sync: auto-sync from HOWARD-HOME at 2026-06-25 11:42:29

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-06-25 11:42:29

clients/cascades-tucson/docs/REMAINING-WORK-PLAN.md

@@ -84,7 +84,11 @@ retire per-PC Synology Drive Client.
 **Prep blockers / decisions (2026-06-24):**
 - **5 machines on Windows Home cannot domain-join** until upgraded to Pro (need license keys):
   LAPTOP-8P7HDSEI, MDIRECTOR-PC, MEMRECEPT-PC, NurseAssist, SALES4-PC. **Howard handling the
-  Home->Pro upgrades himself** (list DM'd 2026-06-24).
+  Home->Pro upgrades himself, ONSITE** (decision 2026-06-25).
+  - *2026-06-25 live re-check: the 6PM cron `ad0a56a9` never completed — all 5 still `EditionID=Core`
+    (Home), Licensed on Home keys, none half-upgraded. Remote job abandoned; Howard doing them onsite.
+    Next step for these 5 = domain-join once they read `EditionID=Professional`. ProductName reads
+    "Windows 10 Home" even on the Win11 boxes (stale registry string) — trust EditionID, not ProductName.*
 - **OneDrive KFM ON** (unlink before folder-redirect GPO): LAPTOP-8P7HDSEI, NurseAssist.
 - **Pending reboots + KFM unlinks: held for onsite** (Howard) — disruptive to clear remotely.
 - **LAPTOP-DRQ5L558** is off the Cascades network (8.8.8.8/1.1.1.1 DNS, no DC reachability) —

clients/cascades-tucson/docs/migration/share-group-roster-proposed-2026-06-25.md

@@ -0,0 +1,130 @@
+# CS-SERVER Share Group Roster — PROPOSED (for review)
+
+> **Built 2026-06-25 (Howard)** by inverting `share-access-matrix-2026-04-23.md` onto the
+> **live** `SG-*` groups on CS-SERVER. **Nothing assigned yet** — every `SG-*-RW` group is
+> currently EMPTY. This is the worksheet to walk through and confirm "the right people"
+> before we populate the groups. Tick/strike names as we go.
+>
+> Legend: **[OPEN]** = matrix left this person's scope unresolved · *(leaving)* = exclude ·
+> *(no AD acct yet)* = create account first · **[VERIFY AD]** = confirm a domain account exists.
+
+---
+
+## Live state snapshot (2026-06-25)
+
+- **All access groups exist but are EMPTY:** `SG-Management-RW`, `SG-Mgmt-RW` (dup),
+  `SG-Sales-RW`, `SG-Sales-RO`, `SG-Server-RW`, `SG-Directory-RW`, `SG-Receptionist-RW`,
+  `SG-Culinary-RW`, `SG-Activities-RW`, `SG-IT-RW`, `SG-Chat-RW` (retired share).
+- **Populated (not part of this pass):** `SG-Caregivers` (38), `SG-FolderRedirect` (8),
+  `SG-FrontDesk` (1), `SG-Reception-PCs` (1 = RECEPTIONIST-PC), `SG-PC-MainTower` (1 = NURSESTATION-PC).
+- **Data shares present:** Accounting, Activities, Culinary, directoryshare, Executive, IT,
+  Management, Receptionist, Sales, SalesDept, Server, homes.
+- **Missing vs matrix:** no **ALdocs** / **WebDocs** share or group; no **Clinical/PHI** share
+  (pending Meredith); `SG-Office-PHI-Internal/-External` exist empty.
+
+---
+
+## Per-group proposed rosters
+
+### `SG-Management-RW`  →  `\\CS-SERVER\Management`
+**RW:** Meredith Kuhn, Ashley Jensen, Lauren Hasselman, Allison Reibschied, Megan Hiatt,
+Crystal Rodriguez, Veronica Feller, Shelby Trozzi, Christina DuPras  ·  ~~Tamra Matthews~~ *(leaving)*
+**RO (read-only):** Lois Lane, Christine Nyanzunda **[OPEN]**, Susan Hicks **[OPEN]**, John Trozzi, Lupe Sanchez **[OPEN]**
+> No `SG-Management-RO` group exists — RO members need either a new RO group or a direct NTFS read ACL. **Decision needed.**
+
+### `SG-Sales-RW`  →  `\\CS-SERVER\Sales` / `SalesDept`
+**RW:** Meredith Kuhn, Ashley Jensen, Lauren Hasselman, Megan Hiatt, Crystal Rodriguez  ·  ~~Tamra Matthews~~ *(leaving)*
+**RO (`SG-Sales-RO`):** Shelby Trozzi
+> **Two shares exist — `Sales` and `SalesDept`.** SalesDept holds the real history (2014–2026 reports, marketing). Confirm which the group maps to (or both), and what `Sales` is for.
+
+### `SG-ALdocs-RW`  →  `\\CS-SERVER\ALdocs`  *(share + group NOT created yet)*
+**RW:** Lois Lane, Karen Rossini, Meredith Kuhn, Ashley Jensen, Megan Hiatt, Crystal Rodriguez  ·  ~~Tamra Matthews~~ *(leaving)*
+> Must create the share + `SG-ALdocs-RW` group before assigning. Nurses (Lois/Karen) + Exec tier + Sales team.
+
+### `SG-WebDocs-RW`  →  `\\CS-SERVER\WebDocs`  *(share + group NOT created yet)*
+**RW:** Megan Hiatt, Crystal Rodriguez, Meredith Kuhn, Ashley Jensen  ·  ~~Tamra Matthews~~ *(leaving)*
+> Must create the share + `SG-WebDocs-RW` group. Distinct from the retired DSM `web` station.
+
+### `SG-Server-RW`  →  `\\CS-SERVER\Server`
+**RW:** Meredith Kuhn, Ashley Jensen, Lauren Hasselman, Veronica Feller, Shelby Trozzi, Christina DuPras, John Trozzi **[OPEN — Server or just Directory?]**
+**RO:** Matt Brooks
+> No `SG-Server-RO` group — Matt's RO needs an RO group or direct NTFS read.
+
+### `SG-Directory-RW`  →  `\\CS-SERVER\directoryshare`
+**RW (per matrix "Access: Directory"):** Meredith, Ashley, Lauren, Allison, Megan, Crystal,
+Lois, Karen, Veronica, Shelby, Christine, Christina DuPras, Cathy Kingston, Shontiel Nunn,
+Kyla Quick Tiffany *(no AD acct yet)*, Michelle Shestko, Sebastian Leon, Sheldon Gardfrey,
+Ray Rai, Susan Hicks, Sharon Edwards, Alma R Montt *(no AD acct yet)*, John Trozzi, Matt Brooks, Lupe Sanchez
+**Excluded:** kitchen staff (JD, Ramon, Alyssa), drivers, caregivers
+> **Big question:** matrix intro says "most staff need **read**" but each person's line reads
+> "Access" (= RW). Does everyone really need WRITE to the resident directory, or **read for most +
+> write for the few who maintain it** (front desk)? Likely should be a `SG-Directory-RO` (most) +
+> `SG-Directory-RW` (front-desk maintainers). **Decision needed.**
+
+### `SG-Receptionist-RW`  →  `\\CS-SERVER\Receptionist`  *(Tower front desk ONLY)*
+**RW:** Cathy Kingston, Shontiel Nunn, Kyla Quick Tiffany *(no AD acct yet)*, Sebastian Leon,
+Sheldon Gardfrey, Ray Rai, Christina DuPras, Meredith Kuhn, Ashley Jensen
+**RO:** Lauren Hasselman
+**Explicitly excluded:** Michelle Shestko (MC desk), Matt Brooks (MC coverage), Sales team
+> Mapped **by machine + user** via GPO/logon script — drive appears only on Tower reception PC(s)
+> for users in this group. Needs the machine-scope GPO, not just group membership.
+
+### `SG-Culinary-RW`  →  `\\CS-SERVER\Culinary`
+**RW:** JD Martin, Ramon Castaneda, Alyssa Brooks
+**RO:** Meredith Kuhn, John Trozzi, Ashley Jensen
+> Kitchen staff get Culinary ONLY (no Directory, no other shares). No `SG-Culinary-RO` group — RO trio needs one or direct NTFS read.
+
+### `SG-Activities-RW`  →  `\\CS-SERVER\Activities`  (= Life Enrichment)
+**RW:** Susan Hicks **[OPEN]**, Sharon Edwards, Alma R Montt *(no AD acct yet)*, Veronica Feller,
+Meredith Kuhn, Ashley Jensen
+**RO:** Shelby Trozzi, Christina DuPras
+> Confirm `Activities` share == the Life Enrichment data share (matrix called it `LifeEnrichment`).
+> LE workstations have no mapped drives today — this is their first map.
+
+### `SG-IT-RW`  →  `\\CS-SERVER\IT`
+**RW:** IT only — ACG admins (no Cascades staff)
+> Leave as admin-only.
+
+### Clinical / PHI  →  `\\CS-SERVER\Clinical-PHI`  **(PENDING — share may not be created)**
+**Proposed RW *if* created:** Meredith Kuhn, Ashley Jensen, Lois Lane, Karen Rossini,
+Veronica Feller, Shelby Trozzi, Christine Nyanzunda
+> Synology `pacs` was empty. **Meredith decision:** create an empty Clinical-PHI share with this
+> list, or retire the concept (everything clinical lives in ALIS) and strip Clinical from all lines above.
+> `SG-Office-PHI-Internal/-External` already exist empty — decide if those are the intended groups.
+
+### Accounting  →  `\\CS-SERVER\Accounting`  **(share exists, no SG group, not in matrix)**
+**Proposed RW:** Allison Reibschied (Accounting Asst), Lauren Hasselman (Business Office Dir)? Meredith/Ashley?
+> **Not defined in the 2026-04-23 matrix.** Confirm who owns the Accounting share + whether it needs its own `SG-Accounting-RW` group.
+
+### Direct-ACL shares (no group — leave as-is)
+- **`Executive`** — Ashley Jensen + Meredith Kuhn (done 2026-06-24, #32193).
+- **Sandra Fish Archive** (`D:\Shares\Archive\Former-Director-Sandra-Fish`) — Meredith, sole custodian.
+
+---
+
+## Structural decisions to make before we populate (not per-person)
+
+1. **RO groups missing.** Only `SG-Sales-RO` exists. Several shares need read-only members
+   (Management, Server, Culinary, Receptionist, Activities). Create matching `SG-*-RO` groups, or
+   apply direct NTFS read ACLs? (Groups are cleaner/auditable; recommend RO groups.)
+2. **Dedupe `SG-Management-RW` vs `SG-Mgmt-RW`** — keep one, delete the other (both empty — zero risk).
+3. **Delete `SG-Chat-RW`** — the chat share is retired (→ Teams).
+4. **Create ALdocs + WebDocs** shares + `SG-ALdocs-RW`/`SG-WebDocs-RW` groups.
+5. **Directory RW-vs-RO model** — decide read-for-most + write-for-front-desk (recommended) vs everyone-RW.
+6. **Clinical/PHI** — create or retire (Meredith).
+7. **Accounting share** — define ownership + group.
+
+## Per-person open questions (carry over from the matrix — confirm with John/Meredith)
+- [ ] **Lois Lane** — Clinical + Directory + Mgmt-read, or ALIS-only?
+- [ ] **Karen Rossini** — Clinical + Directory, or less?
+- [ ] **Susan Hicks** — LE Director scope as proposed?
+- [ ] **John Trozzi** — Server access, or just Directory + Culinary-read?
+- [ ] **Lupe Sanchez** — Directory only, or + Management read?
+- [ ] **Shelby Trozzi** — narrowed MC-Director scope (no admin-full) OK?
+- [ ] **Matt Brooks** — primary dept: Maintenance or MC Reception?
+- [ ] **Christine Nyanzunda** — Management read or write?
+
+## AD-account verification needed before assignment
+Confirm a domain account exists for: Cathy Kingston, Shontiel Nunn, Michelle Shestko,
+Sebastian Leon, Sheldon Gardfrey, Ray Rai, Sharon Edwards, Allison Reibschied.
+**Create first:** Kyla Quick Tiffany, Alma R Montt (matrix: not yet created).