sync: auto-sync from HOWARD-HOME at 2026-07-19 13:56:33
Author: Howard Enos Machine: HOWARD-HOME Timestamp: 2026-07-19 13:56:33
This commit is contained in:
@@ -0,0 +1,131 @@
|
||||
# Prairie Schooner: Server Migration, QuickBooks Cutover, AD FSMO Transfer
|
||||
|
||||
## User
|
||||
- **User:** Howard Enos (howard)
|
||||
- **Machine:** Howard-Home
|
||||
- **Role:** tech
|
||||
|
||||
## Session Summary
|
||||
|
||||
Worked through the Prairie Schooner server migration project, covering three tracker issues: UDM Pro network swap (#83), QuickBooks Enterprise migration (#84), and AD FSMO role transfer (part of #82/#85). Verified the UDM Pro was online and healthy via Site Manager (899/38 Mbps, 0 loss), then closed issues #83 and #86 (DNS outage resolved by the swap).
|
||||
|
||||
Performed the QuickBooks Enterprise 24.0 migration from TPS-SERVER (192.168.1.125, WS2016 Essentials) to TPS-SVR (192.168.1.135, WS2019 Standard HPE ProLiant MicroServer Gen10 Plus v2). Ran final robocopy sync of 143GB QB data. Stopped QuickBooksDB34 on TPS-SERVER, started it on TPS-SVR (had to fix a logon failure by switching the service account from .\QBDataServiceUser34 to LocalSystem). The DBSM GUI on TPS-SVR was an old version (v18) that produced .ND files with IPv6 addresses; manually wrote the correct .ND files with ServerIp=192.168.1.135 and EngineName=QB_TPS-SVR_34.
|
||||
|
||||
Transferred all 5 FSMO roles from TPS-SERVER to TPS-SVR. Required adding guru to Schema Admins and Enterprise Admins groups first. Created a GPO "QB Drive Map - Q to TPS-SVR" with a Replace-action GPP drive map for Q: -> \\tps-svr\Quickbooks. The GPO creation via script failed initially (wrote Drives.xml to a bogus local path); fixed by writing Drives.xml to the correct SYSVOL path and bumping the GPO version.
|
||||
|
||||
Encountered persistent gpupdate user policy failures ("Windows could not determine if the user and computer accounts are in the same forest"). Root cause investigation revealed multiple compounding issues: (1) Mel-PC had static DNS pointing to TPS-SERVER only, (2) TPS-SERVER had 3 stale IPs on its NIC (192.168.1.120, .125, 10.10.10.5) polluting DNS, (3) TPS-SVR Windows Firewall Private/Public profiles were blocking AD traffic, (4) Netlogon firewall rule group was disabled on TPS-SVR, (5) no AD subnet existed for 192.168.1.0/24, (6) Mel-PC Netlogon service was stopped with Manual startup type after a restart. The final fix was setting Netlogon to Automatic and starting it on Mel-PC. All DC firewall rule groups were properly enabled on TPS-SVR with firewall on. Stopped KDC and Netlogon on TPS-SERVER to force workstation failover to TPS-SVR.
|
||||
|
||||
QuickBooks and Q: drive mapping confirmed working on Mel-PC (logged in as Erin). TPS-JAYMI and TPS-Tina verified to have Netlogon running/Automatic for Monday readiness.
|
||||
|
||||
## Key Decisions
|
||||
|
||||
- Manually wrote .ND files instead of relying on the DBSM GUI, which was an old v18 version producing IPv6 addresses even after disabling IPv6 on the NIC.
|
||||
- Changed QuickBooksDB34 service account from .\QBDataServiceUser34 to LocalSystem to resolve a logon failure on TPS-SVR.
|
||||
- Used GPP drive map with Replace action (not Update) to override existing per-user registry Q: drive mappings.
|
||||
- Stopped KDC and Netlogon on TPS-SERVER rather than demoting it immediately, to force workstations to failover to TPS-SVR while keeping DNS running as secondary.
|
||||
- Enabled all 16 DC firewall rule groups on TPS-SVR rather than disabling the firewall entirely.
|
||||
|
||||
## Problems Encountered
|
||||
|
||||
- **QuickBooksDB34 service logon failure on TPS-SVR:** The service was configured to run as .\QBDataServiceUser34 with an incorrect/missing password. Fixed by changing to LocalSystem via sc.exe config.
|
||||
- **DBSM v18 producing IPv6 .ND files:** The QuickBooks Database Server Manager in C:\Program Files\Common Files\Intuit\QuickBooks was version 18, not 34. It produced .ND files with ServerIp=::1 (IPv6 loopback) even after disabling IPv6. Resolved by manually writing correct .ND file content.
|
||||
- **GPO script wrote to wrong path:** The PowerShell GPO creation script failed because $gpo was null (GPO already existed from a prior attempt), causing Drives.xml to write to C:\TPS.local\... instead of the SYSVOL share. Fixed by writing directly to the known GPO GUID path in SYSVOL.
|
||||
- **FSMO transfer Access Denied:** guru account was in Domain Admins but not Schema Admins or Enterprise Admins. Added guru to both groups; required logoff/logon for new token.
|
||||
- **gpupdate user policy "same forest" failure:** Multiple compounding issues -- static DNS on Mel-PC NIC, stale IPs on TPS-SERVER polluting DNS A records, TPS-SVR firewall blocking RPC on Private/Public profiles, Netlogon firewall rules disabled on TPS-SVR, missing AD subnet for 192.168.1.0/24, and Mel-PC Netlogon service stopped with Manual startup. Each was fixed individually; the Netlogon service being stopped was the final blocker.
|
||||
- **Per-user drive maps not GPO-based:** Original assumption was GPP drive maps in Default Domain Policy. Actual state was per-user persistent registry maps (HKCU\Network\Q) pointing to \\tps-server\Quickbooks. Required loading unloaded user hives to discover.
|
||||
|
||||
## Configuration Changes
|
||||
|
||||
### TPS-SVR (192.168.1.135)
|
||||
- QuickBooksDB34 service: changed from .\QBDataServiceUser34 to LocalSystem, set to Automatic
|
||||
- FSMO roles: all 5 transferred from TPS-SERVER
|
||||
- guru added to Schema Admins and Enterprise Admins
|
||||
- GPO "QB Drive Map - Q to TPS-SVR" created (GUID: 26450217-4f5e-4857-be36-a165267aafa8)
|
||||
- Drives.xml written to SYSVOL with Q: -> \\tps-svr\Quickbooks (Replace action)
|
||||
- AD subnet 192.168.1.0/24 added to Default-First-Site-Name
|
||||
- All DC firewall rule groups enabled (Netlogon Service, Remote Event Log Management, Remote Scheduled Tasks Management, Remote Volume Management, Windows Defender Firewall Remote Management were disabled)
|
||||
- Firewall enabled on all profiles (Domain, Private, Public)
|
||||
- NIC DNS changed to 127.0.0.1, 192.168.1.125
|
||||
- IPv6 disabled on NIC
|
||||
- .ND files manually written: schoonerQB2025.QBW.ND and renamed.QBW.ND (ServerIp=192.168.1.135, EngineName=QB_TPS-SVR_34, ServerPort=64189)
|
||||
|
||||
### TPS-SERVER (192.168.1.125)
|
||||
- QuickBooksDB34: stopped and set to Disabled
|
||||
- KDC and Netlogon services: stopped (to force workstation failover)
|
||||
- Stale IPs removed: 10.10.10.5 and 192.168.1.120
|
||||
- NIC DNS changed to point to TPS-SVR (192.168.1.135) as primary
|
||||
- Stale DNS A records removed: tps-server 10.10.10.5 and 192.168.1.120, domain root @ 10.10.10.5 and 192.168.1.120
|
||||
|
||||
### Mel-PC (192.168.1.149)
|
||||
- Static DNS removed from NIC, set to DHCP auto
|
||||
- Netlogon service: set to Automatic startup, started
|
||||
|
||||
### UDM Pro (192.168.1.1)
|
||||
- DHCP DNS already configured correctly: 192.168.1.135 (primary), 192.168.1.125 (secondary)
|
||||
- Domain Name: tps.local
|
||||
|
||||
### Bug Tracker
|
||||
- Issue #83 (SonicWall/USG to UDM Pro): closed with verification comment
|
||||
- Issue #86 (DNS/web outage): closed as resolved by #83
|
||||
- Issue #82 (umbrella server migration): updated with status comment
|
||||
|
||||
## Credentials & Secrets
|
||||
|
||||
- **TPS\Administrator:** r3tr0gradE99# (from vault: clients/prairie-schooner/tps-administrator.sops.yaml)
|
||||
- **TPS\guru:** r3tr0gradE99! (from vault: clients/prairie-schooner/tps-domain-admin.sops.yaml)
|
||||
- **Tina's AD password:** unknown, not in vault. Password last set 10/26/2017. Howard requested it -- needs reset or recovery.
|
||||
|
||||
## Infrastructure & Servers
|
||||
|
||||
| Host | IP | OS | Role | Status |
|
||||
|------|----|----|------|--------|
|
||||
| TPS-SVR | 192.168.1.135 | WS2019 Standard | Primary DC, GC, DNS, FSMO holder, QB host | Active |
|
||||
| TPS-SERVER | 192.168.1.125 | WS2016 Essentials | Secondary DC (KDC/Netlogon stopped), DNS secondary | Pending decom |
|
||||
| Mel-PC | 192.168.1.149 | Win10 | Workstation (mel, erin) | Working |
|
||||
| TPS-JAYMI | 192.168.1.130 | Win10 | Workstation (jaymi) | Ready |
|
||||
| TPS-Tina | 192.168.1.139 | Win10 | Workstation (tina) | Ready |
|
||||
| UDM Pro | 192.168.1.1 | UniFi OS | Gateway, DHCP, DNS relay | Online, WAN 184.176.147.183 |
|
||||
| USW-16-PoE | 192.168.1.188 | UniFi | Switch | Online |
|
||||
|
||||
- Domain: TPS.local
|
||||
- DHCP range: 192.168.1.100 - 192.168.1.199
|
||||
- QB share: \\tps-svr\Quickbooks -> C:\Share\Quickbooks (142.95 GB)
|
||||
- QB company files: schoonerQB2025.QBW (current, 3.0 GB), renamed.QBW (archive, 2.9 GB)
|
||||
- GPO GUID: 26450217-4f5e-4857-be36-a165267aafa8
|
||||
|
||||
## Commands & Outputs
|
||||
|
||||
```powershell
|
||||
# FSMO transfer (on TPS-SVR as TPS\guru, elevated)
|
||||
Move-ADDirectoryServerOperationMasterRole -Identity "TPS-SVR" -OperationMasterRole SchemaMaster,DomainNamingMaster,PDCEmulator,RIDMaster,InfrastructureMaster -Force
|
||||
|
||||
# Verify FSMO
|
||||
netdom query fsmo
|
||||
# All 5 roles on TPS-SVR.TPS.local
|
||||
|
||||
# AD subnet creation
|
||||
New-ADReplicationSubnet -Name "192.168.1.0/24" -Site "Default-First-Site-Name"
|
||||
|
||||
# Fix Mel-PC Netlogon (the final fix for gpupdate)
|
||||
Set-Service Netlogon -StartupType Automatic
|
||||
Start-Service Netlogon
|
||||
nltest /dsgetdc:TPS.local /force # confirmed TPS-SVR found
|
||||
gpupdate /force # succeeded
|
||||
```
|
||||
|
||||
## Pending / Incomplete Tasks
|
||||
|
||||
- **Tina's password:** Howard requested it. Not in vault. Needs reset on TPS-SVR and vaulting.
|
||||
- **Issue #84 (QB migration):** Functionally complete but not yet closed in tracker. Need to verify on TPS-Tina and TPS-JAYMI Monday.
|
||||
- **Issue #85 (DC decommission):** Blocked until QB is confirmed stable. TPS-SERVER still running as secondary DC with KDC/Netlogon stopped. Full decom (dcpromo demotion, CA migration, DNS/AD cleanup) is next.
|
||||
- **TPS-SERVER has duplicate _ldap._tcp SRV record:** 3 entries (tps-server lowercase, TPS-SERVER uppercase, tps-svr). The duplicate TPS-SERVER entry should be cleaned.
|
||||
- **Mel-PC P: drive:** mel has P: mapped to \\Schoonerdc2\Quickbooks company file -- unknown what this server is. May need cleanup.
|
||||
- **QuickBooksDB34 service account on TPS-SVR:** Changed to LocalSystem as a quick fix. Should evaluate whether QBDataServiceUser34 should be properly configured with the correct password.
|
||||
- **Old QB backup folders:** C:\Share\Quickbooks has ~25 QBBackupTemp folders consuming significant space. Can be cleaned after migration is confirmed stable.
|
||||
|
||||
## Reference Information
|
||||
|
||||
- Site Manager console ID: E4388319DCF3000000000716C1DE00000000077029F700000000639C7A87:1980774344
|
||||
- RMM Agent IDs: Mel-PC=eb2f2aeb-f56e-4fc6-8e5a-73257b95e5f0, TPS-SVR=799675cf-5c94-465a-b653-63e08d016526, TPS-SERVER=4f8dff0c-b033-4f66-9101-9350e32e0a81, TPS-JAYMI=1fbf4e45-1b48-4c82-af85-847fc1344e12, TPS-Tina=c8d76770-dc9e-45b7-94c7-fdcab3e105a2
|
||||
- Tracker issues: #82 (server migration umbrella), #83 (network swap, CLOSED), #84 (QB migration), #85 (DC decom), #86 (DNS outage, CLOSED)
|
||||
- GPO path: \\TPS.local\SYSVOL\TPS.local\Policies\{26450217-4f5e-4857-be36-a165267aafa8}\User\Preferences\Drives\Drives.xml
|
||||
10
errorlog.md
10
errorlog.md
@@ -19,6 +19,16 @@ Categories (the `[type]` tag): _(none)_ = skill/command execution failure ·
|
||||
|
||||
<!-- Append entries below this line -->
|
||||
|
||||
2026-07-19 | Howard-Home | bug-tracker/prairie-schooner | [correction] assumed disabling Domain firewall profile was sufficient; Private/Public profiles were also blocking AD traffic because TPS-SVR NIC was classified as Private/Public instead of Domain [ctx: ref=prairie-schooner-migration]
|
||||
|
||||
2026-07-19 | Howard-Home | unifi-wifi/gw-sitemanager | Site Manager API call failed (HTTP 404) [ctx: path=/v1/connector/consoles/E4388319DCF3000000000716C1DE00000000077029F700000000639C7A87:1980774344/proxy/networkapi/s/default/rest/networkconf]
|
||||
|
||||
2026-07-19 | Howard-Home | unifi-wifi/gw-sitemanager | Site Manager API call failed (HTTP 404) [ctx: path=/v1/connector/consoles/E4388319DCF3000000000716C1DE00000000077029F700000000639C7A87:1980774344/proxy/network/rest/networkconf]
|
||||
|
||||
2026-07-19 | Howard-Home | unifi-wifi/gw-sitemanager | Site Manager API call failed (HTTP 404) [ctx: path=/v1/connector/consoles/E4388319DCF3000000000716C1DE00000000077029F700000000639C7A87:1980774344/proxy/networkrest/networkconf]
|
||||
|
||||
2026-07-19 | Howard-Home | bug-tracker | [correction] forgot to update tracker issue #13 when committing the fix -- user had to remind [ctx: ref=feedback_tracker_discipline]
|
||||
|
||||
2026-07-19 | Howard-Home | msp360/backups | [correction] 2026-07-15 correction reversed: LAB-SVR is the CURRENT Len's Auto server (replacement FOR LAB-SERVER); it was merely powered off — Howard powered it on onsite 2026-07-18
|
||||
|
||||
2026-07-18 | Howard-Home | bug-tracker | [correction] 12 closed gururmm issues had zero fix comments — fixes were committed but tracker was never updated [ctx: ref=feedback_tracker_discipline]
|
||||
|
||||
Reference in New Issue
Block a user