azcomputerguru/claudetools
1
0
Fork 0
Code Issues 73 Pull Requests Actions Packages Projects Releases Wiki Activity

sync: auto-sync from HOWARD-HOME at 2026-07-17 14:14:41

Browse Source 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-17 14:14:41
This commit is contained in:
Howard Enos
2026-07-17 14:15:18 -07:00
parent 3a7b6a1cc1
commit 8d2ca14cac
47 changed files with 1025 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

100
clients/cascades-tucson/session-logs/2026-07/2026-07-17-howard-nurse-station-kiosk-build.md Normal file
View File

@@ -0,0 +1,100 @@
# Cascades of Tucson — Nurse Station Kiosk GPO Build (NURSESTATION-PC)
## User
- **User:** Howard Enos (howard)
- **Machine:** Howard-Home
- **Role:** tech
## Session Summary
Continued from the earlier 7/17 session (roadmap refresh + Juan Andrade offboard). This session built and iteratively debugged the nurse-station kiosk configuration for NURSESTATION-PC, delivering on WS3 step 3b: shared caregiver desktops with phone-parity lockdown.
The kiosk GPO (`CSC - Nurse Station Kiosk`, GUID `32d76052-4d92-446c-95fb-614653f84742`) was built with Edge policies for caregivers: `BrowserSignin=2` (force OS account sign-in for SSO), `EdgeDefaultProfileEnabled=1` (auto-profile from PRT, no picker), `ClearBrowsingDataOnExit=1`, `PasswordManagerEnabled=0`, `AutofillAddressEnabled=0`, `AutofillCreditCardEnabled=0`, `SyncDisabled=1`, `HideFirstRunExperience=1`, `AutoImportAtFirstRun=4`, `BrowserGuestModeEnabled=0`, `BrowserAddProfileEnabled=0`, `SignInCtaOnNtpEnabled=0`, `RoamingProfileSupportEnabled=0`, `UserDataSnapshotRetentionLimit=0`. The GPO is linked to `OU=Caregiver Devices,OU=Staff PCs,OU=Workstations` with `GpoApply` filtered to `SG-Caregivers` only; non-caregivers log in with no lockdown via the loopback merge (`UserPolicyMode=1`) on the `CSC - Caregiver Device Lockdown` GPO.
GPP Shortcuts (ALIS, PharmCare, Helpany) were deployed via the kiosk GPO after multiple rounds of debugging. The root cause of non-delivery was wrong CSE GUIDs: the correct CSE for GP Preferences Shortcuts is `{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}` (verified from client registry), not `{BC75B1ED-...}` (Printers) or `{42B5FAAE-...}` (Scripts). Shortcuts target `%DesktopDir%` (per-user desktop), deployed at logon via loopback. The original `CSC - Caregiver Workstation` GPO shortcuts (in the user OU, filtered to `SG-Caregivers-Test`) were moved to the kiosk GPO and removed from the original to prevent duplication.
Additional configurations: `DontDisplayLastUserName=1` + `dontdisplaylockeduser=3` on the lockdown GPO (hides previous usernames on the login screen); both nurse printers (`\\CS-SERVER\Nurses - Brother MFC-L8900CDW` and `\\CS-SERVER\Health Services - Konica Minolta C368`) added as machine-level connections via `rundll32 printui.dll /ga`; UI restrictions (NoRun, NoControlPanel, NoSetFolders, DisableCMD, DisableRegistryTools, DisableTaskMgr, DisableUserInstalls, NoNetHood, NoRecentDocsHistory, ClearRecentDocsOnExit) applied via the kiosk GPO; Microsoft Store blocked via `RemoveWindowsStore=1`.
Session ended with app restriction still incomplete. The UI restrictions (no CMD/PowerShell/Settings/Control Panel/Run/Task Manager/Store) are in place, but user-facing Store apps (Camera, Netflix, Xbox, Spotify, etc.) are still launchable from the Start menu. Howard rejected removing the apps from the machine because non-caregiver users need access. AppLocker with group-specific Deny rules for SG-Caregivers is the correct next step, but was not completed this session.
## Key Decisions
- `BrowserSignin=2` + `EdgeDefaultProfileEnabled=1` chosen to force Edge SSO via PRT, eliminating the need for caregivers to enter credentials in the browser after Windows login. `BrowserSignin=0` (original setting) was blocking PRT passthrough entirely.
- GPP shortcuts placed in the kiosk GPO (machine OU, SG-Caregivers filter) rather than the Caregiver Workstation GPO (user OU, SG-Caregivers-Test filter) so all SG-Caregivers members get shortcuts on any caregiver device, not just test-group members.
- Shortcuts use `%DesktopDir%` (per-user desktop) not `%CommonDesktopDir%` (Public Desktop) because GPP user preferences targeting CommonDesktopDir require a user logon to process but the chicken-and-egg problem means the first login has no shortcuts.
- Printers added as machine-level connections (`/ga` flag) rather than per-user connections so every user gets them automatically without GPO printer deployment complexity.
- `DontDisplayLastUserName` placed in the `CSC - Caregiver Device Lockdown` GPO (not the kiosk GPO) because it's a computer-level policy (HKLM) and must apply regardless of which user is at the login screen.
- App removal rejected by Howard (non-caregivers need the apps) — AppLocker with SG-Caregivers Deny rules is the planned approach for the next session.
- `pilot.test` AD account (from June) used as the test identity instead of creating a new `test.caregiver` account. A duplicate `test.caregiver` was created by mistake and deleted same session. `pilot.test` was added to `SG-Caregivers` (kiosk GPO filter) in addition to existing `SG-Caregivers-Test` membership. Password reset to `CareTest2026!`.
## Problems Encountered
- **PRT not issuing (`AzureAdPrt : NO`):** NURSESTATION-PC was hybrid-joined but PRT acquisition failed. Root cause: stale PRT attempt cached for `sysadmin@cascadestucson.com` with `AADSTS50126` (invalid credentials). Fixed by clearing WAM token broker cache (`Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AC\TokenBroker`) for all users + reboot.
- **Edge showing sync/profile picker:** `BrowserSignin=0` blocked Edge from using the PRT entirely. Changed to `BrowserSignin=2` (force OS account) + `EdgeDefaultProfileEnabled=1` (auto-profile, no picker). Also needed to clear stale Edge profile data (`C:\Users\pilot.test\AppData\Local\Microsoft\Edge\User Data`).
- **Duplicate desktop shortcuts:** Three sources stacking: (1) Public Desktop (manually placed), (2) per-user desktop from Default profile (copied at first login), (3) GPP shortcuts from `CSC - Caregiver Workstation` GPO (`action="R"` to `%DesktopDir%`). Fixed by cleaning Default profile desktop, removing manual Public Desktop shortcuts, and consolidating all shortcuts into the kiosk GPO GPP only.
- **GPP shortcuts not deploying (multiple rounds):** Wrong CSE GUIDs on the GPO AD object and GPT.INI. Tried `{42B5FAAE-...}` (Scripts) and `{BC75B1ED-...}` (Printers) before discovering the correct Shortcuts CSE is `{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}` via `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions` on the client machine. Also discovered the original `CSC - Caregiver Workstation` GPO was filtered to `SG-Caregivers-Test` (not `SG-Caregivers`), so `a.vallejo` (in SG-Caregivers only) never received those shortcuts.
- **CMD window popup at logon:** Caused by a `.bat` logon script configured in the kiosk GPO (created as a shortcut deployment workaround before GPP was fixed). Removed the scripts.ini, Scripts directory, and GPO registry entries for the logon script.
- **Duplicate AD test account:** `test.caregiver` created, then discovered `pilot.test` already existed from June with ALIS staff email mapping and Business Premium license. Deleted `test.caregiver`, added `pilot.test` to `SG-Caregivers`, reset password.
## Configuration Changes
**On CS-SERVER (via RMM):**
- GPO `CSC - Nurse Station Kiosk` (`32d76052-4d92-446c-95fb-614653f84742`): 15 Edge HKCU policies, GPP Shortcuts.xml (ALIS/PharmCare/Helpany to `%DesktopDir%`), CSE GUIDs `[{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}{0F6B957D-509E-11D1-A7CC-0000F87571E3}]`, UI restrictions (NoRun, NoControlPanel, DisableCMD, DisableRegistryTools, DisableTaskMgr, DisableUserInstalls, NoNetHood, NoRecentDocsHistory, ClearRecentDocsOnExit, NoSetFolders, NoSMHelp), RemoveWindowsStore=1
- GPO `CSC - Caregiver Device Lockdown`: added `DontDisplayLastUserName=1` + `dontdisplaylockeduser=3` (HKLM)
- GPO `CSC - Caregiver Workstation` (`3B5CD9A6-A278-4676-A9FD-9396D21A8261`): GPP Shortcuts.xml removed (moved to kiosk GPO)
- AD: `pilot.test` added to `SG-Caregivers`, password reset; duplicate `test.caregiver` account created then deleted
**On NURSESTATION-PC (via RMM):**
- WAM token broker cache cleared for all user profiles
- Edge profile data cleared for pilot.test
- Per-user + Default profile desktop shortcuts cleaned (Public Desktop cleared, GPO handles deployment)
- Machine-level printer connections: `\\CS-SERVER\Nurses - Brother MFC-L8900CDW` + `\\CS-SERVER\Health Services - Konica Minolta C368` via `rundll32 printui.dll /ga`
- Multiple gpupdate /force cycles
**Local scripts created:**
- `clients/cascades-tucson/scripts/`: create-test-caregiver.ps1, align-test-pilot-upn.ps1, audit-test-accounts.ps1, fix-pilot-test-accounts.ps1, kiosk-gpo-firstrun.ps1, fix-edge-sso.ps1, fix-edge-auto-profile.ps1, clear-prt-cache.ps1, check-hybrid-join.ps1, check-printers.ps1, add-nurse-printer.ps1, find-all-shortcuts.ps1, dedup-shortcuts-final.ps1, find-shortcut-source.ps1, identify-gpo-and-fix.ps1, restore-gpp-shortcuts-public.ps1, fix-shortcut-target.ps1, move-shortcuts-to-kiosk-gpo.ps1, cleanup-and-gpupdate.ps1, check-gpp-apply.ps1, debug-gpp-shortcuts.ps1, debug-gpp-2.ps1, check-cse-client.ps1, fix-cse-final.ps1, fix-cse-correct.ps1, fix-gpo-cse-guids.ps1, verify-kiosk-config.ps1, verify-kiosk-2.ps1, caregiver-app-restrictions.ps1, app-restrict-1.ps1, app-restrict-2.ps1, fix-cmd-popup.ps1, list-packaged-apps.ps1, remove-unwanted-apps.ps1, hide-last-user-gpupdate.ps1, clear-edge-profiles-gpupdate.ps1, check-avallejo.ps1
## Credentials & Secrets
- `pilot.test` AD account: `cascades\pilot.test` / `CareTest2026!` (password reset this session; vault: `clients/cascades-tucson/pilot-test-ad.sops.yaml`)
- `a.vallejo` caregiver account: `cascades\a.vallejo` / `Sunrise4827` (from vault: `clients/cascades-tucson/caregiver-temp-passwords-2026-07-01.sops.yaml`)
- Duplicate `test.caregiver` account created with password `KioskTest-7492!`, then DELETED same session. Vault entry `test-caregiver-ad.sops.yaml` also deleted.
## Infrastructure & Servers
- NURSESTATION-PC: RMM agent `f5a89784-834f-47b1-82e2-7e3e9dd337ff`, hybrid-joined (AzureAdJoined=YES, DomainJoined=YES), DeviceId `d3bf931f-f128-4261-8398-b46c34a4b342`, TenantId `207fa277-e9d8-4eb7-ada1-1064d2221498`, DN `CN=NURSESTATION-PC,OU=Caregiver Devices,OU=Staff PCs,OU=Workstations,DC=cascades,DC=local`
- CS-SERVER: RMM agent `c39f1de7-d5b6-45ae-b132-e06977ab1713`
- Kiosk GPO: `CSC - Nurse Station Kiosk`, GUID `32d76052-4d92-446c-95fb-614653f84742`, linked to `OU=Caregiver Devices`, GpoApply=SG-Caregivers
- Lockdown GPO: `CSC - Caregiver Device Lockdown`, UserPolicyMode=1 (loopback merge)
- Caregiver Workstation GPO: `CSC - Caregiver Workstation`, GUID `3B5CD9A6-A278-4676-A9FD-9396D21A8261`, linked to `OU=Caregivers,OU=Departments`, GpoApply=SG-Caregivers-Test
- Reception GPO `CSC - Reception Workstation Policy` also applies to NURSESTATION-PC (pre-existing, flagged)
- Printers: `\\CS-SERVER\Nurses - Brother MFC-L8900CDW` (TCP_192.168.2.75), `\\CS-SERVER\Health Services - Konica Minolta C368` (TCP_192.168.1.138)
- GP Preferences Shortcuts CSE GUID: `{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}` (verified from client `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions`)
## Commands & Outputs
- `dsregcmd /status` on NURSESTATION-PC: `AzureAdJoined: YES`, `DomainJoined: YES`, `AzureAdPrt: NO` (initially), `DeviceAuthStatus: SUCCESS`; PRT failure was `AADSTS50126` for stale `sysadmin@` credential
- `rundll32 printui.dll,PrintUIEntry /ga /n \\CS-SERVER\Nurses - Brother MFC-L8900CDW` — added machine-level printer
- GPP Shortcuts CSE discovery: `Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions"` revealed `{C418DD9D-...}` = "Group Policy Shortcuts"
- `gpresult /scope computer /r` confirmed applied GPOs: CSC - Caregiver Device Lockdown, CSC - Always Wait For Network, CSC - Reception Workstation Policy, CSC - Point and Print
## Pending / Incomplete Tasks
1. **App restriction for caregivers (INCOMPLETE):** UI restrictions block CMD/PowerShell/Settings/Control Panel/Run/Task Manager/Store, but Store apps (Camera, Netflix, Xbox, Spotify) are still launchable. Howard rejected removing apps from the machine (non-caregivers need them). Next step: AppLocker with Packaged App Deny rules scoped to SG-Caregivers — `Allow Domain Users: *` (baseline) + `Deny SG-Caregivers: [Netflix, Camera, Xbox, etc.]`. Needs AppIdentity service enabled + AppLocker XML policy in the Lockdown GPO (Computer Configuration).
2. **ASSISTNURSE-PC:** Second nurse station not yet configured. Needs: move from CN=Computers to OU=Caregiver Devices + deploy machine-level printers + gpupdate. GPO settings will apply automatically.
3. **PRT verification:** After token cache clear + reboot, need to confirm `AzureAdPrt: YES` on next caregiver login and verify ALIS SSO is fully silent (no password prompt in browser).
4. **`CSC - Reception Workstation Policy`:** Still applies to NURSESTATION-PC (pre-existing, flagged to Howard, unresolved).
5. **Cleanup after pilot:** Delete `pilot.test` AD account + delta sync when WS3 caregiver go-live is complete.
6. **Carried from earlier session:** break-glass accounts + FIDO2, caregiver allow-list flip, relicense 29 suspended-Standard, image backup repair, domain-join tail, network tail, WS8 SharePoint/Teams, WS9 Medtelligent scoping, ticket-verify pass.
## Reference Information
- Session log (earlier today): `clients/cascades-tucson/session-logs/2026-07/2026-07-17-howard-roadmap-finish-line-refresh.md`
- Kiosk GPO SYSVOL: `\\cascades.local\SYSVOL\cascades.local\Policies\{32d76052-4d92-446c-95fb-614653f84742}`
- Shortcuts XML: `...\User\Preferences\Shortcuts\Shortcuts.xml` (3 entries: ALIS, PharmCare, Helpany)
- Vault pilot.test: `clients/cascades-tucson/pilot-test-ad.sops.yaml`
- Vault (superseded cloud-only): `clients/cascades-tucson/pilot-test-user.sops.yaml`
- Phone kiosk config (Intune): `CSC - Android Shared Phones Restrictions` id `070a76c2-a8c3-4f7f-9ba7-1f4ac5084184`
- Caregiver controls doc: `clients/cascades-tucson/docs/security/hipaa-caregiver-controls.md`
- ALIS SSO app: `d5108493-cba8-4f08-90b6-1bb0bc09eb2a`
- Syncro customer 20149445; prepaid block 21.5 hrs (live 7/15)