wiki: compile rednour (full) — Carrie Win11 success + corrupt-download root cause, all 3 boxes on Win11, RMM-works correction, Datto AV id, #32368 invoiced

wiki/clients/rednour.md

@@ -2,7 +2,7 @@
 type: client
 name: rednour
 display_name: Rednour Law Offices
-last_compiled: 2026-06-29
+last_compiled: 2026-06-30
 compiled_by: HOWARD-HOME/claude-main
 sources:
   - clients/rednour/reports/2026-05-31-onboard-and-rename-emma-to-carla.md
@@ -28,9 +28,9 @@ sources:
 - **Syncro Customer ID:** 1224246
 - **Contract type:** Break-fix / time-and-materials (prepaid hours: 0)
 - **Recurring line:** ~$59.09/mo (small managed/hosting line)
-- **Labor rate:** (verify — recent labor invoices suggest ~$150-175/hr)
+- **Labor rate:** In-shop / remote $150/hr (confirmed on #32368 + #32343 labor lines); onsite higher (verify)
 - **Managed asset count:** 4 (per Syncro)
-- **Active open tickets:** None as of 2026-06-29
+- **Active open tickets:** None as of 2026-06-30 (#32368 invoiced as #67912)
 - **Primary historical ticket:** Syncro #32343 (id 111409967) — M365 onboarding + email account changes. Status: Invoiced. URL: https://computerguru.syncromsp.com/tickets/111409967
 
 ## Contacts
@@ -62,7 +62,7 @@ All three machines were enrolled by 2026-05-29. Onboarding diagnostic grade: RED
 |---|---|---|---|---|---|---|---|
 | FRONTDESKRECEPT | Dell OptiPlex 3080 | i5-10505 6c/12t | 15.8 GB | Win 11 Pro build 26200 | 192.168.10.115 | 04765560-3e8a-46e5-a507-c5f5f4ead6eb | RED |
 | LEGALASST | Generic OEM | AMD Ryzen 3 3200G 4c/4t | 5.9 GB | Win 11 Pro (upgraded 2026-06-29) | 192.168.10.213 | 18825ea7-df58-47bb-b492-822cb16fb5ec | RED |
-| REDNOURCARRIEVI (rednourcarrievirt) | Generic OEM | i3-9100 4c/4t | 7.7 GB | Win 10 Pro build 19045 | 192.168.10.194 | 8e4e2221-7e2a-4a6f-9eda-864568539961 | RED |
+| REDNOURCARRIEVI (rednourcarrievirt) | Generic OEM | i3-9100 4c/4t | 7.7 GB | Win 11 Pro 25H2 (build 26200, upgraded 2026-06-29) | 192.168.10.194 | 8e4e2221-7e2a-4a6f-9eda-864568539961 | RED |
 
 **Common issues across all three at onboarding:**
 - ScreenConnect (ConnectWise Control) running — prior MSP remote-access agent, not yet removed
@@ -80,8 +80,8 @@ All three machines were enrolled by 2026-05-29. Onboarding diagnostic grade: RED
 - Mapped drives (user `emma`): X: `\\rednourcarrievirt\Time Matters Shared Files`, Y: `\\rednourcarrievirt\Timeslips`, Z: `\\rednourcarrievirt\Documents` — Status OK as of 2026-06-29
 - SFC ran 2026-06-29, repaired corruption (0 unrepairable); repair pending reboot to load
 
-**REDNOURCARRIEVI (rednourcarrievirt) additional:**
-- Win 10 22H2 (build 19045) — EOL since 2025-10-14
+**REDNOURCARRIEVI (rednourcarrievirt) additional (baseline 2026-05-29; box now on Win 11 25H2):**
+- Was Win 10 22H2 (build 19045) at baseline — EOL since 2025-10-14; upgraded to Win 11 25H2 (build 26200) on 2026-06-29
 - Defender real-time protection OFF + antimalware service not running at baseline (critical)
 - Datto RMM running — prior MSP agent, not yet removed
 - C: drive at 11.7% free (54.4 GB of 465.1 GB) at baseline
@@ -153,6 +153,7 @@ All five ComputerGuru SPs are fully consented as of 2026-05-31:
   - 0.5h remote labor (line item 42654682, $75.00, non-taxable, attributed to Mike user_id 1735) — on the existing invoice
   - Comments: 415513323 (hidden/internal), 415514647 (customer-visible), 416427937 (internal — 2026-06-02 follow-up contact fix)
   - Additional onsite labor from 2026-06-25 SMB share work deferred by Howard; Syncro supports multiple invoices per ticket
+- **Hardware/upgrade ticket #32368** (id 111999527) — "New machine for Carrie ... + reception upgrade". **Invoiced 2026-06-29 as #67912, total $669.55:** In-Shop labor (573881) Carrie clone+Win11 1.5h ($225) + FRONTDESKRECEPT NVMe clone 1.0h ($150) + Labor-Remote LEGALASST Win10->11 1.5h ($225, prior session, id 43069980) + hardware (HDMI cable $19.99 + USB-to-HDMI adapter $43.99). Nick's printer setup + future custom phone/desk cables billed as **NO CHARGE** (documented in a public Work Summary note, comment 421331789 — not a line item).
 - **[WARNING] Plaintext local-account passwords in Syncro customer notes** (carrie, ale accounts). These are being vaulted separately — vault migration pending. Do not use Syncro notes as the authoritative credential source.
 
 ## History
@@ -261,7 +262,17 @@ Decoded: `0x8007000D` = `ERROR_INVALID_DATA`; `0x2000C` = failure in the SAFE_OS
 
 Remediation path provided (prioritized): (1) unplug all non-essential externals + temporarily disable third-party AV; (2) build fresh media via the Media Creation Tool and run `setup.exe` from a mounted ISO rather than the in-place download/Update Assistant; (3) clear the upgrade cache (`$WINDOWS.~BT`, `$WINDOWS.~WS`, `SoftwareDistribution\Download`) after stopping wuauserv/bits; (4) DISM RestoreHealth + SFC + chkdsk, confirm 20+ GB free; (5) update storage/chipset drivers (Intel RST / AMD RAID is a classic APPLY_IMAGE culprit).
 
-Howard reported driver updates and OS repairs were already done. He will attempt the upgrade **manually on-site tonight (2026-06-29)** and loop back if it fails. **GuruRMM is not working for Rednour**, so this cannot be assisted remotely — it is a hands-on effort. If the next attempt fails, the actionable next step is to pull the first error from `C:\$WINDOWS.~BT\Sources\Panther\setuperr.log` around the APPLY_IMAGE step.
+Howard reported driver updates and OS repairs were already done. He will attempt the upgrade **manually on-site tonight (2026-06-29)** and loop back if it fails. If the next attempt fails, the actionable next step is to pull the first error from `C:\$WINDOWS.~BT\Sources\Panther\setuperr.log` around the APPLY_IMAGE step. (NOTE: a same-day "GuruRMM not working for Rednour" claim was later DISPROVED — see the evening entry; RMM works on the Windows boxes.)
+
+### 2026-06-29 (evening) — Carrie's machine (REDNOURCARRIEVI) upgraded to Win11 25H2; root cause = corrupt download
+
+**Operator: Howard Enos** (in-shop, ~1.5 hr). After three identical SAFE_OS/APPLY_IMAGE `0x8007000D` failures, diagnosed and resolved live over GuruRMM (agent `8e4e2221...`, v0.6.66 — RMM works fine on this box, contradicting the earlier note).
+
+**Root cause: a corrupt Win11 install image.** The real upstream error in `setuperr.log` was `SPWIMCallback: Error in apply of ...\ks.sys. GLE 1392` -> `CApplyWIM ... Error 0x80070570` (ERROR_FILE_CORRUPT); `0x8007000D` was only the final SAFE_OS rollup. Proven by hashing: the desktop ISO's `install.wim` and the extracted `C:\temp` copy had **identical SHA256** (`9AD2EF7251AED36BCF5E36D4F067B5277C205ED02E3FDFA354069505214C7D54`) = same corrupt bytes (not extraction damage; disk SMART healthy, so not a failing-drive read). The first attempt was additionally masked by running media from the **OneDrive-redirected Desktop** — the `install.wim` was a cloud placeholder, so the offline WinPE/SAFE_OS phase (OneDrive not running) hit `0x80070780` ERROR_CANT_ACCESS_FILE.
+
+**Fix:** re-downloaded via **Media Creation Tool** (`C:\temp\Windows.iso`, ESD-based, label `ESD-ISO` — MCT validates its own download), mounted it, ran `setup.exe` from the mounted drive on local storage. The down-level apply then climbed clean past the ~49% `ks.sys` point (all three prior runs died there), rebooted through SAFE_OS, and booted into **Windows 11 25H2 (build 26200)**. Verified post-upgrade: reboot pending No, `Windows.old` present (10-day rollback window), Datto AV auto-restored Running, Defender RTP Off (expected — Datto AV is primary).
+
+**Billing:** all session work invoiced on #32368 (#67912, $669.55) — see Syncro section. Identified `endpointprotection.exe` for Howard = Datto AV (see Patterns).
 
 ## Patterns & Known Issues
 
@@ -272,10 +283,11 @@ Howard reported driver updates and OS repairs were already done. He will attempt
 - **No MDE license — skip Defender tier.** Defender Add-on is consented but ATP endpoints 650052. Do not attempt Defender-tier calls for this tenant.
 - **Prior MSP agents still installed.** ScreenConnect, Splashtop, and Syncro on all workstations; Datto RMM on REDNOURCARRIEVI. Not yet remediated as of 2026-06-29.
 - **macOS RMM agent installs but does not enroll (site code vs UUID bug).** The macOS install script writes the site enrollment CODE (`GREEN-FALCON-7214`) into `site.plist` as `site_id`. The server's `EnrollRequest.site_id` is typed `uuid::Uuid` — posting the code string causes a 422 UUID deserialization error; the agent retries enrollment forever without connecting. Fix: overwrite `site.plist` with the site UUID `c7f5787c-8e71-45b3-841f-fa52436f7d26` and reload the LaunchDaemon. The paste-block fix was delivered to Howard's Discord DMs (2026-06-26) but has not been applied to Nick's Mac (blocked: no onsite access + no Mac password as of 2026-06-29). Root code fix for Mike: either the install script should stamp the UUID (like the `.pkg` postinstall), or `/api/enroll` should accept a site code. Secondary: add a macOS branch to `default_config_path()` in `agent/src/config.rs`. Coord todo: 6f2d22be-e653-48c8-9f9b-0155420b315d (project gururmm).
-- **LEGALASST upgraded to Win 11 (2026-06-29); REDNOURCARRIEVI still on Win 10 22H2 (EOL).** LEGALASST is now on Win 11 (unsupported-hardware bypass). REDNOURCARRIEVI remains on Win 10 22H2 with no security updates since 2025-10-14 — still needs the upgrade.
-- **GuruRMM is not working for Rednour.** As of 2026-06-29 remote management/remediation via GuruRMM is not usable for this client — any assist must be hands-on / on-site. (Scope verify: whether the agents are offline fleet-wide for Rednour or RMM is simply not a viable path for interactive feature-upgrade work. Note this contradicts earlier live-over-RMM diagnostics on LEGALASST — confirm current agent state before relying on RMM here.)
-- **Win11 in-place upgrade on REDNOURCARRIEVI fails at SAFE_OS / APPLY_IMAGE (`0x8007000D - 0x2000C`).** ERROR_INVALID_DATA while applying the image in the offline phase — points at media/download corruption, storage/disk, or driver/AV/external-device interference, NOT a hardware-compat block. Fix path: fresh ISO via Media Creation Tool + `setup.exe` from mounted ISO, externals unplugged, AV off, upgrade cache cleared, DISM/SFC/chkdsk done. If it recurs, pull the first error from `C:\$WINDOWS.~BT\Sources\Panther\setuperr.log` around APPLY_IMAGE. Drivers + repairs already done by Howard; manual attempt scheduled 2026-06-29 evening.
-- **REDNOURCARRIEVI: Defender was off at onboarding.** Confirm it has been re-enabled; it is a critical finding.
+- **All three workstations now on Win 11 (as of 2026-06-29).** LEGALASST via unsupported-hardware bypass; REDNOURCARRIEVI (Carrie's) to Win 11 25H2 build 26200 on clean Media Creation Tool media; FRONTDESKRECEPT was already Win 11. No remaining Win 10 EOL exposure on the enrolled fleet.
+- **GuruRMM WORKS on Rednour's Windows boxes (corrects an earlier note).** The Windows agents (incl. REDNOURCARRIEVI `8e4e2221...`, v0.6.66) are online and execute commands fine — Carrie's entire upgrade was diagnosed and watched live over `/rmm` on 2026-06-29. Quirk: `/api/agents` returns `is_connected: null` even when `status`="online" and commands complete exit 0 — judge by `status`, not `is_connected`. The client filter uses client_name **"Rednour Law Offices"** (not "rednour") — search by hostname. The only RMM gap is the **macOS** agent (Nick's Mac — separate code-vs-UUID bug below).
+- **[RESOLVED 2026-06-29] Win11 upgrade on REDNOURCARRIEVI failed 3x at SAFE_OS / APPLY_IMAGE (`0x8007000D - 0x2000C`) — root cause was a CORRUPT Win11 download.** The real upstream error was `ks.sys` failing to decompress from the WIM with `0x80070570` (ERROR_FILE_CORRUPT); `0x8007000D` was only the final rollup. Proven by hashing: ISO `install.wim` and the extracted copy had identical SHA256 (`9AD2EF...`) = same corrupt bytes (not extraction damage; SSD healthy). First attempt was also masked by running media from a OneDrive-redirected Desktop (cloud placeholder -> `0x80070780` ERROR_CANT_ACCESS_FILE in WinPE). Fix: re-download via **Media Creation Tool** (validates its own download) and run `setup.exe` from a mounted ISO on LOCAL storage. **Lesson: for repeated APPLY_IMAGE/`ks.sys` corruption, suspect a bad download first — hash the WIM, don't keep retrying the same media.**
+- **`endpointprotection.exe` on these boxes = Datto AV, not malware.** Path `C:\Program Files\infocyte\agent\dattoav\Endpoint Protection SDK\endpointprotection.exe`, service `EndpointProtectionService` ("Endpoint Protection Service"). It's the AV engine inside the Datto EDR/Infocyte agent (ACG-managed, tenant azcomp4587). To pause for a feature upgrade: `Stop-Service EndpointProtectionService -Force` (Auto-start; returns on reboot).
+- **REDNOURCARRIEVI: Defender real-time protection is OFF by design — Datto AV is the registered primary AV** (verified 2026-06-29 post-upgrade: Defender RTP False, Datto AV `EndpointProtectionService` Running). The onboarding "antimalware service not running / Defender off" finding is explained by Datto AV being the active product — confirm Datto AV is healthy rather than expecting Defender RTP on.
 - **REDNOURCARRIEVI: RDP enabled without NLA at onboarding.** Restrict RDP to VPN-only or require NLA.
 - **[RESOLVED 2026-06-29 after Win11 upgrade] LEGALASST: built-in Compressed Folders handler hangs explorer on `.zip` open.** Local zips; Word/PDF fine. `zipfldr.dll` intact (environmental, not a corrupt DLL). AppHang Event 1002, no faulting module. The Win11 in-place upgrade rebuilt the shell/system files and the hang no longer reproduces. 7-Zip 26.02 remains installed as a fallback. If it ever recurs, suspect Defender archive-scan + cloud (MAPS) lookup stalling the shell; to test-disable any shell extension reversibly, add its CLSID to `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Blocked` (delete to restore).
 - **[RESOLVED 2026-06-29 after Win11 upgrade] LEGALASST: WordPerfect 5 "not enough free space" on save** despite verified free space and regardless of save location. Originally hypothesized as a legacy free-space overflow on large-capacity volumes that an OS upgrade would not fix — but it looks resolved after the Win11 upgrade (confirm in normal use). If it recurs, mitigate via DOSBox / SUBST small-capacity drive and confirm WP version/edition.
@@ -290,14 +302,17 @@ Howard reported driver updates and OS repairs were already done. He will attempt
 | P1 | Remove prior MSP agents (ScreenConnect, Splashtop, Syncro, Datto RMM) | Mike/Howard | Present on all 3 machines; Datto RMM on REDNOURCARRIEVI only |
 | DONE | Upgrade LEGALASST to Windows 11 | Howard | 2026-06-29 (remote, ~1.5 hr): in-place upgrade completed via TPM/CPU bypass + `setup.exe /product server`, keep files + apps. Explorer-on-.zip hang and WordPerfect save error both look resolved post-upgrade. Machine is aged/unsupported (Ryzen 3 3200G, 5.9 GB RAM) -> recommend replacement (see below) |
 | P2 | Recommend replacing LEGALASST (age / unsupported hardware) | Howard/Mike | Generic OEM whitebox, AMD Ryzen 3 3200G (2019-era APU), 5.9 GB RAM, no TPM/Secure Boot - outside Win11 support and at end of useful life. Quote a replacement workstation rather than investing further |
-| P1 | Upgrade REDNOURCARRIEVI (Carrie's machine) to Windows 11 | Howard | Win 10 22H2 (EOL 2025-10-14). In-place upgrade fails at SAFE_OS / APPLY_IMAGE `0x8007000D - 0x2000C` (ERROR_INVALID_DATA). Drivers + DISM/SFC/chkdsk already done. Manual attempt scheduled 2026-06-29 evening (fresh ISO, externals unplugged, AV off, cache cleared). RMM not usable for Rednour — hands-on only. If it fails, pull `C:\$WINDOWS.~BT\Sources\Panther\setuperr.log` around APPLY_IMAGE |
-| P1 | Restore/verify GuruRMM functionality for Rednour | Howard/Mike | 2026-06-29: RMM reported not working for this client — confirm scope (agents offline vs not a path for upgrades) and restore remote management |
-| P2 | Bill Carrie-machine / reception-upgrade work to Syncro #32368 | Howard/Mike | Ticket id 111999527, "New machine for Carrie as central hub/file share + reception upgrade" (created 2026-06-02, status Customer Reply). Bill when work complete — route through `/syncro`, do not free-hand |
+| DONE | Upgrade REDNOURCARRIEVI (Carrie's machine) to Windows 11 | Howard | 2026-06-29 (in-shop, 1.5h): completed to Win 11 25H2 build 26200. 3 prior failures were a corrupt Win11 download (`ks.sys` 0x80070570 -> SAFE_OS 0x8007000D); fixed with fresh Media Creation Tool media mounted from local storage. Windows.old present (10-day rollback window) |
+| RESOLVED | GuruRMM functionality for Rednour | Howard | 2026-06-29: GuruRMM WORKS on the Windows boxes (Carrie's upgrade diagnosed live over /rmm). The earlier "not working" note was incorrect / referred to the macOS agent. Only the Mac enrollment remains broken (separate row) |
+| P2 | Verify SMB shares + local accounts survived Carrie's Win11 upgrade | Howard | Feature upgrades can reset sharing/firewall. Confirm Documents / Time Matters / Timeslips shares + local accounts (carrie/nick/emma) still work (Nick's Mac mounts `smb://192.168.10.194/Documents`; mapped X/Y/Z on LEGALASST) |
+| P3 | Carrie's machine: let `Windows.old` ride until ~2026-07-09 | Howard | Don't run Disk Cleanup until Carrie confirms Time Matters / Timeslips / WordPerfect work on Win 11 — preserves the 10-day rollback |
+| P3 | Carrie: deliver the correct USB-C/HDMI adapter | Howard | Interim USB-to-HDMI adapter provided + billed on #32368; swap when the proper adapter arrives |
+| DONE | Bill Carrie-machine / reception-upgrade work to Syncro #32368 | Howard | 2026-06-29: invoiced as #67912, $669.55 (in-shop Carrie clone+Win11 1.5h + FRONTDESKRECEPT NVMe clone 1.0h + LEGALASST remote 1.5h prior + hardware). Public Work Summary note added; Nick = no charge |
 | P1 | Fix GuruRMM macOS agent enrollment on Nick's Apple Silicon Mac | Howard/Mike | Agent installs but does not enroll. Root cause: install script writes site CODE not UUID; server expects UUID. Fix = overwrite `/usr/local/etc/gururmm/site.plist` with `site_id = c7f5787c-8e71-45b3-841f-fa52436f7d26` and reload LaunchDaemon. Paste-block delivered to Howard's Discord DMs (2026-06-26). Blocked: need onsite access + Mac password. Code fix for Mike: enroll.rs accept site code OR install script stamp UUID. Coord todo 6f2d22be |
 | P1 | Vault migration of plaintext local-account passwords in Syncro customer notes | Howard/Mike | Accounts carrie, ale; not yet vaulted |
 | DONE | LEGALASST: WordPerfect 5 "not enough free space" on save | Howard | 2026-06-29: looks resolved after the Win11 upgrade (contradicts earlier "OS upgrade won't fix" hypothesis - confirm in normal use). If it recurs, mitigate via DOSBox / SUBST small-capacity drive |
 | DONE | LEGALASST: built-in zip-handler explorer hang | Howard | 2026-06-29: looks resolved after the Win11 upgrade (shell/system files rebuilt). 7-Zip 26.02 remains installed as a fallback; setting it default for `.zip` is now optional |
-| P2 | Return visit: phone + printer setup at Rednour | Howard | 2026-06-25: pending; may require running a new wire / installing a switch |
+| P2 | Return visit: Nick's custom phone/desktop cables | Howard | Printer setup DONE (no charge). Returning with a box of cable to make custom cables so Nick can place the phone where he wants while keeping it connected to his desktop. Phone/printer wiring may still need a new run / switch |
 | P2 | Final invoice on Syncro #32343 | Mike | 0.5h remote labor (line item 42654682) sitting on Invoiced ticket; additional onsite labor from 2026-06-25 SMB share work deferred by Howard |
 | P2 | Address BitLocker gap on FRONTDESKRECEPT | Mike/Howard | OS volume unencrypted at onboarding |
 | P2 | Confirm Nick's Mac is actually `DUXs-Mac-Studio` | Howard | ScreenConnect shows this name; "Dux" username may indicate it's not Nick's machine — verify before enrolling |

wiki/index.md

@@ -31,7 +31,7 @@ Run `/wiki-lint` to check for stale entries and broken backlinks.
 | [Grabb & Durando Law Office](clients/grabb-durando.md) | Personal injury law firm; GND-SERVER GuruRMM enrolled; AI demand review app scoped ($4K–$7K); website migration pending; plaintext DB password in README needs vaulting | 2026-05-24 |
 | [Pavon](clients/pavon.md) | Former/archive client; GeoVision NVR surveillance; OwnCloud at 172.16.3.22 backed by Uranus; cron stacking fixed; Nextcloud migration deferred 3–6 months | 2026-05-24 |
 | [Rieusset Corp (Tom Sorensen)](clients/rieusset-corp.md) | Small business; email hosted on Neptune Exchange (4 mailboxes: tsorensen, tomrc, ojodeagua, csorensen @rieussetcorp.com); Mailprotector domain ID 57833; outbound via SBR Outbound.Sorensen connector; clipto.com allow rule added 2026-06-08 | 2026-06-08 |
-| [Rednour Law Offices](clients/rednour.md) | Law firm (break-fix/T&M, prepay 0); M365 rednourlaw.com (tenant 4a4ca18a) onboarded, 5 ComputerGuru SPs consented, no MDE license; 3 Win workstations GuruRMM-enrolled (all RED, prior MSP agents pending removal); REDNOURCARRIEVI hosts the firm's peer-to-peer SMB shares (Nick's Mac access done 2026-06-25); **LEGALASST explorer hangs on .zip open (built-in Compressed Folders handler) — 7-Zip workaround + Win11 upgrade planned**; WordPerfect 5 "not enough free space" save error (legacy large-volume bug, OS upgrade won't fix); macOS RMM agent installs but won't enroll (site code-vs-UUID bug, fix staged, coord 6f2d22be); **Carrie's machine (REDNOURCARRIEVI) Win11 upgrade fails at SAFE_OS/APPLY_IMAGE 0x8007000D-0x2000C — manual attempt 2026-06-29 eve; GuruRMM not working for Rednour (hands-on only)**; plaintext local-account creds from Syncro notes vaulted (clients/rednour/local-accounts) | 2026-06-29 |
+| [Rednour Law Offices](clients/rednour.md) | Law firm (break-fix/T&M, prepay 0); M365 rednourlaw.com (tenant 4a4ca18a) onboarded, 5 ComputerGuru SPs consented, no MDE license; 3 Win workstations GuruRMM-enrolled (all RED, prior MSP agents pending removal) — **all three now on Win 11** (LEGALASST + Carrie/REDNOURCARRIEVI upgraded 2026-06-29); REDNOURCARRIEVI hosts the firm's peer-to-peer SMB shares (Nick's Mac access done 2026-06-25); **Carrie's Win11 upgrade root cause = corrupt download (`ks.sys` 0x80070570 -> SAFE_OS 0x8007000D); fixed via fresh Media Creation Tool media — done in-shop, build 26200**; GuruRMM **works** on the Windows boxes (earlier "not working" disproved); macOS RMM agent still won't enroll (site code-vs-UUID bug, coord 6f2d22be); `endpointprotection.exe` = Datto AV (Defender RTP off by design); #32368 invoiced #67912 $669.55 (Nick = no charge); plaintext local-account creds from Syncro notes vaulted (clients/rednour/local-accounts) | 2026-06-30 |
 | [Peaceful Spirit Therapeutic Massage](clients/peaceful-spirit.md) | Massage therapy practice; PST-SERVER (192.168.0.2) + 5 GuruRMM agents; L2TP/IPsec RRAS VPN complete; 2026-06-04 site-wide outage resolved (UDR Ultra reboot dropped VPN port-forward, re-added in controller); BridgettePSHomeComputer re-enrolled (new UUID 01160fc8); vault drift open (pst-admin password); Syncro 278525 (Peaceful Spirit Massage) | 2026-06-04 |
 | [Patriot Internal Medicine](clients/patriot-internal-medicine.md) | Medical practice, two locations (Tucson + Sonoita); GuruRMM client+sites provisioned 2026-06-18 (Tucson: NORTH-WOLF-6270, Sonoita: LIGHT-HARBOR-9617); no agents deployed yet; enrollment keys vaulted; infrastructure discovery pending | 2026-06-18 |
 | [Sombra Residential LLC](clients/sombra-residential.md) | Property management; Server2013 (actually WS2012 EOL, unpatched) + DESKTOP-UQRN4K3 GuruRMM enrolled; Transwiz migration artifacts cause Office credential prompts | 2026-05-24 |