sync: auto-sync from HOWARD-HOME at 2026-07-15 13:59:09

Author: Howard Enos Machine: HOWARD-HOME Timestamp: 2026-07-15 13:59:09
2026-07-15 13:59:40 -07:00
parent 3bab0de9c3
commit 4e3cf71851
12 changed files with 210 additions and 33 deletions
--- a/.claude/memory/MEMORY.md
+++ b/.claude/memory/MEMORY.md
@@ -231,3 +231,4 @@
 - [ask-forum — human-in-the-loop via #ct-forum](../skills/ask-forum/SKILL.md) — ask a teammate a question in the private ct-forum Discord forum, get their human answer back in-session; forum-only, any human can answer, run the --wait as a proper background task
 - [Claude Code Bun crash -> pin 2.1.110](reference_claude_code_bun_crash_pin.md) - v2.1.114+ segfaults on Win11 at new-session start; npm pin 2.1.110 + DISABLE_AUTOUPDATER=1; unpin on #55219 fix
 - [GuruRMM build-server SSH key](reference_gururmm_build_server_ssh.md) — guru@172.16.3.30 key is ~/.ssh/gururmm-physical (not id_*); password fallback vault infrastructure/gururmm-server
+- [LAB-SVR retired](feedback_labsvr_retired.md) — Len's Auto LAB-SVR replaced by LAB-SERVER; never chase LAB-SVR
--- a/.claude/memory/feedback_labsvr_retired.md
+++ b/.claude/memory/feedback_labsvr_retired.md
@@ -0,0 +1,16 @@
+---
+name: LAB-SVR is retired — replaced by LAB-SERVER
+description: Len's Auto machine LAB-SVR was decommissioned and replaced by LAB-SERVER; never chase LAB-SVR again
+type: feedback
+---
+
+Len's Auto Brokerage's **LAB-SVR was replaced by LAB-SERVER**. Do NOT investigate, probe,
+queue commands on, or report LAB-SVR as a stale/offline machine — it is retired.
+
+**Why:** Howard has corrected this repeatedly ("for the last time... STOP LOOKING FOR THAT
+MACHINE", 2026-07-15). LAB-SVR still appears in stale data (GuruRMM offline agent record,
+old MSP360 plan rows), which keeps baiting audits into flagging it.
+
+**How to apply:** In any backup/RMM/fleet audit, treat LAB-SVR rows as retired-machine
+residue. Check LAB-SERVER for Len's Auto server health instead. Cleanup of the stale
+LAB-SVR records (MSP360 plans/user side, RMM agent record) is the actual actionable item.
--- a/.labsvr-probe.ps1
+++ b/.labsvr-probe.ps1
@@ -0,0 +1,14 @@
+$ErrorActionPreference = 'SilentlyContinue'
+Write-Output "=== $(Get-Date) uptime ==="
+(Get-Date) - (Get-CimInstance Win32_OperatingSystem).LastBootUpTime | Select-Object Days, Hours | Format-Table -AutoSize
+Write-Output '=== MSP360 service ==='
+Get-Service | Where-Object { $_.DisplayName -match 'Online Backup|CloudBerry|MSP360' } | Format-Table Name, DisplayName, Status, StartType -AutoSize
+Write-Output '=== disk space ==='
+Get-PSDrive -PSProvider FileSystem | Select-Object Name, @{n='FreeGB';e={[math]::Round($_.Free/1GB,1)}}, @{n='UsedGB';e={[math]::Round($_.Used/1GB,1)}} | Format-Table -AutoSize
+Write-Output '=== latest MSP360 log errors ==='
+$root = @('C:\ProgramData\Online Backup\logs','C:\ProgramData\Arizona Computer Guru\Online Backup\logs') | Where-Object { Test-Path $_ } | Select-Object -First 1
+if ($root) {
+  $log = Get-ChildItem $root -Filter *.log | Sort-Object LastWriteTime -Descending | Select-Object -First 1
+  Write-Output "log: $($log.FullName) ($($log.LastWriteTime))"
+  Get-Content $log.FullName -Tail 60 | Where-Object { $_ -match 'ERROR|WARN|Plan finished|Plan status' } | Select-Object -Last 15
+}
--- a/.msp-mon.json
+++ b/.msp-mon.json
@@ -283,21 +283,21 @@
    "ComputerHid": "{E5CC5350-5DCB-459D-9158-80F6D4A451FA}",
    "BuildVersion": "8.6.0.338",
    "StorageType": "Cloud",
-    "LastStart": "2026-07-14T19:00:06",
-    "NextStart": "2026-07-15T19:00:00",
+    "LastStart": "2026-07-15T19:00:02",
+    "NextStart": "2026-07-16T19:00:00",
    "Status": 0,
-    "ErrorMessage": "[{\"id\":1603,\"code\":\"SkipFileInformation\",\"type\":\"https://mspbackups.com/backup-agent/1603\",\"title\":\"Files and folders were skipped: 574\",\"detail\":\"System/hidden files and folders skipped: 574\",\"priority\":\"Info\",\"kbid\":\"kb00139\"}]",
-    "FilesCopied": 1,
+    "ErrorMessage": "[{\"id\":1603,\"code\":\"SkipFileInformation\",\"type\":\"https://mspbackups.com/backup-agent/1603\",\"title\":\"Files and folders were skipped: 573\",\"detail\":\"System/hidden files and folders skipped: 573\",\"priority\":\"Info\",\"kbid\":\"kb00139\"}]",
+    "FilesCopied": 3,
    "FilesFailed": 0,
-    "DataCopied": 5565662,
-    "Duration": "13 min.",
-    "DataToBackup": 435953,
-    "TotalData": 132526968467,
-    "FilesScanned": 132593,
-    "FilesToBackup": 1,
+    "DataCopied": 14014988,
+    "Duration": "3 min.",
+    "DataToBackup": 14142454,
+    "TotalData": 132527072279,
+    "FilesScanned": 132594,
+    "FilesToBackup": 3,
    "PlanId": "dea7091a-24b7-4011-a4be-f21222883a3e",
    "PlanType": 3,
-    "DetailedReportLink": "https://ws.mspbackups.com/go.aspx?url=QW56eHRNYnhwUkU3K3pKenoybUdvZVpCcjdnMCtGaUNNMnlPQW9BeDBicmpHNzh0Yi9abnVFUkdxRmhVK2ZQK3NQMTlTV0d4WEtPZ1l1aUxoWG5lSDMrM1poR1pUUGZiaFNieVgrSDRTTkUvT2szVk9SN1dtNVVXRFphbThvMjlRNGRWenBTUUxaYjBnK01yeGJ3NWZ1aU1FclRDdEN4OVpYbnFmaG9LLzE4VVMySFdsMSsrK3Azai9IckNLY2IxNU5sRnBHeG5UTVd2dE5ya2JPMDFwWVZSdVByK3ZNSkgzMFNaZTF3RGZ2bERZSVFpOTJHVE9ZQXJwYTA4NERkL2ZFTEhEZ1N2UVA4YWRzcnJhVlVSdDRsaXRWaXVxTnNMNlNoZDgxLzNSSjJKeGkvaCs4RSsvWVdrV042Z2kyMjl5YnJEQWZ6b3F0U1hOQkRIOU1JSEE3V2tReHBIQzZIcXlYQXRWYWVvVDdabytuaHJTZ29OWktVWS83Mk40a1AyalhGUjZhRmhJVjdwb3pjNkxaK0JUZjUrNWFwWXZ0dVk3ZzF6K29XeEh2cz0*"
+    "DetailedReportLink": "https://ws.mspbackups.com/go.aspx?url=QW56eHRNYnhwUkU3K3pKenoybUdvZVpCcjdnMCtGaUNNMnlPQW9BeDBicmpHNzh0Yi9abnVFUkdxRmhVK2ZQK3NQMTlTV0d4WEtPZ1l1aUxoWG5lSDMrM1poR1pUUGZiaFNieVgrSDRTTkUvT2szVk9SN1dtNVVXRFphbThvMjlRNGRWenBTUUxaYjBnK01yeGJ3NWZ1aU1FclRDdEN4OVpYbnFmaG9LLzE4VVMySFdsMSsrK3Azai9IckNLY2IxNU5sRnBHeG5UTVd2dE5ya2JPMDFwWVZSdVByK3ZNSkgzMFNaZTF3RGZ2bERZSVFpOTJHVE9ZQXJwYTA4NERkL1BtdG5vOVpkeVJIbitZSlhzbUIyQUtPWG01bFdoZDJ3N2dDNFpPZjZKVUs2NWNyaHNrTDNtV1FpaExEQ2NWK0dkcDVzR1FEV3lGRmJtY2NtN1RhSTdkaFFvY3R2QTRKTDl0YW9LUUNQTGMyRGI4TjJYZHQyQTI0T0Q4STRIS3BvNnFlM0VQeVF6am9kc0VRTnJqN3VwZ0RzM0t5NnQ2R21aYmJMNzFGb25xaz0*"
  },
  {
    "PlanName": "Consistency check plan for Local - Temp",
@@ -758,21 +758,21 @@
    "ComputerHid": "{F2271BE7-368A-41C2-938C-E9752E77B3F0}",
    "BuildVersion": "8.6.0.338",
    "StorageType": "Cloud",
-    "LastStart": "2026-07-15T17:30:04",
-    "NextStart": "2026-07-15T19:30:00",
+    "LastStart": "2026-07-15T19:30:03",
+    "NextStart": "2026-07-15T21:30:00",
    "Status": 0,
    "ErrorMessage": "",
-    "FilesCopied": 35,
+    "FilesCopied": 32,
    "FilesFailed": 0,
-    "DataCopied": 3409345,
-    "Duration": "26 min.",
-    "DataToBackup": 3931391,
-    "TotalData": 3143808116582,
-    "FilesScanned": 917309,
-    "FilesToBackup": 35,
+    "DataCopied": 13670332,
+    "Duration": "25 min.",
+    "DataToBackup": 14550210,
+    "TotalData": 3143821917423,
+    "FilesScanned": 917328,
+    "FilesToBackup": 32,
    "PlanId": "e25f4cc9-7ed9-4010-b5e2-4684611fd794",
    "PlanType": 3,
-    "DetailedReportLink": "https://ws.mspbackups.com/go.aspx?url=QW56eHRNYnhwUkU3K3pKenoybUdvZVpCcjdnMCtGaUNNMnlPQW9BeDBicWpQV2dmZUFLRnZ5dGhtTVYxWUZTK0ZZZWRWdEFJdW1aTFZBOUsxTGh3eGZEMTBvZ2JxRDA0c1c5ZjMzTmdyZlZkSmJHYmEyUGhnK0dMZ2xTVVRpMkxjVEdCc1B6U0FBSWlxQkFxakw5U3gwd2R0YkhiOEVQSnNWVTcybG5GQXBQanhuZEFLUEEreFJoS3JzR0ZjUjZaMkZQQ25xVWFiT2ZydmtRNDlORTR4QU1Wa1N2SDVNcEwvcnk3K1BqVEVZbVJucjQ3NGlpMlE3Ym93TjBqNk02Qjk3RHAwZkRzamJ5RExYWUkvWlRZdHBBU2U0d00zWENtWGk1QTBNeWc4Qms4c2FXaEtVVUhWaTFDazh5cVB3a1QySUNHNDVPVTRRTUJVc3dFZXQvOWZ6cy85OHBHVDFkR2FJSXA0NlJnaUh5eG5uOUNCUDY5YU1QZHZhQ2U0NFJuOXlPZjVEcDVmMUdSbi9oU2cyK1FQb2FOZDg5Z3BHTElGT0ptam9lODQ1QT0*"
+    "DetailedReportLink": "https://ws.mspbackups.com/go.aspx?url=QW56eHRNYnhwUkU3K3pKenoybUdvZVpCcjdnMCtGaUNNMnlPQW9BeDBicWpQV2dmZUFLRnZ5dGhtTVYxWUZTK0ZZZWRWdEFJdW1aTFZBOUsxTGh3eGZEMTBvZ2JxRDA0c1c5ZjMzTmdyZlZkSmJHYmEyUGhnK0dMZ2xTVVRpMkxjVEdCc1B6U0FBSWlxQkFxakw5U3gwd2R0YkhiOEVQSnNWVTcybG5GQXBQanhuZEFLUEEreFJoS3JzR0ZjUjZaMkZQQ25xVWFiT2ZydmtRNDlORTR4QU1Wa1N2SDVNcEwvcnk3K1BqVEVZbVJucjQ3NGlpMlE3Ym93TjBqNk02Qjk3RHAwZkRzamJ5RExYWUkvWlRZdGt2OHdleE54SUdhelFscDdSeThBRXRYSmVDMWYxRDdRbkM1SkY5NmhZR1ovODFGbVoyWi9RSlc4NWhURDdzZ3BTRytFN0tiLzVKTDBMMlRpYUFCbjdXem1hTVcyaDd2cm1wY3pxMEt3R0x2bmFET2NhSjhDNU1SVHIwMC91M3duY1dLZk1yUW04WVJ1emxrWjdBc3lKND0*"
  },
  {
    "PlanName": "Consistency check plan for Localbackup",
@@ -1158,7 +1158,7 @@
    "ComputerHid": "{11ECF59F-16E5-4D36-845E-ED7E26257FBC}",
    "BuildVersion": "8.6.0.338",
    "StorageType": "Cloud",
-    "LastStart": "2026-07-15T18:00:05",
+    "LastStart": "2026-07-15T19:25:30",
    "NextStart": "2026-07-16T18:00:00",
    "Status": 3,
    "ErrorMessage": null,
@@ -1233,21 +1233,21 @@
    "ComputerHid": "{9E0C27B2-A14E-464C-8545-3DD1B8FFCC6E}",
    "BuildVersion": "8.6.0.338",
    "StorageType": "Cloud",
-    "LastStart": "2026-07-15T17:00:04",
-    "NextStart": "2026-07-15T19:00:00",
+    "LastStart": "2026-07-15T19:00:04",
+    "NextStart": "2026-07-15T21:00:00",
    "Status": 0,
-    "ErrorMessage": "[{\"id\":1603,\"code\":\"SkipFileInformation\",\"type\":\"https://mspbackups.com/backup-agent/1603\",\"title\":\"Files and folders were skipped: 3215\",\"detail\":\"System/hidden files and folders skipped: 3215\",\"priority\":\"Info\",\"kbid\":\"kb00139\"}]",
-    "FilesCopied": 31,
+    "ErrorMessage": "[{\"id\":1603,\"code\":\"SkipFileInformation\",\"type\":\"https://mspbackups.com/backup-agent/1603\",\"title\":\"Files and folders were skipped: 3217\",\"detail\":\"System/hidden files and folders skipped: 3217\",\"priority\":\"Info\",\"kbid\":\"kb00139\"}]",
+    "FilesCopied": 43,
    "FilesFailed": 0,
-    "DataCopied": 44189638,
-    "Duration": "60 min.",
-    "DataToBackup": 13472399,
-    "TotalData": 566153930392,
-    "FilesScanned": 475397,
-    "FilesToBackup": 31,
+    "DataCopied": 91102583,
+    "Duration": "47 min.",
+    "DataToBackup": 68660069,
+    "TotalData": 566218265316,
+    "FilesScanned": 475425,
+    "FilesToBackup": 43,
    "PlanId": "6a121575-84a0-4e98-9c0f-4a656d1a5132",
    "PlanType": 3,
-    "DetailedReportLink": "https://ws.mspbackups.com/go.aspx?url=QW56eHRNYnhwUkU3K3pKenoybUdvZVpCcjdnMCtGaUNNMnlPQW9BeDBiclJBaG1vc2szRDViQUJCTXVyRG5XNTR0RUU0N3RPakZCRzZKQmZLdXZGZllOZmlqay9KNmZqV0w3YzNKL0lEVHFUS0hpcHc1Q2U5L0dNNzlqUXRWRXBURHg4eHpaZnBSbHBtRTBzclJZKzhocFhoellQb29pdmJiZ2Q3S2dIRXdiN0RicEJ2ZTZVSUFoU3MxWU9mVzJOK1dhbzNXdUoyTkN3WEFpcytLaWJTQlJzOXpSNTcrcWM0Wi80QVZoa1NPK2lZN3lQOGpGZTBpVnMram9NOXpDUjkrMXQzbkV3Zy9jNUFEQ2gyTVFTVjUvTVNISm01UEsrSWtiTUNsTE5Gb1RXN0NlY3Y4b2V2SXdhWVZLNkdhSTM3MkFmN2c3SUhGYlk3NTlQYm9IcEtnZVNFTkNMVFAvM1NVOWJmQVdtcVdoclgrWURxVXlWMkVTOGNubG10L0N1OEg0Yzc4M3dDL3BLVlQwcmdXem5sdz09"
+    "DetailedReportLink": "https://ws.mspbackups.com/go.aspx?url=QW56eHRNYnhwUkU3K3pKenoybUdvZVpCcjdnMCtGaUNNMnlPQW9BeDBiclJBaG1vc2szRDViQUJCTXVyRG5XNTR0RUU0N3RPakZCRzZKQmZLdXZGZllOZmlqay9KNmZqV0w3YzNKL0lEVHFUS0hpcHc1Q2U5L0dNNzlqUXRWRXBURHg4eHpaZnBSbHBtRTBzclJZKzhocFhoellQb29pdmJiZ2Q3S2dIRXdiN0RicEJ2ZTZVSUFoU3MxWU9mVzJOK1dhbzNXdUoyTkN3WEFpcytLaWJTQlJzOXpSNTcrcWM0Wi80QVZoa1NPK2lZN3lQOGpGZTBpVnMram9NOXpDUm56R3p3dWpTOUxVNjNTYW5CMGRtUjU4dWo1N1p1Z0xkMElXMjd3ZzYvbTNjU05rbTd0UHg5alJWYXF3dThUTFVJUERYa1hxeDIrenpjNUZucElTYzVDR0NRVWp4VU14bnpoQkhucnRpQ3lqcVhOSmo3cFUxYjlvUmo5KzNaWlhvWEd2OTJmc2Z3TTh0Tzh2RzlFSjlyZz09"
  },
  {
    "PlanName": "Files Backup Plan rednourcarrievirt on Jul 30, 2025, 10:13 AM",
--- a/.sy_ast.json
+++ b/.sy_ast.json
--- a/.sy_cust.json
+++ b/.sy_cust.json
--- a/.sy_inv.json
+++ b/.sy_inv.json
--- a/.sy_prof.json
+++ b/.sy_prof.json
--- a/.sy_tick.json
+++ b/.sy_tick.json
@@ -0,0 +1 @@
+{"tickets":[],"meta":{"total_pages":1,"page":1}}
--- a/clients/cascades-tucson/session-logs/2026-07/2026-07-15-howard-phish-investigation-amu54618.md
+++ b/clients/cascades-tucson/session-logs/2026-07/2026-07-15-howard-phish-investigation-amu54618.md
@@ -0,0 +1,104 @@
+# Session Log — Cascades Tucson phishing investigation + remediation (AMU54618)
+
+## User
+- **User:** Howard Enos (howard)
+- **Machine:** Howard-Home
+- **Role:** tech
+
+## Session Summary
+
+Investigated a suspected phishing email reported by Chris Knight at Cascades Tucson:
+"Past Due - AMU54618 - AMYSH Solutions" from Dax Howard <info@syufway.com>, sent
+2026-07-14 to accounting@cascadestucson.com with a PDF attachment. Used the
+remediation-tool skill (Security Investigator tier, read-only) against tenant
+207fa277-e9d8-4eb7-ada1-1064d2221498.
+
+Found the message delivered to the accounting shared mailbox at 17:32 UTC. Message
+trace showed TWO copies sent ~10 seconds apart: the first quarantined by Defender as
+High Confidence Phish (never released), the second delivered to the Inbox. The only
+recipient in the tenant was accounting@cascadestucson.com. Reply-To header was
+mismatched (dax.howard@steqm.com vs sender info@syufway.com) — BEC indicator.
+
+Downloaded and analyzed the attachment (W9_AMYSH_Solutions54618.pdf, 84 KB): a filled
+IRS W-9 for "AMYSH Solutions", EIN 92-4058031, 75 E Santa Clara St, San Jose CA 95113.
+No URLs, no QR codes, no active content — pure vendor-fraud/BEC setup (goal: onboard
+fake vendor, get invoice paid). MailItemsAccessed audit showed the email was opened by
+ashley.jensen (Outlook Android, 17:32 + 18:16 UTC) and Chris.Knight (Outlook desktop,
+17:33 + 18:54 UTC). Message trace confirmed ZERO outbound mail to either attacker
+address — nobody replied or acted. Verdict: no compromise; risk limited to paying the
+fake invoice.
+
+With Howard's approval, remediated: moved the delivered copy to Deleted Items in the
+accounting mailbox (Graph, exchange-op-graph tier) and added syufway.com + steqm.com to
+the Tenant Allow/Block List (Sender block, no expiration). Wrote the investigation
+report, drafted a client-facing summary explaining findings and why no urgent response
+was needed (low threat, client had already identified it as fake), then trimmed it and
+DM'd it to Howard on Discord (message_id 1527005883177898024).
+
+## Key Decisions
+
+- Used Graph $search on the mailbox instead of $filter (filter with date-range +
+  subject silently returned nothing).
+- Soft-deleted (move to deleteditems) rather than hard delete — recoverable as evidence.
+- Left the quarantined first copy in quarantine untouched.
+- Blocked both the visible sender domain AND the hidden reply-to domain.
+- Classified as low-threat BEC (no payload) — justified non-urgent response to client.
+
+## Problems Encountered
+
+- get-token.sh exited 3: vault_path not found — the script read
+  /c/Users/Howard/.claude/identity.json (empty) rather than the repo identity.json.
+  Fixed by exporting VAULT_ROOT_ENV=/d/vault.
+- Get-QuarantineMessage rejected a scalar SenderAddress — parameter is String[];
+  must pass a JSON array: {"SenderAddress":["info@syufway.com"]}.
+- PreToolUse hook block-tmp-path.sh blocked writing the attachment under /tmp —
+  used repo-relative scratch (./.x_*.json) instead, cleaned up after.
+- base64 -d failed on Graph contentBytes until CR/LF stripped (tr -d '\r\n').
+- Get-MessageTraceV2 (not Get-MessageTrace) is the working cmdlet via adminapi.
+
+## Configuration Changes
+
+- Created: clients/cascades-tucson/reports/2026-07-15-phish-investigation-amu54618.md
+- Created: this session log
+- M365 tenant changes (cascadestucson.com):
+  - Phish message moved to Deleted Items in accounting@cascadestucson.com
+  - Tenant Allow/Block List: syufway.com, steqm.com (Sender block, NoExpiration,
+    note "BEC/vendor-fraud phish 2026-07-14 AMU54618 - blocked by ACG")
+
+## Credentials & Secrets
+
+- None new. Used existing remediation-tool app tiers (investigator, investigator-exo,
+  exchange-op, exchange-op-graph) via SOPS vault at D:/vault (VAULT_ROOT_ENV=/d/vault).
+
+## Infrastructure & Servers
+
+- Tenant: cascadestucson.com = 207fa277-e9d8-4eb7-ada1-1064d2221498
+- accounting@cascadestucson.com is a licensed user mailbox "Accounting Dept."
+  (id 8540c638-d7d4-456f-a6f6-98bf13c7f087) with FullAccess delegates:
+  ashley.jensen, lauren.hasselman, zachary.nelson, Chris.Knight.
+
+## Commands & Outputs
+
+- Message trace: POST https://outlook.office365.com/adminapi/beta/{tenant}/InvokeCommand
+  Get-MessageTraceV2 {SenderAddress, StartDate, EndDate} → Quarantined @17:30:23,
+  Delivered @17:30:34 (2026-07-14 UTC).
+- Audit: Search-UnifiedAuditLog Operations=["MailItemsAccessed"]
+  FreeText="NSCCVAyTgUFD3cMIwaf4nl5G1cSc5xC4W4Cr1Rrk0c" → 5 Bind records (ashley.jensen,
+  Chris.Knight).
+- Delete: POST /users/accounting@cascadestucson.com/messages/{id}/move
+  {"destinationId":"deleteditems"} → HTTP 201.
+- Block: New-TenantAllowBlockListItems {ListType:"Sender",Block:true,
+  Entries:["syufway.com","steqm.com"],NoExpiration:true} → both created.
+
+## Pending / Incomplete Tasks
+
+- Howard to forward the client-facing summary (in his Discord DM) to Cascades.
+- Optional: submit the sample to Microsoft as phish (not done).
+
+## Reference Information
+
+- Report: clients/cascades-tucson/reports/2026-07-15-phish-investigation-amu54618.md
+- Internet-Message-Id: <NSCCVAyTgUFD3cMIwaf4nl5G1cSc5xC4W4Cr1Rrk0c@localhost>
+- Attacker: info@syufway.com (sender), dax.howard@steqm.com (reply-to),
+  "AMYSH Solutions" EIN 92-4058031, invoice ref AMU54618.
+- Discord DM message_id: 1527005883177898024 (to howard).
--- a/errorlog.md
+++ b/errorlog.md
@@ -19,6 +19,8 @@ Categories (the `[type]` tag): _(none)_ = skill/command execution failure ·

 <!-- Append entries below this line -->

+2026-07-15 | Howard-Home | msp360/backups | [correction] assumed LAB-SVR (Len's Auto) is a live machine needing attention; correct is LAB-SVR was RETIRED and replaced by LAB-SERVER — repeated correction from Howard
+
 2026-07-15 | Howard-Home | cascades-verification | [correction] reported Synology-to-server sync as 'overstated/partial' from stale wiki (6/18 note); correct is: shared-folder syncs to the server ARE set up — Howard confirmed. Wiki Team Folder [PENDING] lines are stale

 2026-07-15 | Howard-Home | prairie-schooner/cutover | [correction] assumed a separate USG gateway existed at .136 and was removed at cutover; correct is the .136 device WAS the USW-Lite-16-PoE switch (kept + adopted into UDM Pro) - only the SonicWall was removed
--- a/projects/gps-rmm-audit/client-contact-list-2026-07-15.md
+++ b/projects/gps-rmm-audit/client-contact-list-2026-07-15.md
@@ -0,0 +1,35 @@
+# MSP360 Stale-Backup Client Contact List — 2026-07-15
+
+Machines whose MSP360 backups stopped because the endpoint went silent (last plan run
+succeeded, then no further check-ins). None are remotely reachable — not enrolled in
+GuruRMM, or enrolled but offline. Each needs a client conversation: is the machine still
+in service? If yes → power on / reconnect / reinstall agent. If retired → remove from
+MSP360 so we stop carrying and billing a dead endpoint.
+
+| Priority | Client | Machine | Last good backup | Silent | Ask the client |
+|---|---|---|---|---|---|
+| **HIGH** | Tucson Safety and Medical | TSAM-SERVER | 2026-02-25 | 140d | A SERVER with no backup for 4.5 months. Is it still running? If yes, agent is dead — needs on-site/remote session to fix. If replaced, what took over its data? |
+| **HIGH** | Glaztech Industries | GTI-INV-VMHOST | Image 2025-10-26, Hyper-V 2025-10-28 | ~260d | VM host was pushing 60+ GB images, silent since Oct 2025. Retired? Replaced? If in service, its VMs have no image/Hyper-V protection. |
+| MED | Len's Auto | DESKTOP-BMBTQLI | Image plan NEVER ran | — | Plan was created (next start was 2026-05-03) but never executed once. Does this desktop still exist? Not in RMM. |
+| — | Len's Auto | ~~LAB-SVR~~ RETIRED | — | — | Replaced by LAB-SERVER (per Howard). Cleanup item, not a contact item: remove stale LAB-SVR plans/user from MSP360 and the dead agent record from GuruRMM. Note: no LAB-SERVER backup plans appear in MSP360 monitoring — confirm where the replacement server backs up. |
+| MED | Desert RV | DESKTOP-9T0UAON | Local Backup 2026-05-07 | 69d | Off/disconnected; consistency check stuck "Running". Still in service? |
+| LOW | Tedards | DESKTOP-SUFJR0J | 2025-07-12 (51 MB files) | 368d | Silent a full year — almost certainly retired. Confirm, then remove from MSP360 + purge/retain B2 data per retention policy. |
+
+## Related (tracked separately, same effort)
+
+- **Tucson Coin / Seth-PC** — backs up daily but plan references a phantom E:\ drive that
+  does not exist on the machine (1 SSD, CD at D:, printer at F:). Decision needed:
+  remove E:\ from plan config vs. reconnect a drive. Machine currently offline; probe queued.
+- **ACG-Internal / NEPTUNE** — Exchange backup fixed 2026-07-15 (service account
+  ACG\svc-msp360 with Exchange RBAC); verification run in progress.
+- **Air Pros** — user diegobuilder300@gmail.com DISABLED in MSP360 2026-07-15 and flagged
+  for removal. 418.7 GB still stored in B2 (MSPBackups20200311 destination) — final
+  delete-user (which purges the data) awaits explicit direction.
+
+## Notes
+
+- Status source: MSP360 monitoring feed (authoritative). All six rows above show
+  Status=Success on their last run — the plans are fine, the machines went away.
+- Removal from MSP360 = `delete-user`/company cleanup via the msp360 skill (gated), after
+  the client confirms. B2 data retention is a per-client decision — do not purge without
+  explicit direction.
				`@@ -0,0 +1 @@`
				`{"tickets":[],"meta":{"total_pages":1,"page":1}}`