sync: auto-sync from HOWARD-HOME at 2026-04-22 17:39:56
Author: Howard Enos Machine: HOWARD-HOME Timestamp: 2026-04-22 17:39:56
This commit is contained in:
@@ -0,0 +1,89 @@
|
||||
# CS-SERVER Entra Connect Pre-flight Remediation Result
|
||||
|
||||
**Command ID:** 1bb38813-57ae-4321-ba81-e8dc7ea4a30d
|
||||
**Run at:** 2026-04-23T00:37:14.365639Z
|
||||
**Completed:** 2026-04-23T00:39:04.479126Z
|
||||
**Exit code:** 0
|
||||
|
||||
## STDOUT
|
||||
|
||||
```
|
||||
|
||||
|
||||
========================================================================
|
||||
|
||||
== 0. Pre-flight snapshot (rollback material)
|
||||
|
||||
========================================================================
|
||||
|
||||
[OK] Backup dir: D:\Backups\pre-entra-connect-2026-04-22-1736
|
||||
|
||||
[OK] Registry pre-state exported (.NET + Schannel Protocols)
|
||||
|
||||
[OK] w32tm pre-state captured
|
||||
|
||||
[OK] Event log snapshot saved (200 System events)
|
||||
|
||||
|
||||
|
||||
To roll back TLS changes after reboot:
|
||||
reg import D:\Backups\pre-entra-connect-2026-04-22-1736\dotnet-64.reg
|
||||
reg import D:\Backups\pre-entra-connect-2026-04-22-1736\dotnet-32.reg
|
||||
reg import D:\Backups\pre-entra-connect-2026-04-22-1736\schannel-protocols-pre.reg
|
||||
Restart-Computer
|
||||
|
||||
|
||||
|
||||
========================================================================
|
||||
|
||||
== 1. Time sync fix (w32tm) - no reboot
|
||||
|
||||
========================================================================
|
||||
|
||||
[OK] Configured w32tm peer list: time.windows.com,0x8 pool.ntp.org,0x8 time.nist.gov,0x8
|
||||
|
||||
[OK] Restarted w32time service
|
||||
|
||||
Leap Indicator: 0(no warning)
|
||||
|
||||
Stratum: 4 (secondary reference - syncd by (S)NTP)
|
||||
|
||||
Precision: -23 (119.209ns per tick)
|
||||
|
||||
Root Delay: 0.0311588s
|
||||
|
||||
Root Dispersion: 61.0046385s
|
||||
|
||||
ReferenceId: 0x287706E4 (source IP: 40.119.6.228)
|
||||
|
||||
Last Successful Sync Time: 4/22/2026 5:36:28 PM
|
||||
|
||||
Source: time.windows.com,0x8
|
||||
|
||||
Poll Interval: 6 (64s)
|
||||
|
||||
|
||||
|
||||
[OK] ReferenceId: ReferenceId: 0x287706E4 (source IP: 40.119.6.228) (no longer LOCL)
|
||||
|
||||
|
||||
|
||||
========================================================================
|
||||
|
||||
== 2. TLS 1.2 enforcement (.NET + Schannel) - requires reboot
|
||||
|
||||
========================================================================
|
||||
|
||||
[OK] .NET TLS keys set at HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319
|
||||
|
||||
[OK] .NET TLS keys set at HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319
|
||||
|
||||
[OK] Disabled TLS 1.0 Client
|
||||
|
||||
[OK] Disabled TLS 1.0 Server
|
||||
|
||||
[OK] Disabled TLS 1.1 Client
|
||||
|
||||
[OK] Disabled TLS 1.1 Server
|
||||
|
||||
[OK] Enabled TLS 1.2 Client
|
||||
@@ -0,0 +1,122 @@
|
||||
# CS-SERVER Entra Connect Readiness — Verdict
|
||||
|
||||
**Executed:** 2026-04-22 17:26 MST (via GuruRMM agent `6766e973-e703-47c1-be56-76950290f87c`)
|
||||
**Exit code:** 0
|
||||
**Full output:** `reports/2026-04-22-cs-server-entra-readiness.md`
|
||||
**Script source:** `docs/migration/scripts/entra-connect-readiness.ps1`
|
||||
|
||||
## Overall verdict
|
||||
|
||||
**READY to install Entra Connect, after addressing three small pre-install items.** No hard blockers. Hardware / OS / AD / network environment all meet requirements.
|
||||
|
||||
## PASS (13 checks)
|
||||
|
||||
| Check | Result |
|
||||
|---|---|
|
||||
| Operating system | Windows Server 2019 Standard, build 17763 (≥2016 required) |
|
||||
| .NET Framework | 4.8 (release 528049, ≥4.7.2 required) |
|
||||
| PowerShell | 5.1.17763.8510 (≥5.0 required) |
|
||||
| Disk space | C: 149 GB free / D: 548 GB free |
|
||||
| AD domain / forest mode | Windows2016Forest / Windows2016Domain |
|
||||
| AD Schema version | 88 (Windows Server 2019) |
|
||||
| FSMO roles | All 5 on CS-SERVER (expected for single DC) |
|
||||
| AD size | 44 users, 55 groups, 18 OUs — small enough for fast sync |
|
||||
| Internet to Microsoft | All 7 sync endpoints reach on HTTPS 443 |
|
||||
| WinHTTP proxy | Direct access, no proxy config needed |
|
||||
| Existing AAD/Entra Sync | None — clean install target |
|
||||
| DC health (dcdiag) | Connectivity / Advertising / Services / FsmoCheck all pass |
|
||||
| CPU / RAM headroom | 1% CPU, 27% of 48 GB RAM used |
|
||||
|
||||
## Pre-install items to fix (in order)
|
||||
|
||||
### 1. Time sync — HIGHEST priority
|
||||
|
||||
Currently free-running on the local system clock. `w32tm /query /status` reports:
|
||||
|
||||
- `Source: Free-running System Clock`
|
||||
- `ReferenceId: 0x4C4F434C ("LOCL")`
|
||||
- `Last Successful Sync Time: 4/21/2026 8:31:32 PM` (~21 hours ago at time of check)
|
||||
- Peer state: `Pending`
|
||||
|
||||
Cloud sync has a ±5-minute drift tolerance. A PDC emulator with no external NTP source will drift over days and Entra Connect will start failing intermittently. As the PDC, it's also supposed to be the authoritative time source for the domain — so every other machine is inheriting this drift.
|
||||
|
||||
**Fix (no reboot needed):**
|
||||
|
||||
```powershell
|
||||
w32tm /config /manualpeerlist:"time.windows.com,0x8 pool.ntp.org,0x8 time.nist.gov,0x8" /syncfromflags:manual /reliable:yes /update
|
||||
Restart-Service w32time
|
||||
w32tm /resync /force
|
||||
w32tm /query /status # verify Source is no longer "Free-running"
|
||||
```
|
||||
|
||||
### 2. Backup before install — safety net
|
||||
|
||||
Per the earlier audit, **Windows Server Backup feature is Available but not Installed** and there's no documented Synology ABB of CS-SERVER. Entra Connect install touches the AD schema (extends it with a couple of attributes) and creates a service account. If anything goes sideways, we need a rollback path.
|
||||
|
||||
**Fix:**
|
||||
|
||||
```powershell
|
||||
Install-WindowsFeature Windows-Server-Backup
|
||||
# One-shot full backup + system state to Synology SMB share
|
||||
wbadmin start backup -backupTarget:\\CASCADESDS\Backups\CS-SERVER -include:C:,D: -allCritical -vssFull -quiet
|
||||
```
|
||||
|
||||
(Or use existing Synology ABB if configured — confirm it covers CS-SERVER before install.)
|
||||
|
||||
### 3. TLS 1.2 explicit enforcement — HIPAA + defense in depth
|
||||
|
||||
Server 2019 defaults to TLS 1.2 enabled, so Entra Connect will work today. But the Schannel registry entries are "unset (OS default)" and `.NET SchUseStrongCrypto` is set on 64-bit but missing on 32-bit. Best practice (and cleaner audit story) is to explicitly enable TLS 1.2 and disable 1.0/1.1.
|
||||
|
||||
**Fix (REQUIRES REBOOT for Schannel):**
|
||||
|
||||
```powershell
|
||||
# .NET side (takes effect immediately for new processes)
|
||||
$paths = @(
|
||||
'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319',
|
||||
'HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319'
|
||||
)
|
||||
foreach ($p in $paths) {
|
||||
New-Item -Path $p -Force | Out-Null
|
||||
Set-ItemProperty -Path $p -Name SchUseStrongCrypto -Type DWord -Value 1
|
||||
Set-ItemProperty -Path $p -Name SystemDefaultTlsVersions -Type DWord -Value 1
|
||||
}
|
||||
|
||||
# Schannel side (requires reboot)
|
||||
$base = 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols'
|
||||
foreach ($proto in 'TLS 1.0','TLS 1.1') {
|
||||
foreach ($role in 'Client','Server') {
|
||||
$k = "$base\$proto\$role"
|
||||
New-Item -Path $k -Force | Out-Null
|
||||
Set-ItemProperty -Path $k -Name Enabled -Type DWord -Value 0
|
||||
Set-ItemProperty -Path $k -Name DisabledByDefault -Type DWord -Value 1
|
||||
}
|
||||
}
|
||||
foreach ($role in 'Client','Server') {
|
||||
$k = "$base\TLS 1.2\$role"
|
||||
New-Item -Path $k -Force | Out-Null
|
||||
Set-ItemProperty -Path $k -Name Enabled -Type DWord -Value 1
|
||||
Set-ItemProperty -Path $k -Name DisabledByDefault -Type DWord -Value 0
|
||||
}
|
||||
# Then: Restart-Computer
|
||||
```
|
||||
|
||||
Schedule this for a maintenance window since it requires a reboot of the only DC.
|
||||
|
||||
## Observations (not blockers)
|
||||
|
||||
- **Windows Internal Database (`MSSQL$MICROSOFT##WID`) running** — likely AD Certificate Services or a legacy role. No conflict with Entra Connect's SQL Server LocalDB. Check if still needed.
|
||||
- **QBVSS (QuickBooks VSS) running** — QuickBooks on a DC is already known issue #17 per `hipaa.md`. Not blocking. Keep on long-term cleanup list.
|
||||
- **Event log: 3 System errors + 4 Application errors last 24h** — Firefox browser agent, TPM-WMI (benign on non-TPM hardware), DistributedCOM, .NET Runtime, Security-SPP (licensing). None critical. Not blocking.
|
||||
- **Expired self-signed cert `CN=CS-SERVER.cascades.local`** — known issue #19 (hipaa.md), unrelated to Entra Connect (which uses its own cert for the sync service account).
|
||||
|
||||
## Recommended pre-install sequence
|
||||
|
||||
1. Run the time-sync fix immediately — no downtime, fixes drift right away
|
||||
2. Install Windows Server Backup, run a full backup to Synology share (~30 min depending on D: size)
|
||||
3. Schedule TLS reboot window (tell Meredith — brief disruption)
|
||||
4. After reboot, re-verify with the readiness script (same command, same agent)
|
||||
5. Proceed with Wave 0.5 Entra Connect install
|
||||
|
||||
## Hardware note (not changed by this check)
|
||||
|
||||
CS-SERVER is still the 2009-era Dell R610 with consumer SATA drives carrying C: (the OS drive Entra Connect installs on). This check confirms it's *ready* for Entra Connect — it does not change the underlying "extreme failure risk" status noted in the issue tracker. Entra Connect adds one more critical dependency on aging hardware. A second DC on modern hardware is still the right long-term fix, independent of this rollout.
|
||||
@@ -0,0 +1,246 @@
|
||||
# CS-SERVER Entra Connect Readiness Check Result
|
||||
|
||||
**Run at:** 2026-04-23T00:27:11.103711Z
|
||||
**Completed:** 2026-04-23T00:27:31.663891Z
|
||||
**Exit code:** 0
|
||||
**Command ID:** 83d558be-2a76-416a-b135-1551060ae661
|
||||
|
||||
---
|
||||
|
||||
## STDOUT
|
||||
|
||||
```
|
||||
Entra Connect Readiness Check - 2026-04-22 17:26:18 -07:00
|
||||
|
||||
Host: CS-SERVER
|
||||
|
||||
|
||||
|
||||
============================================================================
|
||||
|
||||
== 1. Operating System
|
||||
|
||||
============================================================================
|
||||
|
||||
OS Caption : Microsoft Windows Server 2019 Standard
|
||||
|
||||
OS Version : 10.0.17763
|
||||
|
||||
OS Build : 17763
|
||||
|
||||
Architecture : 64-bit
|
||||
|
||||
Install Date : 8/4/2024 6:39:38 PM
|
||||
|
||||
Last Boot : 4/14/2026 8:29:03 PM
|
||||
|
||||
Uptime (days) : 7.9
|
||||
|
||||
[OK] Server 2016+ required : Microsoft Windows Server 2019 Standard -> PASS
|
||||
|
||||
|
||||
|
||||
============================================================================
|
||||
|
||||
== 2. .NET Framework version
|
||||
|
||||
============================================================================
|
||||
|
||||
.NET Framework version : System.Object[]
|
||||
|
||||
.NET release key : 528049
|
||||
|
||||
[OK] .NET 4.7.2+ required : 4.8 4.7.2 4.7.1 4.7 4.6.2 -> PASS
|
||||
|
||||
|
||||
|
||||
============================================================================
|
||||
|
||||
== 3. PowerShell
|
||||
|
||||
============================================================================
|
||||
|
||||
PSVersion : 5.1.17763.8510
|
||||
|
||||
PSEdition : Desktop
|
||||
|
||||
[OK] PS 5.0+ required : 5.1.17763.8510 -> PASS
|
||||
|
||||
|
||||
|
||||
============================================================================
|
||||
|
||||
== 4. TLS 1.2 configuration
|
||||
|
||||
============================================================================
|
||||
|
||||
.NET SchUseStrongCrypto (64-bit) : 1
|
||||
|
||||
.NET SchUseStrongCrypto (32-bit) :
|
||||
|
||||
.NET SystemDefaultTlsVersions (64) :
|
||||
|
||||
.NET SystemDefaultTlsVersions (32) :
|
||||
|
||||
SCHANNEL TLS 1.0 Client : unset (OS default)
|
||||
|
||||
SCHANNEL TLS 1.1 Client : unset (OS default)
|
||||
|
||||
SCHANNEL TLS 1.2 Client : unset (OS default)
|
||||
|
||||
SCHANNEL TLS 1.0 Server : unset (OS default)
|
||||
|
||||
SCHANNEL TLS 1.1 Server : unset (OS default)
|
||||
|
||||
SCHANNEL TLS 1.2 Server : unset (OS default)
|
||||
|
||||
(Entra Connect requires TLS 1.2 client enabled; TLS 1.0/1.1 should be disabled per HIPAA best practice.)
|
||||
|
||||
|
||||
|
||||
============================================================================
|
||||
|
||||
== 5. Disk space
|
||||
|
||||
============================================================================
|
||||
|
||||
Drive C: : 149.4 GB free of 296.9 GB (50.3% free)
|
||||
|
||||
Drive D: : 548.5 GB free of 1117.2 GB (49.1% free)
|
||||
|
||||
(Entra Connect needs ~5-20 GB free on install drive, typically C:.)
|
||||
|
||||
|
||||
|
||||
============================================================================
|
||||
|
||||
== 6. AD Domain + FSMO roles
|
||||
|
||||
============================================================================
|
||||
|
||||
Domain : cascades.local
|
||||
|
||||
NetBIOS name : CASCADES
|
||||
|
||||
Forest mode : Windows2016Forest
|
||||
|
||||
Domain mode : Windows2016Domain
|
||||
|
||||
Schema master : CS-SERVER.cascades.local
|
||||
|
||||
Domain naming master : CS-SERVER.cascades.local
|
||||
|
||||
PDC emulator : CS-SERVER.cascades.local
|
||||
|
||||
RID master : CS-SERVER.cascades.local
|
||||
|
||||
Infrastructure master : CS-SERVER.cascades.local
|
||||
|
||||
AD user count : 44
|
||||
|
||||
AD group count : 55
|
||||
|
||||
AD OU count : 18
|
||||
|
||||
|
||||
|
||||
============================================================================
|
||||
|
||||
== 7. AD Schema version
|
||||
|
||||
============================================================================
|
||||
|
||||
Schema objectVersion : 88
|
||||
|
||||
Schema version (mapped) : Windows Server 2019
|
||||
|
||||
|
||||
|
||||
============================================================================
|
||||
|
||||
== 8. Time sync
|
||||
|
||||
============================================================================
|
||||
|
||||
(Entra Connect requires clock within ~5 min of Microsoft time.)
|
||||
|
||||
Leap Indicator: 0(no warning)
|
||||
|
||||
Stratum: 1 (primary reference - syncd by radio clock)
|
||||
|
||||
Precision: -23 (119.209ns per tick)
|
||||
|
||||
Root Delay: 0.0000000s
|
||||
|
||||
Root Dispersion: 10.0000000s
|
||||
|
||||
ReferenceId: 0x4C4F434C (source name: "LOCL")
|
||||
|
||||
Last Successful Sync Time: 4/21/2026 8:31:32 PM
|
||||
|
||||
Source: Free-running System Clock
|
||||
|
||||
Poll Interval: 6 (64s)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
#Peers: 1
|
||||
|
||||
|
||||
|
||||
Peer:
|
||||
|
||||
State: Pending
|
||||
|
||||
Time Remaining: 10209.9342707s
|
||||
|
||||
Mode: 0 (reserved)
|
||||
|
||||
Stratum: 0 (unspecified)
|
||||
|
||||
PeerPoll Interval: 0 (unspecified)
|
||||
|
||||
HostPoll Interval: 0 (unspecified)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
============================================================================
|
||||
|
||||
== 9. Internet connectivity to Microsoft sync endpoints
|
||||
|
||||
============================================================================
|
||||
|
||||
[OK] HTTPS 443 -> login.microsoftonline.com : True
|
||||
|
||||
[OK] HTTPS 443 -> login.windows.net : True
|
||||
|
||||
[OK] HTTPS 443 -> secure.aadcdn.microsoftonline-p.com: True
|
||||
|
||||
[OK] HTTPS 443 -> management.azure.com : True
|
||||
|
||||
[OK] HTTPS 443 -> graph.windows.net : True
|
||||
|
||||
[OK] HTTPS 443 -> adminwebservice.microsoftonline.com: True
|
||||
|
||||
[OK] HTTPS 443 -> provisioningapi.microsoftonline.com: True
|
||||
|
||||
|
||||
|
||||
============================================================================
|
||||
|
||||
== 10. WinHTTP proxy
|
||||
|
||||
============================================================================
|
||||
|
||||
|
||||
|
||||
Current WinHTTP proxy settings:
|
||||
|
||||
|
||||
|
||||
Direct access (no proxy server).
|
||||
|
||||
Reference in New Issue
Block a user