sync: auto-sync from GURU-5070 at 2026-07-07 10:26:45
Author: Mike Swanson Machine: GURU-5070 Timestamp: 2026-07-07 10:26:45
This commit is contained in:
@@ -2,7 +2,7 @@
|
||||
type: client
|
||||
name: valleywide
|
||||
display_name: Valley Wide Plastering
|
||||
last_compiled: 2026-06-23
|
||||
last_compiled: 2026-07-07
|
||||
compiled_by: GURU-5070/claude-main
|
||||
sources:
|
||||
- clients/valleywide/README.md
|
||||
@@ -271,6 +271,18 @@ RDWeb (`https://VWP-QBS/RDWeb/Pages/login.aspx`) was publicly exposed via UDM po
|
||||
|
||||
Power outage caused HP ProLiant NVRAM corruption (BIOS/iLO factory reset). VWP-QBS Dell had a boot retry loop (resolved via DRAC). XenServer was offline. All recovered onsite. **Root cause: no UPS on HP server.**
|
||||
|
||||
### 2026-07-07: VWP-QBS Stuck in Orphaned EDR Network Isolation (~3 hr remote)
|
||||
|
||||
After VWP-QBS was force-rebooted via iDRAC (192.168.3.189) following a hung OS, it came up but **all off-subnet networking failed** — `ping` to its own IP, the gateway, and 8.8.8.8 all returned **"PING: transmit failed. General failure."** Yet `127.0.0.1` pinged fine, it still pulled a DHCP lease (172.16.9.163), and DNS resolved.
|
||||
|
||||
**Root cause:** the removed **Datto EDR (Infocyte engine)** left the host in **orphaned WFP network isolation / containment.** A persistent `Infocyte blocking traffic` WFP filter (block-all) plus an allowlist of Infocyte cloud IPs and DHCP (`*:68`) survived the EDR uninstall — which is why DHCP worked but nothing else did. The EDR was removed via its own uninstaller; a vendor bug left the isolation filters behind. `netsh advfirewall set allprofiles state off`, `netsh winsock reset` / `int ip reset` / `advfirewall reset`, adapter remove/re-add, and reboots all did nothing because the block lived under **Infocyte's own WFP provider/sub-layer, below the Windows Firewall (MpsSvc)**.
|
||||
|
||||
**Diagnosis:** `netsh wfp show filters file=C:\filters.xml` / `show state` — grep for `Infocyte`, revealing `Infocyte blocking traffic` + the `Infocyte Allow Inbound to <IP>` allowlist.
|
||||
|
||||
**Fix:** ran **WFPExplorer** as admin (delivered to the isolated box as an ISO via **DRAC virtual media** — no network), **Filters** view → deleted all `Infocyte` filters. Connectivity restored the instant `Infocyte blocking traffic` was removed. The Infocyte **sub-layer/provider would not delete** (boot-time pinned) — harmless once its filters are gone. Verified back on **172.16.9.169** (AD DNS on DC1 + UDM both agree; stale .163 released). Firewall re-enabled.
|
||||
|
||||
**Reusable signature (fleet-wide):** **`ping` to own IP = "General failure" while `127.0.0.1` works AND DHCP still works** → suspect an **orphaned host-isolation WFP filter from a removed/broken EDR** (Infocyte/Datto, SentinelOne, CrowdStrike, Defender for Endpoint all isolate this way). Firewall-off and stack resets won't clear it. Confirm with `netsh wfp show filters`; remove the vendor's filters with **WFPExplorer** (run elevated). **Note:** Datto RMM agent (v4.4.11915) is still installed on VWP-QBS — decide whether to pull it too.
|
||||
|
||||
---
|
||||
|
||||
## History Highlights
|
||||
@@ -290,17 +302,18 @@ Power outage caused HP ProLiant NVRAM corruption (BIOS/iLO factory reset). VWP-Q
|
||||
| 2026-06-13 | **Syncro** and **Datto RMM Agent** deployment GPOs disabled (`AllSettingsDisabled`, flags=3) via LDAP on VWP_ADSRVR. Existing agents not yet uninstalled — awaiting direction. |
|
||||
| 2026-06-15 | **VWP-FILES scan-to-folder fix.** Copier scan-to-`\\192.168.0.20` broke after the 2026-06-13 cutover — root cause was the dual-homed server having a default gateway only on the 172.16.9.132 NIC, so replies on the .20 NIC to off-subnet clients were dropped (not a VLAN-routing limit; the UDM routes all VLANs). Fix: single-homed VWP-FILES on 192.168.0.20 (gw 192.168.0.1) by disconnecting the .132 vNIC host-side via `Disconnect-VMNetworkAdapter` on VWP-HYPERV1 (in-guest change dropped the RMM agent + auto-rolled-back). .132 vNIC left disconnected (reversible), not removed. Scanner = Brother MFC-L3780CDW (vault `clients/vwp/brother-mfc-l3780cdw`). |
|
||||
| 2026-06-23 | **SMB1 enabled on VWP-FILES** to restore G:/Orders access for the legacy Windows XP app VM (V-XP) after the 6/13 migration — Server 2019 defaults SMB1-off; XP speaks only SMB1. Diagnosed via GuruRMM (payroll desktop G: was fine; Orders runs on V-XP). Ticket #32448, 1.5 hr emergency block deduction (prepay 19.0→17.5 at close). |
|
||||
| 2026-07-07 | **VWP-QBS stuck in orphaned Datto EDR / Infocyte network isolation** after an iDRAC force-reboot. All off-subnet traffic "General failure" (own IP too) while loopback + DHCP worked — a persistent `Infocyte blocking traffic` WFP filter survived the EDR uninstall. Cleared via WFPExplorer (delivered by DRAC virtual media ISO) → deleted the Infocyte filters; back on 172.16.9.169. **~3 hr remote.** See Security Posture 2026-07-07. |
|
||||
|
||||
---
|
||||
|
||||
## Compilation Notes
|
||||
|
||||
**Date range covered:** 2026-04-13 through 2026-06-23.
|
||||
**Date range covered:** 2026-04-13 through 2026-07-07.
|
||||
|
||||
**Items flagged [unverified]:**
|
||||
- M365 MFA and mail flow configuration — never investigated
|
||||
- HP iLO credentials post factory-reset — accessible 2026-05-12 so credentials were re-established; confirm vault entry
|
||||
- DRAC IP for VWP-QBS — functional but undocumented
|
||||
- DRAC IP for VWP-QBS — **documented 2026-07-07: iDRAC 192.168.3.189** (R640, Service Tag C84TTQ2); vault `clients/vwp/quickbooks-server-idrac`. Reach via curl from a 2019 box (DC1) — Server 2025 TLS can't negotiate the BMC's older ciphers.
|
||||
- Yealink provisioning status — 11 phones pending as of 2026-04-22; no follow-up confirmed
|
||||
- RDS CAL grace period — may have expired
|
||||
- AD replication of GPO `flags=3` changes to VWP-DC1 — ADWS not reachable over SSH from ADSRVR; normal replication expected but not spot-checked
|
||||
|
||||
Reference in New Issue
Block a user