sync: auto-sync from HOWARD-HOME at 2026-04-22 17:39:56

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-04-22 17:39:56

clients/cascades-tucson/docs/migration/phase4-synology.md

@@ -1,5 +1,86 @@
 # Step 6: Synology Transition (~2 hours, remote)
 
+**Pre-requisite before any of the 6.x steps below:** a permission inventory of the live Synology must be captured and translated into AD group memberships, and CS-SERVER's NTFS + SMB permissions on the synced shares must match before users' drives get remapped. That work lives in §6.0.
+
+---
+
+## 6.0 — Permission inventory + CS-SERVER ACL application (pre-cutover)
+
+**Why:** Synology Drive Client has been live-syncing `\\cascadesds\*` → `D:\Shares\Main` on CS-SERVER since 2026-03-07 (per `phase2-server-prep.md` §4c). Sync copies the files but **not** the permissions — CS-SERVER's shares inherit whatever the script in `phase2-file-shares.ps1` applies, which currently assumes AD security group memberships that are correct for the target state. Those group memberships are empty or incomplete today.
+
+Before users' mapped drives switch from Synology to CS-SERVER, the ACLs on CS-SERVER must replicate current Synology access rights. Do this in three steps.
+
+### 6.0.1 — Discovery (non-destructive, no maintenance window needed)
+
+SSH into `admin@192.168.0.120` (credentials at `clients/cascades-tucson/synology-cascadesds.sops.yaml`). Run:
+
+```bash
+sudo synogroup --list
+sudo synouser --list
+sudo cat /etc/synoinfo.conf | grep -iE 'share|mode'
+for share in homes Management SalesDept Server chat Public Culinary IT Receptionist directoryshare; do
+    echo "=== $share ==="
+    sudo synoacltool -get /volume1/$share
+    sudo synoshare --get "$share" 2>/dev/null || true
+done
+```
+
+Paste the output into a new file `docs/migration/synology-permission-inventory.md` with one section per share. Capture:
+
+- Owner, group, mode (bitmask)
+- Per-user ACL entries (read / write / delete / changeperm)
+- Per-group ACL entries
+- SMB-share-level permission overrides
+- Inheritance flags
+
+### 6.0.2 — Map Synology accounts to AD
+
+Produce a translation table in the inventory doc:
+
+| Synology identity | AD identity | Notes |
+|---|---|---|
+| `admin` | Domain Admins | keep |
+| `meredith.kuhn` (Synology local) | `Meredith.Kuhn` (AD) | same human |
+| Synology group `Management` | AD `SG-Management-RW` | direct 1:1 |
+| Synology group `Marketing` | AD `SG-Sales-RW` | renamed |
+| ... | ... | ... |
+
+Any Synology account with no AD equivalent either (a) corresponds to a departed employee and gets dropped, or (b) is a new account we need to create in AD first (feeds back into the user rollout waves).
+
+### 6.0.3 — Apply to CS-SERVER + HIPAA additions
+
+Update `scripts/phase2-file-shares.ps1` inputs to reflect the mapping, then run on CS-SERVER. After shares + NTFS are applied, add HIPAA-review-required settings per `docs/security/hipaa-review-2026-04-22.md`:
+
+```powershell
+# Enable SMB3 encryption on every PHI-containing share (addresses 164.312(a)(2)(iv), (e)(2)(ii))
+foreach ($share in 'homes','Management','SalesDept','Server','chat','Culinary','IT','Receptionist','directoryshare') {
+    Set-SmbShare -Name $share -EncryptData $true -Force
+}
+
+# Enable Object Access auditing on the PHI file-share root (addresses 164.312(b))
+auditpol /set /subcategory:"File System" /success:enable /failure:enable
+# NTFS SACL — audit reads+writes on D:\Shares and subtree
+$acl = Get-Acl D:\Shares
+$auditRule = New-Object System.Security.AccessControl.FileSystemAuditRule(
+    'Everyone','ReadData,WriteData,Delete,ChangePermissions','ContainerInherit,ObjectInherit','None','Success,Failure')
+$acl.AddAuditRule($auditRule)
+Set-Acl D:\Shares $acl
+```
+
+Verify with:
+
+```powershell
+Get-SmbShare | Select-Object Name, EncryptData
+Get-Acl D:\Shares -Audit | Format-List
+auditpol /get /subcategory:"File System"
+```
+
+### 6.0.4 — Validation before any user is cut over
+
+Pick one pilot user (Sharon Edwards on DESKTOP-DLTAGOI — already our folder-redirection pilot). Map her CS-SERVER drives manually, open representative files from each share she currently uses on Synology, verify open/save/delete works. Do not touch the GPO drive maps or run §6.1 below until the pilot validates cleanly.
+
+**Rollback at this stage:** no user impact — just don't push the GPO change, and the Synology shares remain authoritative.
+
 ---
 
 ## 6.1 — Verify drive mappings