50:38Z",
|
||||
"architecture": "64-bit"
|
||||
},
|
||||
"facts": {
|
||||
"builtin_admin_enabled": false,
|
||||
"os_eol": {
|
||||
"eol_date": "2026-10-13",
|
||||
"release": "Win11 24H2"
|
||||
},
|
||||
"pending_updates": 0,
|
||||
"pending_reboot": true,
|
||||
"uptime_days": 20.6,
|
||||
"acg_managed_tools": [
|
||||
"ScreenConnect / ConnectWise Control",
|
||||
"Datto RMM",
|
||||
"Splashtop (SOS/Streamer)",
|
||||
"Syncro / Kabuto"
|
||||
],
|
||||
"hardware": {
|
||||
"model": "System Product Name",
|
||||
"manufacturer": "ASUS",
|
||||
"bios_date": "2022-08-12",
|
||||
"cpu_logical": 20,
|
||||
"bios_version": "1620",
|
||||
"cpu_cores": 12,
|
||||
"ram_gb": 31.7,
|
||||
"serial": "System Serial Number",
|
||||
"cpu": "12th Gen Intel(R) Core(TM) i7-12700"
|
||||
},
|
||||
"local_administrators": [
|
||||
"Administrator",
|
||||
"Domain Admins",
|
||||
"Enterprise Admins",
|
||||
"localadmin",
|
||||
"MediaAdmin$",
|
||||
"sysadmin"
|
||||
],
|
||||
"os_build": "26100",
|
||||
"secure_boot": false,
|
||||
"backup_agents": null,
|
||||
"autoruns_run_keys": [
|
||||
{
|
||||
"key": "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
|
||||
"name": "AzureArcSetup",
|
||||
"value": "C:\\WINDOWS\\AzureArcSetup\\Systray\\AzureArcSysTray.exe"
|
||||
},
|
||||
{
|
||||
"key": "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
|
||||
"name": "SecurityHealth",
|
||||
"value": "C:\\WINDOWS\\system32\\SecurityHealthSystray.exe"
|
||||
},
|
||||
{
|
||||
"key": "HKLM:\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run",
|
||||
"name": "CentraStage",
|
||||
"value": "C:\\Program Files (x86)\\CentraStage\\Gui.exe"
|
||||
},
|
||||
{
|
||||
"key": "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce",
|
||||
"name": "msedge_cleanup_{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}",
|
||||
"value": "\"C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\148.0.3967.96\\Installer\\setup.exe\" --msedgewebview --delete-old-versions --system-level --verbose-logging --on-logon"
|
||||
}
|
||||
],
|
||||
"physical_disks": [
|
||||
{
|
||||
"health": "Healthy",
|
||||
"model": "NVMe KINGSTON SNV3S2000G",
|
||||
"media_type": "SSD"
|
||||
}
|
||||
],
|
||||
"local_users": [
|
||||
{
|
||||
"last_logon": "",
|
||||
"name": "Administrator",
|
||||
"password_never_expires": false,
|
||||
"enabled": false
|
||||
},
|
||||
{
|
||||
"last_logon": "",
|
||||
"name": "Guest",
|
||||
"password_never_expires": false,
|
||||
"enabled": false
|
||||
},
|
||||
{
|
||||
"last_logon": "",
|
||||
"name": "krbtgt",
|
||||
"password_never_expires": false,
|
||||
"enabled": false
|
||||
},
|
||||
{
|
||||
"last_logon": "",
|
||||
"name": "DefaultAccount",
|
||||
"password_never_expires": false,
|
||||
"enabled": false
|
||||
},
|
||||
{
|
||||
"last_logon": "",
|
||||
"name": "localadmin",
|
||||
"password_never_expires": false,
|
||||
"enabled": true
|
||||
},
|
||||
{
|
||||
"last_logon": "2026-03-24",
|
||||
"name": "sysadmin",
|
||||
"password_never_expires": false,
|
||||
"enabled": true
|
||||
},
|
||||
{
|
||||
"last_logon": "2026-06-04",
|
||||
"name": "pedro",
|
||||
"password_never_expires": false,
|
||||
"enabled": true
|
||||
},
|
||||
{
|
||||
"last_logon": "2026-06-05",
|
||||
"name": "gonzvar",
|
||||
"password_never_expires": false,
|
||||
"enabled": true
|
||||
},
|
||||
{
|
||||
"last_logon": "2026-06-06",
|
||||
"name": "SERVER$",
|
||||
"password_never_expires": false,
|
||||
"enabled": true
|
||||
},
|
||||
{
|
||||
"last_logon": "",
|
||||
"name": "MediaAdmin$",
|
||||
"password_never_expires": false,
|
||||
"enabled": true
|
||||
},
|
||||
{
|
||||
"last_logon": "2026-06-06",
|
||||
"name": "GTS-W1$",
|
||||
"password_never_expires": false,
|
||||
"enabled": true
|
||||
},
|
||||
{
|
||||
"last_logon": "2026-06-06",
|
||||
"name": "GTS-W2$",
|
||||
"password_never_expires": false,
|
||||
"enabled": true
|
||||
},
|
||||
{
|
||||
"last_logon": "2026-06-06",
|
||||
"name": "GTS-W0$",
|
||||
"password_never_expires": false,
|
||||
"enabled": true
|
||||
}
|
||||
],
|
||||
"scheduled_tasks_count": 2,
|
||||
"volumes": [
|
||||
{
|
||||
"drive": "[unlabeled]",
|
||||
"size_gb": 0.8,
|
||||
"free_pct": 11.8,
|
||||
"free_gb": 0.1
|
||||
},
|
||||
{
|
||||
"drive": "C:",
|
||||
"size_gb": 1862.2,
|
||||
"free_pct": 90.5,
|
||||
"free_gb": 1684.5
|
||||
},
|
||||
{
|
||||
"drive": "[unlabeled]",
|
||||
"size_gb": 0.1,
|
||||
"free_pct": 64.4,
|
||||
"free_gb": 0.1
|
||||
}
|
||||
],
|
||||
"network_adapters": [
|
||||
{
|
||||
"dhcp": false,
|
||||
"description": "Realtek PCIe 2.5GbE Family Controller",
|
||||
"gateway": [
|
||||
"192.168.0.1"
|
||||
],
|
||||
"mac": "50:EB:F6:CF:69:80",
|
||||
"ip": [
|
||||
"192.168.0.2",
|
||||
"fe80::9386:5e2c:c38a:61b1"
|
||||
],
|
||||
"dns": [
|
||||
"192.168.0.2",
|
||||
"192.168.0.5"
|
||||
]
|
||||
}
|
||||
],
|
||||
"failed_autostart_services": [
|
||||
{
|
||||
"name": "AsusUpdateCheck",
|
||||
"display": "AsusUpdateCheck",
|
||||
"state": "Stopped"
|
||||
},
|
||||
{
|
||||
"name": "InventorySvc",
|
||||
"display": "Inventory and Compatibility Appraisal service",
|
||||
"state": "Stopped"
|
||||
}
|
||||
],
|
||||
"stability_14d": {
|
||||
"unexpected_shutdowns": 0,
|
||||
"disk_errors": 83,
|
||||
"bugchecks": 0
|
||||
},
|
||||
"exposure": {
|
||||
"smb1_enabled": false,
|
||||
"laps_present": true,
|
||||
"rdp_enabled": true,
|
||||
"uac_enabled": true,
|
||||
"rdp_nla": true
|
||||
},
|
||||
"accounts_password_never_expires": [],
|
||||
"installed_software": [
|
||||
{
|
||||
"publisher": "Webprofusion Pty Ltd",
|
||||
"name": "Certify Certificate Manager version 6.1.11",
|
||||
"version": "6.1.11"
|
||||
},
|
||||
{
|
||||
"publisher": "Datto Inc.",
|
||||
"name": "Datto RMM",
|
||||
"version": "4.4.11616.11616"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft .NET Host - 8.0.21 (x86)",
|
||||
"version": "64.84.40925"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft .NET Host FX Resolver - 8.0.21 (x86)",
|
||||
"version": "64.84.40925"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft .NET Runtime - 8.0.21 (x86)",
|
||||
"version": "64.84.40925"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft ASP.NET Core 8.0.21 - Shared Framework (x86)",
|
||||
"version": "8.0.21.25475"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft ASP.NET Core 8.0.21 Shared Framework (x86)",
|
||||
"version": "8.0.21.25475"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Edge",
|
||||
"version": "149.0.4022.52"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Edge WebView2 Runtime",
|
||||
"version": "148.0.3967.96"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Windows Desktop Runtime - 8.0.21 (x86)",
|
||||
"version": "64.84.40919"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Windows Desktop Runtime - 8.0.21 (x86)",
|
||||
"version": "8.0.21.35325"
|
||||
},
|
||||
{
|
||||
"publisher": "ScreenConnect Software",
|
||||
"name": "ScreenConnect Client (1912bf3444b41a08)",
|
||||
"version": "26.1.24.9579"
|
||||
},
|
||||
{
|
||||
"publisher": "Splashtop Inc.",
|
||||
"name": "Splashtop Software Updater",
|
||||
"version": "1.5.6.23"
|
||||
},
|
||||
{
|
||||
"publisher": "Splashtop Inc.",
|
||||
"name": "Splashtop Streamer",
|
||||
"version": "3.8.2.0"
|
||||
},
|
||||
{
|
||||
"publisher": "Servably, Inc.",
|
||||
"name": "Syncro",
|
||||
"version": "1.0.201.18410"
|
||||
}
|
||||
],
|
||||
"tpm": {
|
||||
"enabled": true,
|
||||
"ready": true,
|
||||
"present": true
|
||||
},
|
||||
"local_groups": [
|
||||
"Cert Publishers",
|
||||
"RAS and IAS Servers",
|
||||
"Allowed RODC Password Replication Group",
|
||||
"Denied RODC Password Replication Group"
|
||||
],
|
||||
"battery": {
|
||||
"present": false
|
||||
},
|
||||
"third_party_av_active": false,
|
||||
"activation": {
|
||||
"edition": "Microsoft Windows Server 2025 Standard",
|
||||
"description": "Windows(R) Operating System, VOLUME_KMSCLIENT channel",
|
||||
"licensed": true,
|
||||
"license_status_code": 1
|
||||
},
|
||||
"time_source": "Free-running System Clock",
|
||||
"chassis_types": [
|
||||
3
|
||||
],
|
||||
"last_hotfix": {
|
||||
"hotfix_id": "KB5089717",
|
||||
"installed_on": "2026-05-17T07:00:00Z"
|
||||
},
|
||||
"scheduled_tasks": [
|
||||
{
|
||||
"path": "\\",
|
||||
"name": "MicrosoftEdgeUpdateTaskMachineCore{3F3B8390-0879-4598-A0FB-FCCC9A4FBAA9}",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\",
|
||||
"name": "MicrosoftEdgeUpdateTaskMachineUA{F6534644-528C-456C-ABC0-2A47E8920650}",
|
||||
"state": "Ready"
|
||||
}
|
||||
],
|
||||
"antivirus_products": [],
|
||||
"domain_joined": true,
|
||||
"defender": {
|
||||
"antispyware_signature_age": 0,
|
||||
"tamper_protected": false,
|
||||
"real_time_protection": false,
|
||||
"nis_enabled": false,
|
||||
"available": true,
|
||||
"antivirus_enabled": false,
|
||||
"am_service_enabled": false
|
||||
},
|
||||
"bitlocker": {
|
||||
"available": false,
|
||||
"os_volume": "C:"
|
||||
},
|
||||
"is_laptop": false,
|
||||
"installed_software_count": 15,
|
||||
"secure_channel_ok": null,
|
||||
"firewall_profiles": {
|
||||
"Private": true,
|
||||
"Domain": true,
|
||||
"Public": true
|
||||
},
|
||||
"domain": "GTS.local",
|
||||
"foreign_agents": null
|
||||
},
|
||||
"findings": [
|
||||
{
|
||||
"id": "sec.defender.rtp_off",
|
||||
"category": "security",
|
||||
"severity": "critical",
|
||||
"title": "Defender real-time protection is OFF",
|
||||
"detail": "Real-time protection is disabled. The endpoint is unprotected against active threats. Re-enable immediately or confirm a managed 3rd-party AV is providing real-time protection.",
|
||||
"evidence": "RealTimeProtectionEnabled=False; AMServiceEnabled=False; AntispywareSignatureAge=0 days; IsTamperProtected=False"
|
||||
},
|
||||
{
|
||||
"id": "sec.defender.amservice_off",
|
||||
"category": "security",
|
||||
"severity": "critical",
|
||||
"title": "Defender antimalware service is not running",
|
||||
"detail": "The Defender antimalware service is not active. If no 3rd-party AV is present, this endpoint has no antivirus protection.",
|
||||
"evidence": "RealTimeProtectionEnabled=False; AMServiceEnabled=False; AntispywareSignatureAge=0 days; IsTamperProtected=False"
|
||||
},
|
||||
{
|
||||
"id": "sec.defender.tamper_off",
|
||||
"category": "security",
|
||||
"severity": "warning",
|
||||
"title": "Defender tamper protection is OFF",
|
||||
"detail": "Tamper protection is disabled, so malware or a local admin can silently disable Defender. Enable tamper protection (typically via Intune / Security Center).",
|
||||
"evidence": "RealTimeProtectionEnabled=False; AMServiceEnabled=False; AntispywareSignatureAge=0 days; IsTamperProtected=False"
|
||||
},
|
||||
{
|
||||
"id": "sec.av_products.none_registered",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "No AV products registered in Security Center",
|
||||
"detail": "SecurityCenter2 returned no AntiVirusProduct entries. This is normal on Windows Server SKUs (Security Center is a client feature). On a workstation, confirm Defender or a managed AV is active.",
|
||||
"evidence": "root\\SecurityCenter2 AntiVirusProduct: none"
|
||||
},
|
||||
{
|
||||
"id": "sec.foreign_agents.none",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "No competitor/leftover management agents detected",
|
||||
"detail": "No known competitor RMM or unmanaged remote-access agents found in installed programs or services.",
|
||||
"evidence": "Scanned uninstall hives (HKLM + WOW6432Node) and Win32_Service"
|
||||
},
|
||||
{
|
||||
"id": "sec.foreign_agents.acg.screenconnect_connectwise_control",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "Expected ACG management tooling present: ScreenConnect / ConnectWise Control",
|
||||
"detail": "This is Arizona Computer Guru managed/remote-access tooling that we deploy. Its presence is expected and not a foreign-agent risk.",
|
||||
"evidence": "program: ScreenConnect Client (1912bf3444b41a08) 26.1.24.9579\nservice: ScreenConnect Client (1912bf3444b41a08) (ScreenConnect Client (1912bf3444b41a08)) Running"
|
||||
},
|
||||
{
|
||||
"id": "sec.foreign_agents.acg.datto_rmm",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "Expected ACG management tooling present: Datto RMM",
|
||||
"detail": "This is Arizona Computer Guru managed/remote-access tooling that we deploy. Its presence is expected and not a foreign-agent risk.",
|
||||
"evidence": "program: Datto RMM 4.4.11616.11616\nservice: CagService (Datto RMM) Running"
|
||||
},
|
||||
{
|
||||
"id": "sec.foreign_agents.acg.splashtop_sos_streamer_",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "Expected ACG management tooling present: Splashtop (SOS/Streamer)",
|
||||
"detail": "This is Arizona Computer Guru managed/remote-access tooling that we deploy. Its presence is expected and not a foreign-agent risk.",
|
||||
"evidence": "program: Splashtop Software Updater 1.5.6.23\nprogram: Splashtop Streamer 3.8.2.0\nservice: SplashtopRemoteService (Splashtop? Remote Service) Running\nservice: SSUService (Splashtop Software Updater Service) Running"
|
||||
},
|
||||
{
|
||||
"id": "sec.foreign_agents.acg.syncro_kabuto",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "Expected ACG management tooling present: Syncro / Kabuto",
|
||||
"detail": "This is Arizona Computer Guru managed/remote-access tooling that we deploy. Its presence is expected and not a foreign-agent risk.",
|
||||
"evidence": "program: Syncro 1.0.201.18410\nservice: Syncro (Syncro) Running"
|
||||
},
|
||||
{
|
||||
"id": "sec.firewall.ok",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "All firewall profiles enabled",
|
||||
"detail": "Domain, Private, and Public firewall profiles are all enabled.",
|
||||
"evidence": "Private=True; Domain=True; Public=True"
|
||||
},
|
||||
{
|
||||
"id": "sec.bitlocker.unavailable",
|
||||
"category": "security",
|
||||
"severity": "unknown",
|
||||
"title": "BitLocker status unavailable",
|
||||
"detail": "Get-BitLockerVolume failed for the OS volume. BitLocker may not be installed (Home edition) or the cmdlet is unavailable. Verify encryption manually (manage-bde -status).",
|
||||
"evidence": "MountPoint=C:, Get-BitLockerVolume returned null"
|
||||
},
|
||||
{
|
||||
"id": "sec.local_admins.list",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "Local administrators (6)",
|
||||
"detail": "Members of the local Administrators group. Review for unexpected or unknown accounts (especially leftover MSP/vendor accounts from a prior provider).",
|
||||
"evidence": "Administrator\nDomain Admins\nEnterprise Admins\nlocaladmin\nMediaAdmin$\nsysadmin"
|
||||
},
|
||||
{
|
||||
"id": "sec.patch.os_supported",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "OS build supported: Win11 24H2",
|
||||
"detail": "Build 26100 (Win11 24H2) is in support until 2026-10-13.",
|
||||
"evidence": "Microsoft Windows Server 2025 Standard build 26100"
|
||||
},
|
||||
{
|
||||
"id": "sec.patch.last_hotfix",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "Last hotfix: KB5089717",
|
||||
"detail": "Most recently installed update (from Get-HotFix; reflects CBS/MSU packages, not all cumulative metadata).",
|
||||
"evidence": "KB5089717 installed 2026-05-17T07:00:00Z"
|
||||
},
|
||||
{
|
||||
"id": "sec.exposure.rdp_on",
|
||||
"category": "security",
|
||||
"severity": "warning",
|
||||
"title": "RDP is enabled",
|
||||
"detail": "Remote Desktop is enabled (NLA required). Confirm it is restricted to VPN or specific source IPs and not exposed to the internet.",
|
||||
"evidence": "fDenyTSConnections=0; UserAuthentication=1"
|
||||
},
|
||||
{
|
||||
"id": "sec.exposure.smb1_off",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "SMBv1 disabled",
|
||||
"detail": "SMBv1 server protocol is disabled.",
|
||||
"evidence": "EnableSMB1Protocol=False"
|
||||
},
|
||||
{
|
||||
"id": "sec.exposure.laps_present",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "LAPS detected",
|
||||
"detail": "A LAPS mechanism is present.",
|
||||
"evidence": "Windows LAPS reg key"
|
||||
},
|
||||
{
|
||||
"id": "health.stability.recurring",
|
||||
"category": "health",
|
||||
"severity": "critical",
|
||||
"title": "Recurring stability events in the last 14 days",
|
||||
"detail": "Three or more of one event class (unexpected shutdown, BSOD, or disk error) in 14 days indicates a hardware or driver problem. Investigate memory, disk, PSU, and drivers.",
|
||||
"evidence": "Unexpected shutdowns (id 41)=0; Bugchecks/BSOD (id 1001)=0; Disk errors (id 7/51/153)=83"
|
||||
},
|
||||
{
|
||||
"id": "health.reboot_uptime.pending",
|
||||
"category": "health",
|
||||
"severity": "warning",
|
||||
"title": "Reboot pending",
|
||||
"detail": "A reboot is pending. Pending reboots can block patches and leave the system in a half-updated state. Schedule a restart.",
|
||||
"evidence": "PendingFileRenameOperations"
|
||||
},
|
||||
{
|
||||
"id": "health.failed_services.stopped",
|
||||
"category": "health",
|
||||
"severity": "warning",
|
||||
"title": "2 auto-start service(s) not running",
|
||||
"detail": "These services are set to start automatically but are not running. Some may be benign; review for security agents, backup agents, or AV that should be running.",
|
||||
"evidence": "AsusUpdateCheck (AsusUpdateCheck) = Stopped\nInventorySvc (Inventory and Compatibility Appraisal service) = Stopped"
|
||||
},
|
||||
{
|
||||
"id": "health.time.source",
|
||||
"category": "health",
|
||||
"severity": "info",
|
||||
"title": "Time service source",
|
||||
"detail": "Current Windows Time service source.",
|
||||
"evidence": "Source=Free-running System Clock"
|
||||
},
|
||||
{
|
||||
"id": "health.backup.none",
|
||||
"category": "health",
|
||||
"severity": "info",
|
||||
"title": "No backup agent detected",
|
||||
"detail": "No known backup agent service found. Backup expectation varies by endpoint; confirm whether this machine is supposed to have local/cloud backup and whether server-side or M365 backup covers it.",
|
||||
"evidence": "No matching backup service in Win32_Service"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,274 @@
|
||||
# Onboarding Diagnostic Baseline - GTS-SVR25
|
||||
|
||||
- **Grade:** RED
|
||||
- **Host:** GTS-SVR25
|
||||
- **Client:** Gonzvar Tax Services (`gonzvar-tax-services`)
|
||||
- **Collected (UTC):** 2026-06-06T18:13:24Z
|
||||
- **Agent ID:** 3f202b0e-5f48-4f76-833c-d7d1bd00ed58
|
||||
- **Command ID:** 144165ca-d232-4a3d-b904-cb622b431fd9
|
||||
- **Findings:** 3 critical / 4 warning / 14 info / 1 unknown
|
||||
|
||||
- **OS:** Microsoft Windows Server 2025 Standard (build 26100)
|
||||
|
||||
---
|
||||
|
||||
## CRITICAL (3)
|
||||
|
||||
### Defender real-time protection is OFF
|
||||
- **Category:** security
|
||||
- **ID:** `sec.defender.rtp_off`
|
||||
- Real-time protection is disabled. The endpoint is unprotected against active threats. Re-enable immediately or confirm a managed 3rd-party AV is providing real-time protection.
|
||||
|
||||
```
|
||||
RealTimeProtectionEnabled=False; AMServiceEnabled=False; AntispywareSignatureAge=0 days; IsTamperProtected=False
|
||||
```
|
||||
|
||||
### Defender antimalware service is not running
|
||||
- **Category:** security
|
||||
- **ID:** `sec.defender.amservice_off`
|
||||
- The Defender antimalware service is not active. If no 3rd-party AV is present, this endpoint has no antivirus protection.
|
||||
|
||||
```
|
||||
RealTimeProtectionEnabled=False; AMServiceEnabled=False; AntispywareSignatureAge=0 days; IsTamperProtected=False
|
||||
```
|
||||
|
||||
### Recurring stability events in the last 14 days
|
||||
- **Category:** health
|
||||
- **ID:** `health.stability.recurring`
|
||||
- Three or more of one event class (unexpected shutdown, BSOD, or disk error) in 14 days indicates a hardware or driver problem. Investigate memory, disk, PSU, and drivers.
|
||||
|
||||
```
|
||||
Unexpected shutdowns (id 41)=0; Bugchecks/BSOD (id 1001)=0; Disk errors (id 7/51/153)=83
|
||||
```
|
||||
|
||||
|
||||
## WARNING (4)
|
||||
|
||||
### Defender tamper protection is OFF
|
||||
- **Category:** security
|
||||
- **ID:** `sec.defender.tamper_off`
|
||||
- Tamper protection is disabled, so malware or a local admin can silently disable Defender. Enable tamper protection (typically via Intune / Security Center).
|
||||
|
||||
```
|
||||
RealTimeProtectionEnabled=False; AMServiceEnabled=False; AntispywareSignatureAge=0 days; IsTamperProtected=False
|
||||
```
|
||||
|
||||
### RDP is enabled
|
||||
- **Category:** security
|
||||
- **ID:** `sec.exposure.rdp_on`
|
||||
- Remote Desktop is enabled (NLA required). Confirm it is restricted to VPN or specific source IPs and not exposed to the internet.
|
||||
|
||||
```
|
||||
fDenyTSConnections=0; UserAuthentication=1
|
||||
```
|
||||
|
||||
### Reboot pending
|
||||
- **Category:** health
|
||||
- **ID:** `health.reboot_uptime.pending`
|
||||
- A reboot is pending. Pending reboots can block patches and leave the system in a half-updated state. Schedule a restart.
|
||||
|
||||
```
|
||||
PendingFileRenameOperations
|
||||
```
|
||||
|
||||
### 2 auto-start service(s) not running
|
||||
- **Category:** health
|
||||
- **ID:** `health.failed_services.stopped`
|
||||
- These services are set to start automatically but are not running. Some may be benign; review for security agents, backup agents, or AV that should be running.
|
||||
|
||||
```
|
||||
AsusUpdateCheck (AsusUpdateCheck) = Stopped
|
||||
InventorySvc (Inventory and Compatibility Appraisal service) = Stopped
|
||||
```
|
||||
|
||||
|
||||
## INFO (14)
|
||||
|
||||
### No AV products registered in Security Center
|
||||
- **Category:** security
|
||||
- **ID:** `sec.av_products.none_registered`
|
||||
- SecurityCenter2 returned no AntiVirusProduct entries. This is normal on Windows Server SKUs (Security Center is a client feature). On a workstation, confirm Defender or a managed AV is active.
|
||||
|
||||
```
|
||||
root\SecurityCenter2 AntiVirusProduct: none
|
||||
```
|
||||
|
||||
### No competitor/leftover management agents detected
|
||||
- **Category:** security
|
||||
- **ID:** `sec.foreign_agents.none`
|
||||
- No known competitor RMM or unmanaged remote-access agents found in installed programs or services.
|
||||
|
||||
```
|
||||
Scanned uninstall hives (HKLM + WOW6432Node) and Win32_Service
|
||||
```
|
||||
|
||||
### Expected ACG management tooling present: ScreenConnect / ConnectWise Control
|
||||
- **Category:** security
|
||||
- **ID:** `sec.foreign_agents.acg.screenconnect_connectwise_control`
|
||||
- This is Arizona Computer Guru managed/remote-access tooling that we deploy. Its presence is expected and not a foreign-agent risk.
|
||||
|
||||
```
|
||||
program: ScreenConnect Client (1912bf3444b41a08) 26.1.24.9579
|
||||
service: ScreenConnect Client (1912bf3444b41a08) (ScreenConnect Client (1912bf3444b41a08)) Running
|
||||
```
|
||||
|
||||
### Expected ACG management tooling present: Datto RMM
|
||||
- **Category:** security
|
||||
- **ID:** `sec.foreign_agents.acg.datto_rmm`
|
||||
- This is Arizona Computer Guru managed/remote-access tooling that we deploy. Its presence is expected and not a foreign-agent risk.
|
||||
|
||||
```
|
||||
program: Datto RMM 4.4.11616.11616
|
||||
service: CagService (Datto RMM) Running
|
||||
```
|
||||
|
||||
### Expected ACG management tooling present: Splashtop (SOS/Streamer)
|
||||
- **Category:** security
|
||||
- **ID:** `sec.foreign_agents.acg.splashtop_sos_streamer_`
|
||||
- This is Arizona Computer Guru managed/remote-access tooling that we deploy. Its presence is expected and not a foreign-agent risk.
|
||||
|
||||
```
|
||||
program: Splashtop Software Updater 1.5.6.23
|
||||
program: Splashtop Streamer 3.8.2.0
|
||||
service: SplashtopRemoteService (Splashtop? Remote Service) Running
|
||||
service: SSUService (Splashtop Software Updater Service) Running
|
||||
```
|
||||
|
||||
### Expected ACG management tooling present: Syncro / Kabuto
|
||||
- **Category:** security
|
||||
- **ID:** `sec.foreign_agents.acg.syncro_kabuto`
|
||||
- This is Arizona Computer Guru managed/remote-access tooling that we deploy. Its presence is expected and not a foreign-agent risk.
|
||||
|
||||
```
|
||||
program: Syncro 1.0.201.18410
|
||||
service: Syncro (Syncro) Running
|
||||
```
|
||||
|
||||
### All firewall profiles enabled
|
||||
- **Category:** security
|
||||
- **ID:** `sec.firewall.ok`
|
||||
- Domain, Private, and Public firewall profiles are all enabled.
|
||||
|
||||
```
|
||||
Private=True; Domain=True; Public=True
|
||||
```
|
||||
|
||||
### Local administrators (6)
|
||||
- **Category:** security
|
||||
- **ID:** `sec.local_admins.list`
|
||||
- Members of the local Administrators group. Review for unexpected or unknown accounts (especially leftover MSP/vendor accounts from a prior provider).
|
||||
|
||||
```
|
||||
Administrator
|
||||
Domain Admins
|
||||
Enterprise Admins
|
||||
localadmin
|
||||
MediaAdmin$
|
||||
sysadmin
|
||||
```
|
||||
|
||||
### OS build supported: Win11 24H2
|
||||
- **Category:** security
|
||||
- **ID:** `sec.patch.os_supported`
|
||||
- Build 26100 (Win11 24H2) is in support until 2026-10-13.
|
||||
|
||||
```
|
||||
Microsoft Windows Server 2025 Standard build 26100
|
||||
```
|
||||
|
||||
### Last hotfix: KB5089717
|
||||
- **Category:** security
|
||||
- **ID:** `sec.patch.last_hotfix`
|
||||
- Most recently installed update (from Get-HotFix; reflects CBS/MSU packages, not all cumulative metadata).
|
||||
|
||||
```
|
||||
KB5089717 installed 2026-05-17T07:00:00Z
|
||||
```
|
||||
|
||||
### SMBv1 disabled
|
||||
- **Category:** security
|
||||
- **ID:** `sec.exposure.smb1_off`
|
||||
- SMBv1 server protocol is disabled.
|
||||
|
||||
```
|
||||
EnableSMB1Protocol=False
|
||||
```
|
||||
|
||||
### LAPS detected
|
||||
- **Category:** security
|
||||
- **ID:** `sec.exposure.laps_present`
|
||||
- A LAPS mechanism is present.
|
||||
|
||||
```
|
||||
Windows LAPS reg key
|
||||
```
|
||||
|
||||
### Time service source
|
||||
- **Category:** health
|
||||
- **ID:** `health.time.source`
|
||||
- Current Windows Time service source.
|
||||
|
||||
```
|
||||
Source=Free-running System Clock
|
||||
```
|
||||
|
||||
### No backup agent detected
|
||||
- **Category:** health
|
||||
- **ID:** `health.backup.none`
|
||||
- No known backup agent service found. Backup expectation varies by endpoint; confirm whether this machine is supposed to have local/cloud backup and whether server-side or M365 backup covers it.
|
||||
|
||||
```
|
||||
No matching backup service in Win32_Service
|
||||
```
|
||||
|
||||
|
||||
## UNKNOWN (1)
|
||||
|
||||
### BitLocker status unavailable
|
||||
- **Category:** security
|
||||
- **ID:** `sec.bitlocker.unavailable`
|
||||
- Get-BitLockerVolume failed for the OS volume. BitLocker may not be installed (Home edition) or the cmdlet is unavailable. Verify encryption manually (manage-bde -status).
|
||||
|
||||
```
|
||||
MountPoint=C:, Get-BitLockerVolume returned null
|
||||
```
|
||||
|
||||
|
||||
---
|
||||
|
||||
## Inventory Baseline Summary
|
||||
|
||||
- **Manufacturer / Model:** ASUS / System Product Name
|
||||
- **Serial:** System Serial Number
|
||||
- **CPU:** 12th Gen Intel(R) Core(TM) i7-12700 (12 cores / 20 logical)
|
||||
- **RAM (GB):** 31.7
|
||||
- **BIOS:** 1620 (2022-08-12)
|
||||
- **Chassis is laptop:** false
|
||||
- **TPM present / Secure Boot:** true / ?
|
||||
- **Domain joined:** true (GTS.local)
|
||||
- **OS activation licensed:** true
|
||||
- **Uptime (days):** 20.6
|
||||
- **Pending reboot:** true
|
||||
- **Installed software count:** 15
|
||||
- **Scheduled tasks (non-MS, enabled):** 2
|
||||
- **Local administrators:** Administrator, Domain Admins, Enterprise Admins, localadmin, MediaAdmin$, sysadmin
|
||||
|
||||
### Fixed volumes
|
||||
|
||||
- [unlabeled] - 0.1 GB free of 0.8 GB (11.8%)
|
||||
- C: - 1684.5 GB free of 1862.2 GB (90.5%)
|
||||
- [unlabeled] - 0.1 GB free of 0.1 GB (64.4%)
|
||||
|
||||
### Network adapters
|
||||
|
||||
- Realtek PCIe 2.5GbE Family Controller - IP: 192.168.0.2, fe80::9386:5e2c:c38a:61b1 - DNS: 192.168.0.2, 192.168.0.5 - DHCP: false
|
||||
|
||||
---
|
||||
|
||||
## Diff vs Prior Baseline
|
||||
|
||||
- No prior baseline found for this host. This is the first baseline.
|
||||
|
||||
---
|
||||
|
||||
_Generated by run-onboarding-diagnostic.sh (GuruRMM onboarding diagnostic, Phase 1). Raw snapshot: `GTS-SVR25-20260606T181205.json` (immutable)._
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,261 @@
|
||||
# Onboarding Diagnostic Baseline - GTS-W0
|
||||
|
||||
- **Grade:** RED
|
||||
- **Host:** GTS-W0
|
||||
- **Client:** Gonzvar Tax Services (`gonzvar-tax-services`)
|
||||
- **Collected (UTC):** 2026-06-06T18:08:45Z
|
||||
- **Agent ID:** 14751270-35fd-4b89-a083-a014a725e356
|
||||
- **Command ID:** c6247347-570f-45f8-9357-92208252029b
|
||||
- **Findings:** 3 critical / 4 warning / 14 info / 0 unknown
|
||||
|
||||
- **OS:** Microsoft Windows 11 Pro for Workstations (build 26200)
|
||||
|
||||
---
|
||||
|
||||
## CRITICAL (3)
|
||||
|
||||
### Firewall disabled on profile(s): Domain, Private, Public
|
||||
- **Category:** security
|
||||
- **ID:** `sec.firewall.disabled`
|
||||
- One or more firewall profiles are OFF. The endpoint is exposed to lateral movement and inbound attacks on those networks. Re-enable all profiles.
|
||||
|
||||
```
|
||||
Profile states: Private=False; Domain=False; Public=False
|
||||
```
|
||||
|
||||
### RDP enabled WITHOUT Network Level Authentication
|
||||
- **Category:** security
|
||||
- **ID:** `sec.exposure.rdp_no_nla`
|
||||
- RDP is on and NLA is not required. This exposes the logon screen pre-auth and is vulnerable to pre-auth exploits and brute force. Require NLA, restrict RDP to VPN/allow-listed IPs, or disable RDP.
|
||||
|
||||
```
|
||||
fDenyTSConnections=0; UserAuthentication=0
|
||||
```
|
||||
|
||||
### Recurring stability events in the last 14 days
|
||||
- **Category:** health
|
||||
- **ID:** `health.stability.recurring`
|
||||
- Three or more of one event class (unexpected shutdown, BSOD, or disk error) in 14 days indicates a hardware or driver problem. Investigate memory, disk, PSU, and drivers.
|
||||
|
||||
```
|
||||
Unexpected shutdowns (id 41)=2; Bugchecks/BSOD (id 1001)=0; Disk errors (id 7/51/153)=9
|
||||
```
|
||||
|
||||
|
||||
## WARNING (4)
|
||||
|
||||
### OS volume is NOT encrypted with BitLocker
|
||||
- **Category:** security
|
||||
- **ID:** `sec.bitlocker.unencrypted`
|
||||
- The operating system volume is unencrypted. Data is exposed if the disk is removed or the device is lost. Enable BitLocker and escrow the recovery key.
|
||||
|
||||
```
|
||||
Volume=C:; ProtectionStatus=Off; EncryptionPercentage=0; KeyProtectors=
|
||||
```
|
||||
|
||||
### 1 pending Windows updates
|
||||
- **Category:** security
|
||||
- **ID:** `sec.patch.pending`
|
||||
- Windows Update reports pending (not installed, not hidden) updates. Some may be security updates. Approve/install on the next maintenance window.
|
||||
|
||||
```
|
||||
Microsoft.Update.Session search IsInstalled=0 and IsHidden=0 -> 1
|
||||
```
|
||||
|
||||
### Reboot pending
|
||||
- **Category:** health
|
||||
- **ID:** `health.reboot_uptime.pending`
|
||||
- A reboot is pending. Pending reboots can block patches and leave the system in a half-updated state. Schedule a restart.
|
||||
|
||||
```
|
||||
PendingFileRenameOperations
|
||||
```
|
||||
|
||||
### 4 auto-start service(s) not running
|
||||
- **Category:** health
|
||||
- **ID:** `health.failed_services.stopped`
|
||||
- These services are set to start automatically but are not running. Some may be benign; review for security agents, backup agents, or AV that should be running.
|
||||
|
||||
```
|
||||
GoogleUpdaterInternalService150.0.7863.0 (Google Updater Internal Service (GoogleUpdaterInternalService150.0.7863.0)) = Stopped
|
||||
GoogleUpdaterService150.0.7863.0 (Google Updater Service (GoogleUpdaterService150.0.7863.0)) = Stopped
|
||||
gpsvc (Group Policy Client) = Stopped
|
||||
Intel(R) Platform License Manager Service (Intel(R) Platform License Manager Service) = Stopped
|
||||
```
|
||||
|
||||
|
||||
## INFO (14)
|
||||
|
||||
### Defender active and current
|
||||
- **Category:** security
|
||||
- **ID:** `sec.defender.ok`
|
||||
- Real-time protection on, service running, signatures current.
|
||||
|
||||
```
|
||||
RealTimeProtectionEnabled=True; AMServiceEnabled=True; AntispywareSignatureAge=0 days; IsTamperProtected=True
|
||||
```
|
||||
|
||||
### Defender is the only registered AV
|
||||
- **Category:** security
|
||||
- **ID:** `sec.av_products.defender_only`
|
||||
- Only Microsoft/Windows Defender is registered in Security Center.
|
||||
|
||||
```
|
||||
Windows Defender
|
||||
```
|
||||
|
||||
### No competitor/leftover management agents detected
|
||||
- **Category:** security
|
||||
- **ID:** `sec.foreign_agents.none`
|
||||
- No known competitor RMM or unmanaged remote-access agents found in installed programs or services.
|
||||
|
||||
```
|
||||
Scanned uninstall hives (HKLM + WOW6432Node) and Win32_Service
|
||||
```
|
||||
|
||||
### Expected ACG management tooling present: ScreenConnect / ConnectWise Control
|
||||
- **Category:** security
|
||||
- **ID:** `sec.foreign_agents.acg.screenconnect_connectwise_control`
|
||||
- This is Arizona Computer Guru managed/remote-access tooling that we deploy. Its presence is expected and not a foreign-agent risk.
|
||||
|
||||
```
|
||||
program: ScreenConnect Client (1912bf3444b41a08) 26.1.24.9579
|
||||
service: ScreenConnect Client (1912bf3444b41a08) (ScreenConnect Client (1912bf3444b41a08)) Running
|
||||
```
|
||||
|
||||
### Expected ACG management tooling present: Splashtop (SOS/Streamer)
|
||||
- **Category:** security
|
||||
- **ID:** `sec.foreign_agents.acg.splashtop_sos_streamer_`
|
||||
- This is Arizona Computer Guru managed/remote-access tooling that we deploy. Its presence is expected and not a foreign-agent risk.
|
||||
|
||||
```
|
||||
program: Splashtop Streamer 3.8.4.0
|
||||
service: SplashtopRemoteService (Splashtop? Remote Service) Running
|
||||
```
|
||||
|
||||
### Expected ACG management tooling present: Syncro / Kabuto
|
||||
- **Category:** security
|
||||
- **ID:** `sec.foreign_agents.acg.syncro_kabuto`
|
||||
- This is Arizona Computer Guru managed/remote-access tooling that we deploy. Its presence is expected and not a foreign-agent risk.
|
||||
|
||||
```
|
||||
program: Syncro 1.0.201.18410
|
||||
service: Syncro (Syncro) Running
|
||||
```
|
||||
|
||||
### Local administrators (5)
|
||||
- **Category:** security
|
||||
- **ID:** `sec.local_admins.list`
|
||||
- Members of the local Administrators group. Review for unexpected or unknown accounts (especially leftover MSP/vendor accounts from a prior provider).
|
||||
|
||||
```
|
||||
GTS\Domain Admins
|
||||
GTS\pedro
|
||||
GTS-W0\Administrator
|
||||
GTS-W0\localadmin
|
||||
GTS-W0\pgonz
|
||||
```
|
||||
|
||||
### OS build supported: Win11 25H2
|
||||
- **Category:** security
|
||||
- **ID:** `sec.patch.os_supported`
|
||||
- Build 26200 (Win11 25H2) is in support until 2027-10-12.
|
||||
|
||||
```
|
||||
Microsoft Windows 11 Pro for Workstations build 26200
|
||||
```
|
||||
|
||||
### Last hotfix: KB5089549
|
||||
- **Category:** security
|
||||
- **ID:** `sec.patch.last_hotfix`
|
||||
- Most recently installed update (from Get-HotFix; reflects CBS/MSU packages, not all cumulative metadata).
|
||||
|
||||
```
|
||||
KB5089549 installed 2026-05-13T07:00:00Z
|
||||
```
|
||||
|
||||
### SMBv1 disabled
|
||||
- **Category:** security
|
||||
- **ID:** `sec.exposure.smb1_off`
|
||||
- SMBv1 server protocol is disabled.
|
||||
|
||||
```
|
||||
EnableSMB1Protocol=False
|
||||
```
|
||||
|
||||
### LAPS detected
|
||||
- **Category:** security
|
||||
- **ID:** `sec.exposure.laps_present`
|
||||
- A LAPS mechanism is present.
|
||||
|
||||
```
|
||||
Windows LAPS reg key
|
||||
```
|
||||
|
||||
### Domain secure channel healthy
|
||||
- **Category:** health
|
||||
- **ID:** `health.domain.secure_channel_ok`
|
||||
- Machine trust relationship with the domain is intact.
|
||||
|
||||
```
|
||||
Domain=GTS.local
|
||||
```
|
||||
|
||||
### Time service source
|
||||
- **Category:** health
|
||||
- **ID:** `health.time.source`
|
||||
- Current Windows Time service source.
|
||||
|
||||
```
|
||||
Source=GTS-SVR25.GTS.local
|
||||
```
|
||||
|
||||
### No backup agent detected
|
||||
- **Category:** health
|
||||
- **ID:** `health.backup.none`
|
||||
- No known backup agent service found. Backup expectation varies by endpoint; confirm whether this machine is supposed to have local/cloud backup and whether server-side or M365 backup covers it.
|
||||
|
||||
```
|
||||
No matching backup service in Win32_Service
|
||||
```
|
||||
|
||||
|
||||
---
|
||||
|
||||
## Inventory Baseline Summary
|
||||
|
||||
- **Manufacturer / Model:** LENOVO / 90SM006QUS
|
||||
- **Serial:** MJ0JAX1V
|
||||
- **CPU:** 12th Gen Intel(R) Core(TM) i5-12400 (6 cores / 12 logical)
|
||||
- **RAM (GB):** 15.7
|
||||
- **BIOS:** M49KT29A (2024-01-04)
|
||||
- **Chassis is laptop:** false
|
||||
- **TPM present / Secure Boot:** true / true
|
||||
- **Domain joined:** true (GTS.local)
|
||||
- **OS activation licensed:** true
|
||||
- **Uptime (days):** 1
|
||||
- **Pending reboot:** true
|
||||
- **Installed software count:** 98
|
||||
- **Scheduled tasks (non-MS, enabled):** 50
|
||||
- **Local administrators:** GTS\Domain Admins, GTS\pedro, GTS-W0\Administrator, GTS-W0\localadmin, GTS-W0\pgonz
|
||||
|
||||
### Fixed volumes
|
||||
|
||||
- [SYSTEM] - 0.2 GB free of 0.2 GB (76.9%)
|
||||
- C: - 759.6 GB free of 929.3 GB (81.7%)
|
||||
- [WinRE_DRV] - 1.1 GB free of 2 GB (58.4%)
|
||||
|
||||
### Network adapters
|
||||
|
||||
- ZeroTier Virtual Port - IP: 10.244.136.41, fe80::3d86:b469:1b75:a41a, fc2a:89c2:7ba6:1abe:37ee::1 - DNS: - DHCP: false
|
||||
- Realtek PCIe GbE Family Controller - IP: 192.168.0.145, fe80::1da6:3314:1e3b:8ade - DNS: 192.168.0.2, 192.168.0.5 - DHCP: true
|
||||
|
||||
---
|
||||
|
||||
## Diff vs Prior Baseline
|
||||
|
||||
- No prior baseline found for this host. This is the first baseline.
|
||||
|
||||
---
|
||||
|
||||
_Generated by run-onboarding-diagnostic.sh (GuruRMM onboarding diagnostic, Phase 1). Raw snapshot: `GTS-W0-20260606T180736.json` (immutable)._
|
||||
@@ -0,0 +1,897 @@
|
||||
{
|
||||
"host": "GTS-W1",
|
||||
"collected_at_utc": "2026-06-06T18:09:51Z",
|
||||
"os": {
|
||||
"caption": "Microsoft Windows 11 Pro for Workstations",
|
||||
"version": "10.0.26200",
|
||||
"build": "26200",
|
||||
"install_date": "2025-03-05T16:34:47Z",
|
||||
"last_boot_utc": "2026-05-13T05:55:08Z",
|
||||
"architecture": "64-bit"
|
||||
},
|
||||
"facts": {
|
||||
"builtin_admin_enabled": false,
|
||||
"os_eol": {
|
||||
"eol_date": "2027-10-12",
|
||||
"release": "Win11 25H2"
|
||||
},
|
||||
"pending_updates": 3,
|
||||
"pending_reboot": true,
|
||||
"uptime_days": 24.5,
|
||||
"acg_managed_tools": [
|
||||
"ScreenConnect / ConnectWise Control",
|
||||
"Splashtop (SOS/Streamer)",
|
||||
"Syncro / Kabuto"
|
||||
],
|
||||
"hardware": {
|
||||
"model": "90SM006QUS",
|
||||
"manufacturer": "LENOVO",
|
||||
"bios_date": "2024-01-04",
|
||||
"cpu_logical": 12,
|
||||
"bios_version": "M49KT29A",
|
||||
"cpu_cores": 6,
|
||||
"ram_gb": 15.7,
|
||||
"serial": "MJ0J9LD0",
|
||||
"cpu": "12th Gen Intel(R) Core(TM) i5-12400"
|
||||
},
|
||||
"local_administrators": [
|
||||
"GTS\\Domain Admins",
|
||||
"GTS\\gonzvar",
|
||||
"GTS-W1\\Administrator",
|
||||
"GTS-W1\\localadmin",
|
||||
"GTS-W1\\pgonz"
|
||||
],
|
||||
"os_build": "26200",
|
||||
"secure_boot": true,
|
||||
"backup_agents": null,
|
||||
"autoruns_run_keys": [
|
||||
{
|
||||
"key": "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
|
||||
"name": "SecurityHealth",
|
||||
"value": "C:\\WINDOWS\\system32\\SecurityHealthSystray.exe"
|
||||
},
|
||||
{
|
||||
"key": "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
|
||||
"name": "RtkAudUService",
|
||||
"value": "\"C:\\WINDOWS\\System32\\DriverStore\\FileRepository\\realtekservice.inf_amd64_23392958033090bf\\RtkAudUService64.exe\" -background"
|
||||
},
|
||||
{
|
||||
"key": "HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
|
||||
"name": "GoogleDriveFS",
|
||||
"value": "\"C:\\Program Files\\Google\\Drive File Stream\\126.0.5.0\\GoogleDriveFS.exe\" --startup_mode"
|
||||
},
|
||||
{
|
||||
"key": "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce",
|
||||
"name": "msedge_cleanup_{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}",
|
||||
"value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\149.0.4022.52\\Installer\\setup.exe\" --msedge --channel=stable --delete-old-versions --system-level --verbose-logging --on-logon"
|
||||
},
|
||||
{
|
||||
"key": "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce",
|
||||
"name": "Delete Cached Update Binary",
|
||||
"value": "C:\\WINDOWS\\system32\\cmd.exe /q /c del /q \"C:\\Program Files\\Microsoft OneDrive\\Update\\OneDriveSetup.exe\""
|
||||
},
|
||||
{
|
||||
"key": "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce",
|
||||
"name": "Delete Cached Standalone Update Binary",
|
||||
"value": "C:\\WINDOWS\\system32\\cmd.exe /q /c del /q \"C:\\Program Files\\Microsoft OneDrive\\StandaloneUpdater\\OneDriveSetup.exe\""
|
||||
}
|
||||
],
|
||||
"physical_disks": [
|
||||
{
|
||||
"health": "Healthy",
|
||||
"model": "KBG40ZNV1T02 KIOXIA",
|
||||
"media_type": "SSD"
|
||||
}
|
||||
],
|
||||
"local_users": [
|
||||
{
|
||||
"last_logon": "2022-08-26",
|
||||
"name": "Administrator",
|
||||
"password_never_expires": false,
|
||||
"enabled": false
|
||||
},
|
||||
{
|
||||
"last_logon": "",
|
||||
"name": "DefaultAccount",
|
||||
"password_never_expires": false,
|
||||
"enabled": false
|
||||
},
|
||||
{
|
||||
"last_logon": "",
|
||||
"name": "Guest",
|
||||
"password_never_expires": false,
|
||||
"enabled": false
|
||||
},
|
||||
{
|
||||
"last_logon": "",
|
||||
"name": "localadmin",
|
||||
"password_never_expires": false,
|
||||
"enabled": true
|
||||
},
|
||||
{
|
||||
"last_logon": "",
|
||||
"name": "pgonz",
|
||||
"password_never_expires": false,
|
||||
"enabled": true
|
||||
},
|
||||
{
|
||||
"last_logon": "",
|
||||
"name": "WDAGUtilityAccount",
|
||||
"password_never_expires": false,
|
||||
"enabled": false
|
||||
}
|
||||
],
|
||||
"scheduled_tasks_count": 45,
|
||||
"volumes": [
|
||||
{
|
||||
"drive": "[SYSTEM]",
|
||||
"size_gb": 0.2,
|
||||
"free_pct": 76.9,
|
||||
"free_gb": 0.2
|
||||
},
|
||||
{
|
||||
"drive": "C:",
|
||||
"size_gb": 951.6,
|
||||
"free_pct": 84.5,
|
||||
"free_gb": 803.9
|
||||
},
|
||||
{
|
||||
"drive": "[WinRE_DRV]",
|
||||
"size_gb": 2,
|
||||
"free_pct": 65,
|
||||
"free_gb": 1.3
|
||||
}
|
||||
],
|
||||
"network_adapters": [
|
||||
{
|
||||
"dhcp": true,
|
||||
"description": "Realtek PCIe GbE Family Controller",
|
||||
"gateway": [
|
||||
"192.168.0.1"
|
||||
],
|
||||
"mac": "F4:6B:8C:C7:83:A9",
|
||||
"ip": [
|
||||
"192.168.0.143",
|
||||
"fe80::1651:1e3f:81d6:335b"
|
||||
],
|
||||
"dns": [
|
||||
"192.168.0.2",
|
||||
"192.168.0.5"
|
||||
]
|
||||
}
|
||||
],
|
||||
"failed_autostart_services": [
|
||||
{
|
||||
"name": "gpsvc",
|
||||
"display": "Group Policy Client",
|
||||
"state": "Stopped"
|
||||
},
|
||||
{
|
||||
"name": "Intel(R) Platform License Manager Service",
|
||||
"display": "Intel(R) Platform License Manager Service",
|
||||
"state": "Stopped"
|
||||
},
|
||||
{
|
||||
"name": "SysMain",
|
||||
"display": "SysMain",
|
||||
"state": "Stopped"
|
||||
},
|
||||
{
|
||||
"name": "GoogleUpdaterInternalService150.0.7863.0",
|
||||
"display": "Google Updater Internal Service (GoogleUpdaterInternalService150.0.7863.0)",
|
||||
"state": "Stopped"
|
||||
},
|
||||
{
|
||||
"name": "GoogleUpdaterService150.0.7863.0",
|
||||
"display": "Google Updater Service (GoogleUpdaterService150.0.7863.0)",
|
||||
"state": "Stopped"
|
||||
}
|
||||
],
|
||||
"stability_14d": {
|
||||
"unexpected_shutdowns": 0,
|
||||
"disk_errors": 0,
|
||||
"bugchecks": 0
|
||||
},
|
||||
"exposure": {
|
||||
"smb1_enabled": false,
|
||||
"laps_present": true,
|
||||
"rdp_enabled": false,
|
||||
"uac_enabled": true,
|
||||
"rdp_nla": true
|
||||
},
|
||||
"accounts_password_never_expires": [],
|
||||
"installed_software": [
|
||||
{
|
||||
"publisher": "Lenovo",
|
||||
"name": "Calliope_Keyboard",
|
||||
"version": "1.00.08"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Copilot",
|
||||
"version": "148.0.3967.96"
|
||||
},
|
||||
{
|
||||
"publisher": "Drake Software",
|
||||
"name": "Drake Accounting 2025",
|
||||
"version": "25.0.19"
|
||||
},
|
||||
{
|
||||
"publisher": "Intel Corporation",
|
||||
"name": "Dynamic Application Loader Host Interface Service",
|
||||
"version": "1.0.0.0"
|
||||
},
|
||||
{
|
||||
"publisher": "Google LLC",
|
||||
"name": "Google Chrome",
|
||||
"version": "148.0.7778.218"
|
||||
},
|
||||
{
|
||||
"publisher": "Google LLC",
|
||||
"name": "Google Drive",
|
||||
"version": "126.0.5.0"
|
||||
},
|
||||
{
|
||||
"publisher": "Intel(R) Corporation",
|
||||
"name": "Intel(R) Chipset Device Software",
|
||||
"version": "10.1.18836.8283"
|
||||
},
|
||||
{
|
||||
"publisher": "Intel Corporation",
|
||||
"name": "Intel(R) LMS",
|
||||
"version": "1.0.0.0"
|
||||
},
|
||||
{
|
||||
"publisher": "Intel Corporation",
|
||||
"name": "Intel(R) Management Engine Components",
|
||||
"version": "1.0.0.0"
|
||||
},
|
||||
{
|
||||
"publisher": "Intel Corporation",
|
||||
"name": "Intel(R) Management Engine Components",
|
||||
"version": "2130.16.0.2387"
|
||||
},
|
||||
{
|
||||
"publisher": "Intel Corporation",
|
||||
"name": "Intel(R) Management Engine Driver",
|
||||
"version": "1.0.0.0"
|
||||
},
|
||||
{
|
||||
"publisher": "Lenovo",
|
||||
"name": "Lenovo Now",
|
||||
"version": "4.6.0.44"
|
||||
},
|
||||
{
|
||||
"publisher": "Lenovo Group Ltd.",
|
||||
"name": "Lenovo Vantage Service",
|
||||
"version": "4.2601.31.0"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft .NET Host - 6.0.13 (x86)",
|
||||
"version": "48.55.52137"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft .NET Host - 8.0.0 (x86)",
|
||||
"version": "64.0.4211"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft .NET Host FX Resolver - 6.0.13 (x86)",
|
||||
"version": "48.55.52137"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft .NET Host FX Resolver - 8.0.0 (x86)",
|
||||
"version": "64.0.4211"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft .NET Runtime - 6.0.13 (x86)",
|
||||
"version": "48.55.52137"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft .NET Runtime - 8.0.0 (x86)",
|
||||
"version": "64.0.4211"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft 365 - en-us",
|
||||
"version": "16.0.20026.20112"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft ASP.NET Core 8.0.0 - Shared Framework (x86)",
|
||||
"version": "8.0.0.23531"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft ASP.NET Core 8.0.0 Shared Framework (x86)",
|
||||
"version": "8.0.0.23531"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Edge",
|
||||
"version": "149.0.4022.52"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Edge WebView2 Runtime",
|
||||
"version": "148.0.3967.96"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft OneDrive",
|
||||
"version": "26.088.0510.0004"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft OneNote - en-us",
|
||||
"version": "16.0.20026.20112"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft SQL Server Compact 4.0 SP1 x64 ENU",
|
||||
"version": "4.0.8876.1"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft",
|
||||
"name": "Microsoft Teams Meeting Add-in for Microsoft Office",
|
||||
"version": "1.25.24601"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Update Health Tools",
|
||||
"version": "5.72.0.0"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.44.35211",
|
||||
"version": "14.44.35211.0"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.44.35211",
|
||||
"version": "14.44.35211.0"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.44.35211",
|
||||
"version": "14.44.35211"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.44.35211",
|
||||
"version": "14.44.35211"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Visual C++ 2022 X86 Additional Runtime - 14.44.35211",
|
||||
"version": "14.44.35211"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.44.35211",
|
||||
"version": "14.44.35211"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Windows Desktop Runtime - 6.0.13 (x86)",
|
||||
"version": "48.55.53270"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Windows Desktop Runtime - 6.0.13 (x86)",
|
||||
"version": "6.0.13.32001"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Windows Desktop Runtime - 8.0.0 (x86)",
|
||||
"version": "64.0.5329"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Windows Desktop Runtime - 8.0.0 (x86)",
|
||||
"version": "8.0.0.33101"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Office 16 Click-to-Run Extensibility Component",
|
||||
"version": "16.0.20026.20076"
|
||||
},
|
||||
{
|
||||
"publisher": "Realtek Semiconductor Corp.",
|
||||
"name": "Realtek Audio Driver",
|
||||
"version": "6.0.9225.1"
|
||||
},
|
||||
{
|
||||
"publisher": "Realtek Semiconductor Corp.",
|
||||
"name": "Realtek Card Reader",
|
||||
"version": "10.0.26100.31287"
|
||||
},
|
||||
{
|
||||
"publisher": "ScreenConnect Software",
|
||||
"name": "ScreenConnect Client (1912bf3444b41a08)",
|
||||
"version": "26.1.24.9579"
|
||||
},
|
||||
{
|
||||
"publisher": "Splashtop Inc.",
|
||||
"name": "Splashtop Streamer",
|
||||
"version": "3.8.2.0"
|
||||
},
|
||||
{
|
||||
"publisher": "Servably, Inc.",
|
||||
"name": "Syncro",
|
||||
"version": "1.0.201.18410"
|
||||
}
|
||||
],
|
||||
"tpm": {
|
||||
"enabled": true,
|
||||
"ready": true,
|
||||
"present": true
|
||||
},
|
||||
"local_groups": [
|
||||
"Access Control Assistance Operators",
|
||||
"Administrators",
|
||||
"Backup Operators",
|
||||
"Cryptographic Operators",
|
||||
"Device Owners",
|
||||
"Distributed COM Users",
|
||||
"Event Log Readers",
|
||||
"Guests",
|
||||
"Hyper-V Administrators",
|
||||
"IIS_IUSRS",
|
||||
"Network Configuration Operators",
|
||||
"OpenSSH Users",
|
||||
"Performance Log Users",
|
||||
"Performance Monitor Users",
|
||||
"Power Users",
|
||||
"Remote Desktop Users",
|
||||
"Remote Management Users",
|
||||
"Replicator",
|
||||
"System Managed Accounts Group",
|
||||
"User Mode Hardware Operators",
|
||||
"Users"
|
||||
],
|
||||
"battery": {
|
||||
"present": false
|
||||
},
|
||||
"third_party_av_active": false,
|
||||
"activation": {
|
||||
"edition": "Microsoft Windows 11 Pro for Workstations",
|
||||
"description": "Windows(R) Operating System, VOLUME_MAK channel",
|
||||
"licensed": true,
|
||||
"license_status_code": 1
|
||||
},
|
||||
"time_source": "GTS-SVR25.GTS.local",
|
||||
"chassis_types": [
|
||||
3
|
||||
],
|
||||
"last_hotfix": {
|
||||
"hotfix_id": "KB5089549",
|
||||
"installed_on": "2026-05-13T07:00:00Z"
|
||||
},
|
||||
"scheduled_tasks": [
|
||||
{
|
||||
"path": "\\",
|
||||
"name": "Calliope_Keyboard",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\",
|
||||
"name": "MicrosoftEdgeUpdateTaskMachineCore",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\",
|
||||
"name": "MicrosoftEdgeUpdateTaskMachineUA",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\",
|
||||
"name": "OneDrive Per-Machine Standalone Update Task",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\",
|
||||
"name": "OneDrive Reporting Task-S-1-5-21-1734567741-2755581958-76075995-1121",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\",
|
||||
"name": "OneDrive Reporting Task-S-1-5-21-3052971633-1913791397-467572743-1001",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\",
|
||||
"name": "OneDrive Startup Task-S-1-5-21-1734567741-2755581958-76075995-1121",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\",
|
||||
"name": "OneDrive Startup Task-S-1-5-21-3052971633-1913791397-467572743-1001",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\",
|
||||
"name": "OneLaunchUpdateTask",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\GoogleSystem\\GoogleUpdater\\",
|
||||
"name": "GoogleUpdaterTaskSystem150.0.7863.0{09941C4E-E337-463E-BE02-F432DB9AD38E}",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\GoogleUserPEH\\",
|
||||
"name": "RunPlatformExperienceHelper_Daily",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\GoogleUserPEH\\",
|
||||
"name": "RunPlatformExperienceHelper_Metrics",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\",
|
||||
"name": "LenovoNowQuarterlyLaunch",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\",
|
||||
"name": "LenovoWelcomeLauncher",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\",
|
||||
"name": "LenovoWelcomeQuarterlyLaunch",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\",
|
||||
"name": "LenovoWelcomeTask",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\ImController\\",
|
||||
"name": "Lenovo iM Controller Monitor",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\ImController\\",
|
||||
"name": "Lenovo iM Controller Scheduled Maintenance",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\ImController\\Plugins\\",
|
||||
"name": "LenovoSystemUpdatePlugin_WeeklyTask",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\ImController\\TimeBasedEvents\\",
|
||||
"name": "44cd4312-be7a-427e-a5d6-50d4648309e5",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\ImController\\TimeBasedEvents\\",
|
||||
"name": "e3e75683-06a2-428f-8ece-9845b32c6bbe",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\ImController\\TimeBasedEvents\\",
|
||||
"name": "e8e5f7dd-7e58-4558-ac68-a494321cff6c",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\UDC\\",
|
||||
"name": "Lenovo UDC Idle Monitor",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\UDC\\",
|
||||
"name": "Lenovo UDC Lazy Deployment",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\UDC\\",
|
||||
"name": "Lenovo UDC Maintainance Task",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\UDC\\",
|
||||
"name": "Lenovo UDC Monitor",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\",
|
||||
"name": "Lenovo.Vantage.ServiceMaintainance",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\",
|
||||
"name": "StartupFixPlan",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\Schedule\\",
|
||||
"name": "BatteryGaugeAddinDailyScheduleTask",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\Schedule\\",
|
||||
"name": "ConsumerAddinDailyScheduleTask",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\Schedule\\",
|
||||
"name": "DailyTelemetryTransmission",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\Schedule\\",
|
||||
"name": "GenericMessagingAddin",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\Schedule\\",
|
||||
"name": "GenericMessagingAddin_Pulsation",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\Schedule\\",
|
||||
"name": "HeartbeatAddinDailyScheduleTask",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\Schedule\\",
|
||||
"name": "Lenovo.Vantage.SmartPerformance.MonthlyReport",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\Schedule\\",
|
||||
"name": "LenovoBoostAddin.Prompt",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\Schedule\\",
|
||||
"name": "LenovoCompanionAppAddinDailyScheduleTask",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\Schedule\\",
|
||||
"name": "LenovoSystemUpdateAddin_WeeklyTask",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\Schedule\\",
|
||||
"name": "NotificationCenter",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\Schedule\\",
|
||||
"name": "SmartPerformance.ExpireReminder",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\Schedule\\",
|
||||
"name": "VantageCoreAddinDailyScheduleTask",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\Schedule\\",
|
||||
"name": "VantageCoreAddinIdleScheduleTask",
|
||||
"state": "Running"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\Schedule\\",
|
||||
"name": "VantageCoreAddinWeekScheduleTask",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\SoftLanding\\S-1-5-21-1734567741-2755581958-76075995-1121\\",
|
||||
"name": "SoftLandingCreativeManagementTask",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\SoftLanding\\S-1-5-21-1734567741-2755581958-76075995-1121\\",
|
||||
"name": "SoftLandingDeferralTask-{06948242-2a07-4683-a193-612c85a68ebf}",
|
||||
"state": "Ready"
|
||||
}
|
||||
],
|
||||
"antivirus_products": [
|
||||
"Windows Defender"
|
||||
],
|
||||
"domain_joined": true,
|
||||
"defender": {
|
||||
"antispyware_signature_age": 0,
|
||||
"tamper_protected": true,
|
||||
"real_time_protection": true,
|
||||
"nis_enabled": true,
|
||||
"available": true,
|
||||
"antivirus_enabled": true,
|
||||
"am_service_enabled": true
|
||||
},
|
||||
"bitlocker": {
|
||||
"os_volume": "C:",
|
||||
"key_protectors": [],
|
||||
"recovery_key_present": false,
|
||||
"available": true,
|
||||
"encryption_percent": 0,
|
||||
"protection_status": "Off"
|
||||
},
|
||||
"is_laptop": false,
|
||||
"installed_software_count": 45,
|
||||
"secure_channel_ok": true,
|
||||
"firewall_profiles": {
|
||||
"Private": true,
|
||||
"Domain": true,
|
||||
"Public": true
|
||||
},
|
||||
"domain": "GTS.local",
|
||||
"foreign_agents": null
|
||||
},
|
||||
"findings": [
|
||||
{
|
||||
"id": "sec.defender.ok",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "Defender active and current",
|
||||
"detail": "Real-time protection on, service running, signatures current.",
|
||||
"evidence": "RealTimeProtectionEnabled=True; AMServiceEnabled=True; AntispywareSignatureAge=0 days; IsTamperProtected=True"
|
||||
},
|
||||
{
|
||||
"id": "sec.av_products.defender_only",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "Defender is the only registered AV",
|
||||
"detail": "Only Microsoft/Windows Defender is registered in Security Center.",
|
||||
"evidence": "Windows Defender"
|
||||
},
|
||||
{
|
||||
"id": "sec.foreign_agents.none",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "No competitor/leftover management agents detected",
|
||||
"detail": "No known competitor RMM or unmanaged remote-access agents found in installed programs or services.",
|
||||
"evidence": "Scanned uninstall hives (HKLM + WOW6432Node) and Win32_Service"
|
||||
},
|
||||
{
|
||||
"id": "sec.foreign_agents.acg.screenconnect_connectwise_control",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "Expected ACG management tooling present: ScreenConnect / ConnectWise Control",
|
||||
"detail": "This is Arizona Computer Guru managed/remote-access tooling that we deploy. Its presence is expected and not a foreign-agent risk.",
|
||||
"evidence": "program: ScreenConnect Client (1912bf3444b41a08) 26.1.24.9579\nservice: ScreenConnect Client (1912bf3444b41a08) (ScreenConnect Client (1912bf3444b41a08)) Running"
|
||||
},
|
||||
{
|
||||
"id": "sec.foreign_agents.acg.splashtop_sos_streamer_",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "Expected ACG management tooling present: Splashtop (SOS/Streamer)",
|
||||
"detail": "This is Arizona Computer Guru managed/remote-access tooling that we deploy. Its presence is expected and not a foreign-agent risk.",
|
||||
"evidence": "program: Splashtop Streamer 3.8.2.0\nservice: SplashtopRemoteService (Splashtop? Remote Service) Running"
|
||||
},
|
||||
{
|
||||
"id": "sec.foreign_agents.acg.syncro_kabuto",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "Expected ACG management tooling present: Syncro / Kabuto",
|
||||
"detail": "This is Arizona Computer Guru managed/remote-access tooling that we deploy. Its presence is expected and not a foreign-agent risk.",
|
||||
"evidence": "program: Syncro 1.0.201.18410\nservice: Syncro (Syncro) Running"
|
||||
},
|
||||
{
|
||||
"id": "sec.firewall.ok",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "All firewall profiles enabled",
|
||||
"detail": "Domain, Private, and Public firewall profiles are all enabled.",
|
||||
"evidence": "Private=True; Domain=True; Public=True"
|
||||
},
|
||||
{
|
||||
"id": "sec.bitlocker.unencrypted",
|
||||
"category": "security",
|
||||
"severity": "warning",
|
||||
"title": "OS volume is NOT encrypted with BitLocker",
|
||||
"detail": "The operating system volume is unencrypted. Data is exposed if the disk is removed or the device is lost. Enable BitLocker and escrow the recovery key.",
|
||||
"evidence": "Volume=C:; ProtectionStatus=Off; EncryptionPercentage=0; KeyProtectors="
|
||||
},
|
||||
{
|
||||
"id": "sec.local_admins.list",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "Local administrators (5)",
|
||||
"detail": "Members of the local Administrators group. Review for unexpected or unknown accounts (especially leftover MSP/vendor accounts from a prior provider).",
|
||||
"evidence": "GTS\\Domain Admins\nGTS\\gonzvar\nGTS-W1\\Administrator\nGTS-W1\\localadmin\nGTS-W1\\pgonz"
|
||||
},
|
||||
{
|
||||
"id": "sec.patch.os_supported",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "OS build supported: Win11 25H2",
|
||||
"detail": "Build 26200 (Win11 25H2) is in support until 2027-10-12.",
|
||||
"evidence": "Microsoft Windows 11 Pro for Workstations build 26200"
|
||||
},
|
||||
{
|
||||
"id": "sec.patch.pending",
|
||||
"category": "security",
|
||||
"severity": "warning",
|
||||
"title": "3 pending Windows updates",
|
||||
"detail": "Windows Update reports pending (not installed, not hidden) updates. Some may be security updates. Approve/install on the next maintenance window.",
|
||||
"evidence": "Microsoft.Update.Session search IsInstalled=0 and IsHidden=0 -> 3"
|
||||
},
|
||||
{
|
||||
"id": "sec.patch.last_hotfix",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "Last hotfix: KB5089549",
|
||||
"detail": "Most recently installed update (from Get-HotFix; reflects CBS/MSU packages, not all cumulative metadata).",
|
||||
"evidence": "KB5089549 installed 2026-05-13T07:00:00Z"
|
||||
},
|
||||
{
|
||||
"id": "sec.exposure.smb1_off",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "SMBv1 disabled",
|
||||
"detail": "SMBv1 server protocol is disabled.",
|
||||
"evidence": "EnableSMB1Protocol=False"
|
||||
},
|
||||
{
|
||||
"id": "sec.exposure.laps_present",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "LAPS detected",
|
||||
"detail": "A LAPS mechanism is present.",
|
||||
"evidence": "Windows LAPS reg key"
|
||||
},
|
||||
{
|
||||
"id": "health.stability.clean",
|
||||
"category": "health",
|
||||
"severity": "info",
|
||||
"title": "No stability events in the last 14 days",
|
||||
"detail": "No unexpected shutdowns, BSODs, or disk errors logged.",
|
||||
"evidence": "Unexpected shutdowns (id 41)=0; Bugchecks/BSOD (id 1001)=0; Disk errors (id 7/51/153)=0"
|
||||
},
|
||||
{
|
||||
"id": "health.reboot_uptime.pending",
|
||||
"category": "health",
|
||||
"severity": "warning",
|
||||
"title": "Reboot pending",
|
||||
"detail": "A reboot is pending. Pending reboots can block patches and leave the system in a half-updated state. Schedule a restart.",
|
||||
"evidence": "PendingFileRenameOperations"
|
||||
},
|
||||
{
|
||||
"id": "health.failed_services.stopped",
|
||||
"category": "health",
|
||||
"severity": "warning",
|
||||
"title": "5 auto-start service(s) not running",
|
||||
"detail": "These services are set to start automatically but are not running. Some may be benign; review for security agents, backup agents, or AV that should be running.",
|
||||
"evidence": "gpsvc (Group Policy Client) = Stopped\nIntel(R) Platform License Manager Service (Intel(R) Platform License Manager Service) = Stopped\nSysMain (SysMain) = Stopped\nGoogleUpdaterInternalService150.0.7863.0 (Google Updater Internal Service (GoogleUpdaterInternalService150.0.7863.0)) = Stopped\nGoogleUpdaterService150.0.7863.0 (Google Updater Service (GoogleUpdaterService150.0.7863.0)) = Stopped"
|
||||
},
|
||||
{
|
||||
"id": "health.domain.secure_channel_ok",
|
||||
"category": "health",
|
||||
"severity": "info",
|
||||
"title": "Domain secure channel healthy",
|
||||
"detail": "Machine trust relationship with the domain is intact.",
|
||||
"evidence": "Domain=GTS.local"
|
||||
},
|
||||
{
|
||||
"id": "health.time.source",
|
||||
"category": "health",
|
||||
"severity": "info",
|
||||
"title": "Time service source",
|
||||
"detail": "Current Windows Time service source.",
|
||||
"evidence": "Source=GTS-SVR25.GTS.local"
|
||||
},
|
||||
{
|
||||
"id": "health.backup.none",
|
||||
"category": "health",
|
||||
"severity": "info",
|
||||
"title": "No backup agent detected",
|
||||
"detail": "No known backup agent service found. Backup expectation varies by endpoint; confirm whether this machine is supposed to have local/cloud backup and whether server-side or M365 backup covers it.",
|
||||
"evidence": "No matching backup service in Win32_Service"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,249 @@
|
||||
# Onboarding Diagnostic Baseline - GTS-W1
|
||||
|
||||
- **Grade:** AMBER
|
||||
- **Host:** GTS-W1
|
||||
- **Client:** Gonzvar Tax Services (`gonzvar-tax-services`)
|
||||
- **Collected (UTC):** 2026-06-06T18:09:51Z
|
||||
- **Agent ID:** 151c0c38-eb28-48c7-87d8-51ef8d81cc75
|
||||
- **Command ID:** 748d8235-1d1f-4015-a74e-f03c4aade06b
|
||||
- **Findings:** 0 critical / 4 warning / 16 info / 0 unknown
|
||||
|
||||
- **OS:** Microsoft Windows 11 Pro for Workstations (build 26200)
|
||||
|
||||
---
|
||||
|
||||
## WARNING (4)
|
||||
|
||||
### OS volume is NOT encrypted with BitLocker
|
||||
- **Category:** security
|
||||
- **ID:** `sec.bitlocker.unencrypted`
|
||||
- The operating system volume is unencrypted. Data is exposed if the disk is removed or the device is lost. Enable BitLocker and escrow the recovery key.
|
||||
|
||||
```
|
||||
Volume=C:; ProtectionStatus=Off; EncryptionPercentage=0; KeyProtectors=
|
||||
```
|
||||
|
||||
### 3 pending Windows updates
|
||||
- **Category:** security
|
||||
- **ID:** `sec.patch.pending`
|
||||
- Windows Update reports pending (not installed, not hidden) updates. Some may be security updates. Approve/install on the next maintenance window.
|
||||
|
||||
```
|
||||
Microsoft.Update.Session search IsInstalled=0 and IsHidden=0 -> 3
|
||||
```
|
||||
|
||||
### Reboot pending
|
||||
- **Category:** health
|
||||
- **ID:** `health.reboot_uptime.pending`
|
||||
- A reboot is pending. Pending reboots can block patches and leave the system in a half-updated state. Schedule a restart.
|
||||
|
||||
```
|
||||
PendingFileRenameOperations
|
||||
```
|
||||
|
||||
### 5 auto-start service(s) not running
|
||||
- **Category:** health
|
||||
- **ID:** `health.failed_services.stopped`
|
||||
- These services are set to start automatically but are not running. Some may be benign; review for security agents, backup agents, or AV that should be running.
|
||||
|
||||
```
|
||||
gpsvc (Group Policy Client) = Stopped
|
||||
Intel(R) Platform License Manager Service (Intel(R) Platform License Manager Service) = Stopped
|
||||
SysMain (SysMain) = Stopped
|
||||
GoogleUpdaterInternalService150.0.7863.0 (Google Updater Internal Service (GoogleUpdaterInternalService150.0.7863.0)) = Stopped
|
||||
GoogleUpdaterService150.0.7863.0 (Google Updater Service (GoogleUpdaterService150.0.7863.0)) = Stopped
|
||||
```
|
||||
|
||||
|
||||
## INFO (16)
|
||||
|
||||
### Defender active and current
|
||||
- **Category:** security
|
||||
- **ID:** `sec.defender.ok`
|
||||
- Real-time protection on, service running, signatures current.
|
||||
|
||||
```
|
||||
RealTimeProtectionEnabled=True; AMServiceEnabled=True; AntispywareSignatureAge=0 days; IsTamperProtected=True
|
||||
```
|
||||
|
||||
### Defender is the only registered AV
|
||||
- **Category:** security
|
||||
- **ID:** `sec.av_products.defender_only`
|
||||
- Only Microsoft/Windows Defender is registered in Security Center.
|
||||
|
||||
```
|
||||
Windows Defender
|
||||
```
|
||||
|
||||
### No competitor/leftover management agents detected
|
||||
- **Category:** security
|
||||
- **ID:** `sec.foreign_agents.none`
|
||||
- No known competitor RMM or unmanaged remote-access agents found in installed programs or services.
|
||||
|
||||
```
|
||||
Scanned uninstall hives (HKLM + WOW6432Node) and Win32_Service
|
||||
```
|
||||
|
||||
### Expected ACG management tooling present: ScreenConnect / ConnectWise Control
|
||||
- **Category:** security
|
||||
- **ID:** `sec.foreign_agents.acg.screenconnect_connectwise_control`
|
||||
- This is Arizona Computer Guru managed/remote-access tooling that we deploy. Its presence is expected and not a foreign-agent risk.
|
||||
|
||||
```
|
||||
program: ScreenConnect Client (1912bf3444b41a08) 26.1.24.9579
|
||||
service: ScreenConnect Client (1912bf3444b41a08) (ScreenConnect Client (1912bf3444b41a08)) Running
|
||||
```
|
||||
|
||||
### Expected ACG management tooling present: Splashtop (SOS/Streamer)
|
||||
- **Category:** security
|
||||
- **ID:** `sec.foreign_agents.acg.splashtop_sos_streamer_`
|
||||
- This is Arizona Computer Guru managed/remote-access tooling that we deploy. Its presence is expected and not a foreign-agent risk.
|
||||
|
||||
```
|
||||
program: Splashtop Streamer 3.8.2.0
|
||||
service: SplashtopRemoteService (Splashtop? Remote Service) Running
|
||||
```
|
||||
|
||||
### Expected ACG management tooling present: Syncro / Kabuto
|
||||
- **Category:** security
|
||||
- **ID:** `sec.foreign_agents.acg.syncro_kabuto`
|
||||
- This is Arizona Computer Guru managed/remote-access tooling that we deploy. Its presence is expected and not a foreign-agent risk.
|
||||
|
||||
```
|
||||
program: Syncro 1.0.201.18410
|
||||
service: Syncro (Syncro) Running
|
||||
```
|
||||
|
||||
### All firewall profiles enabled
|
||||
- **Category:** security
|
||||
- **ID:** `sec.firewall.ok`
|
||||
- Domain, Private, and Public firewall profiles are all enabled.
|
||||
|
||||
```
|
||||
Private=True; Domain=True; Public=True
|
||||
```
|
||||
|
||||
### Local administrators (5)
|
||||
- **Category:** security
|
||||
- **ID:** `sec.local_admins.list`
|
||||
- Members of the local Administrators group. Review for unexpected or unknown accounts (especially leftover MSP/vendor accounts from a prior provider).
|
||||
|
||||
```
|
||||
GTS\Domain Admins
|
||||
GTS\gonzvar
|
||||
GTS-W1\Administrator
|
||||
GTS-W1\localadmin
|
||||
GTS-W1\pgonz
|
||||
```
|
||||
|
||||
### OS build supported: Win11 25H2
|
||||
- **Category:** security
|
||||
- **ID:** `sec.patch.os_supported`
|
||||
- Build 26200 (Win11 25H2) is in support until 2027-10-12.
|
||||
|
||||
```
|
||||
Microsoft Windows 11 Pro for Workstations build 26200
|
||||
```
|
||||
|
||||
### Last hotfix: KB5089549
|
||||
- **Category:** security
|
||||
- **ID:** `sec.patch.last_hotfix`
|
||||
- Most recently installed update (from Get-HotFix; reflects CBS/MSU packages, not all cumulative metadata).
|
||||
|
||||
```
|
||||
KB5089549 installed 2026-05-13T07:00:00Z
|
||||
```
|
||||
|
||||
### SMBv1 disabled
|
||||
- **Category:** security
|
||||
- **ID:** `sec.exposure.smb1_off`
|
||||
- SMBv1 server protocol is disabled.
|
||||
|
||||
```
|
||||
EnableSMB1Protocol=False
|
||||
```
|
||||
|
||||
### LAPS detected
|
||||
- **Category:** security
|
||||
- **ID:** `sec.exposure.laps_present`
|
||||
- A LAPS mechanism is present.
|
||||
|
||||
```
|
||||
Windows LAPS reg key
|
||||
```
|
||||
|
||||
### No stability events in the last 14 days
|
||||
- **Category:** health
|
||||
- **ID:** `health.stability.clean`
|
||||
- No unexpected shutdowns, BSODs, or disk errors logged.
|
||||
|
||||
```
|
||||
Unexpected shutdowns (id 41)=0; Bugchecks/BSOD (id 1001)=0; Disk errors (id 7/51/153)=0
|
||||
```
|
||||
|
||||
### Domain secure channel healthy
|
||||
- **Category:** health
|
||||
- **ID:** `health.domain.secure_channel_ok`
|
||||
- Machine trust relationship with the domain is intact.
|
||||
|
||||
```
|
||||
Domain=GTS.local
|
||||
```
|
||||
|
||||
### Time service source
|
||||
- **Category:** health
|
||||
- **ID:** `health.time.source`
|
||||
- Current Windows Time service source.
|
||||
|
||||
```
|
||||
Source=GTS-SVR25.GTS.local
|
||||
```
|
||||
|
||||
### No backup agent detected
|
||||
- **Category:** health
|
||||
- **ID:** `health.backup.none`
|
||||
- No known backup agent service found. Backup expectation varies by endpoint; confirm whether this machine is supposed to have local/cloud backup and whether server-side or M365 backup covers it.
|
||||
|
||||
```
|
||||
No matching backup service in Win32_Service
|
||||
```
|
||||
|
||||
|
||||
---
|
||||
|
||||
## Inventory Baseline Summary
|
||||
|
||||
- **Manufacturer / Model:** LENOVO / 90SM006QUS
|
||||
- **Serial:** MJ0J9LD0
|
||||
- **CPU:** 12th Gen Intel(R) Core(TM) i5-12400 (6 cores / 12 logical)
|
||||
- **RAM (GB):** 15.7
|
||||
- **BIOS:** M49KT29A (2024-01-04)
|
||||
- **Chassis is laptop:** false
|
||||
- **TPM present / Secure Boot:** true / true
|
||||
- **Domain joined:** true (GTS.local)
|
||||
- **OS activation licensed:** true
|
||||
- **Uptime (days):** 24.5
|
||||
- **Pending reboot:** true
|
||||
- **Installed software count:** 45
|
||||
- **Scheduled tasks (non-MS, enabled):** 45
|
||||
- **Local administrators:** GTS\Domain Admins, GTS\gonzvar, GTS-W1\Administrator, GTS-W1\localadmin, GTS-W1\pgonz
|
||||
|
||||
### Fixed volumes
|
||||
|
||||
- [SYSTEM] - 0.2 GB free of 0.2 GB (76.9%)
|
||||
- C: - 803.9 GB free of 951.6 GB (84.5%)
|
||||
- [WinRE_DRV] - 1.3 GB free of 2 GB (65%)
|
||||
|
||||
### Network adapters
|
||||
|
||||
- Realtek PCIe GbE Family Controller - IP: 192.168.0.143, fe80::1651:1e3f:81d6:335b - DNS: 192.168.0.2, 192.168.0.5 - DHCP: true
|
||||
|
||||
---
|
||||
|
||||
## Diff vs Prior Baseline
|
||||
|
||||
- No prior baseline found for this host. This is the first baseline.
|
||||
|
||||
---
|
||||
|
||||
_Generated by run-onboarding-diagnostic.sh (GuruRMM onboarding diagnostic, Phase 1). Raw snapshot: `GTS-W1-20260606T180908.json` (immutable)._
|
||||
@@ -0,0 +1,912 @@
|
||||
{
|
||||
"host": "GTS-W2",
|
||||
"collected_at_utc": "2026-06-06T18:11:25Z",
|
||||
"os": {
|
||||
"caption": "Microsoft Windows 11 Pro for Workstations",
|
||||
"version": "10.0.26200",
|
||||
"build": "26200",
|
||||
"install_date": "2025-02-21T09:16:13Z",
|
||||
"last_boot_utc": "2026-04-17T22:07:40Z",
|
||||
"architecture": "64-bit"
|
||||
},
|
||||
"facts": {
|
||||
"builtin_admin_enabled": false,
|
||||
"os_eol": {
|
||||
"eol_date": "2027-10-12",
|
||||
"release": "Win11 25H2"
|
||||
},
|
||||
"pending_updates": 6,
|
||||
"pending_reboot": true,
|
||||
"uptime_days": 49.8,
|
||||
"acg_managed_tools": [
|
||||
"ScreenConnect / ConnectWise Control",
|
||||
"Splashtop (SOS/Streamer)",
|
||||
"Syncro / Kabuto"
|
||||
],
|
||||
"hardware": {
|
||||
"model": "90SM006QUS",
|
||||
"manufacturer": "LENOVO",
|
||||
"bios_date": "2024-01-04",
|
||||
"cpu_logical": 12,
|
||||
"bios_version": "M49KT29A",
|
||||
"cpu_cores": 6,
|
||||
"ram_gb": 15.7,
|
||||
"serial": "MJ0JAWPT",
|
||||
"cpu": "12th Gen Intel(R) Core(TM) i5-12400"
|
||||
},
|
||||
"local_administrators": [
|
||||
"GTS\\Domain Admins",
|
||||
"GTS\\gonzvar",
|
||||
"GTS-W2\\Administrator",
|
||||
"GTS-W2\\localadmin",
|
||||
"GTS-W2\\pgonz"
|
||||
],
|
||||
"os_build": "26200",
|
||||
"secure_boot": true,
|
||||
"backup_agents": null,
|
||||
"autoruns_run_keys": [
|
||||
{
|
||||
"key": "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
|
||||
"name": "SecurityHealth",
|
||||
"value": "C:\\WINDOWS\\system32\\SecurityHealthSystray.exe"
|
||||
},
|
||||
{
|
||||
"key": "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
|
||||
"name": "RtkAudUService",
|
||||
"value": "\"C:\\WINDOWS\\System32\\DriverStore\\FileRepository\\realtekservice.inf_amd64_23392958033090bf\\RtkAudUService64.exe\" -background"
|
||||
}
|
||||
],
|
||||
"physical_disks": [
|
||||
{
|
||||
"health": "Healthy",
|
||||
"model": "KINGSTON SNV2S1000G",
|
||||
"media_type": "SSD"
|
||||
}
|
||||
],
|
||||
"local_users": [
|
||||
{
|
||||
"last_logon": "2022-08-26",
|
||||
"name": "Administrator",
|
||||
"password_never_expires": false,
|
||||
"enabled": false
|
||||
},
|
||||
{
|
||||
"last_logon": "",
|
||||
"name": "DefaultAccount",
|
||||
"password_never_expires": false,
|
||||
"enabled": false
|
||||
},
|
||||
{
|
||||
"last_logon": "",
|
||||
"name": "Guest",
|
||||
"password_never_expires": false,
|
||||
"enabled": false
|
||||
},
|
||||
{
|
||||
"last_logon": "",
|
||||
"name": "localadmin",
|
||||
"password_never_expires": false,
|
||||
"enabled": true
|
||||
},
|
||||
{
|
||||
"last_logon": "",
|
||||
"name": "pgonz",
|
||||
"password_never_expires": false,
|
||||
"enabled": true
|
||||
},
|
||||
{
|
||||
"last_logon": "",
|
||||
"name": "WDAGUtilityAccount",
|
||||
"password_never_expires": false,
|
||||
"enabled": false
|
||||
}
|
||||
],
|
||||
"scheduled_tasks_count": 46,
|
||||
"volumes": [
|
||||
{
|
||||
"drive": "[SYSTEM]",
|
||||
"size_gb": 0.2,
|
||||
"free_pct": 76.9,
|
||||
"free_gb": 0.2
|
||||
},
|
||||
{
|
||||
"drive": "C:",
|
||||
"size_gb": 929.3,
|
||||
"free_pct": 81.4,
|
||||
"free_gb": 756.7
|
||||
},
|
||||
{
|
||||
"drive": "[WinRE_DRV]",
|
||||
"size_gb": 2,
|
||||
"free_pct": 60.2,
|
||||
"free_gb": 1.2
|
||||
}
|
||||
],
|
||||
"network_adapters": [
|
||||
{
|
||||
"dhcp": true,
|
||||
"description": "Realtek PCIe GbE Family Controller",
|
||||
"gateway": [
|
||||
"192.168.0.1"
|
||||
],
|
||||
"mac": "F4:6B:8C:C7:84:BC",
|
||||
"ip": [
|
||||
"192.168.0.146",
|
||||
"fe80::826b:1844:b416:d971"
|
||||
],
|
||||
"dns": [
|
||||
"192.168.0.2",
|
||||
"192.168.0.5"
|
||||
]
|
||||
}
|
||||
],
|
||||
"failed_autostart_services": [
|
||||
{
|
||||
"name": "Intel(R) Platform License Manager Service",
|
||||
"display": "Intel(R) Platform License Manager Service",
|
||||
"state": "Stopped"
|
||||
},
|
||||
{
|
||||
"name": "GoogleUpdaterInternalService150.0.7863.0",
|
||||
"display": "Google Updater Internal Service (GoogleUpdaterInternalService150.0.7863.0)",
|
||||
"state": "Stopped"
|
||||
},
|
||||
{
|
||||
"name": "GoogleUpdaterService150.0.7863.0",
|
||||
"display": "Google Updater Service (GoogleUpdaterService150.0.7863.0)",
|
||||
"state": "Stopped"
|
||||
}
|
||||
],
|
||||
"stability_14d": {
|
||||
"unexpected_shutdowns": 0,
|
||||
"disk_errors": 0,
|
||||
"bugchecks": 0
|
||||
},
|
||||
"exposure": {
|
||||
"smb1_enabled": false,
|
||||
"laps_present": true,
|
||||
"rdp_enabled": false,
|
||||
"uac_enabled": true,
|
||||
"rdp_nla": true
|
||||
},
|
||||
"accounts_password_never_expires": [],
|
||||
"installed_software": [
|
||||
{
|
||||
"publisher": "Adobe",
|
||||
"name": "Adobe Acrobat (64-bit)",
|
||||
"version": "26.001.21563"
|
||||
},
|
||||
{
|
||||
"publisher": "Adobe Systems Incorporated",
|
||||
"name": "Adobe Refresh Manager",
|
||||
"version": "1.8.0"
|
||||
},
|
||||
{
|
||||
"publisher": "Bitdefender",
|
||||
"name": "Bitdefender Endpoint Security Tools",
|
||||
"version": "8.26.6.644"
|
||||
},
|
||||
{
|
||||
"publisher": "Lenovo",
|
||||
"name": "Calliope_Keyboard",
|
||||
"version": "1.00.08"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Copilot",
|
||||
"version": "147.0.3912.60"
|
||||
},
|
||||
{
|
||||
"publisher": "Drake Software",
|
||||
"name": "Drake Accounting 2025",
|
||||
"version": "25.0.18"
|
||||
},
|
||||
{
|
||||
"publisher": "Intel Corporation",
|
||||
"name": "Dynamic Application Loader Host Interface Service",
|
||||
"version": "1.0.0.0"
|
||||
},
|
||||
{
|
||||
"publisher": "Google LLC",
|
||||
"name": "Google Chrome",
|
||||
"version": "148.0.7778.217"
|
||||
},
|
||||
{
|
||||
"publisher": "",
|
||||
"name": "Ingenico USB Drivers 3.40 (remove only)",
|
||||
"version": "3.40"
|
||||
},
|
||||
{
|
||||
"publisher": "Intel Corporation",
|
||||
"name": "Intel(R) Chipset Device Software",
|
||||
"version": "10.1.18836.8283"
|
||||
},
|
||||
{
|
||||
"publisher": "Intel Corporation",
|
||||
"name": "Intel(R) LMS",
|
||||
"version": "1.0.0.0"
|
||||
},
|
||||
{
|
||||
"publisher": "Intel Corporation",
|
||||
"name": "Intel(R) Management Engine Components",
|
||||
"version": "1.0.0.0"
|
||||
},
|
||||
{
|
||||
"publisher": "Intel Corporation",
|
||||
"name": "Intel(R) Management Engine Components",
|
||||
"version": "2130.16.0.2387"
|
||||
},
|
||||
{
|
||||
"publisher": "Intel Corporation",
|
||||
"name": "Intel(R) Management Engine Driver",
|
||||
"version": "1.0.0.0"
|
||||
},
|
||||
{
|
||||
"publisher": "Lenovo",
|
||||
"name": "Lenovo Now",
|
||||
"version": "4.4.0.61"
|
||||
},
|
||||
{
|
||||
"publisher": "Lenovo Group Ltd.",
|
||||
"name": "Lenovo Vantage Service",
|
||||
"version": "4.2601.31.0"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft .NET Host - 6.0.13 (x86)",
|
||||
"version": "48.55.52137"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft .NET Host - 8.0.0 (x86)",
|
||||
"version": "64.0.4211"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft .NET Host FX Resolver - 6.0.13 (x86)",
|
||||
"version": "48.55.52137"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft .NET Host FX Resolver - 8.0.0 (x86)",
|
||||
"version": "64.0.4211"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft .NET Runtime - 6.0.13 (x86)",
|
||||
"version": "48.55.52137"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft .NET Runtime - 8.0.0 (x86)",
|
||||
"version": "64.0.4211"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft 365 - en-us",
|
||||
"version": "16.0.19822.20168"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft ASP.NET Core 8.0.0 - Shared Framework (x86)",
|
||||
"version": "8.0.0.23531"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft ASP.NET Core 8.0.0 Shared Framework (x86)",
|
||||
"version": "8.0.0.23531"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Edge",
|
||||
"version": "147.0.3912.60"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Edge WebView2 Runtime",
|
||||
"version": "147.0.3912.60"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft OneNote - en-us",
|
||||
"version": "16.0.19822.20168"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft SQL Server Compact 4.0 SP1 x64 ENU",
|
||||
"version": "4.0.8876.1"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft",
|
||||
"name": "Microsoft Teams Meeting Add-in for Microsoft Office",
|
||||
"version": "1.24.25506"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Update Health Tools",
|
||||
"version": "5.72.0.0"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.44.35211",
|
||||
"version": "14.44.35211.0"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.44.35211",
|
||||
"version": "14.44.35211.0"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.44.35211",
|
||||
"version": "14.44.35211"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.44.35211",
|
||||
"version": "14.44.35211"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Visual C++ 2022 X86 Additional Runtime - 14.44.35211",
|
||||
"version": "14.44.35211"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.44.35211",
|
||||
"version": "14.44.35211"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Windows Desktop Runtime - 6.0.13 (x86)",
|
||||
"version": "48.55.53270"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Windows Desktop Runtime - 6.0.13 (x86)",
|
||||
"version": "6.0.13.32001"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Windows Desktop Runtime - 8.0.0 (x86)",
|
||||
"version": "64.0.5329"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Windows Desktop Runtime - 8.0.0 (x86)",
|
||||
"version": "8.0.0.33101"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Office 16 Click-to-Run Extensibility Component",
|
||||
"version": "16.0.19822.20104"
|
||||
},
|
||||
{
|
||||
"publisher": "Sober Lemur S.r.l.",
|
||||
"name": "PDFsam Visual",
|
||||
"version": "4.3.0"
|
||||
},
|
||||
{
|
||||
"publisher": "Realtek Semiconductor Corp.",
|
||||
"name": "Realtek Audio Driver",
|
||||
"version": "6.0.9225.1"
|
||||
},
|
||||
{
|
||||
"publisher": "Realtek Semiconductor Corp.",
|
||||
"name": "Realtek Card Reader",
|
||||
"version": "10.0.26100.31287"
|
||||
},
|
||||
{
|
||||
"publisher": "ScreenConnect Software",
|
||||
"name": "ScreenConnect Client (1912bf3444b41a08)",
|
||||
"version": "26.1.24.9579"
|
||||
},
|
||||
{
|
||||
"publisher": "Splashtop Inc.",
|
||||
"name": "Splashtop Streamer",
|
||||
"version": "3.8.2.0"
|
||||
},
|
||||
{
|
||||
"publisher": "Servably, Inc.",
|
||||
"name": "Syncro",
|
||||
"version": "1.0.201.18410"
|
||||
}
|
||||
],
|
||||
"tpm": {
|
||||
"enabled": true,
|
||||
"ready": true,
|
||||
"present": true
|
||||
},
|
||||
"local_groups": [
|
||||
"Access Control Assistance Operators",
|
||||
"Administrators",
|
||||
"Backup Operators",
|
||||
"Cryptographic Operators",
|
||||
"Device Owners",
|
||||
"Distributed COM Users",
|
||||
"Event Log Readers",
|
||||
"Guests",
|
||||
"Hyper-V Administrators",
|
||||
"IIS_IUSRS",
|
||||
"Network Configuration Operators",
|
||||
"OpenSSH Users",
|
||||
"Performance Log Users",
|
||||
"Performance Monitor Users",
|
||||
"Power Users",
|
||||
"Remote Desktop Users",
|
||||
"Remote Management Users",
|
||||
"Replicator",
|
||||
"System Managed Accounts Group",
|
||||
"User Mode Hardware Operators",
|
||||
"Users"
|
||||
],
|
||||
"battery": {
|
||||
"present": false
|
||||
},
|
||||
"third_party_av_active": true,
|
||||
"activation": {
|
||||
"edition": "Microsoft Windows 11 Pro for Workstations",
|
||||
"description": "Windows(R) Operating System, VOLUME_MAK channel",
|
||||
"licensed": true,
|
||||
"license_status_code": 1
|
||||
},
|
||||
"time_source": "GTS-SVR25.GTS.local",
|
||||
"chassis_types": [
|
||||
3
|
||||
],
|
||||
"last_hotfix": {
|
||||
"hotfix_id": "KB5083769",
|
||||
"installed_on": "2026-04-15T07:00:00Z"
|
||||
},
|
||||
"scheduled_tasks": [
|
||||
{
|
||||
"path": "\\",
|
||||
"name": "Adobe Acrobat Update Task",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\",
|
||||
"name": "Calliope_Keyboard",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\",
|
||||
"name": "MicrosoftEdgeUpdateTaskMachineCore",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\",
|
||||
"name": "MicrosoftEdgeUpdateTaskMachineUA",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\",
|
||||
"name": "OneDrive Reporting Task-S-1-5-21-1734567741-2755581958-76075995-1121",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\",
|
||||
"name": "OneDrive Reporting Task-S-1-5-21-3052971633-1913791397-467572743-1001",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\",
|
||||
"name": "OneDrive Standalone Update Task-S-1-5-21-1734567741-2755581958-76075995-1121",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\",
|
||||
"name": "OneDrive Standalone Update Task-S-1-5-21-3052971633-1913791397-467572743-1001",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\",
|
||||
"name": "OneDrive Startup Task-S-1-5-21-1734567741-2755581958-76075995-1121",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\GoogleSystem\\GoogleUpdater\\",
|
||||
"name": "GoogleUpdaterTaskSystem150.0.7863.0{12AFA30B-C755-45D6-85CC-33CDD9BF2243}",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\GoogleUserPEH\\",
|
||||
"name": "RunPlatformExperienceHelper_Daily",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\",
|
||||
"name": "LenovoNowQuarterlyLaunch",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\",
|
||||
"name": "LenovoWelcomeLauncher",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\",
|
||||
"name": "LenovoWelcomeQuarterlyLaunch",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\",
|
||||
"name": "LenovoWelcomeTask",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\ImController\\",
|
||||
"name": "Lenovo iM Controller Monitor",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\ImController\\",
|
||||
"name": "Lenovo iM Controller Scheduled Maintenance",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\ImController\\Plugins\\",
|
||||
"name": "LenovoSystemUpdatePlugin_WeeklyTask",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\ImController\\TimeBasedEvents\\",
|
||||
"name": "05655d16-248b-4767-838a-1fde57338d36",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\ImController\\TimeBasedEvents\\",
|
||||
"name": "ea1a50a7-715a-4c26-b922-ac42ec877042",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\ImController\\TimeBasedEvents\\",
|
||||
"name": "fea6f267-63b1-48d6-ac80-caab635a514f",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\UDC\\",
|
||||
"name": "Lenovo UDC Idle Monitor",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\UDC\\",
|
||||
"name": "Lenovo UDC Lazy Deployment",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\UDC\\",
|
||||
"name": "Lenovo UDC Maintainance Task",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\UDC\\",
|
||||
"name": "Lenovo UDC Monitor",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\",
|
||||
"name": "Lenovo.Vantage.ServiceMaintainance",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\",
|
||||
"name": "StartupFixPlan",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\Schedule\\",
|
||||
"name": "BatteryGaugeAddinDailyScheduleTask",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\Schedule\\",
|
||||
"name": "ConsumerAddinDailyScheduleTask",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\Schedule\\",
|
||||
"name": "DailyTelemetryTransmission",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\Schedule\\",
|
||||
"name": "GenericMessagingAddin",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\Schedule\\",
|
||||
"name": "GenericMessagingAddin_Pulsation",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\Schedule\\",
|
||||
"name": "HeartbeatAddinDailyScheduleTask",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\Schedule\\",
|
||||
"name": "Lenovo.Vantage.SmartPerformance.MonthlyReport",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\Schedule\\",
|
||||
"name": "LenovoBoostAddin.Prompt",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\Schedule\\",
|
||||
"name": "LenovoCompanionAppAddinDailyScheduleTask",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\Schedule\\",
|
||||
"name": "LenovoSystemUpdateAddin_WeeklyTask",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\Schedule\\",
|
||||
"name": "NotificationCenter",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\Schedule\\",
|
||||
"name": "SmartLock.ExpireReminder",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\Schedule\\",
|
||||
"name": "SmartPerformance.ExpireReminder",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\Schedule\\",
|
||||
"name": "VantageCoreAddinDailyScheduleTask",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\Schedule\\",
|
||||
"name": "VantageCoreAddinIdleScheduleTask",
|
||||
"state": "Running"
|
||||
},
|
||||
{
|
||||
"path": "\\Lenovo\\Vantage\\Schedule\\",
|
||||
"name": "VantageCoreAddinWeekScheduleTask",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\McAfeeTsk\\",
|
||||
"name": "OOBEUpgrader",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\SoftLanding\\S-1-5-21-1734567741-2755581958-76075995-1121\\",
|
||||
"name": "SoftLandingCreativeManagementTask",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\SoftLanding\\S-1-5-21-1734567741-2755581958-76075995-1121\\",
|
||||
"name": "SoftLandingDeferralTask-{94a334fe-d698-472a-a23e-c320fa58dbdd}",
|
||||
"state": "Ready"
|
||||
}
|
||||
],
|
||||
"antivirus_products": [
|
||||
"Windows Defender",
|
||||
"Bitdefender Endpoint Security Tools Antimalware"
|
||||
],
|
||||
"domain_joined": true,
|
||||
"defender": {
|
||||
"antispyware_signature_age": 0,
|
||||
"tamper_protected": false,
|
||||
"real_time_protection": false,
|
||||
"nis_enabled": false,
|
||||
"available": true,
|
||||
"antivirus_enabled": false,
|
||||
"am_service_enabled": false
|
||||
},
|
||||
"bitlocker": {
|
||||
"os_volume": "C:",
|
||||
"key_protectors": [],
|
||||
"recovery_key_present": false,
|
||||
"available": true,
|
||||
"encryption_percent": 0,
|
||||
"protection_status": "Off"
|
||||
},
|
||||
"is_laptop": false,
|
||||
"installed_software_count": 48,
|
||||
"secure_channel_ok": true,
|
||||
"firewall_profiles": {
|
||||
"Private": true,
|
||||
"Domain": true,
|
||||
"Public": true
|
||||
},
|
||||
"domain": "GTS.local",
|
||||
"foreign_agents": null
|
||||
},
|
||||
"findings": [
|
||||
{
|
||||
"id": "sec.defender.rtp_off",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "Defender real-time protection is OFF (3rd-party AV active)",
|
||||
"detail": "Defender real-time protection is off because a managed/known 3rd-party AV is active. Windows disables Defender real-time protection when another AV registers, so this is expected. Confirm the 3rd-party AV is providing real-time protection.",
|
||||
"evidence": "RealTimeProtectionEnabled=False; AMServiceEnabled=False; AntispywareSignatureAge=0 days; IsTamperProtected=False; SecurityCenter2 AntiVirusProduct: Bitdefender Endpoint Security Tools Antimalware (productState=0x41000, RTP on)"
|
||||
},
|
||||
{
|
||||
"id": "sec.defender.amservice_off",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "Defender antimalware service is not running (3rd-party AV active)",
|
||||
"detail": "The Defender antimalware service is not active because a managed/known 3rd-party AV is registered. Windows stands Defender down when another AV provides protection, so this is expected. Confirm the 3rd-party AV is running.",
|
||||
"evidence": "RealTimeProtectionEnabled=False; AMServiceEnabled=False; AntispywareSignatureAge=0 days; IsTamperProtected=False; SecurityCenter2 AntiVirusProduct: Bitdefender Endpoint Security Tools Antimalware (productState=0x41000, RTP on)"
|
||||
},
|
||||
{
|
||||
"id": "sec.defender.tamper_off",
|
||||
"category": "security",
|
||||
"severity": "warning",
|
||||
"title": "Defender tamper protection is OFF",
|
||||
"detail": "Tamper protection is disabled, so malware or a local admin can silently disable Defender. Enable tamper protection (typically via Intune / Security Center).",
|
||||
"evidence": "RealTimeProtectionEnabled=False; AMServiceEnabled=False; AntispywareSignatureAge=0 days; IsTamperProtected=False"
|
||||
},
|
||||
{
|
||||
"id": "sec.av_products.third_party",
|
||||
"category": "security",
|
||||
"severity": "warning",
|
||||
"title": "Third-party AV present: Bitdefender Endpoint Security Tools Antimalware",
|
||||
"detail": "A non-Defender antivirus is registered. Running two real-time AV engines causes conflicts, performance loss, and detection gaps. Confirm the intended AV and ensure only one provides real-time protection.",
|
||||
"evidence": "Registered AV: Windows Defender, Bitdefender Endpoint Security Tools Antimalware"
|
||||
},
|
||||
{
|
||||
"id": "sec.foreign_agents.none",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "No competitor/leftover management agents detected",
|
||||
"detail": "No known competitor RMM or unmanaged remote-access agents found in installed programs or services.",
|
||||
"evidence": "Scanned uninstall hives (HKLM + WOW6432Node) and Win32_Service"
|
||||
},
|
||||
{
|
||||
"id": "sec.foreign_agents.acg.screenconnect_connectwise_control",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "Expected ACG management tooling present: ScreenConnect / ConnectWise Control",
|
||||
"detail": "This is Arizona Computer Guru managed/remote-access tooling that we deploy. Its presence is expected and not a foreign-agent risk.",
|
||||
"evidence": "program: ScreenConnect Client (1912bf3444b41a08) 26.1.24.9579\nservice: ScreenConnect Client (1912bf3444b41a08) (ScreenConnect Client (1912bf3444b41a08)) Running"
|
||||
},
|
||||
{
|
||||
"id": "sec.foreign_agents.acg.splashtop_sos_streamer_",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "Expected ACG management tooling present: Splashtop (SOS/Streamer)",
|
||||
"detail": "This is Arizona Computer Guru managed/remote-access tooling that we deploy. Its presence is expected and not a foreign-agent risk.",
|
||||
"evidence": "program: Splashtop Streamer 3.8.2.0\nservice: SplashtopRemoteService (Splashtop? Remote Service) Running"
|
||||
},
|
||||
{
|
||||
"id": "sec.foreign_agents.acg.syncro_kabuto",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "Expected ACG management tooling present: Syncro / Kabuto",
|
||||
"detail": "This is Arizona Computer Guru managed/remote-access tooling that we deploy. Its presence is expected and not a foreign-agent risk.",
|
||||
"evidence": "program: Syncro 1.0.201.18410\nservice: Syncro (Syncro) Running"
|
||||
},
|
||||
{
|
||||
"id": "sec.firewall.ok",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "All firewall profiles enabled",
|
||||
"detail": "Domain, Private, and Public firewall profiles are all enabled.",
|
||||
"evidence": "Private=True; Domain=True; Public=True"
|
||||
},
|
||||
{
|
||||
"id": "sec.bitlocker.unencrypted",
|
||||
"category": "security",
|
||||
"severity": "warning",
|
||||
"title": "OS volume is NOT encrypted with BitLocker",
|
||||
"detail": "The operating system volume is unencrypted. Data is exposed if the disk is removed or the device is lost. Enable BitLocker and escrow the recovery key.",
|
||||
"evidence": "Volume=C:; ProtectionStatus=Off; EncryptionPercentage=0; KeyProtectors="
|
||||
},
|
||||
{
|
||||
"id": "sec.local_admins.list",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "Local administrators (5)",
|
||||
"detail": "Members of the local Administrators group. Review for unexpected or unknown accounts (especially leftover MSP/vendor accounts from a prior provider).",
|
||||
"evidence": "GTS\\Domain Admins\nGTS\\gonzvar\nGTS-W2\\Administrator\nGTS-W2\\localadmin\nGTS-W2\\pgonz"
|
||||
},
|
||||
{
|
||||
"id": "sec.patch.os_supported",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "OS build supported: Win11 25H2",
|
||||
"detail": "Build 26200 (Win11 25H2) is in support until 2027-10-12.",
|
||||
"evidence": "Microsoft Windows 11 Pro for Workstations build 26200"
|
||||
},
|
||||
{
|
||||
"id": "sec.patch.pending",
|
||||
"category": "security",
|
||||
"severity": "warning",
|
||||
"title": "6 pending Windows updates",
|
||||
"detail": "Windows Update reports pending (not installed, not hidden) updates. Some may be security updates. Approve/install on the next maintenance window.",
|
||||
"evidence": "Microsoft.Update.Session search IsInstalled=0 and IsHidden=0 -> 6"
|
||||
},
|
||||
{
|
||||
"id": "sec.patch.last_hotfix",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "Last hotfix: KB5083769",
|
||||
"detail": "Most recently installed update (from Get-HotFix; reflects CBS/MSU packages, not all cumulative metadata).",
|
||||
"evidence": "KB5083769 installed 2026-04-15T07:00:00Z"
|
||||
},
|
||||
{
|
||||
"id": "sec.exposure.smb1_off",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "SMBv1 disabled",
|
||||
"detail": "SMBv1 server protocol is disabled.",
|
||||
"evidence": "EnableSMB1Protocol=False"
|
||||
},
|
||||
{
|
||||
"id": "sec.exposure.laps_present",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "LAPS detected",
|
||||
"detail": "A LAPS mechanism is present.",
|
||||
"evidence": "Windows LAPS reg key"
|
||||
},
|
||||
{
|
||||
"id": "health.stability.clean",
|
||||
"category": "health",
|
||||
"severity": "info",
|
||||
"title": "No stability events in the last 14 days",
|
||||
"detail": "No unexpected shutdowns, BSODs, or disk errors logged.",
|
||||
"evidence": "Unexpected shutdowns (id 41)=0; Bugchecks/BSOD (id 1001)=0; Disk errors (id 7/51/153)=0"
|
||||
},
|
||||
{
|
||||
"id": "health.reboot_uptime.pending",
|
||||
"category": "health",
|
||||
"severity": "warning",
|
||||
"title": "Reboot pending",
|
||||
"detail": "A reboot is pending. Pending reboots can block patches and leave the system in a half-updated state. Schedule a restart.",
|
||||
"evidence": "PendingFileRenameOperations"
|
||||
},
|
||||
{
|
||||
"id": "health.reboot_uptime.long_uptime",
|
||||
"category": "health",
|
||||
"severity": "warning",
|
||||
"title": "Uptime is 49.8 days",
|
||||
"detail": "Uptime exceeds 30 days. Long uptime usually means pending updates have not been applied (reboots deferred). Schedule maintenance.",
|
||||
"evidence": "LastBootUpTime=2026-04-17 15:07:40Z"
|
||||
},
|
||||
{
|
||||
"id": "health.failed_services.stopped",
|
||||
"category": "health",
|
||||
"severity": "warning",
|
||||
"title": "3 auto-start service(s) not running",
|
||||
"detail": "These services are set to start automatically but are not running. Some may be benign; review for security agents, backup agents, or AV that should be running.",
|
||||
"evidence": "Intel(R) Platform License Manager Service (Intel(R) Platform License Manager Service) = Stopped\nGoogleUpdaterInternalService150.0.7863.0 (Google Updater Internal Service (GoogleUpdaterInternalService150.0.7863.0)) = Stopped\nGoogleUpdaterService150.0.7863.0 (Google Updater Service (GoogleUpdaterService150.0.7863.0)) = Stopped"
|
||||
},
|
||||
{
|
||||
"id": "health.domain.secure_channel_ok",
|
||||
"category": "health",
|
||||
"severity": "info",
|
||||
"title": "Domain secure channel healthy",
|
||||
"detail": "Machine trust relationship with the domain is intact.",
|
||||
"evidence": "Domain=GTS.local"
|
||||
},
|
||||
{
|
||||
"id": "health.time.source",
|
||||
"category": "health",
|
||||
"severity": "info",
|
||||
"title": "Time service source",
|
||||
"detail": "Current Windows Time service source.",
|
||||
"evidence": "Source=GTS-SVR25.GTS.local"
|
||||
},
|
||||
{
|
||||
"id": "health.backup.none",
|
||||
"category": "health",
|
||||
"severity": "info",
|
||||
"title": "No backup agent detected",
|
||||
"detail": "No known backup agent service found. Backup expectation varies by endpoint; confirm whether this machine is supposed to have local/cloud backup and whether server-side or M365 backup covers it.",
|
||||
"evidence": "No matching backup service in Win32_Service"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,274 @@
|
||||
# Onboarding Diagnostic Baseline - GTS-W2
|
||||
|
||||
- **Grade:** AMBER
|
||||
- **Host:** GTS-W2
|
||||
- **Client:** Gonzvar Tax Services (`gonzvar-tax-services`)
|
||||
- **Collected (UTC):** 2026-06-06T18:11:25Z
|
||||
- **Agent ID:** d0c703c1-c9c9-4763-b219-d24442882fb6
|
||||
- **Command ID:** 447f17bd-9c1b-473a-9cd4-a45d90ced9cd
|
||||
- **Findings:** 0 critical / 7 warning / 16 info / 0 unknown
|
||||
|
||||
- **OS:** Microsoft Windows 11 Pro for Workstations (build 26200)
|
||||
|
||||
---
|
||||
|
||||
## WARNING (7)
|
||||
|
||||
### Defender tamper protection is OFF
|
||||
- **Category:** security
|
||||
- **ID:** `sec.defender.tamper_off`
|
||||
- Tamper protection is disabled, so malware or a local admin can silently disable Defender. Enable tamper protection (typically via Intune / Security Center).
|
||||
|
||||
```
|
||||
RealTimeProtectionEnabled=False; AMServiceEnabled=False; AntispywareSignatureAge=0 days; IsTamperProtected=False
|
||||
```
|
||||
|
||||
### Third-party AV present: Bitdefender Endpoint Security Tools Antimalware
|
||||
- **Category:** security
|
||||
- **ID:** `sec.av_products.third_party`
|
||||
- A non-Defender antivirus is registered. Running two real-time AV engines causes conflicts, performance loss, and detection gaps. Confirm the intended AV and ensure only one provides real-time protection.
|
||||
|
||||
```
|
||||
Registered AV: Windows Defender, Bitdefender Endpoint Security Tools Antimalware
|
||||
```
|
||||
|
||||
### OS volume is NOT encrypted with BitLocker
|
||||
- **Category:** security
|
||||
- **ID:** `sec.bitlocker.unencrypted`
|
||||
- The operating system volume is unencrypted. Data is exposed if the disk is removed or the device is lost. Enable BitLocker and escrow the recovery key.
|
||||
|
||||
```
|
||||
Volume=C:; ProtectionStatus=Off; EncryptionPercentage=0; KeyProtectors=
|
||||
```
|
||||
|
||||
### 6 pending Windows updates
|
||||
- **Category:** security
|
||||
- **ID:** `sec.patch.pending`
|
||||
- Windows Update reports pending (not installed, not hidden) updates. Some may be security updates. Approve/install on the next maintenance window.
|
||||
|
||||
```
|
||||
Microsoft.Update.Session search IsInstalled=0 and IsHidden=0 -> 6
|
||||
```
|
||||
|
||||
### Reboot pending
|
||||
- **Category:** health
|
||||
- **ID:** `health.reboot_uptime.pending`
|
||||
- A reboot is pending. Pending reboots can block patches and leave the system in a half-updated state. Schedule a restart.
|
||||
|
||||
```
|
||||
PendingFileRenameOperations
|
||||
```
|
||||
|
||||
### Uptime is 49.8 days
|
||||
- **Category:** health
|
||||
- **ID:** `health.reboot_uptime.long_uptime`
|
||||
- Uptime exceeds 30 days. Long uptime usually means pending updates have not been applied (reboots deferred). Schedule maintenance.
|
||||
|
||||
```
|
||||
LastBootUpTime=2026-04-17 15:07:40Z
|
||||
```
|
||||
|
||||
### 3 auto-start service(s) not running
|
||||
- **Category:** health
|
||||
- **ID:** `health.failed_services.stopped`
|
||||
- These services are set to start automatically but are not running. Some may be benign; review for security agents, backup agents, or AV that should be running.
|
||||
|
||||
```
|
||||
Intel(R) Platform License Manager Service (Intel(R) Platform License Manager Service) = Stopped
|
||||
GoogleUpdaterInternalService150.0.7863.0 (Google Updater Internal Service (GoogleUpdaterInternalService150.0.7863.0)) = Stopped
|
||||
GoogleUpdaterService150.0.7863.0 (Google Updater Service (GoogleUpdaterService150.0.7863.0)) = Stopped
|
||||
```
|
||||
|
||||
|
||||
## INFO (16)
|
||||
|
||||
### Defender real-time protection is OFF (3rd-party AV active)
|
||||
- **Category:** security
|
||||
- **ID:** `sec.defender.rtp_off`
|
||||
- Defender real-time protection is off because a managed/known 3rd-party AV is active. Windows disables Defender real-time protection when another AV registers, so this is expected. Confirm the 3rd-party AV is providing real-time protection.
|
||||
|
||||
```
|
||||
RealTimeProtectionEnabled=False; AMServiceEnabled=False; AntispywareSignatureAge=0 days; IsTamperProtected=False; SecurityCenter2 AntiVirusProduct: Bitdefender Endpoint Security Tools Antimalware (productState=0x41000, RTP on)
|
||||
```
|
||||
|
||||
### Defender antimalware service is not running (3rd-party AV active)
|
||||
- **Category:** security
|
||||
- **ID:** `sec.defender.amservice_off`
|
||||
- The Defender antimalware service is not active because a managed/known 3rd-party AV is registered. Windows stands Defender down when another AV provides protection, so this is expected. Confirm the 3rd-party AV is running.
|
||||
|
||||
```
|
||||
RealTimeProtectionEnabled=False; AMServiceEnabled=False; AntispywareSignatureAge=0 days; IsTamperProtected=False; SecurityCenter2 AntiVirusProduct: Bitdefender Endpoint Security Tools Antimalware (productState=0x41000, RTP on)
|
||||
```
|
||||
|
||||
### No competitor/leftover management agents detected
|
||||
- **Category:** security
|
||||
- **ID:** `sec.foreign_agents.none`
|
||||
- No known competitor RMM or unmanaged remote-access agents found in installed programs or services.
|
||||
|
||||
```
|
||||
Scanned uninstall hives (HKLM + WOW6432Node) and Win32_Service
|
||||
```
|
||||
|
||||
### Expected ACG management tooling present: ScreenConnect / ConnectWise Control
|
||||
- **Category:** security
|
||||
- **ID:** `sec.foreign_agents.acg.screenconnect_connectwise_control`
|
||||
- This is Arizona Computer Guru managed/remote-access tooling that we deploy. Its presence is expected and not a foreign-agent risk.
|
||||
|
||||
```
|
||||
program: ScreenConnect Client (1912bf3444b41a08) 26.1.24.9579
|
||||
service: ScreenConnect Client (1912bf3444b41a08) (ScreenConnect Client (1912bf3444b41a08)) Running
|
||||
```
|
||||
|
||||
### Expected ACG management tooling present: Splashtop (SOS/Streamer)
|
||||
- **Category:** security
|
||||
- **ID:** `sec.foreign_agents.acg.splashtop_sos_streamer_`
|
||||
- This is Arizona Computer Guru managed/remote-access tooling that we deploy. Its presence is expected and not a foreign-agent risk.
|
||||
|
||||
```
|
||||
program: Splashtop Streamer 3.8.2.0
|
||||
service: SplashtopRemoteService (Splashtop? Remote Service) Running
|
||||
```
|
||||
|
||||
### Expected ACG management tooling present: Syncro / Kabuto
|
||||
- **Category:** security
|
||||
- **ID:** `sec.foreign_agents.acg.syncro_kabuto`
|
||||
- This is Arizona Computer Guru managed/remote-access tooling that we deploy. Its presence is expected and not a foreign-agent risk.
|
||||
|
||||
```
|
||||
program: Syncro 1.0.201.18410
|
||||
service: Syncro (Syncro) Running
|
||||
```
|
||||
|
||||
### All firewall profiles enabled
|
||||
- **Category:** security
|
||||
- **ID:** `sec.firewall.ok`
|
||||
- Domain, Private, and Public firewall profiles are all enabled.
|
||||
|
||||
```
|
||||
Private=True; Domain=True; Public=True
|
||||
```
|
||||
|
||||
### Local administrators (5)
|
||||
- **Category:** security
|
||||
- **ID:** `sec.local_admins.list`
|
||||
- Members of the local Administrators group. Review for unexpected or unknown accounts (especially leftover MSP/vendor accounts from a prior provider).
|
||||
|
||||
```
|
||||
GTS\Domain Admins
|
||||
GTS\gonzvar
|
||||
GTS-W2\Administrator
|
||||
GTS-W2\localadmin
|
||||
GTS-W2\pgonz
|
||||
```
|
||||
|
||||
### OS build supported: Win11 25H2
|
||||
- **Category:** security
|
||||
- **ID:** `sec.patch.os_supported`
|
||||
- Build 26200 (Win11 25H2) is in support until 2027-10-12.
|
||||
|
||||
```
|
||||
Microsoft Windows 11 Pro for Workstations build 26200
|
||||
```
|
||||
|
||||
### Last hotfix: KB5083769
|
||||
- **Category:** security
|
||||
- **ID:** `sec.patch.last_hotfix`
|
||||
- Most recently installed update (from Get-HotFix; reflects CBS/MSU packages, not all cumulative metadata).
|
||||
|
||||
```
|
||||
KB5083769 installed 2026-04-15T07:00:00Z
|
||||
```
|
||||
|
||||
### SMBv1 disabled
|
||||
- **Category:** security
|
||||
- **ID:** `sec.exposure.smb1_off`
|
||||
- SMBv1 server protocol is disabled.
|
||||
|
||||
```
|
||||
EnableSMB1Protocol=False
|
||||
```
|
||||
|
||||
### LAPS detected
|
||||
- **Category:** security
|
||||
- **ID:** `sec.exposure.laps_present`
|
||||
- A LAPS mechanism is present.
|
||||
|
||||
```
|
||||
Windows LAPS reg key
|
||||
```
|
||||
|
||||
### No stability events in the last 14 days
|
||||
- **Category:** health
|
||||
- **ID:** `health.stability.clean`
|
||||
- No unexpected shutdowns, BSODs, or disk errors logged.
|
||||
|
||||
```
|
||||
Unexpected shutdowns (id 41)=0; Bugchecks/BSOD (id 1001)=0; Disk errors (id 7/51/153)=0
|
||||
```
|
||||
|
||||
### Domain secure channel healthy
|
||||
- **Category:** health
|
||||
- **ID:** `health.domain.secure_channel_ok`
|
||||
- Machine trust relationship with the domain is intact.
|
||||
|
||||
```
|
||||
Domain=GTS.local
|
||||
```
|
||||
|
||||
### Time service source
|
||||
- **Category:** health
|
||||
- **ID:** `health.time.source`
|
||||
- Current Windows Time service source.
|
||||
|
||||
```
|
||||
Source=GTS-SVR25.GTS.local
|
||||
```
|
||||
|
||||
### No backup agent detected
|
||||
- **Category:** health
|
||||
- **ID:** `health.backup.none`
|
||||
- No known backup agent service found. Backup expectation varies by endpoint; confirm whether this machine is supposed to have local/cloud backup and whether server-side or M365 backup covers it.
|
||||
|
||||
```
|
||||
No matching backup service in Win32_Service
|
||||
```
|
||||
|
||||
|
||||
---
|
||||
|
||||
## Inventory Baseline Summary
|
||||
|
||||
- **Manufacturer / Model:** LENOVO / 90SM006QUS
|
||||
- **Serial:** MJ0JAWPT
|
||||
- **CPU:** 12th Gen Intel(R) Core(TM) i5-12400 (6 cores / 12 logical)
|
||||
- **RAM (GB):** 15.7
|
||||
- **BIOS:** M49KT29A (2024-01-04)
|
||||
- **Chassis is laptop:** false
|
||||
- **TPM present / Secure Boot:** true / true
|
||||
- **Domain joined:** true (GTS.local)
|
||||
- **OS activation licensed:** true
|
||||
- **Uptime (days):** 49.8
|
||||
- **Pending reboot:** true
|
||||
- **Installed software count:** 48
|
||||
- **Scheduled tasks (non-MS, enabled):** 46
|
||||
- **Local administrators:** GTS\Domain Admins, GTS\gonzvar, GTS-W2\Administrator, GTS-W2\localadmin, GTS-W2\pgonz
|
||||
|
||||
### Fixed volumes
|
||||
|
||||
- [SYSTEM] - 0.2 GB free of 0.2 GB (76.9%)
|
||||
- C: - 756.7 GB free of 929.3 GB (81.4%)
|
||||
- [WinRE_DRV] - 1.2 GB free of 2 GB (60.2%)
|
||||
|
||||
### Network adapters
|
||||
|
||||
- Realtek PCIe GbE Family Controller - IP: 192.168.0.146, fe80::826b:1844:b416:d971 - DNS: 192.168.0.2, 192.168.0.5 - DHCP: true
|
||||
|
||||
---
|
||||
|
||||
## Diff vs Prior Baseline
|
||||
|
||||
- No prior baseline found for this host. This is the first baseline.
|
||||
|
||||
---
|
||||
|
||||
_Generated by run-onboarding-diagnostic.sh (GuruRMM onboarding diagnostic, Phase 1). Raw snapshot: `GTS-W2-20260606T181016.json` (immutable)._
|
||||
@@ -0,0 +1,601 @@
|
||||
{
|
||||
"host": "SERVER",
|
||||
"collected_at_utc": "2026-06-06T18:13:19Z",
|
||||
"os": {
|
||||
"caption": "Microsoft Windows Server 2019 Standard",
|
||||
"version": "10.0.17763",
|
||||
"build": "17763",
|
||||
"install_date": "2025-09-26T04:50:29Z",
|
||||
"last_boot_utc": "2026-02-22T00:37:40Z",
|
||||
"architecture": "64-bit"
|
||||
},
|
||||
"facts": {
|
||||
"builtin_admin_enabled": false,
|
||||
"os_eol": {
|
||||
"eol_date": "2020-11-10",
|
||||
"release": "Win10 1809"
|
||||
},
|
||||
"pending_updates": 5,
|
||||
"pending_reboot": true,
|
||||
"uptime_days": 104.8,
|
||||
"acg_managed_tools": [
|
||||
"ScreenConnect / ConnectWise Control",
|
||||
"Splashtop (SOS/Streamer)",
|
||||
"Syncro / Kabuto"
|
||||
],
|
||||
"hardware": {
|
||||
"model": "PowerEdge T440",
|
||||
"manufacturer": "Dell Inc.",
|
||||
"bios_date": "2020-08-31",
|
||||
"cpu_logical": 6,
|
||||
"bios_version": "2.8.2",
|
||||
"cpu_cores": 6,
|
||||
"ram_gb": 7.6,
|
||||
"serial": "5308R53",
|
||||
"cpu": "Intel(R) Xeon(R) Bronze 3204 CPU @ 1.90GHz"
|
||||
},
|
||||
"local_administrators": [
|
||||
"Administrator",
|
||||
"Domain Admins",
|
||||
"Enterprise Admins",
|
||||
"localadmin",
|
||||
"MediaAdmin$",
|
||||
"sysadmin"
|
||||
],
|
||||
"os_build": "17763",
|
||||
"secure_boot": null,
|
||||
"backup_agents": null,
|
||||
"autoruns_run_keys": [
|
||||
{
|
||||
"key": "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
|
||||
"name": "SecurityHealth",
|
||||
"value": "C:\\WINDOWS\\system32\\SecurityHealthSystray.exe"
|
||||
}
|
||||
],
|
||||
"physical_disks": [
|
||||
{
|
||||
"health": "Healthy",
|
||||
"model": "ST1000NM004A-2MN130",
|
||||
"media_type": "HDD"
|
||||
}
|
||||
],
|
||||
"local_users": [
|
||||
{
|
||||
"last_logon": "2020-10-25",
|
||||
"name": "Administrator",
|
||||
"password_never_expires": false,
|
||||
"enabled": false
|
||||
},
|
||||
{
|
||||
"last_logon": "",
|
||||
"name": "Guest",
|
||||
"password_never_expires": false,
|
||||
"enabled": false
|
||||
},
|
||||
{
|
||||
"last_logon": "",
|
||||
"name": "krbtgt",
|
||||
"password_never_expires": false,
|
||||
"enabled": false
|
||||
},
|
||||
{
|
||||
"last_logon": "",
|
||||
"name": "DefaultAccount",
|
||||
"password_never_expires": false,
|
||||
"enabled": false
|
||||
},
|
||||
{
|
||||
"last_logon": "2025-09-26",
|
||||
"name": "localadmin",
|
||||
"password_never_expires": false,
|
||||
"enabled": true
|
||||
},
|
||||
{
|
||||
"last_logon": "2026-01-07",
|
||||
"name": "sysadmin",
|
||||
"password_never_expires": false,
|
||||
"enabled": true
|
||||
},
|
||||
{
|
||||
"last_logon": "2026-06-06",
|
||||
"name": "pedro",
|
||||
"password_never_expires": false,
|
||||
"enabled": true
|
||||
},
|
||||
{
|
||||
"last_logon": "2026-06-05",
|
||||
"name": "gonzvar",
|
||||
"password_never_expires": false,
|
||||
"enabled": true
|
||||
},
|
||||
{
|
||||
"last_logon": "2026-06-06",
|
||||
"name": "SERVER$",
|
||||
"password_never_expires": false,
|
||||
"enabled": true
|
||||
},
|
||||
{
|
||||
"last_logon": "2025-09-24",
|
||||
"name": "MediaAdmin$",
|
||||
"password_never_expires": false,
|
||||
"enabled": true
|
||||
},
|
||||
{
|
||||
"last_logon": "2026-06-06",
|
||||
"name": "GTS-W1$",
|
||||
"password_never_expires": false,
|
||||
"enabled": true
|
||||
},
|
||||
{
|
||||
"last_logon": "2026-06-05",
|
||||
"name": "GTS-W2$",
|
||||
"password_never_expires": false,
|
||||
"enabled": true
|
||||
},
|
||||
{
|
||||
"last_logon": "2026-06-06",
|
||||
"name": "GTS-W0$",
|
||||
"password_never_expires": false,
|
||||
"enabled": true
|
||||
}
|
||||
],
|
||||
"scheduled_tasks_count": 3,
|
||||
"volumes": [
|
||||
{
|
||||
"drive": "[System Reserved]",
|
||||
"size_gb": 0.5,
|
||||
"free_pct": 93,
|
||||
"free_gb": 0.5
|
||||
},
|
||||
{
|
||||
"drive": "C:",
|
||||
"size_gb": 930.2,
|
||||
"free_pct": 80.7,
|
||||
"free_gb": 750.9
|
||||
},
|
||||
{
|
||||
"drive": "[unlabeled]",
|
||||
"size_gb": 0.8,
|
||||
"free_pct": 42.6,
|
||||
"free_gb": 0.3
|
||||
}
|
||||
],
|
||||
"network_adapters": [
|
||||
{
|
||||
"dhcp": false,
|
||||
"description": "Broadcom NetXtreme Gigabit Ethernet #2",
|
||||
"gateway": [
|
||||
"192.168.0.1"
|
||||
],
|
||||
"mac": "2C:EA:7F:57:98:E8",
|
||||
"ip": [
|
||||
"192.168.0.5",
|
||||
"fe80::bd6f:321c:c1d5:2f3c"
|
||||
],
|
||||
"dns": [
|
||||
"192.168.0.5",
|
||||
"192.168.0.2"
|
||||
]
|
||||
}
|
||||
],
|
||||
"failed_autostart_services": [
|
||||
{
|
||||
"name": "GoogleUpdaterInternalService150.0.7863.0",
|
||||
"display": "Google Updater Internal Service (GoogleUpdaterInternalService150.0.7863.0)",
|
||||
"state": "Stopped"
|
||||
},
|
||||
{
|
||||
"name": "GoogleUpdaterService150.0.7863.0",
|
||||
"display": "Google Updater Service (GoogleUpdaterService150.0.7863.0)",
|
||||
"state": "Stopped"
|
||||
}
|
||||
],
|
||||
"stability_14d": {
|
||||
"unexpected_shutdowns": 0,
|
||||
"disk_errors": 0,
|
||||
"bugchecks": 0
|
||||
},
|
||||
"exposure": {
|
||||
"smb1_enabled": true,
|
||||
"laps_present": false,
|
||||
"rdp_enabled": true,
|
||||
"uac_enabled": true,
|
||||
"rdp_nla": true
|
||||
},
|
||||
"accounts_password_never_expires": [],
|
||||
"installed_software": [
|
||||
{
|
||||
"publisher": "Webprofusion Pty Ltd",
|
||||
"name": "Certify Certificate Manager version 6.1.9",
|
||||
"version": "6.1.9"
|
||||
},
|
||||
{
|
||||
"publisher": "Dell Inc.",
|
||||
"name": "Dell EMC OpenManage Systems Management Software (64-Bit)",
|
||||
"version": "10.3.0.0"
|
||||
},
|
||||
{
|
||||
"publisher": "Drake Software",
|
||||
"name": "Drake Accounting 2025",
|
||||
"version": "25.0.45"
|
||||
},
|
||||
{
|
||||
"publisher": "Google LLC",
|
||||
"name": "Google Chrome",
|
||||
"version": "148.0.7778.217"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft .NET Host - 6.0.7 (x86)",
|
||||
"version": "48.31.44002"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft .NET Host - 8.0.11 (x64)",
|
||||
"version": "64.44.23191"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft .NET Host - 8.0.20 (x86)",
|
||||
"version": "64.80.39230"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft .NET Host FX Resolver - 6.0.7 (x86)",
|
||||
"version": "48.31.44002"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft .NET Host FX Resolver - 8.0.11 (x64)",
|
||||
"version": "64.44.23191"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft .NET Host FX Resolver - 8.0.20 (x86)",
|
||||
"version": "64.80.39230"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft .NET Runtime - 6.0.7 (x86)",
|
||||
"version": "48.31.44002"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft .NET Runtime - 8.0.11 (x64)",
|
||||
"version": "64.44.23191"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft .NET Runtime - 8.0.20 (x86)",
|
||||
"version": "64.80.39230"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft ASP.NET Core 8.0.0 - Shared Framework (x86)",
|
||||
"version": "8.0.0.23531"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft ASP.NET Core 8.0.0 Shared Framework (x86)",
|
||||
"version": "8.0.0.23531"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft SQL Server Compact 4.0 SP1 x64 ENU",
|
||||
"version": "4.0.8876.1"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.28.29914",
|
||||
"version": "14.28.29914.0"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Visual C++ 2019 X86 Additional Runtime - 14.28.29914",
|
||||
"version": "14.28.29914"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.28.29914",
|
||||
"version": "14.28.29914"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Windows Desktop Runtime - 6.0.7 (x86)",
|
||||
"version": "48.31.44003"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Windows Desktop Runtime - 6.0.7 (x86)",
|
||||
"version": "6.0.7.31422"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Windows Desktop Runtime - 8.0.11 (x64)",
|
||||
"version": "64.44.23253"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Windows Desktop Runtime - 8.0.11 (x64)",
|
||||
"version": "8.0.11.34221"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Windows Desktop Runtime - 8.0.20 (x86)",
|
||||
"version": "64.80.39251"
|
||||
},
|
||||
{
|
||||
"publisher": "Microsoft Corporation",
|
||||
"name": "Microsoft Windows Desktop Runtime - 8.0.20 (x86)",
|
||||
"version": "8.0.20.35221"
|
||||
},
|
||||
{
|
||||
"publisher": "ScreenConnect Software",
|
||||
"name": "ScreenConnect Client (1912bf3444b41a08)",
|
||||
"version": "26.1.24.9579"
|
||||
},
|
||||
{
|
||||
"publisher": "Splashtop Inc.",
|
||||
"name": "Splashtop Software Updater",
|
||||
"version": "1.5.6.23"
|
||||
},
|
||||
{
|
||||
"publisher": "Splashtop Inc.",
|
||||
"name": "Splashtop Streamer",
|
||||
"version": "3.8.2.0"
|
||||
},
|
||||
{
|
||||
"publisher": "Servably, Inc.",
|
||||
"name": "Syncro",
|
||||
"version": "1.0.201.18410"
|
||||
},
|
||||
{
|
||||
"publisher": "win.rar GmbH",
|
||||
"name": "WinRAR 7.13 (64-bit)",
|
||||
"version": "7.13.0"
|
||||
}
|
||||
],
|
||||
"tpm": {
|
||||
"enabled": false,
|
||||
"ready": false,
|
||||
"present": false
|
||||
},
|
||||
"local_groups": [
|
||||
"Cert Publishers",
|
||||
"RAS and IAS Servers",
|
||||
"Allowed RODC Password Replication Group",
|
||||
"Denied RODC Password Replication Group"
|
||||
],
|
||||
"battery": {
|
||||
"present": false
|
||||
},
|
||||
"activation": {
|
||||
"edition": "Microsoft Windows Server 2019 Standard",
|
||||
"description": "Windows(R) Operating System, VOLUME_KMSCLIENT channel",
|
||||
"licensed": false,
|
||||
"license_status_code": 5
|
||||
},
|
||||
"time_source": "Free-running System Clock",
|
||||
"chassis_types": [
|
||||
17
|
||||
],
|
||||
"last_hotfix": {
|
||||
"hotfix_id": "KB5070248",
|
||||
"installed_on": "2026-01-17T08:00:00Z"
|
||||
},
|
||||
"scheduled_tasks": [
|
||||
{
|
||||
"path": "\\",
|
||||
"name": "Dell SupportAssistAgent AutoUpdate",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\",
|
||||
"name": "ShadowCopyVolume{5f67aa97-0000-0000-0000-501f00000000}",
|
||||
"state": "Ready"
|
||||
},
|
||||
{
|
||||
"path": "\\GoogleSystem\\GoogleUpdater\\",
|
||||
"name": "GoogleUpdaterTaskSystem150.0.7863.0{2E905B25-4378-464B-9268-EAB95C26A418}",
|
||||
"state": "Ready"
|
||||
}
|
||||
],
|
||||
"antivirus_products": [],
|
||||
"domain_joined": true,
|
||||
"defender": {
|
||||
"available": false
|
||||
},
|
||||
"bitlocker": {
|
||||
"available": false,
|
||||
"os_volume": "C:"
|
||||
},
|
||||
"is_laptop": false,
|
||||
"installed_software_count": 30,
|
||||
"secure_channel_ok": true,
|
||||
"firewall_profiles": {
|
||||
"Private": false,
|
||||
"Domain": false,
|
||||
"Public": false
|
||||
},
|
||||
"domain": "GTS.local",
|
||||
"foreign_agents": null
|
||||
},
|
||||
"findings": [
|
||||
{
|
||||
"id": "sec.defender.unavailable",
|
||||
"category": "security",
|
||||
"severity": "warning",
|
||||
"title": "Defender status unavailable",
|
||||
"detail": "Get-MpComputerStatus returned nothing. Defender may be disabled, replaced by a 3rd-party AV, or the cmdlet is unavailable. Confirm an active AV exists (see security-center check).",
|
||||
"evidence": "Get-MpComputerStatus returned null"
|
||||
},
|
||||
{
|
||||
"id": "sec.av_products.none_registered",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "No AV products registered in Security Center",
|
||||
"detail": "SecurityCenter2 returned no AntiVirusProduct entries. This is normal on Windows Server SKUs (Security Center is a client feature). On a workstation, confirm Defender or a managed AV is active.",
|
||||
"evidence": "root\\SecurityCenter2 AntiVirusProduct: none"
|
||||
},
|
||||
{
|
||||
"id": "sec.foreign_agents.none",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "No competitor/leftover management agents detected",
|
||||
"detail": "No known competitor RMM or unmanaged remote-access agents found in installed programs or services.",
|
||||
"evidence": "Scanned uninstall hives (HKLM + WOW6432Node) and Win32_Service"
|
||||
},
|
||||
{
|
||||
"id": "sec.foreign_agents.acg.screenconnect_connectwise_control",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "Expected ACG management tooling present: ScreenConnect / ConnectWise Control",
|
||||
"detail": "This is Arizona Computer Guru managed/remote-access tooling that we deploy. Its presence is expected and not a foreign-agent risk.",
|
||||
"evidence": "program: ScreenConnect Client (1912bf3444b41a08) 26.1.24.9579\nservice: ScreenConnect Client (1912bf3444b41a08) (ScreenConnect Client (1912bf3444b41a08)) Running"
|
||||
},
|
||||
{
|
||||
"id": "sec.foreign_agents.acg.splashtop_sos_streamer_",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "Expected ACG management tooling present: Splashtop (SOS/Streamer)",
|
||||
"detail": "This is Arizona Computer Guru managed/remote-access tooling that we deploy. Its presence is expected and not a foreign-agent risk.",
|
||||
"evidence": "program: Splashtop Software Updater 1.5.6.23\nprogram: Splashtop Streamer 3.8.2.0\nservice: SplashtopRemoteService (Splashtop? Remote Service) Running\nservice: SSUService (Splashtop Software Updater Service) Running"
|
||||
},
|
||||
{
|
||||
"id": "sec.foreign_agents.acg.syncro_kabuto",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "Expected ACG management tooling present: Syncro / Kabuto",
|
||||
"detail": "This is Arizona Computer Guru managed/remote-access tooling that we deploy. Its presence is expected and not a foreign-agent risk.",
|
||||
"evidence": "program: Syncro 1.0.201.18410\nservice: Syncro (Syncro) Running"
|
||||
},
|
||||
{
|
||||
"id": "sec.firewall.disabled",
|
||||
"category": "security",
|
||||
"severity": "critical",
|
||||
"title": "Firewall disabled on profile(s): Domain, Private, Public",
|
||||
"detail": "One or more firewall profiles are OFF. The endpoint is exposed to lateral movement and inbound attacks on those networks. Re-enable all profiles.",
|
||||
"evidence": "Profile states: Private=False; Domain=False; Public=False"
|
||||
},
|
||||
{
|
||||
"id": "sec.bitlocker.unavailable",
|
||||
"category": "security",
|
||||
"severity": "unknown",
|
||||
"title": "BitLocker status unavailable",
|
||||
"detail": "Get-BitLockerVolume failed for the OS volume. BitLocker may not be installed (Home edition) or the cmdlet is unavailable. Verify encryption manually (manage-bde -status).",
|
||||
"evidence": "MountPoint=C:, Get-BitLockerVolume returned null"
|
||||
},
|
||||
{
|
||||
"id": "sec.local_admins.list",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "Local administrators (6)",
|
||||
"detail": "Members of the local Administrators group. Review for unexpected or unknown accounts (especially leftover MSP/vendor accounts from a prior provider).",
|
||||
"evidence": "Administrator\nDomain Admins\nEnterprise Admins\nlocaladmin\nMediaAdmin$\nsysadmin"
|
||||
},
|
||||
{
|
||||
"id": "sec.patch.os_eol",
|
||||
"category": "security",
|
||||
"severity": "critical",
|
||||
"title": "OS build is end-of-life: Win10 1809",
|
||||
"detail": "This OS build (17763, Win10 1809) passed end-of-servicing on 2020-11-10. It no longer receives security updates. Plan a feature update or OS upgrade.",
|
||||
"evidence": "Microsoft Windows Server 2019 Standard build 17763; EOL 2020-11-10"
|
||||
},
|
||||
{
|
||||
"id": "sec.patch.pending",
|
||||
"category": "security",
|
||||
"severity": "warning",
|
||||
"title": "5 pending Windows updates",
|
||||
"detail": "Windows Update reports pending (not installed, not hidden) updates. Some may be security updates. Approve/install on the next maintenance window.",
|
||||
"evidence": "Microsoft.Update.Session search IsInstalled=0 and IsHidden=0 -> 5"
|
||||
},
|
||||
{
|
||||
"id": "sec.patch.last_hotfix",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "Last hotfix: KB5070248",
|
||||
"detail": "Most recently installed update (from Get-HotFix; reflects CBS/MSU packages, not all cumulative metadata).",
|
||||
"evidence": "KB5070248 installed 2026-01-17T08:00:00Z"
|
||||
},
|
||||
{
|
||||
"id": "sec.exposure.rdp_on",
|
||||
"category": "security",
|
||||
"severity": "warning",
|
||||
"title": "RDP is enabled",
|
||||
"detail": "Remote Desktop is enabled (NLA required). Confirm it is restricted to VPN or specific source IPs and not exposed to the internet.",
|
||||
"evidence": "fDenyTSConnections=0; UserAuthentication=1"
|
||||
},
|
||||
{
|
||||
"id": "sec.exposure.smb1",
|
||||
"category": "security",
|
||||
"severity": "critical",
|
||||
"title": "SMBv1 is ENABLED",
|
||||
"detail": "SMBv1 is an obsolete, insecure protocol (WannaCry/EternalBlue vector). Disable it: Set-SmbServerConfiguration -EnableSMB1Protocol $false and remove the SMB1 feature.",
|
||||
"evidence": "Get-SmbServerConfiguration EnableSMB1Protocol=True"
|
||||
},
|
||||
{
|
||||
"id": "sec.exposure.no_laps",
|
||||
"category": "security",
|
||||
"severity": "info",
|
||||
"title": "LAPS not detected",
|
||||
"detail": "No LAPS (Windows LAPS or legacy AdmPwd) detected. Without LAPS, the local admin password is likely static/shared across the fleet. Consider deploying LAPS to randomize and escrow local admin passwords.",
|
||||
"evidence": "No LAPS registry keys, CSE, or service found"
|
||||
},
|
||||
{
|
||||
"id": "health.stability.clean",
|
||||
"category": "health",
|
||||
"severity": "info",
|
||||
"title": "No stability events in the last 14 days",
|
||||
"detail": "No unexpected shutdowns, BSODs, or disk errors logged.",
|
||||
"evidence": "Unexpected shutdowns (id 41)=0; Bugchecks/BSOD (id 1001)=0; Disk errors (id 7/51/153)=0"
|
||||
},
|
||||
{
|
||||
"id": "health.reboot_uptime.pending",
|
||||
"category": "health",
|
||||
"severity": "warning",
|
||||
"title": "Reboot pending",
|
||||
"detail": "A reboot is pending. Pending reboots can block patches and leave the system in a half-updated state. Schedule a restart.",
|
||||
"evidence": "PendingFileRenameOperations"
|
||||
},
|
||||
{
|
||||
"id": "health.reboot_uptime.long_uptime",
|
||||
"category": "health",
|
||||
"severity": "warning",
|
||||
"title": "Uptime is 104.8 days",
|
||||
"detail": "Uptime exceeds 30 days. Long uptime usually means pending updates have not been applied (reboots deferred). Schedule maintenance.",
|
||||
"evidence": "LastBootUpTime=2026-02-21 16:37:40Z"
|
||||
},
|
||||
{
|
||||
"id": "health.failed_services.stopped",
|
||||
"category": "health",
|
||||
"severity": "warning",
|
||||
"title": "2 auto-start service(s) not running",
|
||||
"detail": "These services are set to start automatically but are not running. Some may be benign; review for security agents, backup agents, or AV that should be running.",
|
||||
"evidence": "GoogleUpdaterInternalService150.0.7863.0 (Google Updater Internal Service (GoogleUpdaterInternalService150.0.7863.0)) = Stopped\nGoogleUpdaterService150.0.7863.0 (Google Updater Service (GoogleUpdaterService150.0.7863.0)) = Stopped"
|
||||
},
|
||||
{
|
||||
"id": "health.domain.secure_channel_ok",
|
||||
"category": "health",
|
||||
"severity": "info",
|
||||
"title": "Domain secure channel healthy",
|
||||
"detail": "Machine trust relationship with the domain is intact.",
|
||||
"evidence": "Domain=GTS.local"
|
||||
},
|
||||
{
|
||||
"id": "health.time.source",
|
||||
"category": "health",
|
||||
"severity": "info",
|
||||
"title": "Time service source",
|
||||
"detail": "Current Windows Time service source.",
|
||||
"evidence": "Source=Free-running System Clock"
|
||||
},
|
||||
{
|
||||
"id": "health.backup.none",
|
||||
"category": "health",
|
||||
"severity": "info",
|
||||
"title": "No backup agent detected",
|
||||
"detail": "No known backup agent service found. Backup expectation varies by endpoint; confirm whether this machine is supposed to have local/cloud backup and whether server-side or M365 backup covers it.",
|
||||
"evidence": "No matching backup service in Win32_Service"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,273 @@
|
||||
# Onboarding Diagnostic Baseline - SERVER
|
||||
|
||||
- **Grade:** RED
|
||||
- **Host:** SERVER
|
||||
- **Client:** Gonzvar Tax Services (`gonzvar-tax-services`)
|
||||
- **Collected (UTC):** 2026-06-06T18:13:19Z
|
||||
- **Agent ID:** 9fe137ba-6164-4b7a-8a9d-4e8c4b9e40a5
|
||||
- **Command ID:** d91f435d-b67c-43e4-a872-adb82dd07157
|
||||
- **Findings:** 3 critical / 6 warning / 12 info / 1 unknown
|
||||
|
||||
- **OS:** Microsoft Windows Server 2019 Standard (build 17763)
|
||||
|
||||
---
|
||||
|
||||
## CRITICAL (3)
|
||||
|
||||
### Firewall disabled on profile(s): Domain, Private, Public
|
||||
- **Category:** security
|
||||
- **ID:** `sec.firewall.disabled`
|
||||
- One or more firewall profiles are OFF. The endpoint is exposed to lateral movement and inbound attacks on those networks. Re-enable all profiles.
|
||||
|
||||
```
|
||||
Profile states: Private=False; Domain=False; Public=False
|
||||
```
|
||||
|
||||
### OS build is end-of-life: Win10 1809
|
||||
- **Category:** security
|
||||
- **ID:** `sec.patch.os_eol`
|
||||
- This OS build (17763, Win10 1809) passed end-of-servicing on 2020-11-10. It no longer receives security updates. Plan a feature update or OS upgrade.
|
||||
|
||||
```
|
||||
Microsoft Windows Server 2019 Standard build 17763; EOL 2020-11-10
|
||||
```
|
||||
|
||||
### SMBv1 is ENABLED
|
||||
- **Category:** security
|
||||
- **ID:** `sec.exposure.smb1`
|
||||
- SMBv1 is an obsolete, insecure protocol (WannaCry/EternalBlue vector). Disable it: Set-SmbServerConfiguration -EnableSMB1Protocol $false and remove the SMB1 feature.
|
||||
|
||||
```
|
||||
Get-SmbServerConfiguration EnableSMB1Protocol=True
|
||||
```
|
||||
|
||||
|
||||
## WARNING (6)
|
||||
|
||||
### Defender status unavailable
|
||||
- **Category:** security
|
||||
- **ID:** `sec.defender.unavailable`
|
||||
- Get-MpComputerStatus returned nothing. Defender may be disabled, replaced by a 3rd-party AV, or the cmdlet is unavailable. Confirm an active AV exists (see security-center check).
|
||||
|
||||
```
|
||||
Get-MpComputerStatus returned null
|
||||
```
|
||||
|
||||
### 5 pending Windows updates
|
||||
- **Category:** security
|
||||
- **ID:** `sec.patch.pending`
|
||||
- Windows Update reports pending (not installed, not hidden) updates. Some may be security updates. Approve/install on the next maintenance window.
|
||||
|
||||
```
|
||||
Microsoft.Update.Session search IsInstalled=0 and IsHidden=0 -> 5
|
||||
```
|
||||
|
||||
### RDP is enabled
|
||||
- **Category:** security
|
||||
- **ID:** `sec.exposure.rdp_on`
|
||||
- Remote Desktop is enabled (NLA required). Confirm it is restricted to VPN or specific source IPs and not exposed to the internet.
|
||||
|
||||
```
|
||||
fDenyTSConnections=0; UserAuthentication=1
|
||||
```
|
||||
|
||||
### Reboot pending
|
||||
- **Category:** health
|
||||
- **ID:** `health.reboot_uptime.pending`
|
||||
- A reboot is pending. Pending reboots can block patches and leave the system in a half-updated state. Schedule a restart.
|
||||
|
||||
```
|
||||
PendingFileRenameOperations
|
||||
```
|
||||
|
||||
### Uptime is 104.8 days
|
||||
- **Category:** health
|
||||
- **ID:** `health.reboot_uptime.long_uptime`
|
||||
- Uptime exceeds 30 days. Long uptime usually means pending updates have not been applied (reboots deferred). Schedule maintenance.
|
||||
|
||||
```
|
||||
LastBootUpTime=2026-02-21 16:37:40Z
|
||||
```
|
||||
|
||||
### 2 auto-start service(s) not running
|
||||
- **Category:** health
|
||||
- **ID:** `health.failed_services.stopped`
|
||||
- These services are set to start automatically but are not running. Some may be benign; review for security agents, backup agents, or AV that should be running.
|
||||
|
||||
```
|
||||
GoogleUpdaterInternalService150.0.7863.0 (Google Updater Internal Service (GoogleUpdaterInternalService150.0.7863.0)) = Stopped
|
||||
GoogleUpdaterService150.0.7863.0 (Google Updater Service (GoogleUpdaterService150.0.7863.0)) = Stopped
|
||||
```
|
||||
|
||||
|
||||
## INFO (12)
|
||||
|
||||
### No AV products registered in Security Center
|
||||
- **Category:** security
|
||||
- **ID:** `sec.av_products.none_registered`
|
||||
- SecurityCenter2 returned no AntiVirusProduct entries. This is normal on Windows Server SKUs (Security Center is a client feature). On a workstation, confirm Defender or a managed AV is active.
|
||||
|
||||
```
|
||||
root\SecurityCenter2 AntiVirusProduct: none
|
||||
```
|
||||
|
||||
### No competitor/leftover management agents detected
|
||||
- **Category:** security
|
||||
- **ID:** `sec.foreign_agents.none`
|
||||
- No known competitor RMM or unmanaged remote-access agents found in installed programs or services.
|
||||
|
||||
```
|
||||
Scanned uninstall hives (HKLM + WOW6432Node) and Win32_Service
|
||||
```
|
||||
|
||||
### Expected ACG management tooling present: ScreenConnect / ConnectWise Control
|
||||
- **Category:** security
|
||||
- **ID:** `sec.foreign_agents.acg.screenconnect_connectwise_control`
|
||||
- This is Arizona Computer Guru managed/remote-access tooling that we deploy. Its presence is expected and not a foreign-agent risk.
|
||||
|
||||
```
|
||||
program: ScreenConnect Client (1912bf3444b41a08) 26.1.24.9579
|
||||
service: ScreenConnect Client (1912bf3444b41a08) (ScreenConnect Client (1912bf3444b41a08)) Running
|
||||
```
|
||||
|
||||
### Expected ACG management tooling present: Splashtop (SOS/Streamer)
|
||||
- **Category:** security
|
||||
- **ID:** `sec.foreign_agents.acg.splashtop_sos_streamer_`
|
||||
- This is Arizona Computer Guru managed/remote-access tooling that we deploy. Its presence is expected and not a foreign-agent risk.
|
||||
|
||||
```
|
||||
program: Splashtop Software Updater 1.5.6.23
|
||||
program: Splashtop Streamer 3.8.2.0
|
||||
service: SplashtopRemoteService (Splashtop? Remote Service) Running
|
||||
service: SSUService (Splashtop Software Updater Service) Running
|
||||
```
|
||||
|
||||
### Expected ACG management tooling present: Syncro / Kabuto
|
||||
- **Category:** security
|
||||
- **ID:** `sec.foreign_agents.acg.syncro_kabuto`
|
||||
- This is Arizona Computer Guru managed/remote-access tooling that we deploy. Its presence is expected and not a foreign-agent risk.
|
||||
|
||||
```
|
||||
program: Syncro 1.0.201.18410
|
||||
service: Syncro (Syncro) Running
|
||||
```
|
||||
|
||||
### Local administrators (6)
|
||||
- **Category:** security
|
||||
- **ID:** `sec.local_admins.list`
|
||||
- Members of the local Administrators group. Review for unexpected or unknown accounts (especially leftover MSP/vendor accounts from a prior provider).
|
||||
|
||||
```
|
||||
Administrator
|
||||
Domain Admins
|
||||
Enterprise Admins
|
||||
localadmin
|
||||
MediaAdmin$
|
||||
sysadmin
|
||||
```
|
||||
|
||||
### Last hotfix: KB5070248
|
||||
- **Category:** security
|
||||
- **ID:** `sec.patch.last_hotfix`
|
||||
- Most recently installed update (from Get-HotFix; reflects CBS/MSU packages, not all cumulative metadata).
|
||||
|
||||
```
|
||||
KB5070248 installed 2026-01-17T08:00:00Z
|
||||
```
|
||||
|
||||
### LAPS not detected
|
||||
- **Category:** security
|
||||
- **ID:** `sec.exposure.no_laps`
|
||||
- No LAPS (Windows LAPS or legacy AdmPwd) detected. Without LAPS, the local admin password is likely static/shared across the fleet. Consider deploying LAPS to randomize and escrow local admin passwords.
|
||||
|
||||
```
|
||||
No LAPS registry keys, CSE, or service found
|
||||
```
|
||||
|
||||
### No stability events in the last 14 days
|
||||
- **Category:** health
|
||||
- **ID:** `health.stability.clean`
|
||||
- No unexpected shutdowns, BSODs, or disk errors logged.
|
||||
|
||||
```
|
||||
Unexpected shutdowns (id 41)=0; Bugchecks/BSOD (id 1001)=0; Disk errors (id 7/51/153)=0
|
||||
```
|
||||
|
||||
### Domain secure channel healthy
|
||||
- **Category:** health
|
||||
- **ID:** `health.domain.secure_channel_ok`
|
||||
- Machine trust relationship with the domain is intact.
|
||||
|
||||
```
|
||||
Domain=GTS.local
|
||||
```
|
||||
|
||||
### Time service source
|
||||
- **Category:** health
|
||||
- **ID:** `health.time.source`
|
||||
- Current Windows Time service source.
|
||||
|
||||
```
|
||||
Source=Free-running System Clock
|
||||
```
|
||||
|
||||
### No backup agent detected
|
||||
- **Category:** health
|
||||
- **ID:** `health.backup.none`
|
||||
- No known backup agent service found. Backup expectation varies by endpoint; confirm whether this machine is supposed to have local/cloud backup and whether server-side or M365 backup covers it.
|
||||
|
||||
```
|
||||
No matching backup service in Win32_Service
|
||||
```
|
||||
|
||||
|
||||
## UNKNOWN (1)
|
||||
|
||||
### BitLocker status unavailable
|
||||
- **Category:** security
|
||||
- **ID:** `sec.bitlocker.unavailable`
|
||||
- Get-BitLockerVolume failed for the OS volume. BitLocker may not be installed (Home edition) or the cmdlet is unavailable. Verify encryption manually (manage-bde -status).
|
||||
|
||||
```
|
||||
MountPoint=C:, Get-BitLockerVolume returned null
|
||||
```
|
||||
|
||||
|
||||
---
|
||||
|
||||
## Inventory Baseline Summary
|
||||
|
||||
- **Manufacturer / Model:** Dell Inc. / PowerEdge T440
|
||||
- **Serial:** 5308R53
|
||||
- **CPU:** Intel(R) Xeon(R) Bronze 3204 CPU @ 1.90GHz (6 cores / 6 logical)
|
||||
- **RAM (GB):** 7.6
|
||||
- **BIOS:** 2.8.2 (2020-08-31)
|
||||
- **Chassis is laptop:** false
|
||||
- **TPM present / Secure Boot:** ? / ?
|
||||
- **Domain joined:** true (GTS.local)
|
||||
- **OS activation licensed:** ?
|
||||
- **Uptime (days):** 104.8
|
||||
- **Pending reboot:** true
|
||||
- **Installed software count:** 30
|
||||
- **Scheduled tasks (non-MS, enabled):** 3
|
||||
- **Local administrators:** Administrator, Domain Admins, Enterprise Admins, localadmin, MediaAdmin$, sysadmin
|
||||
|
||||
### Fixed volumes
|
||||
|
||||
- [System Reserved] - 0.5 GB free of 0.5 GB (93%)
|
||||
- C: - 750.9 GB free of 930.2 GB (80.7%)
|
||||
- [unlabeled] - 0.3 GB free of 0.8 GB (42.6%)
|
||||
|
||||
### Network adapters
|
||||
|
||||
- Broadcom NetXtreme Gigabit Ethernet #2 - IP: 192.168.0.5, fe80::bd6f:321c:c1d5:2f3c - DNS: 192.168.0.5, 192.168.0.2 - DHCP: false
|
||||
|
||||
---
|
||||
|
||||
## Diff vs Prior Baseline
|
||||
|
||||
- No prior baseline found for this host. This is the first baseline.
|
||||
|
||||
---
|
||||
|
||||
_Generated by run-onboarding-diagnostic.sh (GuruRMM onboarding diagnostic, Phase 1). Raw snapshot: `SERVER-20260606T181304.json` (immutable)._
|
||||
@@ -0,0 +1,821 @@
|
||||
# Session Log - Gonzvar Tax Services RMM Onboarding + Critical Diagnostic Probe Bug Discovery
|
||||
|
||||
## User
|
||||
- **User:** Mike Swanson (mike)
|
||||
- **Machine:** Mikes-MacBook-Air (Mac)
|
||||
- **Role:** admin
|
||||
|
||||
## Date
|
||||
2026-06-06
|
||||
|
||||
## Summary
|
||||
|
||||
Onboarded Gonzvar Tax Services as new MSP client in GuruRMM, ran comprehensive security/health diagnostics on all 6 enrolled machines (3 workstations, 1 personal workstation, 2 servers), and discovered critical false positive in diagnostic probe: Event ID 153 VBS boot messages were incorrectly counted as disk errors, causing false "failing drive" alert on GTS-W0. Investigation confirmed drive healthy, corrected assessment, identified probe bug affecting all Windows 11 machines with VBS enabled, and documented full analysis with remediation plan.
|
||||
|
||||
## Context
|
||||
|
||||
Continuation of session that included Gemini CLI installation, Wolkin RMM diagnostic, and Tailscale remote printing planning. User requested onboarding for new MSP client "Gonzvar Tax Services" with initial setup tasks including QuickBooks RemoteApp, system cleanup, RDP over VPN, and eventual RMM enrollment. Upon discovering machines already enrolled, immediately ran fleet-wide diagnostics.
|
||||
|
||||
---
|
||||
|
||||
## Work Performed
|
||||
|
||||
### 1. Gonzvar Tax Services - Coordination API Todo Creation
|
||||
|
||||
**Objective:** Create task tracking for Gonzvar initial setup requirements.
|
||||
|
||||
User provided initial task list:
|
||||
- Install QuickBooks on server with RemoteApp sharing (local users + VPN access)
|
||||
- Cleanup on all machines (3 workstations + server)
|
||||
- Setup RDP access to each machine via VPN
|
||||
- RMM enrollment (deferred - "I'll get RMM on them in a little while")
|
||||
|
||||
**Implementation:**
|
||||
|
||||
Created 4 todos in coordination API with project_key `gonzvar`:
|
||||
|
||||
1. **QuickBooks RemoteApp Setup** (ID: 1b2d8e20-5560-4c27-975a-f58782caace9)
|
||||
- Text: "Install QuickBooks on Gonzvar server with RemoteApp sharing to local users and over VPN"
|
||||
- Priority: Medium
|
||||
- Assigned: Mike
|
||||
|
||||
2. **System Cleanup** (ID: 8f0f914b-9783-4330-a970-df2d58240f7a)
|
||||
- Text: "Cleanup on all Gonzvar machines (3 workstations + server) - disk cleanup, temp files, updates"
|
||||
- Priority: Medium
|
||||
- Assigned: Mike
|
||||
|
||||
3. **RDP over VPN** (ID: 6d18aed9-9adc-4782-b022-c462f6dc7079)
|
||||
- Text: "Setup RDP access to each Gonzvar machine (3 workstations) via VPN"
|
||||
- Priority: Medium
|
||||
- Assigned: Mike
|
||||
|
||||
4. **RMM Enrollment** (ID: e48c2808-7876-4eaa-9cde-26a3ca18cd24)
|
||||
- Text: "Enroll Gonzvar machines in GuruRMM (3 workstations + server) - deferred, to be done later"
|
||||
- Priority: Low (deferred)
|
||||
- Assigned: Mike
|
||||
|
||||
**Documentation:**
|
||||
|
||||
Created `clients/gonzvar-tax-services/TASKS.md` with:
|
||||
- Overview of 4 machines (3 workstations + server)
|
||||
- Detailed task breakdown
|
||||
- Follow-up requirements checklist
|
||||
- Coordination API query examples
|
||||
|
||||
**Outcome:** Task tracking established. Recognized that RMM client creation needed to happen first despite "deferred" enrollment.
|
||||
|
||||
---
|
||||
|
||||
### 2. GuruRMM Client and Site Creation
|
||||
|
||||
**Objective:** Create Gonzvar Tax Services client in RMM to generate enrollment keys, even though agent installation is deferred.
|
||||
|
||||
User correctly identified: "That means he needs to be created in RMM" - can't enroll machines without client/site existing.
|
||||
|
||||
**Steps:**
|
||||
|
||||
1. **Authenticated to RMM API**
|
||||
- Base URL: http://172.16.3.30:3001
|
||||
- Retrieved credentials from vault: `infrastructure/gururmm-server.sops.yaml`
|
||||
- Obtained JWT token
|
||||
|
||||
2. **Checked for duplicate client**
|
||||
- Queried existing clients for "Gonzvar Tax Services"
|
||||
- No duplicate found
|
||||
|
||||
3. **Created client**
|
||||
```json
|
||||
POST /api/clients
|
||||
{
|
||||
"name": "Gonzvar Tax Services"
|
||||
}
|
||||
```
|
||||
- Client ID: `ae78d033-b09c-4898-ac9f-febe1fad54fa`
|
||||
|
||||
4. **Created site "Main"**
|
||||
```json
|
||||
POST /api/sites
|
||||
{
|
||||
"client_id": "ae78d033-b09c-4898-ac9f-febe1fad54fa",
|
||||
"name": "Main"
|
||||
}
|
||||
```
|
||||
- Site ID: `fa410749-ac42-432a-a4be-a6eafa20eb92`
|
||||
- Site Code: `INNER-BEAR-6727` (server-generated, unique)
|
||||
- API Key: Captured one-time enrollment key
|
||||
|
||||
5. **Vaulted enrollment key**
|
||||
- Created `clients/gonzvar-tax-services/gururmm-site-main.sops.yaml`
|
||||
- Structure:
|
||||
```yaml
|
||||
client: Gonzvar Tax Services
|
||||
site: Main
|
||||
created: "2026-06-06"
|
||||
credentials:
|
||||
client_id: "ae78d033-b09c-4898-ac9f-febe1fad54fa"
|
||||
site_id: "fa410749-ac42-432a-a4be-a6eafa20eb92"
|
||||
site_code: "INNER-BEAR-6727"
|
||||
api_key: "<one-time-key>"
|
||||
installer_url: "https://rmm.azcomputerguru.com/install/INNER-BEAR-6727"
|
||||
msi_url: "https://rmm.azcomputerguru.com/api/sites/fa410749-.../installer"
|
||||
```
|
||||
- Encrypted with SOPS using vault's `.sops.yaml` config
|
||||
- Verified round-trip decrypt
|
||||
- Committed and pushed to vault repo
|
||||
|
||||
**Enrollment Details:**
|
||||
- **Install Page:** https://rmm.azcomputerguru.com/install/INNER-BEAR-6727
|
||||
- **MSI Installer:** https://rmm.azcomputerguru.com/api/sites/fa410749-ac42-432a-a4be-a6eafa20eb92/installer
|
||||
|
||||
**Alert Posted:** `[RMM] Mike onboarded client 'Gonzvar Tax Services' + site 'Main' (INNER-BEAR-6727)` to #dev-alerts
|
||||
|
||||
**Documentation Updated:**
|
||||
- Updated `clients/gonzvar-tax-services/TASKS.md` with RMM enrollment details
|
||||
- Marked client/site creation as completed
|
||||
|
||||
**Outcome:** Client fully onboarded in RMM with vaulted enrollment credentials. Ready for agent installation when needed.
|
||||
|
||||
---
|
||||
|
||||
### 3. Discovery of Pre-Enrolled Machines
|
||||
|
||||
**Objective:** Check if any Gonzvar machines were already enrolled, expecting 0.
|
||||
|
||||
**Surprise Finding:** **6 machines already enrolled** (more than the expected 4):
|
||||
|
||||
| Hostname | OS | Version | Last Seen | Agent Version |
|
||||
|----------|----|---------|-----------|--------------|
|
||||
| GTS-W0 | Windows | 11 (26200) | 2026-06-06 18:06 | 0.6.57 |
|
||||
| GTS-W1 | Windows | 11 (26200) | 2026-06-06 18:05 | 0.6.57 |
|
||||
| GTS-W2 | Windows | 11 (26200) | 2026-06-06 18:05 | 0.6.57 |
|
||||
| GTS-PEDRO-H | Windows | 11 (26200) | 2026-06-06 18:06 | 0.6.57 |
|
||||
| GTS-SVR25 | Windows | 11 (26100) | 2026-06-06 18:05 | 0.6.57 |
|
||||
| SERVER | Windows | 10 (17763) | 2026-06-06 18:06 | 0.6.57 |
|
||||
|
||||
**Analysis:**
|
||||
- 4 workstations (W0, W1, W2, PEDRO-H) instead of expected 3
|
||||
- 2 servers (GTS-SVR25 on Win11, SERVER on Win10 Server 2019)
|
||||
- All agents current version (0.6.57)
|
||||
- All recently connected (within last minute)
|
||||
- Naming convention: GTS-* prefix
|
||||
|
||||
**Decision:** User requested: "Onboard Diag all of those machines for Gonzvar"
|
||||
|
||||
Immediately proceeded to run comprehensive diagnostics on entire fleet.
|
||||
|
||||
---
|
||||
|
||||
### 4. Fleet-Wide Onboarding Diagnostics
|
||||
|
||||
**Objective:** Run security and health diagnostics on all 6 Gonzvar machines to establish baselines and identify issues.
|
||||
|
||||
**Diagnostic Tool:** `run-onboarding-diagnostic.sh` with probe `onboarding-diagnostic.ps1`
|
||||
- Probe size: 70,739 bytes
|
||||
- Upload method: 4 chunks of base64-encoded PowerShell (24KB each)
|
||||
- Execution: PowerShell as SYSTEM, 240s timeout
|
||||
- Output: JSON + Markdown baseline reports
|
||||
|
||||
**Execution Sequence:**
|
||||
|
||||
Ran diagnostics sequentially on all 6 machines:
|
||||
|
||||
**Machine 1: GTS-W0**
|
||||
- Duration: ~90 seconds
|
||||
- Status: Completed
|
||||
- Grade: **RED**
|
||||
- Findings: 3 critical, 4 warning, 14 info
|
||||
- Baseline: `GTS-W0-20260606T180736.{json,md}`
|
||||
|
||||
**Machine 2: GTS-W1**
|
||||
- Duration: ~70 seconds
|
||||
- Status: Completed
|
||||
- Grade: **AMBER**
|
||||
- Findings: 0 critical, 4 warning, 16 info
|
||||
- Baseline: `GTS-W1-20260606T180908.{json,md}`
|
||||
|
||||
**Machine 3: GTS-W2**
|
||||
- Duration: ~70 seconds
|
||||
- Status: Completed
|
||||
- Grade: **AMBER**
|
||||
- Findings: 0 critical, 7 warning, 16 info
|
||||
- Baseline: `GTS-W2-20260606T181016.{json,md}`
|
||||
|
||||
**Machine 4: GTS-PEDRO-H**
|
||||
- Duration: ~60 seconds
|
||||
- Status: Completed
|
||||
- Grade: **AMBER**
|
||||
- Findings: 0 critical, 5 warning, 13 info
|
||||
- Baseline: `GTS-PEDRO-H-20260606T181113.{json,md}`
|
||||
|
||||
**Machine 5: GTS-SVR25**
|
||||
- Duration: ~50 seconds
|
||||
- Status: Completed
|
||||
- Grade: **RED**
|
||||
- Findings: 3 critical, 4 warning, 14 info, 1 unknown
|
||||
- Baseline: `GTS-SVR25-20260606T181205.{json,md}`
|
||||
|
||||
**Machine 6: SERVER**
|
||||
- Duration: ~60 seconds
|
||||
- Status: Completed
|
||||
- Grade: **RED**
|
||||
- Findings: 3 critical, 6 warning, 12 info, 1 unknown
|
||||
- Baseline: `SERVER-20260606T181304.{json,md}`
|
||||
|
||||
**Total Time:** ~6 minutes for all 6 machines
|
||||
|
||||
**Fleet Summary:**
|
||||
- **3 RED machines** (GTS-W0, GTS-SVR25, SERVER) - Immediate action required
|
||||
- **3 AMBER machines** (GTS-W1, GTS-W2, GTS-PEDRO-H) - Scheduled maintenance needed
|
||||
|
||||
**Common Critical Issues Identified:**
|
||||
- Firewall disabled (all profiles OFF) on multiple machines
|
||||
- RDP enabled without NLA (Network Level Authentication) on multiple machines
|
||||
- BitLocker not enabled on several machines
|
||||
- **Recurring stability events** on GTS-W0 (flagged as most critical)
|
||||
|
||||
**Documentation Created:**
|
||||
- 12 baseline files (6 JSON + 6 Markdown) in `clients/gonzvar-tax-services/onboarding-baselines/`
|
||||
- `DIAGNOSTIC-SUMMARY-2026-06-06.md` - Fleet-wide summary with action plan
|
||||
|
||||
**Alert Posted:** `[RMM] CRITICAL: Gonzvar GTS-W0 has failing drive (9 disk errors) + firewall OFF + RDP no NLA - BACKUP DATA NOW`
|
||||
|
||||
---
|
||||
|
||||
### 5. GTS-W0 Critical Finding Analysis
|
||||
|
||||
**Initial Assessment:** GTS-W0 received RED grade with **3 critical findings**:
|
||||
|
||||
1. **All firewalls disabled** (Domain, Private, Public profiles OFF)
|
||||
2. **RDP enabled WITHOUT NLA** (pre-auth vulnerability)
|
||||
3. **Recurring stability events - 9 DISK ERRORS in 14 days**
|
||||
|
||||
The third finding triggered highest alarm:
|
||||
- Event IDs 7/51/153 (disk errors)
|
||||
- 2 unexpected shutdowns (Event ID 41)
|
||||
- 9 disk errors
|
||||
- Diagnostic classification: "CRITICAL - Hardware failure imminent"
|
||||
|
||||
**Recommendation from probe:**
|
||||
- Backup data immediately
|
||||
- Run SMART diagnostics
|
||||
- Replace failing drive
|
||||
- Drive details: Kingston SNV2S1000G 1TB NVMe SSD
|
||||
- Drive health per probe: "Healthy" (contradictory)
|
||||
|
||||
**User's Critical Question:**
|
||||
|
||||
User asked: "Were those disk errors actually attributed to that drive, or to external media?"
|
||||
|
||||
**This question revealed the false positive.** Excellent instinct - the probe reported "9 disk errors" but SMART showed "Healthy", which seemed contradictory.
|
||||
|
||||
---
|
||||
|
||||
### 6. Deep Dive Investigation - Disk Error Attribution
|
||||
|
||||
**Objective:** Determine if the 9 "disk errors" were from the internal NVMe drive or external media (USB drives, etc.).
|
||||
|
||||
**Method:** Query Windows Event Viewer directly on GTS-W0 for Event IDs 7, 51, 153 with full message details.
|
||||
|
||||
**Script Dispatched:**
|
||||
```powershell
|
||||
$StartDate = (Get-Date).AddDays(-14)
|
||||
$Events = Get-WinEvent -FilterHashtable @{
|
||||
LogName = "System"
|
||||
ID = 7,51,153
|
||||
StartTime = $StartDate
|
||||
} | Select-Object -First 20
|
||||
|
||||
# Display event details: ID, timestamp, source, message
|
||||
# Also query physical disk health
|
||||
```
|
||||
|
||||
**Results - SHOCKING DISCOVERY:**
|
||||
|
||||
**ALL 9 events were Event ID 153 from source "Microsoft-Windows-Kernel-Boot":**
|
||||
|
||||
```
|
||||
Event ID: 153 | Source: Microsoft-Windows-Kernel-Boot
|
||||
Message: Virtualization-based security (policies: VBS Enabled,VSM Required,Hvci,
|
||||
Boot Chain Signer Soft Enforced) is enabled due to VBS registry configuration.
|
||||
```
|
||||
|
||||
**These are NOT disk errors!** They are:
|
||||
- Informational boot messages
|
||||
- Logged every time the system boots
|
||||
- Indicate VBS (Virtualization-Based Security) and HVCI are enabled
|
||||
- **Completely benign** - security features working as intended
|
||||
|
||||
**Event Timeline:**
|
||||
- 2026-06-05 10:05:43 - VBS enabled (boot)
|
||||
- 2026-06-02 17:39:06 - VBS enabled (boot)
|
||||
- 2026-06-02 17:34:58 - VBS enabled (boot)
|
||||
- 2026-06-02 14:30:34 - VBS enabled (boot)
|
||||
- 2026-06-01 17:55:26 - VBS enabled (boot)
|
||||
- 2026-05-31 09:48:23 - VBS enabled (boot)
|
||||
- 2026-05-30 09:47:52 - VBS enabled (boot)
|
||||
- 2026-05-30 08:59:25 - VBS enabled (boot)
|
||||
- 2026-05-30 08:55:04 - VBS enabled (boot)
|
||||
|
||||
**Pattern:** Multiple boots per day (2-4 on 05/30, 05/31, 06/01, 06/02) = frequent restarts, not hardware failures.
|
||||
|
||||
**Physical Disk Health Confirmed:**
|
||||
```
|
||||
FriendlyName MediaType BusType Size HealthStatus OperationalStatus
|
||||
------------ --------- ------- ---- ------------ -----------------
|
||||
KINGSTON SNV2S1000G SSD NVMe 1000204886016 Healthy OK
|
||||
```
|
||||
|
||||
**No actual disk errors found** in Event Viewer when filtering properly.
|
||||
|
||||
---
|
||||
|
||||
### 7. Root Cause Analysis - Diagnostic Probe Bug
|
||||
|
||||
**Problem:** Event ID 153 has **dual meanings** depending on the source:
|
||||
|
||||
| Event ID | Source | Meaning | Severity |
|
||||
|----------|--------|---------|----------|
|
||||
| 153 | **Disk** | Actual disk I/O error | CRITICAL - Hardware failure |
|
||||
| 153 | **Microsoft-Windows-Kernel-Boot** | VBS/HVCI enabled status | INFO - Security feature working |
|
||||
|
||||
**Current Probe Code (Problematic):**
|
||||
```powershell
|
||||
# From onboarding-diagnostic.ps1 (line ~400-410)
|
||||
$DiskErrors = (Get-WinEvent -FilterHashtable @{
|
||||
LogName = 'System'
|
||||
ID = 7,51,153
|
||||
StartTime = $14DaysAgo
|
||||
} -ErrorAction SilentlyContinue | Measure-Object).Count
|
||||
```
|
||||
|
||||
This query returns **ALL Event ID 153 events** regardless of source, so it counts:
|
||||
- Actual disk errors from "Disk" source ✓ (correct)
|
||||
- VBS boot messages from "Microsoft-Windows-Kernel-Boot" source ✗ (incorrect)
|
||||
|
||||
**Impact:**
|
||||
- **Every Windows 11 machine with VBS enabled** (default on 12th gen Intel and newer) shows false disk errors
|
||||
- False positives inflate to 9+ "errors" on machines that boot frequently
|
||||
- Triggers CRITICAL alerts and unnecessary drive replacement recommendations
|
||||
- Affects fleet-wide diagnostic accuracy
|
||||
|
||||
**Fix Required:**
|
||||
|
||||
Add source filtering to exclude "Microsoft-Windows-Kernel-Boot":
|
||||
|
||||
```powershell
|
||||
# Option 1: Exclude kernel boot events
|
||||
$DiskErrors = (Get-WinEvent -FilterHashtable @{
|
||||
LogName = 'System'
|
||||
ID = 7,51,153
|
||||
StartTime = $14DaysAgo
|
||||
} -ErrorAction SilentlyContinue |
|
||||
Where-Object { $_.ProviderName -ne 'Microsoft-Windows-Kernel-Boot' } |
|
||||
Measure-Object).Count
|
||||
|
||||
# Option 2: Query Disk source directly (more precise)
|
||||
$DiskErrors = (Get-WinEvent -FilterHashtable @{
|
||||
LogName = 'System'
|
||||
ProviderName = 'disk'
|
||||
StartTime = $14DaysAgo
|
||||
} -ErrorAction SilentlyContinue | Measure-Object).Count
|
||||
```
|
||||
|
||||
**Scope of Bug:**
|
||||
- Likely affects **all recent diagnostics** on Windows 11 machines
|
||||
- Wolkin FRONT diagnostic (run earlier today) may also have false positives
|
||||
- Need to re-run diagnostics fleet-wide after probe fix
|
||||
- Need to review and correct any prior RED grades caused by this bug
|
||||
|
||||
---
|
||||
|
||||
### 8. Documentation and Correction
|
||||
|
||||
**Actions Taken:**
|
||||
|
||||
1. **Created Detailed Analysis Report**
|
||||
- File: `clients/gonzvar-tax-services/GTS-W0-DISK-ANALYSIS.md`
|
||||
- Contents:
|
||||
- Summary: False positive, drive is healthy
|
||||
- Root cause: Event ID 153 dual meanings
|
||||
- Full event timeline showing VBS boot messages
|
||||
- Drive health verification (SMART OK)
|
||||
- Revised assessment (still RED but for different reasons)
|
||||
- Diagnostic probe bug details with fix
|
||||
- Lessons learned
|
||||
|
||||
2. **Updated Diagnostic Summary**
|
||||
- File: `clients/gonzvar-tax-services/DIAGNOSTIC-SUMMARY-2026-06-06.md`
|
||||
- Added prominent correction notice at top
|
||||
- Strikethrough on incorrect findings
|
||||
- Updated action plan (removed backup/replacement tasks)
|
||||
- Added probe fix to Phase 3 action items
|
||||
- Corrected GTS-W0 section with accurate critical issues
|
||||
|
||||
3. **Corrected GTS-W0 Assessment**
|
||||
|
||||
**REMOVED (False Positive):**
|
||||
- ~~9 disk errors in 14 days~~
|
||||
- ~~Failing hard drive~~
|
||||
- ~~Backup data immediately~~
|
||||
- ~~Order replacement drive~~
|
||||
- ~~Replace drive~~
|
||||
|
||||
**ACTUAL CRITICAL Issues:**
|
||||
- All firewalls disabled (Domain, Private, Public OFF)
|
||||
- RDP enabled WITHOUT NLA (pre-auth vulnerability)
|
||||
|
||||
**WARNING Issues (Unchanged):**
|
||||
- BitLocker not enabled
|
||||
- 1 pending Windows update
|
||||
- Reboot pending
|
||||
- 4 auto-start services stopped
|
||||
- 2 unexpected shutdowns (Event ID 41) - investigate separately (may be power-related, not drive)
|
||||
|
||||
**Grade:** Still **RED** due to firewall and RDP issues, but NO failing drive
|
||||
|
||||
4. **Posted Correction Alert**
|
||||
- Alert: `[RMM] CORRECTION: Gonzvar GTS-W0 disk errors were FALSE POSITIVE (VBS boot messages, not drive failure) - Drive is HEALTHY, no replacement needed. Still RED for firewall OFF + RDP no NLA`
|
||||
- Posted to #dev-alerts to correct previous critical alert
|
||||
|
||||
**Outcome:** Documentation fully corrected, false alarm retracted, actual issues clearly identified, probe bug documented with fix.
|
||||
|
||||
---
|
||||
|
||||
### 9. Broader Implications and Next Steps
|
||||
|
||||
**Immediate Actions Required:**
|
||||
|
||||
1. **Fix Diagnostic Probe Script**
|
||||
- Update `onboarding-diagnostic.ps1` with Event ID 153 source filtering
|
||||
- Test fix on Windows 11 + Windows 10 machines
|
||||
- Verify no false negatives (actual disk errors still detected)
|
||||
- Commit updated probe to repo
|
||||
|
||||
2. **Re-Run Gonzvar Diagnostics**
|
||||
- Re-baseline all 6 machines with fixed probe
|
||||
- Compare before/after grades
|
||||
- Update summary report with corrected findings
|
||||
- Likely will see grade improvements (RED → AMBER on some machines)
|
||||
|
||||
3. **Review Recent Diagnostics**
|
||||
- Check Wolkin FRONT baseline (2026-06-06) for Event ID 153 false positives
|
||||
- Review any other Windows 11 diagnostics from last 30 days
|
||||
- Correct any misdiagnosed "failing drives"
|
||||
- Update coordination API todos if drive replacements were scheduled
|
||||
|
||||
4. **Address Actual Gonzvar Issues**
|
||||
- Enable firewalls on all machines (Domain, Private, Public profiles)
|
||||
- Fix RDP: Enable NLA or disable RDP entirely, restrict to VPN/allow-listed IPs
|
||||
- Enable BitLocker on unencrypted OS volumes
|
||||
- Install pending Windows updates
|
||||
- Reboot machines to clear pending reboot flags
|
||||
- Investigate Group Policy Client service stopped on multiple machines
|
||||
|
||||
5. **Deploy Tailscale for Gonzvar**
|
||||
- Same solution as planned for Wolkin
|
||||
- Install on server + 3 workstations for RDP over VPN
|
||||
- Addresses RDP security concern (VPN-only access)
|
||||
|
||||
6. **Complete Gonzvar Setup Tasks**
|
||||
- Install QuickBooks on server with RemoteApp
|
||||
- System cleanup on all machines
|
||||
- Deploy RDP over VPN (Tailscale)
|
||||
- Document final configuration
|
||||
|
||||
**Long-Term Improvements:**
|
||||
|
||||
1. **Probe Quality Assurance**
|
||||
- Add unit tests for probe script
|
||||
- Test against Windows 10, 11, Server 2019, Server 2022
|
||||
- Verify all Event ID queries filter by source where needed
|
||||
- Document Event ID meanings and sources
|
||||
|
||||
2. **Grading Logic Review**
|
||||
- Review all "critical" thresholds
|
||||
- Ensure no other dual-meaning Event IDs exist
|
||||
- Add probe version to baseline metadata
|
||||
- Allow baseline re-grading when probe improves
|
||||
|
||||
3. **Fleet-Wide Standards**
|
||||
- Document baseline security configuration (firewall, RDP, BitLocker)
|
||||
- Create remediation playbooks for common findings
|
||||
- Automate fixes via RMM where possible (firewall enable, NLA enable)
|
||||
|
||||
---
|
||||
|
||||
## Technical Notes
|
||||
|
||||
### Event ID 153 Dual Meaning
|
||||
|
||||
**Windows Event IDs are NOT globally unique.** The same Event ID can have completely different meanings depending on the source/provider.
|
||||
|
||||
**Event ID 153 Sources:**
|
||||
|
||||
1. **Source: "Disk"** (the one the probe wants)
|
||||
- Category: Disk errors
|
||||
- Meaning: Disk I/O error, potential hardware failure
|
||||
- Severity: WARNING to CRITICAL
|
||||
- Action: Investigate disk health, check SMART, consider replacement
|
||||
|
||||
2. **Source: "Microsoft-Windows-Kernel-Boot"** (the false positive)
|
||||
- Category: Boot information
|
||||
- Meaning: Virtualization-Based Security (VBS) enabled
|
||||
- Features logged: VBS, VSM (Virtual Secure Mode), HVCI (Hypervisor-Protected Code Integrity)
|
||||
- Severity: INFORMATIONAL
|
||||
- Action: None (feature working as intended)
|
||||
|
||||
**Why VBS Shows Up as Event ID 153:**
|
||||
|
||||
Windows 11 on modern hardware (12th gen Intel+, AMD Ryzen 3000+) enables VBS/HVCI by default:
|
||||
- VBS: Virtualization-Based Security (uses Hyper-V to isolate security features)
|
||||
- VSM: Virtual Secure Mode (isolated execution environment)
|
||||
- HVCI: Hypervisor-Protected Code Integrity (prevents unsigned code injection)
|
||||
|
||||
These are **security enhancements**, not errors. Event ID 153 from Kernel-Boot fires on every boot to confirm VBS is active.
|
||||
|
||||
**Frequency Pattern:**
|
||||
|
||||
Machines with frequent reboots show more Event ID 153 (Kernel-Boot) entries:
|
||||
- Windows Update reboots
|
||||
- User-initiated reboots
|
||||
- Power loss / unexpected shutdown recovery boots
|
||||
- Maintenance window reboots
|
||||
|
||||
This explains why GTS-W0 had 9 events in 14 days (9 boots) with 2-4 boots on some days (likely Windows Updates or troubleshooting).
|
||||
|
||||
### Diagnostic Probe Architecture
|
||||
|
||||
**Current Flow:**
|
||||
1. Probe uploaded to endpoint in 4 base64-encoded chunks (24KB each)
|
||||
2. Final command decodes and executes probe
|
||||
3. Probe runs ~80 security/health checks as SYSTEM
|
||||
4. JSON output fenced between markers: `===DIAG-JSON-START===` / `===DIAG-JSON-END===`
|
||||
5. Runner extracts JSON, grades findings, writes JSON + Markdown baselines
|
||||
|
||||
**Grading Logic:**
|
||||
- **RED:** ≥1 critical finding
|
||||
- **AMBER:** ≥1 warning, 0 critical
|
||||
- **GREEN:** 0 critical, 0 warning
|
||||
|
||||
**Stability Check (Current - Broken):**
|
||||
```powershell
|
||||
# Query last 14 days
|
||||
$14DaysAgo = (Get-Date).AddDays(-14)
|
||||
|
||||
# Count unexpected shutdowns (Event ID 41)
|
||||
$UnexpectedShutdowns = (Get-WinEvent -FilterHashtable @{
|
||||
LogName = 'System'; ID = 41; StartTime = $14DaysAgo
|
||||
} -ErrorAction SilentlyContinue | Measure-Object).Count
|
||||
|
||||
# Count bugchecks/BSODs (Event ID 1001)
|
||||
$Bugchecks = (Get-WinEvent -FilterHashtable @{
|
||||
LogName = 'System'; ID = 1001; StartTime = $14DaysAgo
|
||||
} -ErrorAction SilentlyContinue | Measure-Object).Count
|
||||
|
||||
# Count disk errors (Event IDs 7, 51, 153) -- BUG HERE
|
||||
$DiskErrors = (Get-WinEvent -FilterHashtable @{
|
||||
LogName = 'System'; ID = 7,51,153; StartTime = $14DaysAgo
|
||||
} -ErrorAction SilentlyContinue | Measure-Object).Count
|
||||
|
||||
# Grade based on counts
|
||||
if ($DiskErrors -ge 3 -or $UnexpectedShutdowns -ge 3 -or $Bugchecks -ge 3) {
|
||||
# CRITICAL - Recurring stability events
|
||||
} elseif ($DiskErrors -gt 0 -or $UnexpectedShutdowns -gt 0 -or $Bugchecks -gt 0) {
|
||||
# WARNING - Some stability events
|
||||
}
|
||||
```
|
||||
|
||||
**The bug:** Line with `$DiskErrors` doesn't filter by source, so it counts VBS messages.
|
||||
|
||||
**Fix:** Add `Where-Object` filter or use `ProviderName = 'disk'` in FilterHashtable.
|
||||
|
||||
### Kingston SNV2S1000G Drive Details
|
||||
|
||||
**Specifications:**
|
||||
- Model: KINGSTON SNV2S1000G
|
||||
- Capacity: 1TB (1000GB)
|
||||
- Interface: NVMe (PCIe Gen 3.0 x4)
|
||||
- Form Factor: M.2 2280
|
||||
- Controller: Phison E21T (DRAM-less)
|
||||
- NAND: QLC (lower endurance than TLC)
|
||||
- Tier: Budget/value NVMe SSD
|
||||
- Common in: OEM systems (Dell, Lenovo, HP pre-builts)
|
||||
|
||||
**Performance:**
|
||||
- Sequential Read: ~3,500 MB/s
|
||||
- Sequential Write: ~2,100 MB/s
|
||||
- 4K Random: Adequate for boot/OS drive
|
||||
|
||||
**Health on GTS-W0:**
|
||||
- SMART Status: Healthy
|
||||
- Operational Status: OK
|
||||
- No actual disk errors in Event Viewer
|
||||
- **No replacement needed**
|
||||
|
||||
**Notes:** While this is a budget-tier SSD (QLC NAND, DRAM-less controller), it's perfectly adequate for workstation use. QLC has lower write endurance than TLC, but typical office workload won't exceed TBW (terabytes written) rating during expected lifespan.
|
||||
|
||||
---
|
||||
|
||||
## Lessons Learned
|
||||
|
||||
### 1. Always Verify Critical Findings
|
||||
|
||||
**Before:** Automated diagnostic reported "9 disk errors" → immediately recommended drive replacement and urgent backup.
|
||||
|
||||
**User's instinct:** Questioned whether errors were from internal drive or external media.
|
||||
|
||||
**Result:** Investigation revealed complete false positive. No drive failure, no backup urgency, no replacement needed.
|
||||
|
||||
**Takeaway:** Don't trust automated diagnostics blindly. When SMART shows "Healthy" but probe shows "9 disk errors", the contradiction should trigger manual verification.
|
||||
|
||||
### 2. Event ID Context Matters
|
||||
|
||||
**Mistake:** Queried Event ID 153 without considering source/provider.
|
||||
|
||||
**Reality:** Event IDs are not globally unique. Same ID can mean completely different things from different sources.
|
||||
|
||||
**Fix:** Always filter by source when Event ID meanings overlap. Use `ProviderName` in FilterHashtable or `Where-Object { $_.ProviderName -eq 'expected-source' }`.
|
||||
|
||||
### 3. Windows 11 Defaults Change Diagnostic Assumptions
|
||||
|
||||
**Old assumption (Windows 10):** Event ID 153 = disk errors only
|
||||
|
||||
**New reality (Windows 11):** Event ID 153 = disk errors (Disk source) + VBS status (Kernel-Boot source)
|
||||
|
||||
**Why:** Windows 11 enables VBS/HVCI by default on supported hardware (12th gen Intel+, modern AMD). This wasn't common on Windows 10.
|
||||
|
||||
**Impact:** Diagnostics written for Windows 10 need updates for Windows 11 behavioral changes.
|
||||
|
||||
### 4. Question Patterns and Contradictions
|
||||
|
||||
**Pattern:** 9 "disk errors" but SMART shows "Healthy" and system is stable (1 day uptime, working normally).
|
||||
|
||||
**Contradiction:** Real disk failures usually show:
|
||||
- Degrading SMART attributes
|
||||
- Increasing error frequency over time
|
||||
- Symptoms: slow performance, hangs, corrupted files
|
||||
- Event messages reference specific disk/volume
|
||||
|
||||
**GTS-W0 showed:** No symptoms, no SMART degradation, "errors" at regular intervals (boots), all messages identical (VBS enabled).
|
||||
|
||||
**Takeaway:** When automated findings contradict observable behavior and health metrics, investigate manually before acting.
|
||||
|
||||
### 5. Fleet-Wide Impact of Probe Bugs
|
||||
|
||||
**Single bug impact:**
|
||||
- Affected all 6 Gonzvar machines (likely false positives on others too)
|
||||
- Affected Wolkin diagnostics (run earlier same day)
|
||||
- Affected any Windows 11 diagnostics in last 30 days
|
||||
- Generated false critical alerts
|
||||
- Wasted troubleshooting time
|
||||
- Could have led to unnecessary hardware purchases
|
||||
|
||||
**Takeaway:** Probe quality is critical. Small bugs have fleet-wide impact and erode trust in automated diagnostics.
|
||||
|
||||
### 6. Document Corrections Prominently
|
||||
|
||||
**Actions taken:**
|
||||
- Created dedicated analysis document (GTS-W0-DISK-ANALYSIS.md)
|
||||
- Updated summary report with prominent correction notice
|
||||
- Posted correction alert to #dev-alerts
|
||||
- Strikethrough on incorrect findings (preservation + visibility)
|
||||
- Explained root cause and lessons learned
|
||||
|
||||
**Takeaway:** When diagnostics are wrong, document the correction as thoroughly as the original finding. This prevents future confusion and helps others learn from the mistake.
|
||||
|
||||
---
|
||||
|
||||
## Files Modified
|
||||
|
||||
**Created:**
|
||||
1. `clients/gonzvar-tax-services/TASKS.md` - Initial setup task list
|
||||
2. `clients/gonzvar-tax-services/onboarding-baselines/GTS-W0-20260606T180736.json` - Baseline snapshot (17.5KB)
|
||||
3. `clients/gonzvar-tax-services/onboarding-baselines/GTS-W0-20260606T180736.md` - Human report
|
||||
4. `clients/gonzvar-tax-services/onboarding-baselines/GTS-W1-20260606T180908.json` - Baseline snapshot
|
||||
5. `clients/gonzvar-tax-services/onboarding-baselines/GTS-W1-20260606T180908.md` - Human report
|
||||
6. `clients/gonzvar-tax-services/onboarding-baselines/GTS-W2-20260606T181016.json` - Baseline snapshot
|
||||
7. `clients/gonzvar-tax-services/onboarding-baselines/GTS-W2-20260606T181016.md` - Human report
|
||||
8. `clients/gonzvar-tax-services/onboarding-baselines/GTS-PEDRO-H-20260606T181113.json` - Baseline snapshot
|
||||
9. `clients/gonzvar-tax-services/onboarding-baselines/GTS-PEDRO-H-20260606T181113.md` - Human report
|
||||
10. `clients/gonzvar-tax-services/onboarding-baselines/GTS-SVR25-20260606T181205.json` - Baseline snapshot
|
||||
11. `clients/gonzvar-tax-services/onboarding-baselines/GTS-SVR25-20260606T181205.md` - Human report
|
||||
12. `clients/gonzvar-tax-services/onboarding-baselines/SERVER-20260606T181304.json` - Baseline snapshot
|
||||
13. `clients/gonzvar-tax-services/onboarding-baselines/SERVER-20260606T181304.md` - Human report
|
||||
14. `clients/gonzvar-tax-services/DIAGNOSTIC-SUMMARY-2026-06-06.md` - Fleet summary
|
||||
15. `clients/gonzvar-tax-services/GTS-W0-DISK-ANALYSIS.md` - False positive investigation
|
||||
|
||||
**Modified:**
|
||||
1. `clients/gonzvar-tax-services/TASKS.md` - Added RMM enrollment details, marked client/site creation complete
|
||||
2. `clients/gonzvar-tax-services/DIAGNOSTIC-SUMMARY-2026-06-06.md` - Added correction notice, updated GTS-W0 section, revised action plan
|
||||
|
||||
**Vault:**
|
||||
1. `clients/gonzvar-tax-services/gururmm-site-main.sops.yaml` - Enrollment key (encrypted with SOPS)
|
||||
|
||||
---
|
||||
|
||||
## Coordination API Activity
|
||||
|
||||
**Todos Created:**
|
||||
1. QuickBooks RemoteApp setup - ID: 1b2d8e20-5560-4c27-975a-f58782caace9
|
||||
2. System cleanup (all machines) - ID: 8f0f914b-9783-4330-a970-df2d58240f7a
|
||||
3. RDP access via VPN - ID: 6d18aed9-9adc-4782-b022-c462f6dc7079
|
||||
4. RMM enrollment (deferred) - ID: e48c2808-7876-4eaa-9cde-26a3ca18cd24
|
||||
|
||||
**Project Key:** gonzvar
|
||||
**Status:** All pending
|
||||
**Assigned:** Mike
|
||||
|
||||
---
|
||||
|
||||
## Alerts Posted
|
||||
|
||||
1. **RMM Onboarding:** "Mike onboarded client 'Gonzvar Tax Services' + site 'Main' (INNER-BEAR-6727)" - Message ID: 1512879733703049420
|
||||
|
||||
2. **Initial Critical (Incorrect):** "CRITICAL: Gonzvar GTS-W0 has failing drive (9 disk errors) + firewall OFF + RDP no NLA - BACKUP DATA NOW" - Message ID: 1512882395634729061
|
||||
|
||||
3. **Correction:** "CORRECTION: Gonzvar GTS-W0 disk errors were FALSE POSITIVE (VBS boot messages, not drive failure) - Drive is HEALTHY, no replacement needed. Still RED for firewall OFF + RDP no NLA" - Message ID: 1512885465227853844
|
||||
|
||||
---
|
||||
|
||||
## Follow-up Required
|
||||
|
||||
### Immediate (This Week)
|
||||
|
||||
1. **Fix Diagnostic Probe Script**
|
||||
- Update `onboarding-diagnostic.ps1` Event ID 153 query with source filtering
|
||||
- Test on Windows 10, 11, Server 2019, Server 2022
|
||||
- Verify no false negatives (actual disk errors still detected)
|
||||
- Commit and deploy updated probe
|
||||
|
||||
2. **Re-Run Diagnostics**
|
||||
- Re-baseline all 6 Gonzvar machines with fixed probe
|
||||
- Compare before/after grades and findings
|
||||
- Update DIAGNOSTIC-SUMMARY with corrected baselines
|
||||
- Check for grade improvements (likely RED → AMBER on some machines)
|
||||
|
||||
3. **Review Recent Diagnostics**
|
||||
- Check Wolkin FRONT baseline (2026-06-06) for Event ID 153 false positives
|
||||
- Review any Windows 11 diagnostics from last 30 days
|
||||
- Correct any misdiagnosed "failing drives"
|
||||
- Cancel any scheduled drive replacements if based on this bug
|
||||
|
||||
### Short-Term (Next 1-2 Weeks)
|
||||
|
||||
4. **Address Gonzvar Security Issues**
|
||||
- Enable firewalls on all machines (Domain, Private, Public profiles)
|
||||
- Fix RDP: Enable NLA or disable RDP entirely
|
||||
- Enable BitLocker on unencrypted OS volumes (W0, others TBD)
|
||||
- Install pending Windows updates on all machines
|
||||
- Reboot all machines to clear pending reboot flags
|
||||
- Investigate Group Policy Client service stopped on multiple machines
|
||||
|
||||
5. **Deploy Tailscale for Gonzvar**
|
||||
- Create Tailscale account for Gonzvar (or use existing)
|
||||
- Install Tailscale on GTS-SVR25 and/or SERVER
|
||||
- Install Tailscale on 3 workstations (W0, W1, W2)
|
||||
- Configure for RDP over VPN (addresses RDP security concern)
|
||||
- Test remote connectivity
|
||||
- Document Tailscale IPs and configuration
|
||||
|
||||
6. **Complete Gonzvar Setup Tasks**
|
||||
- Install QuickBooks on server (determine which: GTS-SVR25 or SERVER)
|
||||
- Configure RemoteApp for QB (local users + VPN access)
|
||||
- System cleanup on all 6 machines (disk cleanup, temp files, updates)
|
||||
- Document final baseline configuration
|
||||
|
||||
### Long-Term (Next Month)
|
||||
|
||||
7. **Probe Quality Assurance**
|
||||
- Add unit tests for probe script
|
||||
- Test against all supported OS versions
|
||||
- Review all Event ID queries for source filtering needs
|
||||
- Document Event ID meanings and sources
|
||||
- Add probe version to baseline metadata
|
||||
|
||||
8. **Fleet-Wide Standards Documentation**
|
||||
- Document baseline security configuration (firewall, RDP, BitLocker, tamper protection)
|
||||
- Create remediation playbooks for common findings
|
||||
- Automate fixes via RMM where possible (firewall enable, NLA enable, BitLocker enable)
|
||||
- Schedule quarterly re-diagnostics
|
||||
|
||||
9. **Baseline Re-Grading Feature**
|
||||
- Allow baselines to be re-graded with updated probe logic
|
||||
- Track probe version in baseline metadata
|
||||
- Show diff: "was RED with probe v1.0, now AMBER with probe v1.1"
|
||||
- Preserve historical baselines (immutable snapshots)
|
||||
|
||||
---
|
||||
|
||||
## Session Metadata
|
||||
|
||||
- **Duration:** ~4 hours (continuation of earlier Gemini CLI + Wolkin work)
|
||||
- **Mode:** Client (Gonzvar Tax Services)
|
||||
- **Primary tools:** RMM skill, Bash, coordination API, Read, Write, Edit
|
||||
- **RMM commands dispatched:** 8 (6 diagnostics + 1 investigation + 1 verification)
|
||||
- **Diagnostics completed:** 6 machines, all successful
|
||||
- **Critical bug discovered:** Event ID 153 false positive affecting all Windows 11 diagnostics
|
||||
- **False alarm corrected:** Drive replacement urgency removed, actual issues identified
|
||||
|
||||
---
|
||||
|
||||
**Session complete.** Gonzvar Tax Services fully onboarded in RMM, fleet baselined (with corrected assessment), critical diagnostic probe bug discovered and documented with fix, and comprehensive remediation plan established. Probe fix required before additional diagnostics.
|
||||
Reference in New Issue
Block a user