azcomputerguru/claudetools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sync: auto-sync from HOWARD-HOME at 2026-07-15 11:39:11

Browse Source 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-15 11:39:11
This commit is contained in:
Howard Enos
2026-07-15 11:39:45 -07:00
parent aae897abfe
commit 71aa0da646
13 changed files with 3175 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
wiki/clients/cascades-tucson.md
View File

@@ -534,7 +534,7 @@ Cascades' line-of-business / reporting SaaS (the systems they pull data OUT of,
- **6 GHz is nearly unused -- root cause: CSCNet not broadcasting 6 GHz** (`wlan_bands=[2g,5g]`, found 2026-06-18). 75 radios active but only ~1 client because the band is dark at the SSID level. Largest untapped, clean, non-DFS capacity. Enabling requires WPA3+PMF conversion on the 427-client SSID -- Howard's supervised decision.
- **Poly phone drops (2026-06-17) -- CLOSED.** Root cause = intentional pfSense reboot on 2026-06-16 22:38:12 MST (one fleet-wide event; 28/30 phones each dropped once). Only a gateway-level event explains all-floors-at-once.
- **DHCP is healthy.** pfSense dhcpd.log: 1241 ACK / 1 NAK / 0 no-free-leases. Per-room /28 HIPAA segmentation is intentional; do NOT flatten. `sta_dhcp_failures` metric is client/WiFi-side, not pfSense-side.
- **Switch audit (2026-06-16):** ~25 ports linked at 100 Mbps but gig-capable (systematic cabling/NIC issue, 1st/2nd/3rd-floor switches; investigate after WiFi Phase A). 3 offline switches: Switch 2nd Floor #2 (reset+re-adopted 2026-06-17), Switch 4th Floor #2, USW Pro Max 16. Port p38 (1st Floor USW) 4.0% tx-drop rate.
- **Switch audit (2026-06-16):** ~25 ports linked at 100 Mbps but gig-capable (systematic cabling/NIC issue, 1st/2nd/3rd-floor switches; investigate after WiFi Phase A). Offline switches (Switch 4th Floor #2, USW Pro Max 16) are **offline by design -- not an issue** (Howard 2026-07-15); Switch 2nd Floor #2 reset+re-adopted 2026-06-17. Port p38 (1st Floor USW) 4.0% tx-drop rate.
- **Mesh topology:** 2nd Floor Atrium is wireless-mesh parent for CC Bridge + salon (5 GHz backhaul ch36); 206 U7 Pro carries AP 108. These must NEVER be disabled or powered down via zone command -- coverage-thin auto-excludes them.
- **AP-hang recovery:** use `device-control.sh cascades poe-cycle "<AP name>" --apply`. Do NOT use `force-provision` -- it took AP 445 offline during the Floor-4 pilot.
- **Tooling (`unifi-wifi` skill -- feature-complete as of 2026-06-19):**
@@ -578,7 +578,7 @@ Full design: `docs/network/phase1-voice-qos-design.md`. Status DESIGN -- nothing
- **[DESIGN] ALIS-native 2FA is not a perimeter control.** Force all ALIS logins through Entra SSO (SSO-only, credential fallback disabled); disable ALIS-native 2FA per-user then globally.
- **[INFO] Android enrollment token expiry (2027-05-08) does NOT unenroll devices.** Renewal needed only before enrolling new devices after that date.
- **[WARN] ~25 switch ports at 100 Mbps but gig-capable.** Investigate after WiFi optimization is stable.
- **[WARN] 3 offline switches** (Switch 4th Floor #2, USW Pro Max 16 -- root cause unknown; Switch 2nd Floor #2 was reset+re-adopted 2026-06-17). Investigate onsite.
- **[INFO] Offline switches are BY DESIGN -- not an issue** (Howard, 2026-07-15). Switch 4th Floor #2 + USW Pro Max 16 are intentionally offline; Switch 2nd Floor #2 was reset+re-adopted 2026-06-17. Do not flag or investigate.
- **[SECURITY] Synology Cloud Signin Portal credential exposed in vault git history (commit 1fbc0e1).** Encrypted go-forward but credential must be rotated.
- **[FLEET] Endpoint security migration substantially complete (2026-06-30; CS-SERVER covered 2026-07-13).** Datto EDR/AV (Infocyte/azcomp4587) is the ACG-managed endpoint stack -- ~35 agents enrolled. Bitdefender removed from RECEPTIONIST-PC (both boxes); orphaned BD folders cleaned; CS-SERVER cleaned of legacy Datto 6/26 and **re-enrolled in Datto EDR 2026-07-13 (HUNTAgent=Running, cmd `0a60cac7`)** -- the DC had been unprotected in between. **Pending:** DESKTOP-TRCIEJA BD_ACTIVE (needs GravityZone console uninstall; box slated for replacement); DESKTOP-F94M8UT (Alma's, powered off) queued EDR install; confirm Cascades removed from Syncro's BD deployment; GravityZone portal cleanup of stale RECEPTIONIST-PC records; reconcile laptop3 (EDR, no RMM agent); confirm/remove stale EDR agents laptop1 + cascades-laptop.