sync: auto-sync from HOWARD-HOME at 2026-07-20 15:06:11

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-20 15:06:11

clients/lens-auto-brokerage/PROJECT_STATE.md

@@ -20,148 +20,277 @@
 **Last Activity:** 2026-07-20
 **Tracker Issue:** claudetools #71
 
-Comprehensive inventory gathered 2026-07-20 from GuruRMM, ScreenConnect, and Syncro.
+Full inventory of lab-server gathered 2026-07-20 via ScreenConnect backstage commands.
-Migration plan drafted below. Howard is working on getting RMM onto the old Server 2008
+All data needed for migration planning is now captured. Decision points documented below.
-(lab-server) for direct inventory of Deskman.
 
 ---
 
 ## Server 2008 Decommission — Migration Plan
 
 ### Scope
-Migrate Deskman off the EOL Server 2008 (lab-server, 192.168.1.241) to LAB-SVR
+Migrate DeskMan and file shares off the EOL Server 2008 (lab-server, 192.168.1.241)
-(Server 2019, 192.168.1.82), then decommission the 2008 box.
+to LAB-SVR (Server 2019, 192.168.1.82), then decommission the 2008 box.
 
-### What We Know (as of 2026-07-20)
+### What We Know (confirmed live 2026-07-20)
 
-**Source machine (lab-server / Server 2008):**
+**Source: lab-server (Server 2008 SP2)**
-- HP ProLiant ML310e Gen8 v2, Xeon E3-1220 v3, SN MX253500HB
+- HP ProLiant ML310e Gen8 v2, Xeon E3-1220 v3, 4GB RAM, SN MX253500HB
-- IP 192.168.1.241, WORKGROUP
+- 32-bit OS on 64-bit hardware
-- Runs Deskman (confirmed by Becky's 2026-06-17 crash report)
+- IP 192.168.1.241 (DHCP), WORKGROUP, DNS -> 192.168.1.1 (gateway)
-- NOT in GuruRMM, NOT in ScreenConnect — no remote visibility currently
+- C: 931GB total, 667GB free (264GB used)
-- Howard is working on getting RMM agent installed
+- D: 100MB System Reserved partition
+- OS installed 2015-12-04, last boot 2026-07-11
+- Windows Firewall enabled, Remote Registry enabled, WinRM enabled
+- ScreenConnect + RemotePC (7.6.84) + Datto RMM (registered but possibly not running)
+- NO antivirus, NO backup agent, Guest account ENABLED and in use
 
-**Target machine (LAB-SVR / Server 2019):**
+**DeskMan (the primary workload):**
+- Install path: `C:\DeskMan`
+- Main executables: DeskMan.exe (2015), DMain.exe (2023-06-13, 73MB — the real runtime)
+- **Database: FoxPro DBF files** — no SQL engine, raw .DBF/.CDX files on disk
+- Data path: `C:\DeskMan\Data` — 422 files, ~1.05 GB
+- DeskMan root total: ~734 MB (plus Data subdirs = ~1.8 GB total)
+- Config: `C:\DeskMan\amPath.ini` contains `apPath=\\lab-server\DeskMan`
+- User profiles in `C:\DeskMan\Data\.ini`: Becky, Brian, Anna, Carla, and others
+- Credit card interface config: `C:\DeskMan\CreditInterfaces.xml`
+- Upgrade/DLL directories: `C:\DeskMan\DMUpgrade`, `C:\DeskMan\DMDLL`
+- Backup copies on disk: `Data - Copy`, `Data Copy 20230321` (x3 variants)
+- Desktop backup ZIPs: `C:\Users\localadmin\Desktop\DeskMan.zip` (x2)
+- eLink download artifact: `C:\Users\Administrator\AppData\Local\eLink\Zip\deskman.exe`
+- `C:\Users\Administrator\Desktop\NEW DESKMAN DATA` directory exists
+- **NOT a Windows service** — runs as a user-mode application
+- **Shared via SMB** as `\\lab-server\DeskMan` — all workstations access it this way
+- **Backup script** `dmBackup.BAT` does xcopy to `D:\dmBackup\` but D: is only 100MB — **backup is broken**
+
+**SMB Shares on lab-server:**
+| Share Name | Path | Notes |
+|---|---|---|
+| DeskMan | C:\DeskMan | Main app + data share — all workstations connect here |
+| Public | C:\Users\Public | Standard public share |
+| shares | C:\shares | File shares: Backups, FileCabinet, IT Services, Profiles |
+
+**C:\shares contents:**
+- `C:\shares\Backups\` — Backup.conf, Backup_Log (2023-12-22), subdirs: Fabs, MADONNA, PUBLIC
+- `C:\shares\FileCabinet\` — unknown contents/size
+- `C:\shares\IT Services\` — unknown contents/size
+- `C:\shares\Profiles\` — unknown contents/size
+- **Total size of C:\shares: UNKNOWN — need to measure**
+
+**Active SMB sessions (live at time of inventory):**
+| Client IP | User | Open Files | Workstation |
+|---|---|---|---|
+| 192.168.1.135 | dana | 271 | **UNKNOWN MACHINE — not in RMM or SC fleet** |
+| 192.168.1.136 | becky | 281 | LAB-Becky |
+| 192.168.1.164 | administrator | 271 | LAB-DAWN (Tina) |
+| 192.168.1.229 | dana | 271 | LAB-MADONNA |
+| 192.168.1.247 | localadmin | 280 | DESKTOP-JDQMLCE |
+| 192.168.1.75 | Guest | 273 | DESKTOP-0J55V6L (Brian) — **Guest access, security concern** |
+
+**[WARNING] 6 workstations actively connected with 271-281 open files EACH. Migration
+requires coordinating downtime — cannot move data while files are open.**
+
+**[WARNING] Unknown machine at 192.168.1.135 (user "dana") — not in our fleet. Need
+to identify this endpoint and get it managed.**
+
+**[WARNING] Brian's machine (.75) connects as Guest — unauthenticated SMB access.**
+
+**Local user accounts on lab-server:**
+| Account | Admin | Password Expires | Status |
+|---|---|---|---|
+| Administrator | Yes | Yes | Enabled |
+| becky | Yes | No | Enabled |
+| dana | No | No | Enabled |
+| Guest | No | No | **Enabled** |
+| guru | Yes | Yes | Enabled |
+| localadmin | Yes | Yes | Enabled |
+| parke | No | No | Enabled |
+| tina | No | No | Enabled |
+| turner | No | Yes | Enabled |
+
+**Confirmed NOT on lab-server:**
+- No QuickBooks (no files, no services, no registry entries)
+- No SQL Server / MySQL / database engine
+- No MSP360, Carbonite, Veeam, or any backup agent
+- No antivirus
+- Not a print server (only XPS Document Writer, not shared)
+- No mapped drives from this server to elsewhere
+
+**Target: LAB-SVR (Server 2019)**
 - HPE ProLiant MicroServer Gen10 Plus v2, Xeon E-2314, 16GB RAM
-- IP 192.168.1.82, AD DC for LAB.lan
+- IP 192.168.1.82, AD DC for LAB.lan, DNS at 127.0.0.1 (self)
-- C: drive 1.77TB total, 1.6TB free — plenty of space
+- C: 1.77TB total, 1.6TB free — more than enough space
-- Roles installed: AD DS, DNS, File Server, DFS, GPMC
+- Roles: AD DS, DNS, File Server, DFS, GPMC
 - MSP360 backup running
-- NO Deskman installed, NO QuickBooks installed
+- NO DeskMan, NO QuickBooks installed
 - GuruRMM 0.6.66 (needs update to 0.6.79)
+- No user-facing shares yet (only NETLOGON/SYSVOL)
 
-**QuickBooks situation — CHANGED from original scope:**
+**QuickBooks — RESOLVED: not part of migration scope.**
-- QuickBooks Enterprise 20.0 + 24.0 is on LAB-Becky (Becky's workstation), NOT the server
+- QuickBooks Enterprise 20.0 + 24.0 is ONLY on LAB-Becky (workstation)
-- Full QB services running on LAB-Becky (QBCFMonitor, QBUpdate, QBIDP, QBWCMonitor)
+- No QuickBooks on lab-server at all
-- Intellipay V400 payment terminal service also on LAB-Becky
+- QB stays on Becky's machine, no action needed
-- Original docs said QB was on the 2008 server — need to verify whether there's still a
+
-  server-side QB instance or if Becky's is the only live copy
+---
-- If QB is only on Becky's machine, it may NOT need to move to the server at all
 
 ### Decision Points (resolve before executing)
 
 1. **Domain join — yes or no?**
    LAB-SVR is already an AD DC (LAB.lan) with DNS, but zero workstations are joined.
-   All 7 workstations are WORKGROUP with DNS pointing at the router (192.168.1.1).
+   All 7 workstations are WORKGROUP with DNS pointing at the router.
-   Options:
-   - (a) Domain-join the Pro workstations (6 of 7 — Brian's is Win 11 Home, cannot join)
-   - (b) Leave as WORKGROUP, treat the DC role as unnecessary overhead, possibly demote
-   - Decision affects: GPO management, centralized auth, printer deployment, share permissions
-   - **Recommendation:** For a 7-machine shop with no IT staff, WORKGROUP is simpler.
-     Domain adds complexity they can't self-manage. Unless there's a business need for
-     centralized policy, consider demoting the DC.
    
-2. **QuickBooks — does it need to move?**
+   Consider: They have 7+ staff accessing a shared app via SMB with local accounts.
-   - If QB is only on Becky's workstation and working fine, leave it there
+   The Guest account is being used for access. User "dana" logs in from two different
-   - If there's a server-side QB instance on the 2008 box, that needs to move or be retired
+   machines. Local account management across 7+ machines is fragile.
-   - Need to check lab-server once RMM is on it (or via ScreenConnect backstage)
    
-3. **Deskman — what data needs to migrate?**
+   **Domain arguments FOR:**
-   - Deskman is a lobby/customer management app. Need to identify:
+   - Centralized user accounts (one password per person, not per machine)
-     - Where Deskman stores its database (local SQL? file-based?)
+   - Eliminate Guest access (security)
-     - What version is running on the 2008 server
+   - GPO for printer deployment, drive mappings, security policy
-     - Is there a newer version compatible with Server 2019?
+   - Proper file share permissions (domain users/groups)
-     - Which workstations connect to Deskman on the server (or is it server-only?)
+   - The DC is already running — just need to join workstations
-   - Once RMM is on lab-server, run inventory to answer these
    
-4. **Printers — anything to reconfigure?**
+   **Domain arguments AGAINST:**
-   - RICOH IM 600SR at 192.168.1.105 is the main copier, installed on all workstations via IP/WSD
+   - Brian's machine is Win 11 Home (cannot join without upgrade to Pro)
-   - HP OfficeJet Pro 9010, Brother HL-L2350DW/L2340D also on most machines
+   - Small shop with no IT staff — domain adds complexity
-   - If staying WORKGROUP: printers are already direct-to-device, no server dependency
+   - They've been running WORKGROUP for years without complaint
-   - If domain-joining: could deploy printers via GPO (but adds complexity)
+   - One more thing to maintain (AD, DNS, DHCP, GPO)
-   - **Check:** Does lab-server act as a print server for any of these? If so, that role
-     needs to move. If printers are direct IP/USB on each workstation, no action needed.
    
-5. **Mapped drives / shares — anything on the 2008 server?**
+   **Recommendation:** Domain-join makes sense here. They already have the DC, and the
-   - No user-facing shares found on LAB-SVR (only NETLOGON/SYSVOL)
+   current setup has security issues (Guest access, local account sprawl). The migration
-   - LAB-MADONNA has a local "Ricoh Scans" share (C:\Ricoh Scans)
+   is a natural break point to clean this up. Budget the Win 11 Home -> Pro upgrade for
-   - **Check:** Does lab-server host any file shares that workstations map to?
+   Brian's machine.
-     Need to inventory shares on the 2008 box once we have access.
 
-6. **Backup — is the 2008 server's data backed up before we touch it?**
+2. **DeskMan share — how to repoint?**
-   - Syncro ticket #32147 (open since 2026-04-13): "Confirm data backup is in place"
+   Every workstation has DeskMan configured to access `\\lab-server\DeskMan` via the
-   - MSP360 is on LAB-SVR and LAB-Becky — unknown if 2008 server has any backup
+   `amPath.ini` file. Migration requires:
-   - **MUST verify backup of Deskman data before migration begins**
+   - Copy `C:\DeskMan` to LAB-SVR
+   - Create SMB share `DeskMan` on LAB-SVR pointing to `C:\DeskMan`
+   - Update `amPath.ini` on every workstation to `\\LAB-SVR\DeskMan` (or use DNS alias)
+   - OR: create a DNS CNAME so "lab-server" resolves to LAB-SVR's IP — avoids touching
+     every workstation's config (simpler cutover)
 
-7. **Hours — will 3.75 prepaid hours cover this?**
+3. **C:\shares — what's in there and does it need to move?**
-   - Almost certainly not. A server migration + Deskman install + testing will take
+   - Backups, FileCabinet, IT Services, Profiles folders
-     more than 4 hours. Need to discuss block hour replenishment with Len/Becky.
+   - Need to measure total size
+   - Need to check if workstations have mapped drives to `\\lab-server\shares`
+   - If yes, recreate on LAB-SVR and repoint (or use DNS alias)
 
-### Migration Steps (draft — execute after decisions above are resolved)
+4. **Unknown machine at 192.168.1.135 — who is this?**
+   - User "dana" connecting from .135 with 271 open files in DeskMan
+   - Not in GuruRMM, not in ScreenConnect, not in Syncro
+   - Must identify, enroll, and manage before migration
+   - Also: "dana" connects from .229 (LAB-MADONNA) — same person, two machines?
 
-**Phase 0: Inventory (IN PROGRESS)**
+5. **Guest access from Brian's machine — fix immediately or at migration?**
-- [x] Gather RMM/SC/Syncro fleet data (2026-07-20)
+   - DESKTOP-0J55V6L (.75) connects to lab-server as Guest
-- [ ] Get RMM agent on lab-server (Howard working on this)
+   - This is unauthenticated file access to the DeskMan share
-- [ ] Inventory lab-server: Deskman version + data location, shares, printers, QB presence
+   - Create a proper local account for Brian on lab-server, or domain-join to fix
-- [ ] Confirm QuickBooks situation (server vs Becky's workstation)
-- [ ] Verify Deskman data backup exists or create one
 
-**Phase 1: Prepare target (LAB-SVR)**
+6. **DeskMan version compatibility with Server 2019?**
-- [ ] Update GuruRMM agent to 0.6.79
+   - DMain.exe was last updated 2023-06-13 — relatively recent
-- [ ] Install Deskman on LAB-SVR (Server 2019 compatible version)
+   - DeskMan.exe is from 2015 (launcher only)
-- [ ] Configure Deskman data location on LAB-SVR
+   - Need to verify DeskMan runs on Server 2019 (FoxPro apps sometimes have OS compat issues)
-- [ ] If QB needs to move: install QuickBooks on LAB-SVR
+   - Test on LAB-SVR before cutover
-- [ ] If file shares exist on 2008: recreate on LAB-SVR
-- [ ] If print server role on 2008: recreate on LAB-SVR
 
-**Phase 2: Migrate data**
+7. **Backup before migration — CRITICAL**
-- [ ] Copy Deskman database/data from lab-server to LAB-SVR
+   - No backup agent on lab-server
-- [ ] If QB server instance exists: migrate QB data
+   - The dmBackup.BAT script is broken (D: is only 100MB)
-- [ ] Copy any file shares / user data
+   - MSP360 is on LAB-SVR — could back up to there first
+   - Manual copy of C:\DeskMan and C:\shares to LAB-SVR IS the backup
+   - Do a full robocopy to LAB-SVR and verify before touching anything
 
-**Phase 3: Cut over**
+8. **RemotePC and redundant remote tools**
-- [ ] Repoint workstations from lab-server to LAB-SVR for Deskman
+   - lab-server runs: ScreenConnect + RemotePC + Datto RMM (maybe)
-- [ ] Test Deskman access from each workstation that uses it
+   - After migration, remove RemotePC from decommissioned box
-- [ ] Test QB if moved
+   - Standardize on ScreenConnect + GuruRMM for the fleet
-- [ ] Test all printers, shares, payment terminals
+
+9. **Hours — 3.75 prepaid hours will NOT cover this.**
+   - Scope: copy data, set up shares, test DeskMan, repoint 6+ workstations,
+     possibly domain-join 6-7 machines, identify unknown endpoint, clean up
+   - Estimate: 8-12 hours of work minimum
+   - Need to discuss block hour replenishment with Len/Becky before starting
+
+---
+
+### Migration Steps (execute after decisions above are resolved)
+
+**Phase 0: Pre-Migration (do these BEFORE scheduling downtime)**
+- [x] Inventory lab-server via ScreenConnect (2026-07-20) -- DONE
+- [x] Inventory fleet via RMM/SC/Syncro (2026-07-20) -- DONE
+- [x] Confirm QuickBooks is NOT on lab-server -- DONE (not in scope)
+- [ ] Identify unknown machine at 192.168.1.135 (dana)
+- [ ] Measure C:\shares total size
+- [ ] Test DeskMan on Server 2019 (install on LAB-SVR, verify it runs)
+- [ ] Update LAB-SVR GuruRMM agent to 0.6.79
+- [ ] Discuss hours/budget with Len/Becky (3.75 hrs won't cover it)
+- [ ] Decide: domain-join or stay WORKGROUP
+- [ ] If domain-join: plan workstation join order, budget Win11 Home->Pro for Brian
+
+**Phase 1: Prepare Target (LAB-SVR) — no downtime needed**
+- [ ] Create DeskMan directory on LAB-SVR
+- [ ] Initial robocopy of C:\DeskMan from lab-server to LAB-SVR (bulk copy while live)
+- [ ] Robocopy C:\shares from lab-server to LAB-SVR
+- [ ] Create SMB shares on LAB-SVR: DeskMan, shares (match permissions)
+- [ ] Install DeskMan on LAB-SVR and verify it launches
+- [ ] If domain-joining: create domain user accounts for all staff
+- [ ] If domain-joining: set up GPO for printers and drive mappings
+
+**Phase 2: Cutover (REQUIRES DOWNTIME — schedule after hours or weekend)**
+- [ ] Notify all staff — DeskMan will be unavailable during cutover
+- [ ] Close all DeskMan sessions on all workstations
+- [ ] Final robocopy /MIR from lab-server to LAB-SVR (delta sync)
+- [ ] Create/verify SMB share on LAB-SVR
+- [ ] Option A: Update amPath.ini on every workstation to \\LAB-SVR\DeskMan
+- [ ] Option B: Add DNS CNAME "lab-server" -> LAB-SVR (simpler, fewer touchpoints)
+- [ ] Recreate user accounts on LAB-SVR share (or use domain accounts)
+- [ ] If domain-joining: join workstations to LAB.lan domain
+- [ ] Test DeskMan access from each workstation
+- [ ] Test file share access from each workstation
+- [ ] Fix Brian's Guest access (create proper account or domain-join)
+
+**Phase 3: Validation (run both servers in parallel)**
+- [ ] Monitor DeskMan usage for 1 week on new server
+- [ ] Confirm all users can access all features
+- [ ] Confirm credit card interface works (CreditInterfaces.xml)
+- [ ] Confirm no data loss (compare file counts/sizes)
+- [ ] Keep lab-server powered on but shares disabled (fallback)
 
 **Phase 4: Decommission**
-- [ ] Run parallel (both servers) for a validation period
+- [ ] Power off lab-server after validation period
-- [ ] Power off lab-server
+- [ ] Remove RemotePC from lab-server
-- [ ] Archive/wipe lab-server after validation period
+- [ ] Archive final copy of lab-server data
-- [ ] Close Syncro ticket #32147
+- [ ] Remove stale LENS-SV asset from Syncro
+- [ ] Reassign DESERTRVSERVER to Desert RV Center in Syncro
+- [ ] Close Syncro ticket #32147 (backup confirmed)
 - [ ] Close tracker issue #71
 - [ ] Update billing if scope changes
 
-### Cleanup Items (not migration-blocking, but noted)
+---
 
-| Item | Machine | Notes |
+### Cleanup Items (not migration-blocking, address during or after)
-|------|---------|-------|
+
-| Old LabTech/Automate agent (LTService) still running | DESKTOP-0J55V6L | Remove |
+| Item | Machine | Priority |
-| Duplicate ScreenConnect instance | DESKTOP-0J55V6L | Remove old one |
+|------|---------|----------|
-| TeamViewer installed | DESKTOP-0J55V6L | Remove if not needed |
+| Unknown endpoint at .135 (dana) | Network | HIGH — identify before migration |
-| AMD Catalyst leftovers | DESKTOP-0J55V6L | Uninstall |
+| Guest account enabled + in use | lab-server | HIGH — security |
-| Windows 11 Home (can't domain-join) | DESKTOP-0J55V6L | Upgrade to Pro if domain-joining |
+| No antivirus on lab-server | lab-server | Note (decommissioning anyway) |
-| Office 2010 (EOL) | DESKTOP-0J55V6L, LAB-MADONNA | Upgrade to M365 |
+| No Datto EDR | LAB-DAWN, LAB-MADONNA, DESKTOP-0J55V6L, LAB-SVR | MEDIUM — deploy |
-| McAfee alongside Datto EDR | EV-DAWG | Remove McAfee |
+| Old LabTech/Automate agent still running | DESKTOP-0J55V6L | LOW — remove |
-| No Datto EDR | LAB-DAWN, LAB-MADONNA, DESKTOP-0J55V6L, LAB-SVR | Deploy |
+| Duplicate ScreenConnect instance | DESKTOP-0J55V6L | LOW — remove |
-| Pending reboot (32+ days) | DESKTOP-JDQMLCE | Reboot / investigate if machine is needed |
+| TeamViewer installed | DESKTOP-0J55V6L | LOW — remove if not needed |
-| localadmin password expired | EV-DAWG | Reset |
+| Windows 11 Home (can't domain-join) | DESKTOP-0J55V6L | MEDIUM if domain-joining |
-| LENS-SV Syncro asset stale (Jan 2025) | Syncro | Archive |
+| Office 2010 (EOL) | DESKTOP-0J55V6L, LAB-MADONNA | LOW — upgrade to M365 |
-| DESERTRVSERVER in wrong Syncro account | Syncro | Move to Desert RV Center |
+| McAfee alongside Datto EDR | EV-DAWG | LOW — remove McAfee |
-| Empty phones billing schedule (#482424) | Syncro | Investigate or remove |
+| Pending reboot (32+ days) | DESKTOP-JDQMLCE | LOW — reboot |
-| LAB-SVR GuruRMM agent outdated (0.6.66) | LAB-SVR | Update to 0.6.79 |
+| localadmin password expired | EV-DAWG | LOW — reset |
-| G: drive 0 GB on LAB-MADONNA | LAB-MADONNA | Investigate |
+| LENS-SV Syncro asset stale | Syncro | LOW — archive after migration |
+| DESERTRVSERVER in wrong Syncro account | Syncro | LOW — move to Desert RV |
+| Empty phones billing schedule | Syncro | LOW — investigate |
+| LAB-SVR GuruRMM agent outdated | LAB-SVR | MEDIUM — update to 0.6.79 |
+| G: drive 0 GB on LAB-MADONNA | LAB-MADONNA | LOW — investigate |
+| RemotePC on lab-server | lab-server | LOW — remove at decommission |
+| Remote Registry enabled | lab-server | Note (decommissioning anyway) |
+| Broken dmBackup.BAT | lab-server | Note (replacing with robocopy) |
 
 ---
 
@@ -173,10 +302,11 @@ See wiki article: `wiki/clients/lens-auto-brokerage.md` (compiled 2026-07-20)
 - **GuruRMM client:** `bc76984f-8dc9-42e7-b978-c8def1143144`
 - **GuruRMM site:** `d8f69cd8-5c42-43bc-ae45-9cc6078d37fb` (enrollment: `UPPER-STAR-2820`)
 - **ScreenConnect company:** "LAB - Len's Auto"
+- **lab-server SC session:** `4a870093-cea4-4d9f-b331-d7034ab537d6`
 - **Syncro customer ID:** 3289131
 - **Vault path:** `clients/lens-auto-brokerage.sops.yaml`
 - **LAN:** 192.168.1.0/24, WAN 174.77.67.237
-- **"Swanson, Len"** is SEPARATE (personal/home, RMM client `607ab79d`, SC "Swanson, Len", WAN 68.109.162.82)
+- **"Swanson, Len"** is SEPARATE (confirmed in RMM + SC + different WAN IP)
 
 ---
 
@@ -184,7 +314,8 @@ See wiki article: `wiki/clients/lens-auto-brokerage.md` (compiled 2026-07-20)
 
 | Date | By | Change | Status |
 |------|-----|--------|--------|
-| 2026-07-20 | Howard | Full fleet inventory from RMM/SC/Syncro; migration plan drafted; wiki updated | PLANNING |
+| 2026-07-20 | Howard | Full lab-server inventory via SC backstage; migration plan drafted with decision points | PLANNING |
+| 2026-07-20 | Howard | Fleet inventory from RMM/SC/Syncro; wiki updated | DONE |
 | 2026-06-17 | Howard | Deskman crash investigation (transient, self-resolved) | RESOLVED |
 | 2026-06-01 | Howard | GuruRMM deployment complete (8 agents) | DONE |
 | 2026-04-16 | Mike | Client directory created, deployment planned | DONE |

clients/lens-auto-brokerage/session-logs/2026-07/2026-07-20-howard-server-migration-planning.md

@@ -0,0 +1,110 @@
+# Lens Auto Brokerage — Server 2008 Decommission Planning
+
+## User
+- **User:** Howard Enos (howard)
+- **Machine:** Howard-Home
+- **Role:** tech
+
+## Session Summary
+
+Conducted a comprehensive inventory and migration planning session for the Lens Auto Brokerage Server 2008 decommission project (tracker issue claudetools #71). The goal was to gather all available data from every source before planning the move, rather than working from stale documentation.
+
+Started by pulling the tracker issue and existing wiki/docs, which were last updated 2026-06-17. Launched three parallel agents to gather live data from GuruRMM (fleet agents, system info, installed software, printers, shares), ScreenConnect (sessions, hardware, OS details), and Syncro (assets, tickets, billing, contacts). Cross-referenced all three sources to build a complete picture of the 7-workstation + 1-server fleet.
+
+Key discovery from the fleet inventory: QuickBooks is ONLY on Becky's workstation (LAB-Becky), not on the server as previously documented. The AD Domain Controller on LAB-SVR (LAB.lan) is running but zero workstations are domain-joined — all remain WORKGROUP. LAB-SVR's IP is .82, not .81 as previously recorded. Confirmed "Swanson, Len" is properly separated in both RMM and ScreenConnect (different client, different WAN IP).
+
+Then gathered a full inventory of lab-server (the Server 2008 source machine) via ScreenConnect backstage commands. Initial commands hit the 5000-character truncation limit, so pivoted to writing output to a file on the server and reading it back in chunks. Found that DeskMan is the sole workload — a FoxPro/DBF car dealership management app at C:\DeskMan (~1.8GB), shared via SMB as \\lab-server\DeskMan, with 6 workstations concurrently connected (271-281 open files each). Also found C:\shares with Backups/FileCabinet/IT Services/Profiles directories that need to move. No QuickBooks, no database engine, no backup agent on the server. Security concerns: Guest account enabled and actively used by Brian's machine, unknown endpoint at 192.168.1.135 (user "dana") not in any management tool, Remote Registry enabled.
+
+Updated the wiki article (wiki/clients/lens-auto-brokerage.md), PROJECT_STATE.md with a full 4-phase migration plan and 9 decision points, and added status comments to tracker issue #71. The project is now fully documented and ready for decision-making before execution.
+
+## Key Decisions
+
+- QuickBooks removed from migration scope — confirmed only on Becky's workstation, not on the server. No action needed.
+- Recommended domain-join over staying WORKGROUP — the DC is already running, and current setup has security issues (Guest SMB access, local account sprawl, unmanaged endpoint). The migration is a natural break point for this cleanup.
+- Identified DNS CNAME as the simplest cutover approach — creating a "lab-server" CNAME pointing to LAB-SVR avoids touching amPath.ini on every workstation.
+- Flagged 3.75 prepaid hours as insufficient — estimated 8-12 hours for full migration scope, need to discuss block replenishment before starting work.
+
+## Problems Encountered
+
+- ScreenConnect backstage command output truncated at ~5000 characters for large commands (wmic product, dir /s, systeminfo). Resolved by writing output to C:\inventory.txt on the server and reading back in chunks via PowerShell Get-Content with -Skip/-First pagination.
+- LAB-SVR IP was documented as .81 in old wiki article but confirmed as .82 via live RMM and ScreenConnect data. Corrected in all documentation.
+
+## Configuration Changes
+
+- **Modified:** `wiki/clients/lens-auto-brokerage.md` — Full rewrite with live data from all three sources (RMM/SC/Syncro). Updated IP, contacts, billing, endpoint inventory with per-machine detail, share/printer tables, known issues, active work section.
+- **Modified:** `clients/lens-auto-brokerage/PROJECT_STATE.md` — Complete rewrite with 4-phase migration plan, 9 decision points, lab-server inventory data (DeskMan details, shares, users, services, SMB sessions), cleanup items table, infrastructure quick reference.
+- **Created:** This session log.
+
+## Credentials & Secrets
+
+No new credentials discovered. Existing vault path: `clients/lens-auto-brokerage.sops.yaml`.
+
+Lab-server local accounts documented: Administrator, becky, dana, Guest (enabled), guru, localadmin, parke, tina, turner. Passwords not captured — will need to be set/reset during migration or domain-join.
+
+## Infrastructure & Servers
+
+| Host | IP | OS | Role | Notes |
+|---|---|---|---|---|
+| LAB-SVR | 192.168.1.82 | Server 2019 Std | AD DC (LAB.lan), DNS, File Server, DFS | Migration target. 1.6TB free. GuruRMM 0.6.66. |
+| lab-server | 192.168.1.241 | Server 2008 SP2 | DeskMan host, file shares | Migration source. 667GB free. SC session 4a870093. |
+| DESKTOP-0J55V6L | 192.168.1.75 | Win 11 Home | Brian's workstation | Win 11 Home (can't domain-join). Connects as Guest. |
+| DESKTOP-JDQMLCE | 192.168.1.247 | Win 11 Pro | Turner's workstation | 32+ day uptime, pending reboot, user idle 22 days. |
+| EV-DAWG | 192.168.1.200 | Win 11 Pro | Gloss's workstation | McAfee + Datto EDR conflict. |
+| Josh-Lens | 192.168.1.87 | Win 11 Pro | Josh's workstation | |
+| LAB-Becky | 192.168.1.136 | Win 10 Pro | Becky's workstation | QuickBooks Enterprise 20.0 + 24.0. MSP360 backup. |
+| LAB-DAWN | 192.168.1.164 | Win 11 Pro | Tina's workstation | No Datto EDR. |
+| LAB-MADONNA | 192.168.1.229 | Win 11 Pro | Madonna's workstation | No Datto EDR. Ricoh Scans share. |
+| UNKNOWN | 192.168.1.135 | Unknown | dana's machine | NOT in RMM/SC/Syncro. Actively using DeskMan. |
+| LAS-GAMER | 192.168.1.15 (home) | Win 11 Pro | Len's personal | Separate RMM/SC client. WAN 68.109.162.82. |
+| RICOH IM 600SR | 192.168.1.105 | — | Main copier | On all workstations. |
+| Gateway/Router | 192.168.1.1 | — | UDM | DNS for all workstations. |
+
+- WAN: 174.77.67.237
+- LAN: 192.168.1.0/24
+- AD Domain: LAB.lan (DC running but unused by workstations)
+- Syncro customer ID: 3289131
+- GuruRMM client: bc76984f-8dc9-42e7-b978-c8def1143144
+- GuruRMM site: d8f69cd8-5c42-43bc-ae45-9cc6078d37fb (enrollment: UPPER-STAR-2820)
+- ScreenConnect company: "LAB - Len's Auto"
+- lab-server SC session: 4a870093-cea4-4d9f-b331-d7034ab537d6
+
+## Commands & Outputs
+
+ScreenConnect backstage commands run on lab-server (via sc.py send-command):
+- `systeminfo` — confirmed Server 2008 SP2, 4GB RAM, 32-bit OS, WORKGROUP, installed 2015-12-04
+- `net share` — DeskMan (C:\DeskMan), Public, shares (C:\shares) + admin shares
+- `net session` — 6 concurrent SMB sessions from .75/.135/.136/.164/.229/.247
+- `wmic printer` — not a print server, only XPS Document Writer
+- `dir C:\DeskMan /a /s` — 422 data files, ~1.05GB in Data, ~734MB total root
+- `type C:\DeskMan\amPath.ini` — `apPath=\\lab-server\DeskMan`
+- `sc query type= service state= all | findstr deskman` — no DeskMan Windows service
+- `wmic service where "state='running'"` — 60 services including RPCService (RemotePC), ScreenConnect, LanmanServer
+- `net user` — 9 accounts all enabled including Guest
+
+## Pending / Incomplete Tasks
+
+- [ ] Identify unknown machine at 192.168.1.135 (user "dana") — HIGH priority
+- [ ] Measure C:\shares total size on lab-server
+- [ ] Test DeskMan compatibility with Server 2019 (install on LAB-SVR, verify launch)
+- [ ] Howard: get GuruRMM agent onto lab-server
+- [ ] Discuss hours/budget with Len/Becky (3.75 hrs remaining, need 8-12)
+- [ ] Decision: domain-join workstations to LAB.lan or stay WORKGROUP
+- [ ] If domain-joining: budget Win 11 Home -> Pro upgrade for Brian's machine
+- [ ] Update LAB-SVR GuruRMM agent from 0.6.66 to 0.6.79
+- [ ] Deploy Datto EDR to LAB-DAWN, LAB-MADONNA, DESKTOP-0J55V6L, LAB-SVR
+- [ ] Reassign DESERTRVSERVER from Lens Auto to Desert RV Center in Syncro
+- [ ] Archive stale LENS-SV Syncro asset
+
+## Reference Information
+
+- Tracker issue: claudetools #71 (Lens Auto: Server 2008 decommission)
+- Syncro open tickets: #32363 (credit card terminal), #32299 (Brian Chrome), #32147 (backup confirmation)
+- Syncro resolved: #32525 (browser hijack Brian 2026-07-09), #32162 (server upgrade 2026-04-16)
+- DeskMan install: C:\DeskMan, data at C:\DeskMan\Data (FoxPro DBF), config amPath.ini
+- DeskMan data backups on disk: Data - Copy, Data Copy 20230321 (x3), DeskMan.zip (x2)
+- DeskMan credit card config: C:\DeskMan\CreditInterfaces.xml
+- File shares: C:\shares (Backups, FileCabinet, IT Services, Profiles)
+- Billing: $190/mo recurring, 3.75 hrs prepaid remaining
+- Contacts: Becky Kahn 520-247-1089, Michale Haubert 520-318-1040
+- PROJECT_STATE.md: clients/lens-auto-brokerage/PROJECT_STATE.md (full migration plan)
+- Wiki: wiki/clients/lens-auto-brokerage.md (compiled 2026-07-20)