azcomputerguru/claudetools
1
0
Fork 0
Code Issues 59 Pull Requests Actions Packages Projects Releases Wiki Activity

sync: auto-sync from HOWARD-HOME at 2026-07-19 13:56:33

Browse Source 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-19 13:56:33
This commit is contained in:
Howard Enos
2026-07-19 13:57:01 -07:00
parent b57f098487
commit 362da2183c
2 changed files with 141 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

131
clients/prairie-schooner/session-logs/2026-07/2026-07-19-howard-server-migration-qb-ad.md Normal file
View File

@@ -0,0 +1,131 @@
# Prairie Schooner: Server Migration, QuickBooks Cutover, AD FSMO Transfer
## User
- **User:** Howard Enos (howard)
- **Machine:** Howard-Home
- **Role:** tech
## Session Summary
Worked through the Prairie Schooner server migration project, covering three tracker issues: UDM Pro network swap (#83), QuickBooks Enterprise migration (#84), and AD FSMO role transfer (part of #82/#85). Verified the UDM Pro was online and healthy via Site Manager (899/38 Mbps, 0 loss), then closed issues #83 and #86 (DNS outage resolved by the swap).
Performed the QuickBooks Enterprise 24.0 migration from TPS-SERVER (192.168.1.125, WS2016 Essentials) to TPS-SVR (192.168.1.135, WS2019 Standard HPE ProLiant MicroServer Gen10 Plus v2). Ran final robocopy sync of 143GB QB data. Stopped QuickBooksDB34 on TPS-SERVER, started it on TPS-SVR (had to fix a logon failure by switching the service account from .\QBDataServiceUser34 to LocalSystem). The DBSM GUI on TPS-SVR was an old version (v18) that produced .ND files with IPv6 addresses; manually wrote the correct .ND files with ServerIp=192.168.1.135 and EngineName=QB_TPS-SVR_34.
Transferred all 5 FSMO roles from TPS-SERVER to TPS-SVR. Required adding guru to Schema Admins and Enterprise Admins groups first. Created a GPO "QB Drive Map - Q to TPS-SVR" with a Replace-action GPP drive map for Q: -> \\tps-svr\Quickbooks. The GPO creation via script failed initially (wrote Drives.xml to a bogus local path); fixed by writing Drives.xml to the correct SYSVOL path and bumping the GPO version.
Encountered persistent gpupdate user policy failures ("Windows could not determine if the user and computer accounts are in the same forest"). Root cause investigation revealed multiple compounding issues: (1) Mel-PC had static DNS pointing to TPS-SERVER only, (2) TPS-SERVER had 3 stale IPs on its NIC (192.168.1.120, .125, 10.10.10.5) polluting DNS, (3) TPS-SVR Windows Firewall Private/Public profiles were blocking AD traffic, (4) Netlogon firewall rule group was disabled on TPS-SVR, (5) no AD subnet existed for 192.168.1.0/24, (6) Mel-PC Netlogon service was stopped with Manual startup type after a restart. The final fix was setting Netlogon to Automatic and starting it on Mel-PC. All DC firewall rule groups were properly enabled on TPS-SVR with firewall on. Stopped KDC and Netlogon on TPS-SERVER to force workstation failover to TPS-SVR.
QuickBooks and Q: drive mapping confirmed working on Mel-PC (logged in as Erin). TPS-JAYMI and TPS-Tina verified to have Netlogon running/Automatic for Monday readiness.
## Key Decisions
- Manually wrote .ND files instead of relying on the DBSM GUI, which was an old v18 version producing IPv6 addresses even after disabling IPv6 on the NIC.
- Changed QuickBooksDB34 service account from .\QBDataServiceUser34 to LocalSystem to resolve a logon failure on TPS-SVR.
- Used GPP drive map with Replace action (not Update) to override existing per-user registry Q: drive mappings.
- Stopped KDC and Netlogon on TPS-SERVER rather than demoting it immediately, to force workstations to failover to TPS-SVR while keeping DNS running as secondary.
- Enabled all 16 DC firewall rule groups on TPS-SVR rather than disabling the firewall entirely.
## Problems Encountered
- **QuickBooksDB34 service logon failure on TPS-SVR:** The service was configured to run as .\QBDataServiceUser34 with an incorrect/missing password. Fixed by changing to LocalSystem via sc.exe config.
- **DBSM v18 producing IPv6 .ND files:** The QuickBooks Database Server Manager in C:\Program Files\Common Files\Intuit\QuickBooks was version 18, not 34. It produced .ND files with ServerIp=::1 (IPv6 loopback) even after disabling IPv6. Resolved by manually writing correct .ND file content.
- **GPO script wrote to wrong path:** The PowerShell GPO creation script failed because $gpo was null (GPO already existed from a prior attempt), causing Drives.xml to write to C:\TPS.local\... instead of the SYSVOL share. Fixed by writing directly to the known GPO GUID path in SYSVOL.
- **FSMO transfer Access Denied:** guru account was in Domain Admins but not Schema Admins or Enterprise Admins. Added guru to both groups; required logoff/logon for new token.
- **gpupdate user policy "same forest" failure:** Multiple compounding issues -- static DNS on Mel-PC NIC, stale IPs on TPS-SERVER polluting DNS A records, TPS-SVR firewall blocking RPC on Private/Public profiles, Netlogon firewall rules disabled on TPS-SVR, missing AD subnet for 192.168.1.0/24, and Mel-PC Netlogon service stopped with Manual startup. Each was fixed individually; the Netlogon service being stopped was the final blocker.
- **Per-user drive maps not GPO-based:** Original assumption was GPP drive maps in Default Domain Policy. Actual state was per-user persistent registry maps (HKCU\Network\Q) pointing to \\tps-server\Quickbooks. Required loading unloaded user hives to discover.
## Configuration Changes
### TPS-SVR (192.168.1.135)
- QuickBooksDB34 service: changed from .\QBDataServiceUser34 to LocalSystem, set to Automatic
- FSMO roles: all 5 transferred from TPS-SERVER
- guru added to Schema Admins and Enterprise Admins
- GPO "QB Drive Map - Q to TPS-SVR" created (GUID: 26450217-4f5e-4857-be36-a165267aafa8)
- Drives.xml written to SYSVOL with Q: -> \\tps-svr\Quickbooks (Replace action)
- AD subnet 192.168.1.0/24 added to Default-First-Site-Name
- All DC firewall rule groups enabled (Netlogon Service, Remote Event Log Management, Remote Scheduled Tasks Management, Remote Volume Management, Windows Defender Firewall Remote Management were disabled)
- Firewall enabled on all profiles (Domain, Private, Public)
- NIC DNS changed to 127.0.0.1, 192.168.1.125
- IPv6 disabled on NIC
- .ND files manually written: schoonerQB2025.QBW.ND and renamed.QBW.ND (ServerIp=192.168.1.135, EngineName=QB_TPS-SVR_34, ServerPort=64189)
### TPS-SERVER (192.168.1.125)
- QuickBooksDB34: stopped and set to Disabled
- KDC and Netlogon services: stopped (to force workstation failover)
- Stale IPs removed: 10.10.10.5 and 192.168.1.120
- NIC DNS changed to point to TPS-SVR (192.168.1.135) as primary
- Stale DNS A records removed: tps-server 10.10.10.5 and 192.168.1.120, domain root @ 10.10.10.5 and 192.168.1.120
### Mel-PC (192.168.1.149)
- Static DNS removed from NIC, set to DHCP auto
- Netlogon service: set to Automatic startup, started
### UDM Pro (192.168.1.1)
- DHCP DNS already configured correctly: 192.168.1.135 (primary), 192.168.1.125 (secondary)
- Domain Name: tps.local
### Bug Tracker
- Issue #83 (SonicWall/USG to UDM Pro): closed with verification comment
- Issue #86 (DNS/web outage): closed as resolved by #83
- Issue #82 (umbrella server migration): updated with status comment
## Credentials & Secrets
- **TPS\Administrator:** r3tr0gradE99# (from vault: clients/prairie-schooner/tps-administrator.sops.yaml)
- **TPS\guru:** r3tr0gradE99! (from vault: clients/prairie-schooner/tps-domain-admin.sops.yaml)
- **Tina's AD password:** unknown, not in vault. Password last set 10/26/2017. Howard requested it -- needs reset or recovery.
## Infrastructure & Servers
| Host | IP | OS | Role | Status |
|------|----|----|------|--------|
| TPS-SVR | 192.168.1.135 | WS2019 Standard | Primary DC, GC, DNS, FSMO holder, QB host | Active |
| TPS-SERVER | 192.168.1.125 | WS2016 Essentials | Secondary DC (KDC/Netlogon stopped), DNS secondary | Pending decom |
| Mel-PC | 192.168.1.149 | Win10 | Workstation (mel, erin) | Working |
| TPS-JAYMI | 192.168.1.130 | Win10 | Workstation (jaymi) | Ready |
| TPS-Tina | 192.168.1.139 | Win10 | Workstation (tina) | Ready |
| UDM Pro | 192.168.1.1 | UniFi OS | Gateway, DHCP, DNS relay | Online, WAN 184.176.147.183 |
| USW-16-PoE | 192.168.1.188 | UniFi | Switch | Online |
- Domain: TPS.local
- DHCP range: 192.168.1.100 - 192.168.1.199
- QB share: \\tps-svr\Quickbooks -> C:\Share\Quickbooks (142.95 GB)
- QB company files: schoonerQB2025.QBW (current, 3.0 GB), renamed.QBW (archive, 2.9 GB)
- GPO GUID: 26450217-4f5e-4857-be36-a165267aafa8
## Commands & Outputs
```powershell
# FSMO transfer (on TPS-SVR as TPS\guru, elevated)
Move-ADDirectoryServerOperationMasterRole -Identity "TPS-SVR" -OperationMasterRole SchemaMaster,DomainNamingMaster,PDCEmulator,RIDMaster,InfrastructureMaster -Force
# Verify FSMO
netdom query fsmo
# All 5 roles on TPS-SVR.TPS.local
# AD subnet creation
New-ADReplicationSubnet -Name "192.168.1.0/24" -Site "Default-First-Site-Name"
# Fix Mel-PC Netlogon (the final fix for gpupdate)
Set-Service Netlogon -StartupType Automatic
Start-Service Netlogon
nltest /dsgetdc:TPS.local /force # confirmed TPS-SVR found
gpupdate /force # succeeded
```
## Pending / Incomplete Tasks
- **Tina's password:** Howard requested it. Not in vault. Needs reset on TPS-SVR and vaulting.
- **Issue #84 (QB migration):** Functionally complete but not yet closed in tracker. Need to verify on TPS-Tina and TPS-JAYMI Monday.
- **Issue #85 (DC decommission):** Blocked until QB is confirmed stable. TPS-SERVER still running as secondary DC with KDC/Netlogon stopped. Full decom (dcpromo demotion, CA migration, DNS/AD cleanup) is next.
- **TPS-SERVER has duplicate _ldap._tcp SRV record:** 3 entries (tps-server lowercase, TPS-SERVER uppercase, tps-svr). The duplicate TPS-SERVER entry should be cleaned.
- **Mel-PC P: drive:** mel has P: mapped to \\Schoonerdc2\Quickbooks company file -- unknown what this server is. May need cleanup.
- **QuickBooksDB34 service account on TPS-SVR:** Changed to LocalSystem as a quick fix. Should evaluate whether QBDataServiceUser34 should be properly configured with the correct password.
- **Old QB backup folders:** C:\Share\Quickbooks has ~25 QBBackupTemp folders consuming significant space. Can be cleaned after migration is confirmed stable.
## Reference Information
- Site Manager console ID: E4388319DCF3000000000716C1DE00000000077029F700000000639C7A87:1980774344
- RMM Agent IDs: Mel-PC=eb2f2aeb-f56e-4fc6-8e5a-73257b95e5f0, TPS-SVR=799675cf-5c94-465a-b653-63e08d016526, TPS-SERVER=4f8dff0c-b033-4f66-9101-9350e32e0a81, TPS-JAYMI=1fbf4e45-1b48-4c82-af85-847fc1344e12, TPS-Tina=c8d76770-dc9e-45b7-94c7-fdcab3e105a2
- Tracker issues: #82 (server migration umbrella), #83 (network swap, CLOSED), #84 (QB migration), #85 (DC decom), #86 (DNS outage, CLOSED)
- GPO path: \\TPS.local\SYSVOL\TPS.local\Policies\{26450217-4f5e-4857-be36-a165267aafa8}\User\Preferences\Drives\Drives.xml

10
errorlog.md
View File

@@ -19,6 +19,16 @@ Categories (the `[type]` tag): _(none)_ = skill/command execution failure ·
<!-- Append entries below this line --> <!-- Append entries below this line -->
2026-07-19 | Howard-Home | bug-tracker/prairie-schooner | [correction] assumed disabling Domain firewall profile was sufficient; Private/Public profiles were also blocking AD traffic because TPS-SVR NIC was classified as Private/Public instead of Domain [ctx: ref=prairie-schooner-migration]
2026-07-19 | Howard-Home | unifi-wifi/gw-sitemanager | Site Manager API call failed (HTTP 404) [ctx: path=/v1/connector/consoles/E4388319DCF3000000000716C1DE00000000077029F700000000639C7A87:1980774344/proxy/networkapi/s/default/rest/networkconf]
2026-07-19 | Howard-Home | unifi-wifi/gw-sitemanager | Site Manager API call failed (HTTP 404) [ctx: path=/v1/connector/consoles/E4388319DCF3000000000716C1DE00000000077029F700000000639C7A87:1980774344/proxy/network/rest/networkconf]
2026-07-19 | Howard-Home | unifi-wifi/gw-sitemanager | Site Manager API call failed (HTTP 404) [ctx: path=/v1/connector/consoles/E4388319DCF3000000000716C1DE00000000077029F700000000639C7A87:1980774344/proxy/networkrest/networkconf]
2026-07-19 | Howard-Home | bug-tracker | [correction] forgot to update tracker issue #13 when committing the fix -- user had to remind [ctx: ref=feedback_tracker_discipline]
2026-07-19 | Howard-Home | msp360/backups | [correction] 2026-07-15 correction reversed: LAB-SVR is the CURRENT Len's Auto server (replacement FOR LAB-SERVER); it was merely powered off — Howard powered it on onsite 2026-07-18 2026-07-19 | Howard-Home | msp360/backups | [correction] 2026-07-15 correction reversed: LAB-SVR is the CURRENT Len's Auto server (replacement FOR LAB-SERVER); it was merely powered off — Howard powered it on onsite 2026-07-18
2026-07-18 | Howard-Home | bug-tracker | [correction] 12 closed gururmm issues had zero fix comments — fixes were committed but tracker was never updated [ctx: ref=feedback_tracker_discipline] 2026-07-18 | Howard-Home | bug-tracker | [correction] 12 closed gururmm issues had zero fix comments — fixes were committed but tracker was never updated [ctx: ref=feedback_tracker_discipline]