From 522594dedb1fd72d0f706742c1aa42200d3dd1cb Mon Sep 17 00:00:00 2001 From: Howard Enos Date: Fri, 10 Jul 2026 07:36:49 -0700 Subject: [PATCH] wiki: compile cascades-tucson (update) Fold 4 session logs since last_compiled=2026-07-01: - 2026-07-02 caregiver phone login / PSO-Caregivers FGPP - 2026-07-02 Shelby Trozzi Company Web Docs share + mapped drive - 2026-07-09 Charity Menle caregiver rename - 2026-07-09 Chris Knight accounting mailbox delegation Surgical update mode (not --full): 735 of 739 lines left byte-for-byte intact. Adds Company Web Docs share record, Shelby vault path (path only), 4 History rows; refreshes Syncro hours/tickets (37.5 hrs, 0 open). Co-Authored-By: Claude Opus 4.8 (1M context) --- wiki/clients/cascades-tucson.md | 22 +++++++++++++++++----- wiki/index.md | 4 ++-- 2 files changed, 19 insertions(+), 7 deletions(-) diff --git a/wiki/clients/cascades-tucson.md b/wiki/clients/cascades-tucson.md index c84a62d8..d12d47aa 100644 --- a/wiki/clients/cascades-tucson.md +++ b/wiki/clients/cascades-tucson.md @@ -2,7 +2,7 @@ type: client name: cascades-tucson display_name: Cascades of Tucson -last_compiled: 2026-07-01 +last_compiled: 2026-07-10 compiled_by: Howard-Home/claude-main sources: - session-logs/2026-03-24-session.md @@ -111,6 +111,11 @@ sources: - clients/cascades-tucson/session-logs/2026-07/2026-07-01-howard-caretaker-roster-update-phone-login-cutover.md - clients/cascades-tucson/reports/2026-07-01-caretaker-roster-update.md - clients/cascades-tucson/docs/cloud/caretaker-phones-only-list.md + - clients/cascades-tucson/session-logs/2026-07/2026-07-02-howard-caretaker-phone-login-pso-roster-cleanup.md + - clients/cascades-tucson/session-logs/2026-07/2026-07-02-howard-shelby-webdocs-share.md + - clients/cascades-tucson/session-logs/2026-07/2026-07-09-howard-charity-menle-caregiver-rename.md + - clients/cascades-tucson/session-logs/2026-07/2026-07-09-howard-chris-knight-accounting-mailbox.md + - .claude/memory/reference_rmm_map_network_drive.md backlinks: - projects/gururmm - wiki/systems/uos-server @@ -235,17 +240,17 @@ Because per-user **Intune** never provisioned tenant-wide (`INTUNE_A = PendingIn - Crystal Rodriguez -- staff - Sharon Edwards -- Life Enrichment Assistant (DESKTOP-DLTAGOI) - Ashley Jensen -- Accountant (DESKTOP-U2DHAP0) - - Shelby Trozzi -- MemCare Director (MDIRECTOR-PC) + - Shelby Trozzi -- MemCare Director (MDIRECTOR-PC, Win Home / not domain-joined). Domain account `CASCADES\Shelby.Trozzi` (`OU=Care-Memorycare`, not Entra-synced); first password set 2026-07-02, vaulted. Has `\\CS-SERVER\Company Web Docs` (Change) mapped as `W:`, plus FullAccess+AutoMap on Alma Montt's converted shared mailbox. - Chris Knight -- Accounting / Business Office (same access tier as Lauren Hasselman); chris.knight@cascadestucson.com (alias: c.knight@cascadestucson.com). **Workstation setup 2026-06-08:** machine **DESKTOP-N5G1ROO** (Win 11 Pro for Workstations) domain-joined + GuruRMM-enrolled (agent `205025ee-2676-4498-8a27-e88562a6f69a`), Office installed. AD account `chris.knight` (OU=Administrative) finished to match Lauren. Mailbox remains cloud-only/unsynced (same split state as Lauren). **Accounting mailbox access 2026-07-09:** granted FullAccess (auto-mapping) + SendAs on `accounting@cascadestucson.com`, matching Lauren/Ashley/Zachary. - JD Martin -- Syncro-confirmed contact (jd.martin@cascadestucson.com); Chef's Office user on CHEF-PC (his default printer = USB Chef Printer). - Lupe Sanchez -- staff (DESKTOP-TRCIEJA). EOL workstation (Gateway ZX6971 AIO, i3-2120, 8 GB RAM, Win11 unsupported). **Decision 2026-06-18: replace machine** (dual-AV + EOL hardware causing slow Excel; no remediation on current box). GuruRMM agent `c9bf1a2d-bfdc-401e-9cc8-f9e90bb19587` (resolve live by hostname; UUIDs change on re-enroll). - Tamra Matthews -- Move-In Coordinator (Marketing/Sales), SALES4-PC. **OFFBOARDED 2026-06-30** (left June 2026 -- see Access section). - **Syncro contact emails (authoritative):** ashley.jensen@, jd.martin@, crystal.rodriguez@, John.trozzi@, meredith.kuhn@, accounting@/accountingassistant@cascadestucson.com. - **Billing rate:** $175/hr all labor (prepaid block customer) -- **Hours remaining:** **37.5 hrs as of 2026-07-01 (live Syncro, unchanged from 2026-06-30).** Prior: 46.75 hrs as of 2026-06-26; 47.75 hrs as of 2026-06-25; 48.25 hrs as of 2026-06-24. Always live-check via `GET /customers/20149445` before billing. +- **Hours remaining:** **37.5 hrs as of 2026-07-10 (live Syncro, unchanged since 2026-06-30).** Prior: 46.75 hrs as of 2026-06-26; 47.75 hrs as of 2026-06-25; 48.25 hrs as of 2026-06-24. Always live-check via `GET /customers/20149445` before billing. - **Syncro customer ID:** 20149445 - **Managed devices (Syncro assets):** 29 (live 2026-07-01) -- **Active tickets:** **0 open Syncro tickets as of 2026-07-01 (live Syncro).** See Active Work and session logs for ongoing project work (domain migration, EDR rollout, caregiver phone SSO, VLAN 20 printer migration). +- **Active tickets:** **0 open Syncro tickets as of 2026-07-10 (live Syncro).** See Active Work and session logs for ongoing project work (domain migration, EDR rollout, caregiver phone SSO, VLAN 20 printer migration). - #110680053 / #32303 -- Entra / domain migration project. Status: **Invoiced** as of 2026-06-05. Plan: `C:\Users\Howard\.claude\plans\wise-discovering-panda.md` - #109412123 -- Entra setup project (verify status) - #32403 -- Meredith locked Word doc (0.5h remote, billed 2026-06-10, Invoiced) @@ -380,6 +385,7 @@ Cascades' line-of-business / reporting SaaS (the systems they pull data OUT of, - **pfSense config backup (2026-06-17):** `clients/cascades-tucson/pfsense-config-backup-2026-06-17.sops.yaml` - **Synology DSM:** http://192.168.0.120:5000 -- vault: `clients/cascades-tucson/synology-cascadesds.sops.yaml` (admin). Drive Server port 6690 (SSL). **[SECURITY] Synology Cloud Signin Portal credential (`clients/cascades-tucson/synology-signin-portal.sops.yaml`) was committed plaintext at vault commit 1fbc0e1 -- exposed in git history; encrypted go-forward but credential should be rotated.** - **M365 admin:** admin@cascadestucson.com -- vault: `clients/cascades-tucson/m365-admin.sops.yaml` +- **Shelby Trozzi (domain account `CASCADES\Shelby.Trozzi`):** vault `clients/cascades-tucson/shelby-trozzi.sops.yaml`. Password set on-prem 2026-07-02 (never-expires, no change-at-logon) -- she had never logged in (`logonCount = 0`). **Safe to reset on-prem: not Entra-synced** (no `ConsistencyGuid`; `OU=Care-Memorycare,OU=Departments` is outside Entra Connect sync scope), so an AD reset does not touch M365. Note AD complexity rejects passwords containing the user's own name. - **M365 sysadmin:** sysadmin@cascadestucson.com -- vault: `clients/cascades-tucson/m365-sysadmin.sops.yaml` - **WiFi CSCNet:** vault: `clients/cascades-tucson/wifi-cscnet.sops.yaml` - **WiFi Voice PPSK (VLAN 30):** vault: `clients/cascades-tucson/wifi-voice-ppsk.sops.yaml` @@ -454,6 +460,8 @@ Cascades' line-of-business / reporting SaaS (the systems they pull data OUT of, - **[CORRECTED 2026-06-24, live] CS-SERVER CAN reach VLAN 20 -- server-hosted printing to VLAN-20 printers works.** CS-SERVER routes to `10.0.20.0/24` via the default gateway (pfSense `192.168.0.1`) and **pings the VLAN-20 gateway `10.0.20.1` fine**. The VLAN-20 print queues already on the server print through it. **Caveat:** the printers often **don't answer ICMP ping when asleep** (and 9100 may show closed while idle) -- that is NOT a firewall block; a real print job wakes them. **[REFINED 2026-06-30] The one real block was policy-routing, not the firewall:** the LAN "allow LAN to any" rule's Gateway=WAN_Group sent CS-SERVER->VLAN 20 out the WAN. A top LAN pass rule (src 192.168.2.248, dst 10.0.20.0/24, gw=default) fixed it -- see pfSense Operations. - **Persistent drive maps to `\\cs-server\AcctDept`:** Chris (DESKTOP-N5G1ROO) Y:, Zachary (ACCT2-PC) Y:, Lauren (DESKTOP-H6QHRR7) X:. - **`\\CS-SERVER\BusinessOffice` (Business Office - Brother L8900CDW, `10.0.20.220`) = the "Accounting Assistant" printer in room 101** -- one physical L8900CDW, already a shared print queue on CS-SERVER. Attached to Chris Knight's PC (DESKTOP-N5G1ROO) 2026-06-24. Do NOT create a duplicate "Accounting Assistant Printer" queue -- it's this one. +- **`\\CS-SERVER\Company Web Docs` (built 2026-07-02):** `D:\Shares\Public\Company Web Docs`, shared for Shelby Trozzi (MemCare Director). **Gated at the SHARE ACL, not NTFS** -- `CASCADES\Shelby.Trozzi` = Change, `BUILTIN\Administrators` = Full; NTFS left as inherited `Everyone:FullControl` from `Public`. The new share is the only network path to the folder, so the share ACL is the effective gate and the `Public` NTFS tree stays undisturbed. Effective access = Change. Share name intentionally contains spaces. + - **Mapping it via RMM does not work directly** -- `user_session` impersonation has no network credential for the outbound SMB hop to CS-SERVER (error 67 / RPC 1702, the documented artifact above). Workaround that DOES work: store the credential with `cmdkey`, then plant a persistent map in the user's hive at `HKCU:\Network\` (RemotePath/UserName/ProviderType 131072); it reconnects at their next interactive logon. For immediate visibility, map it in a live interactive session (ScreenConnect). Reusable pattern -- memory `reference_rmm_map_network_drive`. - **Executive restricted share (built 2026-06-24, ticket #32193):** `D:\Shares\Executive` on CS-SERVER, shared as **`\\cs-server\Executive`**; inheritance broken; SYSTEM / BUILTIN\Administrators = Full; `CASCADES\Ashley.Jensen` + `CASCADES\Meredith.Kuhn` = Modify (no Everyone); share-access limited to the same two + Admins. Mapped persistent `E:` on DESKTOP-U2DHAP0 (Ashley) and ASSISTMAN-PC (Meredith), RW-verified. NOTE: clients reach CS-SERVER SMB at **192.168.2.248** (registered DNS / Ethernet idx16), NOT the .254 Hyper-V vEthernet NIC. RMM dispatch gotcha: build UNC from `[char]92` (heredoc+jq eats `\\`->`\`); surface a remotely-mapped drive in the user's running Explorer with `SHChangeNotify(SHCNE_DRIVEADD)` in their session. ### Printers / VLAN 20 Migration (2026-06-30) @@ -601,7 +609,7 @@ Full design: `docs/network/phase1-voice-qos-design.md`. Status DESIGN -- nothing > **Canonical remaining-work plan: `docs/REMAINING-WORK-PLAN.md`** (built 2026-06-24 from a live > AD+RMM domain-join diff). 7 sequenced workstreams + every open ticket mapped to one. Work from it. -Syncro live pull 2026-07-01: **0 open Syncro tickets; 37.5 prepaid hours; 29 managed devices.** See session logs for active project work (domain migration, EDR rollout, caregiver phone SSO, VLAN 20 printer migration). +Syncro live pull 2026-07-10: **0 open Syncro tickets; 37.5 prepaid hours; 29 managed devices.** See session logs for active project work (domain migration, EDR rollout, caregiver phone SSO, VLAN 20 printer migration). - **[IN PROGRESS 2026-07-01] Caregiver phone SSO -- ALIS email-match (Howard handling), roster now 35.** Entra/identity side DONE for the current roster (`SG-Caregivers` 35 members after the 7/1 reconciliation -- 8 offboarded, 4 new hires -- Business Premium licensed, forced-change AD temp passwords vaulted `clients/cascades-tucson/caregiver-temp-passwords-2026-06-30.sops.yaml` + `caregiver-temp-passwords-2026-07-01.sops.yaml`). Remaining: set each caregiver's ALIS staff `Email` = Entra UPN (carryover from 6/30: 23 confirmed just need Email=UPN; 5 blank-role confirm+match; 5 Med Techs revisit; 7 discharged-record reactivate-vs-recreate decisions); **new from 7/1: build ALIS staff records for Munezero, Cota, Robinson (need job roles -- Certified vs Resident Caregiver / Med Tech) and set Vallejo's ALIS Email = a.vallejo@cascadestucson.com** (she already has an ALIS record, just needed the AD account, created 7/1). Blanket-disable ALIS-native 2FA for the bucket as matched. Zeke Huerta moved to front desk 7/1 (removed from `SG-Caregivers`, needs Authenticator MFA registration, ALIS role change TBD); Kariuki ALIS dup (429856/429858) needs dedupe if she returns. Build path: `alis` skill `build-import` -> upload .xls in ALIS UI. - **[IN PROGRESS, machines ~done / printers lagging as of 2026-07-01] VLAN 20 (CSCNET) staff + printer migration.** Live reconcile 2026-07-01: **22 machines online on VLAN 20**, only CS-SERVER (by design) + ~6 stragglers left on the old LAN. Printer shares only **4/15** repointed (FrontDesk .221, BusinessOffice .220, LifeEnrichment .94, MCReception .78); MCMedTech still stale at 192.168.2.53 though its target 10.0.20.74 is live+reachable (safe repoint held pending the GPO decision). pfSense CS-SERVER->VLAN20 policy-route bypass rule holding. **Next (priority order):** decide reboot-test vs pre-stage-drivers for the Point-and-Print GPO (currently pilot-scoped to DESKTOP-H6QHRR7 only) and take it fleet-wide; repoint MCMedTech + the 4 remaining stale caregiver-GPO shares (NursesPrinter, HealthServices, MCDirector, CopyRoom); repoint `CSC - Life Enrichment Printers` GPO to `\\CS-SERVER\LifeEnrichment`; reboot the MemCare RECEPTIONIST-PC box to apply the MEMCARE-STATION rename (still not applied); domain-join the workgroup boxes (DESKTOP-MD6UQI3, CHEF-PC, MEMCARE-STATION, MEMRECEPT-PC, DESKTOP-LPOPV30) then swap direct-IP printers to server shares. Map: `docs/printer-gpo-map.md`. @@ -730,6 +738,10 @@ Syncro live pull 2026-07-01: **0 open Syncro tickets; 37.5 prepaid hours; 29 man | 2026-06-30 | **VLAN 20 (CSCNET) printer migration.** Migrated Front Desk Epson ET-5800 (.221) + Life Enrichment Canon MF741 (.94) onto VLAN 20 server shares, then dining/chef/medtech/MC-reception. Root-caused a hard blocker: CS-SERVER couldn't reach VLAN 20 printers because the LAN "allow LAN to any" rule policy-routed internal traffic out the WAN (WAN_Group gateway) -- fixed with a top LAN pass rule (gw=default, src CS-SERVER). Established the Point-and-Print policy fix for standard-user driver installs and the Canon UFR-II-only driver requirement (PCL6 -> Error #822). Staged RECEPTIONIST-PC (MemCare box) rename to MEMCARE-STATION. GPO planning doc `docs/printer-gpo-map.md` created. | | 2026-07-01 | **VLAN 20 migration live-reconciled -- much further along than docs showed.** Full GuruRMM fleet pull found **22 machines already on VLAN 20** (only CS-SERVER by design + ~6 stragglers remain on the old LAN), but printer shares lag at **4/15** repointed (MCMedTech still stale 192.168.2.53 despite its live target 10.0.20.74). Rewrote `docs/printer-gpo-map.md` to the live state and updated the `project_cascades_vlan20_migration_routing` memory. No production changes made (read-only reconcile); MCMedTech repoint offered and held pending Howard's GPO go-live decision. Also fixed Howard-Home Tailscale (`UnattendedMode=always`) after it dropped RMM/coord reachability. | | 2026-07-01 | **Caretaker roster update + caregiver phone-login CA cutover.** Reconciled the client's updated caretaker list 1:1 against live AD: disabled 8 (7 leavers + the Lassey duplicate, client confirmed Tele Sepopo Lassey Assiakoley = Celia Lassey) with SG-removal + license reclaim, created 4 new hires (Vallejo, Munezero, Cota, Robinson) with temp passwords vaulted, removed Zeke Huerta from `SG-Caregivers` (front desk, OU move deferred -- Entra Connect sync scope is OU=Caregivers/Groups/Caregiver Devices only), and reaffirmed Nyanzunda stays out (frontline-only rule). `SG-Caregivers` now 35; SPB 45 enabled / 41 consumed. Verified phone/desktop login end-to-end and found + fixed two CA blockers `pilot.test` had masked: the known MFA-exclude bug (added live `SG-Caregivers` to the exclude, fixing the wiki-tracked bug) and the compliance-block policy (`ede985e2`) blocking every device as Intune-noncompliant -- disabled, superseded by the allow-list at final lockdown. Interim posture (Howard's go, overrides the 6/24 hold): caretakers on desktops + phones, on-network only; phones-only lockdown deferred to end of rollout with a tracking list (`docs/cloud/caretaker-phones-only-list.md`). | +| 2026-07-02 | **Caregiver phone login: forced-change gotcha resolved + `PSO-Caregivers` created.** Caregiver temp passwords are used on shared phones that cannot run the "must change password at next logon" flow, so any password expiry re-breaks phone login for the whole cohort. Created a Fine-Grained Password Policy `PSO-Caregivers` on CS-SERVER (never-expire) to stop the 42-day domain `MaxPasswordAge` from re-expiring them (~2026-08-13). Roster cleanup pass alongside. Undo: `Remove-ADFineGrainedPasswordPolicy PSO-Caregivers` (it is `ProtectedFromAccidentalDeletion`). | +| 2026-07-02 | **Shelby Trozzi "Company Web Docs" share + mapped drive.** Made `D:\Shares\Public\Company Web Docs` on CS-SERVER an SMB share gated at the share ACL (Shelby = Change, Admins = Full; NTFS left inherited), so the `Public` NTFS tree stayed untouched. Shelby had never logged into her domain account (`logonCount = 0`) and had no vaulted password; confirmed her OU is outside Entra Connect sync scope, so an on-prem reset was safe -- reset, set never-expires, vaulted. RMM could not push the drive map (`user_session` double-hop -> SMB error 67); worked around with `cmdkey` + a persistent `HKCU:\Network\W` map that mounts at next logon, then mapped it interactively to confirm. | +| 2026-07-09 | **Charity Menle caregiver rename (rename, never re-create).** Resolved that Charity Sika (CSV) and Bariffa Sika (ALIS 309045) are the same person, since legally renamed to Charity Menle; renamed the AD/Entra account to match rather than creating a new object. Established the procedure: `Set-ADUser` for Surname/DisplayName/UPN/EmailAddress, `Rename-ADObject` for the CN, `Set-ADUser -SamAccountName`, then a delta `Start-ADSyncSyncCycle`. Entra export is async -- poll before concluding the sync failed. | +| 2026-07-09 | **Chris Knight granted access to the accounting mailbox.** Added FullAccess (AutoMapping) + SendAs on the `accounting@cascadestucson.com` SharedMailbox via EXO REST `InvokeCommand` (`exchange-op` tier), matching the existing Lauren/Ashley/Zachary delegate tier. Two harness defects surfaced: `consent-audit.sh` graded the tenant RED "app NOT consented" when the real fault was a local vault-path lookup (the tenant was fully consented -- a false negative that points at emailing the client a needless consent link), and a post-write `Get-RecipientPermission` omitted the new SendAs trustee due to EXO replication lag. Both logged to `errorlog.md`. | --- diff --git a/wiki/index.md b/wiki/index.md index 28c367e5..b5b54d89 100644 --- a/wiki/index.md +++ b/wiki/index.md @@ -1,6 +1,6 @@ # Wiki Index -Last updated: 2026-07-08 +Last updated: 2026-07-10 Compiled by: HOWARD-HOME/claude-main (2026-07-06: added Goldstein client article; added Reference section — client Wi-Fi inventory.) @@ -19,7 +19,7 @@ Run `/wiki-lint` to check for stale entries and broken backlinks. | Article | Summary | Last Compiled | |---|---|---| -| [Cascades of Tucson](clients/cascades-tucson.md) | Prepaid block $175/hr, **37.5 hrs remaining** (live 2026-07-01); senior living; active domain migration + HIPAA caregiver-lockdown project (GPOs deployed; Entra Hybrid Join + CA allow-list + ALIS SSO model proven); single DC (CS-SERVER) on aging R610 -- RAID **live-verified HEALTHY 2026-06-24** (the 6/15 "degraded" self-recovered; both mirrors Ok, 1:0:4 = global hot spare; consumer 320GB drives + lost-PSU-redundancy are planned follow-ups, NOT an emergency); cloud backup verified running; **Planned power outage 2026-06-23** clean self-shutdown executed + verified (bring-up ~09:00, John onsite); **Voice VLAN 30 migration COMPLETE 2026-06-19** (~38 devices: 29 Poly + 8 AudioCodes + desktop; awaiting Vertical to set Poly 5GHz-only); **UniFi RF optimized 2026-06-19** (77 U7-Pro APs/~587 clients: 2.4GHz power->Medium on 47 radios + 5GHz clean-DFS 40MHz channel plan -> 5GHz retry halved; 6GHz blocked by WPA3 on PPSK SSID); Syncro 0 open tickets (live EOD 2026-06-25), device-readiness audit done (5 PCs on Win Home need Home->Pro before join); **Alma Montt offboarded 2026-06-25** (Tenant Admin SP left holding a standing PAA role -- removal pending Mike); **CARF Technology & System Plan** deliverable in progress for Ashley Jensen; **endpoint security migration started 2026-06-25** (Datto EDR/AV replacing Bitdefender; 34 agents enrolled); **CS-SERVER: all Datto software removed 2026-06-26**, and the CS-SERVER "SMB error 67" proved to be an RMM-test artifact -- server is healthy, Karen share access verified interactively; **caregiver phone login LIVE 2026-07-01: roster reconciled to 35 (8 offboarded incl. Lassey dup, 4 new hires), two CA blockers fixed (MFA-exclude bug + compliance-block disabled), interim posture = desktops+phones on-network only; ALIS Email=UPN match + 3 new-hire ALIS records pending**; **CSC ENT->VLAN 20 migration (live 2026-07-01): 22 machines on VLAN 20 (only CS-SERVER + ~6 stragglers left on old LAN); printer shares lag at 4/15 repointed; P&P GPO still pilot-scoped**; remaining-work plan: docs/REMAINING-WORK-PLAN.md | 2026-07-01 | +| [Cascades of Tucson](clients/cascades-tucson.md) | Prepaid block $175/hr, **37.5 hrs remaining** (live 2026-07-10); senior living; active domain migration + HIPAA caregiver-lockdown project (GPOs deployed; Entra Hybrid Join + CA allow-list + ALIS SSO model proven); single DC (CS-SERVER) on aging R610 -- RAID **live-verified HEALTHY 2026-06-24** (the 6/15 "degraded" self-recovered; both mirrors Ok, 1:0:4 = global hot spare; consumer 320GB drives + lost-PSU-redundancy are planned follow-ups, NOT an emergency); cloud backup verified running; **Planned power outage 2026-06-23** clean self-shutdown executed + verified (bring-up ~09:00, John onsite); **Voice VLAN 30 migration COMPLETE 2026-06-19** (~38 devices: 29 Poly + 8 AudioCodes + desktop; awaiting Vertical to set Poly 5GHz-only); **UniFi RF optimized 2026-06-19** (77 U7-Pro APs/~587 clients: 2.4GHz power->Medium on 47 radios + 5GHz clean-DFS 40MHz channel plan -> 5GHz retry halved; 6GHz blocked by WPA3 on PPSK SSID); Syncro 0 open tickets (live EOD 2026-06-25), device-readiness audit done (5 PCs on Win Home need Home->Pro before join); **Alma Montt offboarded 2026-06-25** (Tenant Admin SP left holding a standing PAA role -- removal pending Mike); **CARF Technology & System Plan** deliverable in progress for Ashley Jensen; **endpoint security migration started 2026-06-25** (Datto EDR/AV replacing Bitdefender; 34 agents enrolled); **CS-SERVER: all Datto software removed 2026-06-26**, and the CS-SERVER "SMB error 67" proved to be an RMM-test artifact -- server is healthy, Karen share access verified interactively; **caregiver phone login LIVE 2026-07-01: roster reconciled to 35 (8 offboarded incl. Lassey dup, 4 new hires), two CA blockers fixed (MFA-exclude bug + compliance-block disabled), interim posture = desktops+phones on-network only; ALIS Email=UPN match + 3 new-hire ALIS records pending**; **CSC ENT->VLAN 20 migration (live 2026-07-01): 22 machines on VLAN 20 (only CS-SERVER + ~6 stragglers left on old LAN); printer shares lag at 4/15 repointed; P&P GPO still pilot-scoped**; `PSO-Caregivers` never-expire FGPP created 2026-07-02 (stops the 42-day cohort re-break); Shelby "Company Web Docs" share built 2026-07-02; Chris Knight granted FullAccess+SendAs on `accounting@` 2026-07-09; remaining-work plan: docs/REMAINING-WORK-PLAN.md | 2026-07-10 | | [Dataforth Corporation](clients/dataforth.md) | Prepaid block ~$2,099/mo, **30.0 hrs remaining** (live 2026-07-04, 0 open tickets); signal-conditioning manufacturer; 64 DOS test stations; **new 2026-07-04: undocumented MYDATA TPSys SMT line controller (`myserver`, Fedora Core 3, VLAN2) discovered — root recovered via LILO single-user + vaulted; RMM agent ruled out (legacy glibc/kernel/no-systemd)**; test-data-chain audit 2026-07-01 (NWTOC v5.0 spec-copy gap = Syncro #32489); PBX inbound-SIP DNAT emergency fixed 2026-06-23; DFORTH-Ship 0x116 BSOD (aging G1 USDT); 2025 ransomware recovery + incomplete file restore; 2026-03 phishing + MFA; test-datasheet pipeline (Hoffman API + testdatadb on AD2); mail stack INKY->Mailprotector->EXO; shares-ACL project (all open to staff; Phase 2 strawman 2026-06-22); GuruRMM fleet ~45; Bitdefender phase-off | 2026-07-04 | | [Desert RV Center](clients/desert-rv-center.md) | Break-fix + $213.35/mo recurring; RV dealership, Huachuca City AZ; 6 managed devices; DESERTRV.local domain (LAN 10.0.0.0/24); remote users RDP into on-site VMs over **ZeroTier** ("Desert RV" net 172.29.0.0/16); **2026-07-08: restored Alicia's RDP to DRV-BECKY** (stopped ZeroTierOneService = RDP 0x204; started + auto-restart; BECKY + DESKTOP-LBO396F enrolled in GuruRMM); DRV-BECKY firewall locked to RDP-only (no silent RMM push); BECKY slowness pending; 0 open tickets | 2026-07-08 | | [Instrumental Music Center](clients/instrumental-music-center.md) | Prepaid block $175/hr; music retail/repair; AIMsi POS on IMC1\SQLEXPRESS (SQL 2019 Std, misleading name); phantom DC (ServerIMC) slow logons; **two locations split into GuruRMM Main + MOO sites 2026-07-07** (Main 14 agents / MOO 3: BigMom, GHG12G3, IMC-LUIS); full fleet enrolled | 2026-07-07 |