From 8854a584f36d25b6f03fe04a3c26f256e2aff252 Mon Sep 17 00:00:00 2001 From: Howard Enos Date: Tue, 7 Jul 2026 06:54:02 -0700 Subject: [PATCH] sync: auto-sync from HOWARD-HOME at 2026-07-07 06:53:34 Author: Howard Enos Machine: HOWARD-HOME Timestamp: 2026-07-07 06:53:34 --- .../reference_windows_edition_upgrade_rmm.md | 25 ++++- ...026-07-07-howard-dallas-rdp-pro-upgrade.md | 104 ++++++++++++++++++ wiki/clients/goldstein.md | 17 ++- wiki/index.md | 2 +- 4 files changed, 140 insertions(+), 8 deletions(-) create mode 100644 clients/goldstein/session-logs/2026-07/2026-07-07-howard-dallas-rdp-pro-upgrade.md diff --git a/.claude/memory/reference_windows_edition_upgrade_rmm.md b/.claude/memory/reference_windows_edition_upgrade_rmm.md index 96667c8c..0b9b2a55 100644 --- a/.claude/memory/reference_windows_edition_upgrade_rmm.md +++ b/.claude/memory/reference_windows_edition_upgrade_rmm.md @@ -30,6 +30,25 @@ the offline window. `is_connected` is null fleet-wide — track `last_seen` age, **Gotcha 3 — the ACG MAK `infrastructure/windows-pro-mak` is a Pro-for-WORKSTATIONS MAK** (mislabeled "Pro"). `slmgr /ipk` of it on a Professional machine AUTO-UPGRADES the edition to ProfessionalWorkstation -(a strict superset of Pro). If a client genuinely needs *plain* Pro, this key will over-shoot to PfW — -there is no plain-Pro MAK in the vault. Billing: each activation consumes one MAK count = $99 to the -customer (ACG-internal machines: no invoice, still burns a count). +(a strict superset of Pro), live, **no extra reboot** (verified DALLAS 2026-07-07). If a client genuinely +needs *plain* Pro, this key will over-shoot to PfW — there is no plain-Pro MAK in the vault. Billing: +each activation consumes one MAK count = $99 to the customer (ACG-internal machines: no invoice, still +burns a count). + +**Gotcha 4 — `changepk.exe` TIMES OUT under SYSTEM but STILL flips the edition. Do NOT treat the timeout +as failure — VERIFY EditionID.** Run as SYSTEM via `/rmm`, `changepk.exe /ProductKey ` does not return +cleanly (the RMM command comes back `failed` / exit -1 `Command timeout`, or your Start-Process/`&` wrapper +hangs to the agent timeout), yet the registry `EditionID` flip to `Professional` DID happen. Always confirm +with a one-liner (`Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' EditionID`) before +concluding anything — if it reads `Professional`, proceed to the finalize reboot; the running OS still +reports Home in `Win32_OperatingSystem.Caption` until that reboot. (Verified DALLAS 2026-07-07 — the +`changepk` command timed out but EditionID was already `Professional`.) + +**Gotcha 5 — Modern Standby laptops (S0 Low Power Idle) drop the RMM/SC agent when idle/lid-closed, which +mimics an endless reboot.** On a Core Ultra / S0-only machine, idle or a closed lid drops Wi-Fi -> agent +offline for long stretches (looked like a 25-min "slow reboot"; the box had actually been up 25 days and +never rebooted). Before a reboot-driven upgrade on a laptop, pin it awake first: +`powercfg /change standby-timeout-ac 0; powercfg /setacvalueindex SCHEME_CURRENT SUB_BUTTONS LIDACTION 0; +powercfg /setactive SCHEME_CURRENT` (AC only — safe; DON'T lid-nothing on DC/battery). A command dispatched +to an already-offline agent goes `pending` and fires (uncontrolled) on next wake — cancel stale ones with +`/rmm cancel`. NOTE: an RDP *target* laptop must STAY awake to be reachable, so keep the AC no-sleep in place. diff --git a/clients/goldstein/session-logs/2026-07/2026-07-07-howard-dallas-rdp-pro-upgrade.md b/clients/goldstein/session-logs/2026-07/2026-07-07-howard-dallas-rdp-pro-upgrade.md new file mode 100644 index 00000000..1bb2704b --- /dev/null +++ b/clients/goldstein/session-logs/2026-07/2026-07-07-howard-dallas-rdp-pro-upgrade.md @@ -0,0 +1,104 @@ +# Session Log — Goldstein: DALLAS RDP enablement (Home->Pro upgrade) + +## User +- **User:** Howard Enos (howard) +- **Machine:** Howard-Home +- **Role:** tech + +## Session Summary + +Enabled Remote Desktop into the DALLAS laptop (Michelle Goldstein's Lenovo, `Dallas\miche`) from the +Tucson office, under Syncro ticket #32490. Root cause of the "can't RDP in" complaint: **DALLAS ran +Windows 11 Home, which has no Remote Desktop host.** The Tucson<->Dallas UniFi site-to-site VPN was fine +(ping + TCP both confirmed from the Tucson side). Fix required upgrading DALLAS to Windows Pro. + +Followed `reference_windows_edition_upgrade_rmm`. The job spanned two days because DALLAS is a Modern +Standby (S0 Low Power Idle) laptop: during the first attempt (evening 2026-07-06) it went offline (slept +for the day, lid closed) before the edition upgrade could run — the `changepk` and reboot commands only +queued, never executed. Verified the machine had actually been up 25 days (never rebooted); all the +"offline" stretches were sleep, not reboots. Cleaned up the stale queued commands. + +Resumed the morning of 2026-07-07 once DALLAS was back online. Pinned it awake first +(`powercfg` AC never-sleep + lid-does-nothing) so it would hold a session, then ran the upgrade: +`changepk` flipped EditionID to Professional (the command times out under SYSTEM but the flip still +takes — verified EditionID directly), a `Restart-Computer -Force` finalized it to Windows 11 Pro, and +the vault Pro-for-Workstations MAK installed + activated (auto-upgraded the edition to PfW, permanently +activated). Enabled and secured RDP (fDenyTSConnections=0, NLA on, TermService Automatic+Running, +Remote Desktop firewall group enabled, listening on 3389). Verified end-to-end: from DalRes10 (Tucson) +`Test-NetConnection 192.168.1.226 -Port 3389` = TcpTestSucceeded True over the VPN. Deployed an +"RDP DALLAS" shortcut to the Public Desktop of both Tucson machines (DalRes10, GS-Backup). + +Billed 1.0 hr remote ($150, break-fix) on #32490, posted a public + emailed resolution note (mentioning +the yesterday-offline / resumed-this-morning timing), created invoice 1650967814 ($150.00), marked the +ticket Invoiced. + +## Key Decisions + +- **Upgraded Home->Pro rather than a workaround.** Windows Home has no RDP host; RDP Wrapper was rejected + (AV-flagged, unsupported, poor fit for a law firm). Pro upgrade is the supported fix (user chose it). +- **Enrolled/kept AC no-sleep in place permanently.** An RDP target laptop must stay awake to be reachable; + if DALLAS sleeps, Tucson can't RDP in. AC-only (safe); battery still sleeps normally. +- **Verified EditionID directly instead of trusting `changepk`'s exit code.** `changepk` timed out under + SYSTEM but had already flipped EditionID=Professional. +- **Followed the reference procedure after an initial hand-rolled attempt** — the first pass deviated + (assumed changepk auto-reboots, proceeded with an active user). Corrected; logged to errorlog. + +## Problems Encountered + +- **Two-day span due to Modern Standby.** DALLAS slept before the first attempt finished; commands queued + but never ran. Resolved by pinning AC no-sleep on resume and re-running cleanly. +- **`changepk` times out under SYSTEM** but still flips the edition — verified EditionID rather than + treating the timeout as failure. Captured in the reference memory (Gotcha 4). +- **`ps-encoded.sh` failed `iconv: command not found` on HOWARD-HOME** — fell back to inline `jq --arg` + dispatch (safe for quote-free payloads). Logged as friction. +- **Syncro comment POST returned control-char JSON that broke jq** — the comment had actually posted; + confirmed via GET (did not retry), per the skill rule. + +## Configuration Changes + +- **DALLAS:** Windows 11 Home -> Pro -> **Pro for Workstations** (MAK activated, permanent). RDP enabled + (fDenyTSConnections=0, RDP-Tcp UserAuthentication=1), TermService Automatic+Running, Remote Desktop + firewall group enabled. Power: AC standby/hibernate/monitor timeout 0, lid-close action = do nothing (AC). +- **DalRes10 + GS-Backup (Tucson):** `C:\Users\Public\Desktop\RDP DALLAS.rdp` created (full address + 192.168.1.226, username hint DALLAS\miche, prompt for credentials). +- **Syncro #32490:** public resolution comment (422514654, emailed), line item 43163051 ($150 remote), + invoice 1650967814, status Invoiced. +- **Memory:** `reference_windows_edition_upgrade_rmm` updated (Gotchas 4 + 5). + +## Credentials & Secrets + +- Windows Pro-for-Workstations MAK used from vault `infrastructure/windows-pro-mak.sops.yaml` + (`credentials.product_key`). One MAK activation count consumed by DALLAS = $99 to customer (billed via + the 1h remote labor on #32490). No new credentials created. + +## Infrastructure & Servers + +- **DALLAS** — 192.168.1.226 (Intel Wi-Fi 7 BE201), public 99.127.21.4; Win 11 Pro for Workstations + (build 26200); workgroup; RDP host on 3389; SC session 29c62473-a5cb-4e94-a190-c91f05031809; GuruRMM + agent 36c7bbc8-504f-4b4a-8995-3b3e5cdc0f02 (Goldstein/Dallas site SILVER-PEAK-3739). +- **DalRes10 (Tucson)** — 10.10.1.149 (Ethernet) / 10.1.10.170 (Wi-Fi), gw 10.1.10.1; RMM agent + 81cde315-013b-4acd-80d7-5ec2b9b5f084. Reaches DALLAS 3389 over the S2S VPN. +- **GS-Backup (Tucson)** — RMM agent 4f52ef22-89ae-4124-a2b4-d339aaf42f53. +- Tucson<->Dallas UniFi site-to-site VPN: routes 192.168.1.0/24 from the Tucson LAN; verified working. + +## Commands & Outputs + +- Edition flip: `changepk.exe /ProductKey VK7JG-NPHTM-C97JM-9MPGT-3V66T` -> timed out but `EditionID=Professional`. +- Finalize: `Restart-Computer -Force` -> `Caption=Microsoft Windows 11 Pro`, uptime reset. +- Activate: `slmgr /ipk ` -> "Installed ... successfully"; `slmgr /ato` -> "ProfessionalWorkstation ... + Product activated successfully." +- RDP enable verify: `fDeny=0 NLA=1 TermService=Running Listen3389=True RDPfwEnabled=3`. +- From DalRes10: `Test-NetConnection 192.168.1.226 -Port 3389` -> `TcpTestSucceeded=True`. + +## Pending / Incomplete Tasks + +- **Windows updates + reboot** noted at onboarding (2026-07-06 diag) still pending — approve on next window. +- **No backup agent** on DALLAS — confirm whether the laptop needs cloud/local backup. +- RDP is single-session: a Tucson user connecting as `Dallas\miche` logs Michelle out locally — expected; + communicated in the customer note. + +## Reference Information + +- Syncro ticket #32490: https://computerguru.syncromsp.com/tickets/113249206 ; invoice 1650967814 ($150.00). +- Reference procedure: `.claude/memory/reference_windows_edition_upgrade_rmm.md`. +- Prior log: clients/goldstein/session-logs/2026-07/2026-07-06-howard-dallas-rmm-onboard.md diff --git a/wiki/clients/goldstein.md b/wiki/clients/goldstein.md index 0d99d5ea..3391f6cf 100644 --- a/wiki/clients/goldstein.md +++ b/wiki/clients/goldstein.md @@ -2,10 +2,11 @@ type: client name: goldstein display_name: Goldstein (Sheldon Goldstein) -last_compiled: 2026-07-06 +last_compiled: 2026-07-07 compiled_by: HOWARD-HOME/claude-main sources: - clients/goldstein/session-logs/2026-07/2026-07-06-howard-dallas-rmm-onboard.md + - clients/goldstein/session-logs/2026-07/2026-07-07-howard-dallas-rdp-pro-upgrade.md - clients/goldstein/onboarding-baselines/DALLAS-20260706T233936.md backlinks: [] --- @@ -35,7 +36,7 @@ backlinks: [] ### Endpoints (GuruRMM agents) | Host | Site | OS | Notes | |---|---|---|---| -| DALLAS | Dallas | Windows 11 Home (26200 / 25H2) | Lenovo Yoga Slim 7 15ILL9, serial PF570RZ0; Michelle's laptop (`Dallas\miche`); workgroup; enrolled 2026-07-06; agent id `36c7bbc8-504f-4b4a-8995-3b3e5cdc0f02` | +| DALLAS | Dallas | Windows 11 **Pro for Workstations** (26200; upgraded from Home 2026-07-07, MAK activated) | Lenovo Yoga Slim 7 15ILL9, serial PF570RZ0; Michelle's laptop (`Dallas\miche`); workgroup; 192.168.1.226; **RDP host enabled** (3389, NLA); enrolled 2026-07-06; agent id `36c7bbc8-504f-4b4a-8995-3b3e5cdc0f02` | | ASUS-2024 | Dallas | Windows | Pre-existing Dallas-site agent | | DalRes10 | Tucson | Windows | (verify role) | | GS-Backup | Tucson | Windows | Name implies backup box (verify) | @@ -55,14 +56,22 @@ backlinks: [] ## Patterns & Known Issues - **Multi-site under one Syncro customer** — Dallas (TX) and Tucson (Armory Park) locations map to two GuruRMM sites; make sure new endpoints land in the correct site (Dallas machines → `SILVER-PEAK-3739`). +- **Tucson→Dallas RDP** works over the UniFi site-to-site VPN (verified DalRes10 → 192.168.1.226:3389). + Connect via the `RDP DALLAS` desktop shortcut on the Tucson PCs. RDP into DALLAS is single-session — + it signs Michelle out locally. +- **DALLAS is a Modern Standby laptop and MUST stay awake to be RDP-reachable.** AC no-sleep + lid-does- + nothing is set deliberately; if it sleeps, Tucson can't reach it. (On battery it still sleeps normally.) - **DALLAS laptop hygiene (2026-07-06):** pending Windows updates + pending reboot; time source on local CMOS (not NTP); **no backup agent detected** — confirm whether this laptop needs cloud/local backup. ## Active Work -- **Syncro #32490** — "Remote - Unable to remote access to the computers in Dallas" (New). - ScreenConnect installed + GuruRMM agent deployed to DALLAS on 2026-07-06; private note added. +- *No open tickets.* #32490 (Dallas RDP access) **Invoiced 2026-07-07** — invoice 1650967814 ($150.00). ## History Highlights +- **2026-07-07** — Enabled Tucson→Dallas RDP: upgraded DALLAS Windows Home → Pro → **Pro for Workstations** + (MAK activated), enabled RDP, verified 3389 from DalRes10 over the VPN, pushed `RDP DALLAS` icons to the + Tucson desktops (DalRes10, GS-Backup). Billed 1.0h remote ($150), #32490 Invoiced. (Spanned two days — + the Modern-Standby laptop slept before the first attempt could finish.) - **2026-07-06** — Onboarded DALLAS (Michelle's Lenovo) to remote management: ScreenConnect installed, GuruRMM agent deployed into the existing Goldstein/Dallas site, onboarding diagnostic run (AMBER, 0 critical). Ticket #32490. diff --git a/wiki/index.md b/wiki/index.md index bfb5bb7a..416afe27 100644 --- a/wiki/index.md +++ b/wiki/index.md @@ -29,7 +29,7 @@ Run `/wiki-lint` to check for stale entries and broken backlinks. | [CryoWeave](clients/cryoweave.md) | Custom cryogenic cable assemblies; cPanel on IX; website redesign + SEO project in progress; Syncro ID not documented | 2026-05-24 | | [Darrell Delphen](clients/darrell-delphen.md) | Break-fix residential (Yantis, TX); single Windows workstation DDDOffice072023 (GuruRMM); 2026-06-18 Outlook email links failing = ISP-managed Extreme EXOS gateway "NetIQ" SNI-filtering of Intermedia's url.emailprotection.link rewriter (WARP interim bypass, ISP disabled the feature for permanent fix); Syncro #35996725 | 2026-06-18 | | [Glaz-Tech Industries](clients/glaztech.md) | ~200 users, 9 locations; prepaid ~22.25 hrs; web server WWW (192.168.8.72 / 65.113.52.88) — IIS 10/VB.NET e-commerce; CRITICAL security posture: website connects to GTI-INV-SQL as sysadmin (login `tom`, named SQL login, C0 top finding) + plaintext PANs+CVV (stored by GTIware PSA, not website) + plaintext passwords + SQLi via `quo()` + XSS; apex 404 fixed + payment TLS fixed 2026-06-03; intrusion/brute-force log review 2026-06-04 (no attacker found; H5 detection blind spot confirmed — HTTP 200 on both success/failure + no failed-login logging); #32378 Waiting on Customer (assessment + reports + Appendix A delivered); M365 no MFA; SCL bypass rules for vendor DMARC + MailProtector digests | 2026-06-04 | -| [Goldstein (Sheldon Goldstein)](clients/goldstein.md) | Law firm (lawyersdallas.com), break-fix/T&M; two locations — Dallas TX (Michelle) + Tucson/Armory Park (Sheldon); GuruRMM client with Dallas (SILVER-PEAK-3739) + Tucson (RED-LION-9255) sites; DALLAS laptop onboarded 2026-07-06 (ScreenConnect + GuruRMM agent, diag AMBER 0-critical, no backup agent); Syncro #32490; cust 25307933 | 2026-07-06 | +| [Goldstein (Sheldon Goldstein)](clients/goldstein.md) | Law firm (lawyersdallas.com), break-fix/T&M; two locations — Dallas TX (Michelle) + Tucson/Armory Park (Sheldon); GuruRMM client with Dallas (SILVER-PEAK-3739) + Tucson (RED-LION-9255) sites; **DALLAS upgraded Home→Win11 Pro for Workstations + RDP enabled for Tucson over the S2S VPN (2026-07-07, #32490 invoiced $150)**; onboarded 2026-07-06 (ScreenConnect + GuruRMM, diag AMBER, no backup agent); cust 25307933 | 2026-07-07 | | [Grabb & Durando Law Office](clients/grabb-durando.md) | Personal injury law firm; GND-SERVER GuruRMM enrolled; AI demand review app scoped ($4K–$7K); website migration pending; plaintext DB password in README needs vaulting | 2026-05-24 | | [Pavon](clients/pavon.md) | Former/archive client; GeoVision NVR surveillance; OwnCloud at 172.16.3.22 backed by Uranus; cron stacking fixed; Nextcloud migration deferred 3–6 months | 2026-05-24 | | [Rieusset Corp (Tom Sorensen)](clients/rieusset-corp.md) | Small business; email hosted on Neptune Exchange (4 mailboxes: tsorensen, tomrc, ojodeagua, csorensen @rieussetcorp.com); Mailprotector domain ID 57833; outbound via SBR Outbound.Sorensen connector; clipto.com allow rule added 2026-06-08 | 2026-06-08 |