sync: auto-sync from HOWARD-HOME at 2026-07-07 06:53:34

Author: Howard Enos Machine: HOWARD-HOME Timestamp: 2026-07-07 06:53:34
2026-07-07 06:54:02 -07:00
parent 5968ee9231
commit 8854a584f3
4 changed files with 140 additions and 8 deletions
--- a/.claude/memory/reference_windows_edition_upgrade_rmm.md
+++ b/.claude/memory/reference_windows_edition_upgrade_rmm.md
@@ -30,6 +30,25 @@ the offline window. `is_connected` is null fleet-wide — track `last_seen` age,

 **Gotcha 3 — the ACG MAK `infrastructure/windows-pro-mak` is a Pro-for-WORKSTATIONS MAK** (mislabeled
 "Pro"). `slmgr /ipk` of it on a Professional machine AUTO-UPGRADES the edition to ProfessionalWorkstation
-(a strict superset of Pro). If a client genuinely needs *plain* Pro, this key will over-shoot to PfW —
-there is no plain-Pro MAK in the vault. Billing: each activation consumes one MAK count = $99 to the
-customer (ACG-internal machines: no invoice, still burns a count).
+(a strict superset of Pro), live, **no extra reboot** (verified DALLAS 2026-07-07). If a client genuinely
+needs *plain* Pro, this key will over-shoot to PfW — there is no plain-Pro MAK in the vault. Billing:
+each activation consumes one MAK count = $99 to the customer (ACG-internal machines: no invoice, still
+burns a count).
+
+**Gotcha 4 — `changepk.exe` TIMES OUT under SYSTEM but STILL flips the edition. Do NOT treat the timeout
+as failure — VERIFY EditionID.** Run as SYSTEM via `/rmm`, `changepk.exe /ProductKey <key>` does not return
+cleanly (the RMM command comes back `failed` / exit -1 `Command timeout`, or your Start-Process/`&` wrapper
+hangs to the agent timeout), yet the registry `EditionID` flip to `Professional` DID happen. Always confirm
+with a one-liner (`Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' EditionID`) before
+concluding anything — if it reads `Professional`, proceed to the finalize reboot; the running OS still
+reports Home in `Win32_OperatingSystem.Caption` until that reboot. (Verified DALLAS 2026-07-07 — the
+`changepk` command timed out but EditionID was already `Professional`.)
+
+**Gotcha 5 — Modern Standby laptops (S0 Low Power Idle) drop the RMM/SC agent when idle/lid-closed, which
+mimics an endless reboot.** On a Core Ultra / S0-only machine, idle or a closed lid drops Wi-Fi -> agent
+offline for long stretches (looked like a 25-min "slow reboot"; the box had actually been up 25 days and
+never rebooted). Before a reboot-driven upgrade on a laptop, pin it awake first:
+`powercfg /change standby-timeout-ac 0; powercfg /setacvalueindex SCHEME_CURRENT SUB_BUTTONS LIDACTION 0;
+powercfg /setactive SCHEME_CURRENT` (AC only — safe; DON'T lid-nothing on DC/battery). A command dispatched
+to an already-offline agent goes `pending` and fires (uncontrolled) on next wake — cancel stale ones with
+`/rmm cancel`. NOTE: an RDP *target* laptop must STAY awake to be reachable, so keep the AC no-sleep in place.
--- a/clients/goldstein/session-logs/2026-07/2026-07-07-howard-dallas-rdp-pro-upgrade.md
+++ b/clients/goldstein/session-logs/2026-07/2026-07-07-howard-dallas-rdp-pro-upgrade.md
@@ -0,0 +1,104 @@
+# Session Log — Goldstein: DALLAS RDP enablement (Home->Pro upgrade)
+
+## User
+- **User:** Howard Enos (howard)
+- **Machine:** Howard-Home
+- **Role:** tech
+
+## Session Summary
+
+Enabled Remote Desktop into the DALLAS laptop (Michelle Goldstein's Lenovo, `Dallas\miche`) from the
+Tucson office, under Syncro ticket #32490. Root cause of the "can't RDP in" complaint: **DALLAS ran
+Windows 11 Home, which has no Remote Desktop host.** The Tucson<->Dallas UniFi site-to-site VPN was fine
+(ping + TCP both confirmed from the Tucson side). Fix required upgrading DALLAS to Windows Pro.
+
+Followed `reference_windows_edition_upgrade_rmm`. The job spanned two days because DALLAS is a Modern
+Standby (S0 Low Power Idle) laptop: during the first attempt (evening 2026-07-06) it went offline (slept
+for the day, lid closed) before the edition upgrade could run — the `changepk` and reboot commands only
+queued, never executed. Verified the machine had actually been up 25 days (never rebooted); all the
+"offline" stretches were sleep, not reboots. Cleaned up the stale queued commands.
+
+Resumed the morning of 2026-07-07 once DALLAS was back online. Pinned it awake first
+(`powercfg` AC never-sleep + lid-does-nothing) so it would hold a session, then ran the upgrade:
+`changepk` flipped EditionID to Professional (the command times out under SYSTEM but the flip still
+takes — verified EditionID directly), a `Restart-Computer -Force` finalized it to Windows 11 Pro, and
+the vault Pro-for-Workstations MAK installed + activated (auto-upgraded the edition to PfW, permanently
+activated). Enabled and secured RDP (fDenyTSConnections=0, NLA on, TermService Automatic+Running,
+Remote Desktop firewall group enabled, listening on 3389). Verified end-to-end: from DalRes10 (Tucson)
+`Test-NetConnection 192.168.1.226 -Port 3389` = TcpTestSucceeded True over the VPN. Deployed an
+"RDP DALLAS" shortcut to the Public Desktop of both Tucson machines (DalRes10, GS-Backup).
+
+Billed 1.0 hr remote ($150, break-fix) on #32490, posted a public + emailed resolution note (mentioning
+the yesterday-offline / resumed-this-morning timing), created invoice 1650967814 ($150.00), marked the
+ticket Invoiced.
+
+## Key Decisions
+
+- **Upgraded Home->Pro rather than a workaround.** Windows Home has no RDP host; RDP Wrapper was rejected
+  (AV-flagged, unsupported, poor fit for a law firm). Pro upgrade is the supported fix (user chose it).
+- **Enrolled/kept AC no-sleep in place permanently.** An RDP target laptop must stay awake to be reachable;
+  if DALLAS sleeps, Tucson can't RDP in. AC-only (safe); battery still sleeps normally.
+- **Verified EditionID directly instead of trusting `changepk`'s exit code.** `changepk` timed out under
+  SYSTEM but had already flipped EditionID=Professional.
+- **Followed the reference procedure after an initial hand-rolled attempt** — the first pass deviated
+  (assumed changepk auto-reboots, proceeded with an active user). Corrected; logged to errorlog.
+
+## Problems Encountered
+
+- **Two-day span due to Modern Standby.** DALLAS slept before the first attempt finished; commands queued
+  but never ran. Resolved by pinning AC no-sleep on resume and re-running cleanly.
+- **`changepk` times out under SYSTEM** but still flips the edition — verified EditionID rather than
+  treating the timeout as failure. Captured in the reference memory (Gotcha 4).
+- **`ps-encoded.sh` failed `iconv: command not found` on HOWARD-HOME** — fell back to inline `jq --arg`
+  dispatch (safe for quote-free payloads). Logged as friction.
+- **Syncro comment POST returned control-char JSON that broke jq** — the comment had actually posted;
+  confirmed via GET (did not retry), per the skill rule.
+
+## Configuration Changes
+
+- **DALLAS:** Windows 11 Home -> Pro -> **Pro for Workstations** (MAK activated, permanent). RDP enabled
+  (fDenyTSConnections=0, RDP-Tcp UserAuthentication=1), TermService Automatic+Running, Remote Desktop
+  firewall group enabled. Power: AC standby/hibernate/monitor timeout 0, lid-close action = do nothing (AC).
+- **DalRes10 + GS-Backup (Tucson):** `C:\Users\Public\Desktop\RDP DALLAS.rdp` created (full address
+  192.168.1.226, username hint DALLAS\miche, prompt for credentials).
+- **Syncro #32490:** public resolution comment (422514654, emailed), line item 43163051 ($150 remote),
+  invoice 1650967814, status Invoiced.
+- **Memory:** `reference_windows_edition_upgrade_rmm` updated (Gotchas 4 + 5).
+
+## Credentials & Secrets
+
+- Windows Pro-for-Workstations MAK used from vault `infrastructure/windows-pro-mak.sops.yaml`
+  (`credentials.product_key`). One MAK activation count consumed by DALLAS = $99 to customer (billed via
+  the 1h remote labor on #32490). No new credentials created.
+
+## Infrastructure & Servers
+
+- **DALLAS** — 192.168.1.226 (Intel Wi-Fi 7 BE201), public 99.127.21.4; Win 11 Pro for Workstations
+  (build 26200); workgroup; RDP host on 3389; SC session 29c62473-a5cb-4e94-a190-c91f05031809; GuruRMM
+  agent 36c7bbc8-504f-4b4a-8995-3b3e5cdc0f02 (Goldstein/Dallas site SILVER-PEAK-3739).
+- **DalRes10 (Tucson)** — 10.10.1.149 (Ethernet) / 10.1.10.170 (Wi-Fi), gw 10.1.10.1; RMM agent
+  81cde315-013b-4acd-80d7-5ec2b9b5f084. Reaches DALLAS 3389 over the S2S VPN.
+- **GS-Backup (Tucson)** — RMM agent 4f52ef22-89ae-4124-a2b4-d339aaf42f53.
+- Tucson<->Dallas UniFi site-to-site VPN: routes 192.168.1.0/24 from the Tucson LAN; verified working.
+
+## Commands & Outputs
+
+- Edition flip: `changepk.exe /ProductKey VK7JG-NPHTM-C97JM-9MPGT-3V66T` -> timed out but `EditionID=Professional`.
+- Finalize: `Restart-Computer -Force` -> `Caption=Microsoft Windows 11 Pro`, uptime reset.
+- Activate: `slmgr /ipk <MAK>` -> "Installed ... successfully"; `slmgr /ato` -> "ProfessionalWorkstation ...
+  Product activated successfully."
+- RDP enable verify: `fDeny=0 NLA=1 TermService=Running Listen3389=True RDPfwEnabled=3`.
+- From DalRes10: `Test-NetConnection 192.168.1.226 -Port 3389` -> `TcpTestSucceeded=True`.
+
+## Pending / Incomplete Tasks
+
+- **Windows updates + reboot** noted at onboarding (2026-07-06 diag) still pending — approve on next window.
+- **No backup agent** on DALLAS — confirm whether the laptop needs cloud/local backup.
+- RDP is single-session: a Tucson user connecting as `Dallas\miche` logs Michelle out locally — expected;
+  communicated in the customer note.
+
+## Reference Information
+
+- Syncro ticket #32490: https://computerguru.syncromsp.com/tickets/113249206 ; invoice 1650967814 ($150.00).
+- Reference procedure: `.claude/memory/reference_windows_edition_upgrade_rmm.md`.
+- Prior log: clients/goldstein/session-logs/2026-07/2026-07-06-howard-dallas-rmm-onboard.md
--- a/wiki/clients/goldstein.md
+++ b/wiki/clients/goldstein.md
@@ -2,10 +2,11 @@
 type: client
 name: goldstein
 display_name: Goldstein (Sheldon Goldstein)
-last_compiled: 2026-07-06
+last_compiled: 2026-07-07
 compiled_by: HOWARD-HOME/claude-main
 sources:
  - clients/goldstein/session-logs/2026-07/2026-07-06-howard-dallas-rmm-onboard.md
+  - clients/goldstein/session-logs/2026-07/2026-07-07-howard-dallas-rdp-pro-upgrade.md
  - clients/goldstein/onboarding-baselines/DALLAS-20260706T233936.md
 backlinks: []
 ---
@@ -35,7 +36,7 @@ backlinks: []
 ### Endpoints (GuruRMM agents)
 | Host | Site | OS | Notes |
 |---|---|---|---|
-| DALLAS | Dallas | Windows 11 Home (26200 / 25H2) | Lenovo Yoga Slim 7 15ILL9, serial PF570RZ0; Michelle's laptop (`Dallas\miche`); workgroup; enrolled 2026-07-06; agent id `36c7bbc8-504f-4b4a-8995-3b3e5cdc0f02` |
+| DALLAS | Dallas | Windows 11 **Pro for Workstations** (26200; upgraded from Home 2026-07-07, MAK activated) | Lenovo Yoga Slim 7 15ILL9, serial PF570RZ0; Michelle's laptop (`Dallas\miche`); workgroup; 192.168.1.226; **RDP host enabled** (3389, NLA); enrolled 2026-07-06; agent id `36c7bbc8-504f-4b4a-8995-3b3e5cdc0f02` |
 | ASUS-2024 | Dallas | Windows | Pre-existing Dallas-site agent |
 | DalRes10 | Tucson | Windows | (verify role) |
 | GS-Backup | Tucson | Windows | Name implies backup box (verify) |
@@ -55,14 +56,22 @@ backlinks: []
 ## Patterns & Known Issues
 - **Multi-site under one Syncro customer** — Dallas (TX) and Tucson (Armory Park) locations map to
  two GuruRMM sites; make sure new endpoints land in the correct site (Dallas machines → `SILVER-PEAK-3739`).
+- **Tucson→Dallas RDP** works over the UniFi site-to-site VPN (verified DalRes10 → 192.168.1.226:3389).
+  Connect via the `RDP DALLAS` desktop shortcut on the Tucson PCs. RDP into DALLAS is single-session —
+  it signs Michelle out locally.
+- **DALLAS is a Modern Standby laptop and MUST stay awake to be RDP-reachable.** AC no-sleep + lid-does-
+  nothing is set deliberately; if it sleeps, Tucson can't reach it. (On battery it still sleeps normally.)
 - **DALLAS laptop hygiene (2026-07-06):** pending Windows updates + pending reboot; time source on
  local CMOS (not NTP); **no backup agent detected** — confirm whether this laptop needs cloud/local backup.

 ## Active Work
- **Syncro #32490** — "Remote - Unable to remote access to the computers in Dallas" (New).
-  ScreenConnect installed + GuruRMM agent deployed to DALLAS on 2026-07-06; private note added.
+- *No open tickets.* #32490 (Dallas RDP access) **Invoiced 2026-07-07** — invoice 1650967814 ($150.00).

 ## History Highlights
+- **2026-07-07** — Enabled Tucson→Dallas RDP: upgraded DALLAS Windows Home → Pro → **Pro for Workstations**
+  (MAK activated), enabled RDP, verified 3389 from DalRes10 over the VPN, pushed `RDP DALLAS` icons to the
+  Tucson desktops (DalRes10, GS-Backup). Billed 1.0h remote ($150), #32490 Invoiced. (Spanned two days —
+  the Modern-Standby laptop slept before the first attempt could finish.)
 - **2026-07-06** — Onboarded DALLAS (Michelle's Lenovo) to remote management: ScreenConnect installed,
  GuruRMM agent deployed into the existing Goldstein/Dallas site, onboarding diagnostic run (AMBER,
  0 critical). Ticket #32490.
--- a/wiki/index.md
+++ b/wiki/index.md
@@ -29,7 +29,7 @@ Run `/wiki-lint` to check for stale entries and broken backlinks.
 | [CryoWeave](clients/cryoweave.md) | Custom cryogenic cable assemblies; cPanel on IX; website redesign + SEO project in progress; Syncro ID not documented | 2026-05-24 |
 | [Darrell Delphen](clients/darrell-delphen.md) | Break-fix residential (Yantis, TX); single Windows workstation DDDOffice072023 (GuruRMM); 2026-06-18 Outlook email links failing = ISP-managed Extreme EXOS gateway "NetIQ" SNI-filtering of Intermedia's url.emailprotection.link rewriter (WARP interim bypass, ISP disabled the feature for permanent fix); Syncro #35996725 | 2026-06-18 |
 | [Glaz-Tech Industries](clients/glaztech.md) | ~200 users, 9 locations; prepaid ~22.25 hrs; web server WWW (192.168.8.72 / 65.113.52.88) — IIS 10/VB.NET e-commerce; CRITICAL security posture: website connects to GTI-INV-SQL as sysadmin (login `tom`, named SQL login, C0 top finding) + plaintext PANs+CVV (stored by GTIware PSA, not website) + plaintext passwords + SQLi via `quo()` + XSS; apex 404 fixed + payment TLS fixed 2026-06-03; intrusion/brute-force log review 2026-06-04 (no attacker found; H5 detection blind spot confirmed — HTTP 200 on both success/failure + no failed-login logging); #32378 Waiting on Customer (assessment + reports + Appendix A delivered); M365 no MFA; SCL bypass rules for vendor DMARC + MailProtector digests | 2026-06-04 |
-| [Goldstein (Sheldon Goldstein)](clients/goldstein.md) | Law firm (lawyersdallas.com), break-fix/T&M; two locations — Dallas TX (Michelle) + Tucson/Armory Park (Sheldon); GuruRMM client with Dallas (SILVER-PEAK-3739) + Tucson (RED-LION-9255) sites; DALLAS laptop onboarded 2026-07-06 (ScreenConnect + GuruRMM agent, diag AMBER 0-critical, no backup agent); Syncro #32490; cust 25307933 | 2026-07-06 |
+| [Goldstein (Sheldon Goldstein)](clients/goldstein.md) | Law firm (lawyersdallas.com), break-fix/T&M; two locations — Dallas TX (Michelle) + Tucson/Armory Park (Sheldon); GuruRMM client with Dallas (SILVER-PEAK-3739) + Tucson (RED-LION-9255) sites; **DALLAS upgraded Home→Win11 Pro for Workstations + RDP enabled for Tucson over the S2S VPN (2026-07-07, #32490 invoiced $150)**; onboarded 2026-07-06 (ScreenConnect + GuruRMM, diag AMBER, no backup agent); cust 25307933 | 2026-07-07 |
 | [Grabb & Durando Law Office](clients/grabb-durando.md) | Personal injury law firm; GND-SERVER GuruRMM enrolled; AI demand review app scoped ($4K–$7K); website migration pending; plaintext DB password in README needs vaulting | 2026-05-24 |
 | [Pavon](clients/pavon.md) | Former/archive client; GeoVision NVR surveillance; OwnCloud at 172.16.3.22 backed by Uranus; cron stacking fixed; Nextcloud migration deferred 3–6 months | 2026-05-24 |
 | [Rieusset Corp (Tom Sorensen)](clients/rieusset-corp.md) | Small business; email hosted on Neptune Exchange (4 mailboxes: tsorensen, tomrc, ojodeagua, csorensen @rieussetcorp.com); Mailprotector domain ID 57833; outbound via SBR Outbound.Sorensen connector; clipto.com allow rule added 2026-06-08 | 2026-06-08 |