diff --git a/clients/prairie-schooner/session-logs/2026-07/2026-07-19-howard-server-migration-qb-ad.md b/clients/prairie-schooner/session-logs/2026-07/2026-07-19-howard-server-migration-qb-ad.md new file mode 100644 index 00000000..6cda36d0 --- /dev/null +++ b/clients/prairie-schooner/session-logs/2026-07/2026-07-19-howard-server-migration-qb-ad.md @@ -0,0 +1,131 @@ +# Prairie Schooner: Server Migration, QuickBooks Cutover, AD FSMO Transfer + +## User +- **User:** Howard Enos (howard) +- **Machine:** Howard-Home +- **Role:** tech + +## Session Summary + +Worked through the Prairie Schooner server migration project, covering three tracker issues: UDM Pro network swap (#83), QuickBooks Enterprise migration (#84), and AD FSMO role transfer (part of #82/#85). Verified the UDM Pro was online and healthy via Site Manager (899/38 Mbps, 0 loss), then closed issues #83 and #86 (DNS outage resolved by the swap). + +Performed the QuickBooks Enterprise 24.0 migration from TPS-SERVER (192.168.1.125, WS2016 Essentials) to TPS-SVR (192.168.1.135, WS2019 Standard HPE ProLiant MicroServer Gen10 Plus v2). Ran final robocopy sync of 143GB QB data. Stopped QuickBooksDB34 on TPS-SERVER, started it on TPS-SVR (had to fix a logon failure by switching the service account from .\QBDataServiceUser34 to LocalSystem). The DBSM GUI on TPS-SVR was an old version (v18) that produced .ND files with IPv6 addresses; manually wrote the correct .ND files with ServerIp=192.168.1.135 and EngineName=QB_TPS-SVR_34. + +Transferred all 5 FSMO roles from TPS-SERVER to TPS-SVR. Required adding guru to Schema Admins and Enterprise Admins groups first. Created a GPO "QB Drive Map - Q to TPS-SVR" with a Replace-action GPP drive map for Q: -> \\tps-svr\Quickbooks. The GPO creation via script failed initially (wrote Drives.xml to a bogus local path); fixed by writing Drives.xml to the correct SYSVOL path and bumping the GPO version. + +Encountered persistent gpupdate user policy failures ("Windows could not determine if the user and computer accounts are in the same forest"). Root cause investigation revealed multiple compounding issues: (1) Mel-PC had static DNS pointing to TPS-SERVER only, (2) TPS-SERVER had 3 stale IPs on its NIC (192.168.1.120, .125, 10.10.10.5) polluting DNS, (3) TPS-SVR Windows Firewall Private/Public profiles were blocking AD traffic, (4) Netlogon firewall rule group was disabled on TPS-SVR, (5) no AD subnet existed for 192.168.1.0/24, (6) Mel-PC Netlogon service was stopped with Manual startup type after a restart. The final fix was setting Netlogon to Automatic and starting it on Mel-PC. All DC firewall rule groups were properly enabled on TPS-SVR with firewall on. Stopped KDC and Netlogon on TPS-SERVER to force workstation failover to TPS-SVR. + +QuickBooks and Q: drive mapping confirmed working on Mel-PC (logged in as Erin). TPS-JAYMI and TPS-Tina verified to have Netlogon running/Automatic for Monday readiness. + +## Key Decisions + +- Manually wrote .ND files instead of relying on the DBSM GUI, which was an old v18 version producing IPv6 addresses even after disabling IPv6 on the NIC. +- Changed QuickBooksDB34 service account from .\QBDataServiceUser34 to LocalSystem to resolve a logon failure on TPS-SVR. +- Used GPP drive map with Replace action (not Update) to override existing per-user registry Q: drive mappings. +- Stopped KDC and Netlogon on TPS-SERVER rather than demoting it immediately, to force workstations to failover to TPS-SVR while keeping DNS running as secondary. +- Enabled all 16 DC firewall rule groups on TPS-SVR rather than disabling the firewall entirely. + +## Problems Encountered + +- **QuickBooksDB34 service logon failure on TPS-SVR:** The service was configured to run as .\QBDataServiceUser34 with an incorrect/missing password. Fixed by changing to LocalSystem via sc.exe config. +- **DBSM v18 producing IPv6 .ND files:** The QuickBooks Database Server Manager in C:\Program Files\Common Files\Intuit\QuickBooks was version 18, not 34. It produced .ND files with ServerIp=::1 (IPv6 loopback) even after disabling IPv6. Resolved by manually writing correct .ND file content. +- **GPO script wrote to wrong path:** The PowerShell GPO creation script failed because $gpo was null (GPO already existed from a prior attempt), causing Drives.xml to write to C:\TPS.local\... instead of the SYSVOL share. Fixed by writing directly to the known GPO GUID path in SYSVOL. +- **FSMO transfer Access Denied:** guru account was in Domain Admins but not Schema Admins or Enterprise Admins. Added guru to both groups; required logoff/logon for new token. +- **gpupdate user policy "same forest" failure:** Multiple compounding issues -- static DNS on Mel-PC NIC, stale IPs on TPS-SERVER polluting DNS A records, TPS-SVR firewall blocking RPC on Private/Public profiles, Netlogon firewall rules disabled on TPS-SVR, missing AD subnet for 192.168.1.0/24, and Mel-PC Netlogon service stopped with Manual startup. Each was fixed individually; the Netlogon service being stopped was the final blocker. +- **Per-user drive maps not GPO-based:** Original assumption was GPP drive maps in Default Domain Policy. Actual state was per-user persistent registry maps (HKCU\Network\Q) pointing to \\tps-server\Quickbooks. Required loading unloaded user hives to discover. + +## Configuration Changes + +### TPS-SVR (192.168.1.135) +- QuickBooksDB34 service: changed from .\QBDataServiceUser34 to LocalSystem, set to Automatic +- FSMO roles: all 5 transferred from TPS-SERVER +- guru added to Schema Admins and Enterprise Admins +- GPO "QB Drive Map - Q to TPS-SVR" created (GUID: 26450217-4f5e-4857-be36-a165267aafa8) +- Drives.xml written to SYSVOL with Q: -> \\tps-svr\Quickbooks (Replace action) +- AD subnet 192.168.1.0/24 added to Default-First-Site-Name +- All DC firewall rule groups enabled (Netlogon Service, Remote Event Log Management, Remote Scheduled Tasks Management, Remote Volume Management, Windows Defender Firewall Remote Management were disabled) +- Firewall enabled on all profiles (Domain, Private, Public) +- NIC DNS changed to 127.0.0.1, 192.168.1.125 +- IPv6 disabled on NIC +- .ND files manually written: schoonerQB2025.QBW.ND and renamed.QBW.ND (ServerIp=192.168.1.135, EngineName=QB_TPS-SVR_34, ServerPort=64189) + +### TPS-SERVER (192.168.1.125) +- QuickBooksDB34: stopped and set to Disabled +- KDC and Netlogon services: stopped (to force workstation failover) +- Stale IPs removed: 10.10.10.5 and 192.168.1.120 +- NIC DNS changed to point to TPS-SVR (192.168.1.135) as primary +- Stale DNS A records removed: tps-server 10.10.10.5 and 192.168.1.120, domain root @ 10.10.10.5 and 192.168.1.120 + +### Mel-PC (192.168.1.149) +- Static DNS removed from NIC, set to DHCP auto +- Netlogon service: set to Automatic startup, started + +### UDM Pro (192.168.1.1) +- DHCP DNS already configured correctly: 192.168.1.135 (primary), 192.168.1.125 (secondary) +- Domain Name: tps.local + +### Bug Tracker +- Issue #83 (SonicWall/USG to UDM Pro): closed with verification comment +- Issue #86 (DNS/web outage): closed as resolved by #83 +- Issue #82 (umbrella server migration): updated with status comment + +## Credentials & Secrets + +- **TPS\Administrator:** r3tr0gradE99# (from vault: clients/prairie-schooner/tps-administrator.sops.yaml) +- **TPS\guru:** r3tr0gradE99! (from vault: clients/prairie-schooner/tps-domain-admin.sops.yaml) +- **Tina's AD password:** unknown, not in vault. Password last set 10/26/2017. Howard requested it -- needs reset or recovery. + +## Infrastructure & Servers + +| Host | IP | OS | Role | Status | +|------|----|----|------|--------| +| TPS-SVR | 192.168.1.135 | WS2019 Standard | Primary DC, GC, DNS, FSMO holder, QB host | Active | +| TPS-SERVER | 192.168.1.125 | WS2016 Essentials | Secondary DC (KDC/Netlogon stopped), DNS secondary | Pending decom | +| Mel-PC | 192.168.1.149 | Win10 | Workstation (mel, erin) | Working | +| TPS-JAYMI | 192.168.1.130 | Win10 | Workstation (jaymi) | Ready | +| TPS-Tina | 192.168.1.139 | Win10 | Workstation (tina) | Ready | +| UDM Pro | 192.168.1.1 | UniFi OS | Gateway, DHCP, DNS relay | Online, WAN 184.176.147.183 | +| USW-16-PoE | 192.168.1.188 | UniFi | Switch | Online | + +- Domain: TPS.local +- DHCP range: 192.168.1.100 - 192.168.1.199 +- QB share: \\tps-svr\Quickbooks -> C:\Share\Quickbooks (142.95 GB) +- QB company files: schoonerQB2025.QBW (current, 3.0 GB), renamed.QBW (archive, 2.9 GB) +- GPO GUID: 26450217-4f5e-4857-be36-a165267aafa8 + +## Commands & Outputs + +```powershell +# FSMO transfer (on TPS-SVR as TPS\guru, elevated) +Move-ADDirectoryServerOperationMasterRole -Identity "TPS-SVR" -OperationMasterRole SchemaMaster,DomainNamingMaster,PDCEmulator,RIDMaster,InfrastructureMaster -Force + +# Verify FSMO +netdom query fsmo +# All 5 roles on TPS-SVR.TPS.local + +# AD subnet creation +New-ADReplicationSubnet -Name "192.168.1.0/24" -Site "Default-First-Site-Name" + +# Fix Mel-PC Netlogon (the final fix for gpupdate) +Set-Service Netlogon -StartupType Automatic +Start-Service Netlogon +nltest /dsgetdc:TPS.local /force # confirmed TPS-SVR found +gpupdate /force # succeeded +``` + +## Pending / Incomplete Tasks + +- **Tina's password:** Howard requested it. Not in vault. Needs reset on TPS-SVR and vaulting. +- **Issue #84 (QB migration):** Functionally complete but not yet closed in tracker. Need to verify on TPS-Tina and TPS-JAYMI Monday. +- **Issue #85 (DC decommission):** Blocked until QB is confirmed stable. TPS-SERVER still running as secondary DC with KDC/Netlogon stopped. Full decom (dcpromo demotion, CA migration, DNS/AD cleanup) is next. +- **TPS-SERVER has duplicate _ldap._tcp SRV record:** 3 entries (tps-server lowercase, TPS-SERVER uppercase, tps-svr). The duplicate TPS-SERVER entry should be cleaned. +- **Mel-PC P: drive:** mel has P: mapped to \\Schoonerdc2\Quickbooks company file -- unknown what this server is. May need cleanup. +- **QuickBooksDB34 service account on TPS-SVR:** Changed to LocalSystem as a quick fix. Should evaluate whether QBDataServiceUser34 should be properly configured with the correct password. +- **Old QB backup folders:** C:\Share\Quickbooks has ~25 QBBackupTemp folders consuming significant space. Can be cleaned after migration is confirmed stable. + +## Reference Information + +- Site Manager console ID: E4388319DCF3000000000716C1DE00000000077029F700000000639C7A87:1980774344 +- RMM Agent IDs: Mel-PC=eb2f2aeb-f56e-4fc6-8e5a-73257b95e5f0, TPS-SVR=799675cf-5c94-465a-b653-63e08d016526, TPS-SERVER=4f8dff0c-b033-4f66-9101-9350e32e0a81, TPS-JAYMI=1fbf4e45-1b48-4c82-af85-847fc1344e12, TPS-Tina=c8d76770-dc9e-45b7-94c7-fdcab3e105a2 +- Tracker issues: #82 (server migration umbrella), #83 (network swap, CLOSED), #84 (QB migration), #85 (DC decom), #86 (DNS outage, CLOSED) +- GPO path: \\TPS.local\SYSVOL\TPS.local\Policies\{26450217-4f5e-4857-be36-a165267aafa8}\User\Preferences\Drives\Drives.xml diff --git a/errorlog.md b/errorlog.md index 812f39d1..5b40a751 100644 --- a/errorlog.md +++ b/errorlog.md @@ -19,6 +19,16 @@ Categories (the `[type]` tag): _(none)_ = skill/command execution failure · +2026-07-19 | Howard-Home | bug-tracker/prairie-schooner | [correction] assumed disabling Domain firewall profile was sufficient; Private/Public profiles were also blocking AD traffic because TPS-SVR NIC was classified as Private/Public instead of Domain [ctx: ref=prairie-schooner-migration] + +2026-07-19 | Howard-Home | unifi-wifi/gw-sitemanager | Site Manager API call failed (HTTP 404) [ctx: path=/v1/connector/consoles/E4388319DCF3000000000716C1DE00000000077029F700000000639C7A87:1980774344/proxy/networkapi/s/default/rest/networkconf] + +2026-07-19 | Howard-Home | unifi-wifi/gw-sitemanager | Site Manager API call failed (HTTP 404) [ctx: path=/v1/connector/consoles/E4388319DCF3000000000716C1DE00000000077029F700000000639C7A87:1980774344/proxy/network/rest/networkconf] + +2026-07-19 | Howard-Home | unifi-wifi/gw-sitemanager | Site Manager API call failed (HTTP 404) [ctx: path=/v1/connector/consoles/E4388319DCF3000000000716C1DE00000000077029F700000000639C7A87:1980774344/proxy/networkrest/networkconf] + +2026-07-19 | Howard-Home | bug-tracker | [correction] forgot to update tracker issue #13 when committing the fix -- user had to remind [ctx: ref=feedback_tracker_discipline] + 2026-07-19 | Howard-Home | msp360/backups | [correction] 2026-07-15 correction reversed: LAB-SVR is the CURRENT Len's Auto server (replacement FOR LAB-SERVER); it was merely powered off — Howard powered it on onsite 2026-07-18 2026-07-18 | Howard-Home | bug-tracker | [correction] 12 closed gururmm issues had zero fix comments — fixes were committed but tracker was never updated [ctx: ref=feedback_tracker_discipline]