sync: auto-sync from GURU-5070 at 2026-06-11 08:02:42

Author: Mike Swanson
Machine: GURU-5070
Timestamp: 2026-06-11 08:02:42

wiki/clients/wolkin.md

@@ -88,7 +88,7 @@ backlinks: []
 ## Patterns & Known Issues
 - **macOS Syncro JSON parsing:** Syncro customer lookup from Mac failed due to JSON parsing issues (2026-06-07). Use Windows PC for Syncro API operations or manual web portal lookups.
 - **ZeroTier print RPC needs Private profile:** File-and-Printer-Sharing inbound rules (incl. Print Spooler RPC) apply to the Private profile only. The ZeroTier interface was Public on both FRONT and RSW-Laptop, which blocked print/RPC over ZT while file SMB still worked. Fix: set the ZT interface Private on both ends. (Confirmed still Private both ends 2026-06-11.)
-- **[KNOWN WALL] RSW-Laptop SMB to FRONT fails `net use`/`net view` with error 67 / RPC 1702 — scripted connection does NOT work; connect interactively.** First hit 2026-06-07, again 2026-06-11. Symptom: `net use \\FRONT\IPC$` (and by IP `\\10.147.19.199\IPC$`) → **System error 67 "network name cannot be found"**, `net view \\FRONT` → **1702 "binding handle invalid"** — even though everything underneath is healthy: ZeroTier up, name resolves, **TCP 445/139 open**, MTU 2800 carries full DF packets, FRONT spooler running + `Sharp` shared + profile Private + SMB-In allowed, laptop ZT adapter bindings (`ms_msclient`/`ms_server`) all present, and **error 67 persists even with valid `FRONT\julie` creds** (so it is NOT auth, NOT firewall, NOT MTU, NOT bindings, NOT profile). The scripted `Add-Printer -ConnectionName \\FRONT\Sharp` also throws error 67. **What works: a hands-on interactive connection via ScreenConnect as Julie** (how Mike cleared it 2026-06-07). Root cause of the redirector quirk over ZeroTier is still unidentified; do NOT burn hours re-deriving the plumbing — it is all verified clean. Diagnostic tip: `Get-NetAdapterBinding -Name "ZeroTier One [..]"` returns empty because the `[ ]` in the adapter name are treated as wildcards — query by `-InterfaceDescription "ZeroTier Virtual Port"` or pipe the adapter object.
+- **[MEASUREMENT ARTIFACT — not a real fault] SMB/printer tests via the GuruRMM agent give FALSE error 67 / RPC 1702; the real interactive session works.** The printer to `\\front\Sharp` **works** for Julie when she is logged in (confirmed 2026-06-11 by remoting in). But every SMB test run through the **GuruRMM agent's `user_session` context fails** — `net use \\FRONT\IPC$` (and by IP) → System error 67, `net view` → RPC 1702, `Add-Printer -ConnectionName` → 67 — **even with valid `FRONT\julie` creds.** Cause: RMM `user_session` is a **WTS-impersonated, non-interactive token**, which cannot establish an authenticated SMB session to a remote host (the network second-hop/credential context isn't there). It is NOT measuring what Julie's real logon sees. The underlying plumbing is genuinely fine (ZeroTier up, 445/139 open, MTU 2800 full DF, FRONT shared + Private + SMB-In, bindings present) — which is why it prints interactively. **Rule: do NOT use RMM `net use`/`net view`/`Add-Printer` to judge SMB/printer health to a remote host — its 67/1702 means "can't tell," not "broken." Verify via the real session (ScreenConnect).** The 2026-06-07 "wall" was this same artifact (Mike's "manual fix" worked only because it was interactive). See [[../../.claude/memory/feedback_rmm_user_session_smb_false_negative]]. Unrelated tip: `Get-NetAdapterBinding -Name "ZeroTier One [..]"` returns empty because `[ ]` are PowerShell wildcards — use `-InterfaceDescription "ZeroTier Virtual Port"`.
 - **Canonical data is local, not OneDrive:** the firm's repository is `C:\Shared Data\CLIENT FILES` on FRONT (local). OneDrive copies under `OneDrive\Documents` / `OneDrive\Shared Data` were stale predecessors from a defunct Resilio/ownCloud sync setup — consolidated and removed 2026-06-08. Win11 Home does not surface the Explorer "Previous Versions" tab; VSS restores are admin-side (mount the shadow volume).
 
 ## Active Work
@@ -99,7 +99,8 @@ backlinks: []
   - [x] Printer access via ZeroTier (Sharp `\\front\Sharp` over ZT; ZT set Private both ends; FRONT moved to TCP/IP 9100)
   - [x] ClientFiles share repointed to canonical `C:\Shared Data\CLIENT FILES` + data consolidated + VSS enabled (2026-06-08)
 - **Open follow-ups:**
-  - [ ] **RSW-Laptop printer broken again (2026-06-11):** Julie reports "no printers." `\\front\Sharp` is mapped but the SMB session to FRONT fails (error 67 — see Patterns). Plumbing verified clean; needs a **ScreenConnect/interactive reconnect** as Julie (scripted won't work). Consider rotating `front\julie` afterward (its password transited the RMM command log during diagnosis).
+  - [x] **RSW-Laptop printer — WORKING (2026-06-11).** Julie's "no printers" report did not reproduce in her real session; Mike remoted in and `\\front\Sharp` prints fine. The RMM-side error 67 was a measurement artifact (see Patterns), not a real fault. Original report was likely transient (pre-reboot / momentary ZT hiccup).
+  - [ ] **Rotate `front\julie`** — its password transited the RMM command log during diagnosis; rotate + re-vault `clients/wolkin/front-julie.sops.yaml`.
   - [x] **Migrate `front\julie` + M365 creds to vault** — DONE 2026-06-11 (`clients/wolkin/front-julie.sops.yaml`, `clients/wolkin/m365-users.sops.yaml`).
   - [x] **Consolidate the four Wolkin slugs** — DONE 2026-06-11 (canonical `wolkin`; wolkin-law/rswolkin/robert-wolkin stubbed).
   - [ ] Bob to file the 67 loose docs in `CLIENT FILES\Closed Files\_From OneDrive Documents`.