From 8efc351e2592efec5ad75e69d1c9ceba0fc4fce4 Mon Sep 17 00:00:00 2001 From: Howard Enos Date: Tue, 7 Jul 2026 08:23:08 -0700 Subject: [PATCH] sync: auto-sync from HOWARD-HOME at 2026-07-07 08:22:41 Author: Howard Enos Machine: HOWARD-HOME Timestamp: 2026-07-07 08:22:41 --- ...ward-gps-onboard-endpoint-backup-verify.md | 135 ++++++++++++++++++ wiki/clients/marty-ryan.md | 38 +++++ wiki/clients/reliant-well-drilling.md | 46 ++++++ 3 files changed, 219 insertions(+) create mode 100644 projects/gps-rmm-audit/session-logs/2026-07/2026-07-07-howard-gps-onboard-endpoint-backup-verify.md create mode 100644 wiki/clients/marty-ryan.md create mode 100644 wiki/clients/reliant-well-drilling.md diff --git a/projects/gps-rmm-audit/session-logs/2026-07/2026-07-07-howard-gps-onboard-endpoint-backup-verify.md b/projects/gps-rmm-audit/session-logs/2026-07/2026-07-07-howard-gps-onboard-endpoint-backup-verify.md new file mode 100644 index 00000000..14d86bbb --- /dev/null +++ b/projects/gps-rmm-audit/session-logs/2026-07/2026-07-07-howard-gps-onboard-endpoint-backup-verify.md @@ -0,0 +1,135 @@ +# GPS Audit — Held-Client Endpoint Backup Verification + Janet/Marty Ryan Onboarding + +## User +- **User:** Howard Enos (howard) +- **Machine:** Howard-Home +- **Role:** tech + +## Session Summary + +Continuation of the GPS -> GuruRMM backup verification (prior log +`2026-07-05-howard-gps-backup-map-msp360.md`). Deleted a wrong weekend findings DM to +Winter, then resolved the 4 "held / Datto-candidate" billed-backup clients from the map +(Reliant, The Prairie Schooner, Janet Altschuler, Design & Brand Envoys) by putting eyes +directly on the machines. + +For the 3 clients that already had online GuruRMM agents (Reliant, Prairie, Envoys), ran a +Datto-product inventory then a full backup-software scan. Result: their machines run Datto +EDR + Datto RMM (security/management) but **no Datto backup client and no backup software of +any kind** — confirming "Datto backup" per Mike was EDR/RMM, not a backup. The one apparent +exception, Prairie's `TPS-SERVER` showing `wbadmin=yes`, turned out to be a Windows Server +Backup to a USB disk whose last successful run was **3/7/2018** (~8 years dead). So all +verified NOT backing up. + +Janet Altschuler had zero footprint (no RMM agent). Located her 2 machines in ScreenConnect +(`ALTSCHULER-FRON`, `ALTSCHULER-JANE`, Company "Altschuler", both online), onboarded a +GuruRMM client + site, pushed the agent via SC send-command, and both enrolled. Both already +had Datto EDR (confirmed in the EDR console) so per Howard left EDR alone; tied the accounts +together (SC Company/Site normalized to "Janet Altschuler"/"Main", created her wiki). A full +backup-software scan of both machines confirmed **no backup running** (only Dropbox, stopped). + +Updated the Winter + Mike Discord messages in place (PATCH) with the endpoint-verified +results rather than sending new ones. Then ran the GPS-RMM autoenroll plan for machines that +came back online: `WillcoxDOTAdmin` enrolled and auto-reassigned to Reliant (verified a real +Reliant Syncro asset); `DESKTOP-OC2PH4I` (Marty Ryan) enrolled to Staging. Per Howard, +onboarded a new "Marty Ryan" RMM client and reassigned that machine into it; left the +disabled `GPS-RMM-AutoEnroll` scheduled task disabled. Updated customer wikis for the added +machines (created marty-ryan.md and reliant-well-drilling.md; janet-altschuler.md already +existed). + +## Key Decisions + +- Verified the held clients by direct endpoint inspection instead of waiting on the Datto + Workplace super-admin key — RMM agents were already present on 3 of 4, giving ground truth. +- Trusted the Datto EDR **console** over an endpoint registry scan when the two disagreed on + Janet's EDR status (the first quick scan missed the EDR agent; console showed both online). +- Left EDR untouched on Janet's machines (both already covered) per Howard's rule; only tied + accounts together (SC + wiki). +- Edited the existing Winter/Mike DMs in place rather than sending new messages — keeps one + authoritative thread and avoids another retraction (the weekend Winter DM had to be deleted). +- Onboarded Marty Ryan as a real RMM client so the Staging machine could be reassigned; left + the autoenroll scheduled task disabled per Howard (manual sweeps only). + +## Problems Encountered + +- First quick Datto scan on Janet's machines reported only "Datto RMM" (no EDR); a thorough + re-scan + the EDR console both showed Datto EDR Agent present. Transient miss — resolved by + treating the console as authoritative. +- Broad backup-detection regex matched Windows built-ins (MareBackup, RegIdleBackup, Recovery-*, + Sync Host) and unrelated apps (Dropbox, Nero, NETGEAR Genie) — filtered those out; the only + real signal was Prairie TPS-SERVER's ancient wbadmin history. +- ScreenConnect extension does not expose full-fleet listing (`GetSessions` absent) — can only + query `GetSessionsByName`, so finding Janet's machines required her hostnames (Howard supplied + them: ALTSCHULER-FRON / ALTSCHULER-JANE). +- `git rebase` conflict in `errorlog.md` during a `/sync` (two machines appended entries) — + resolved by keeping both sides (append-only log), `git add` + `rebase --continue`. +- ownCloud `usage`/`users` too slow (occ load) to confirm Mineralogical earlier — used direct + SSH + filecache MySQL query instead (separate finding, prior in-session). + +## Configuration Changes + +Created: +- `wiki/clients/janet-altschuler.md` (earlier in session) +- `wiki/clients/marty-ryan.md`, `wiki/clients/reliant-well-drilling.md` +- Vault: `clients/altschuler/gururmm-site-main.sops.yaml`, `clients/marty-ryan/gururmm-site-main.sops.yaml` +Modified: +- `projects/gps-rmm-audit/backup-map.md` (4 held clients -> endpoint-verified NOT BACKING UP; + rollup now 7 of 16 not backing up) +- `projects/gps-rmm-audit/gps-clients.json` (40-client cid list, earlier) +- `projects/gps-rmm-audit/autoenroll.log` (manual sweep run 2026-07-07 07:18) + +## Credentials & Secrets + +- **GuruRMM enrollment key — Janet Altschuler**: vault `clients/altschuler/gururmm-site-main.sops.yaml`. + client_id `d041b8db-1f68-4b30-9ef9-c7b38f44c079`, site **GOLD-LION-1382**. +- **GuruRMM enrollment key — Marty Ryan**: vault `clients/marty-ryan/gururmm-site-main.sops.yaml`. + client_id `b223e7eb-8220-495b-9dcf-4cfd6d974e20`, site **WARM-WOLF-1324**. +- **Datto EDR reg key — Janet Altschuler**: `altschul01` (org "Altschuler, Janet" + `c430e9ac-5d5f-43a7-af8b-f241f6a7dfb1`), already vaulted `msp-tools/datto-edr-regkeys.sops.yaml`. +- Datto Workplace super-admin API key: still NOT received from Mike (existing key 6d1dbfa4 = 0 projects). + +## Infrastructure & Servers + +- **GuruRMM API** `http://172.16.3.30:3001` (RMM base via rmm-auth.sh). +- **ScreenConnect** `https://computerguru.screenconnect.com` (RESTful API Manager, GetSessionsByName only). +- **Janet Altschuler** SC sessions: ALTSCHULER-FRON `73e2b210-a794-4c82-8903-8b9d55842eab`, + ALTSCHULER-JANE `00aab70e-dcce-4278-83ea-7c6107ce6b73` (Company set to "Janet Altschuler", Site "Main"). +- **Datto EDR** instance azcomp4587 (infocyte.com). Both Altschuler machines online, agent v3.17.1.5552. +- RMM machine placements 2026-07-07: Reliant = BookKeeper, RWD-CHRIS, WillcoxDOTAdmin; Marty Ryan + = DESKTOP-OC2PH4I; Janet Altschuler = Altschuler-Front, Altschuler-Janet. + +## Commands & Outputs + +```bash +# autoenroll plan (push Staging installer to online-not-in-RMM, wait, reassign) +bash .claude/scripts/gps-rmm-autoenroll.sh # 2026-07-07 07:18: pushed 2, reassigned 1 +python projects/gps-rmm-audit/tools/rebuild-and-push.py --dry # ONLINE now:2 active<=14d:10 stale:4 dead:58 +python projects/gps-rmm-audit/tools/reassign-staging.py # DESKTOP-OC2PH4I -> Marty Ryan +# onboard (client + site + vault key): POST /api/clients {name}; POST /api/sites {client_id,name:Main} +# Datto EDR install one-liner: edr.py deploy-cmd --regkey altschul01 +# Discord message edit (PATCH): /channels/{ch}/messages/{id} {content} +``` + +Endpoint backup scan result (held clients, 2026-07-06/07): Reliant BookKeeper/RWD-CHRIS = +none; Prairie Mel-PC/TPS-Tina = none, TPS-SERVER = WSB last 3/7/2018 (dead), TPS-SVR unscannable; +Envoys DESKTOP-BCLOLSI/-I51630E = none (OSGOOD-PAUL offline); Janet FRON/JANE = none (Dropbox stopped). + +## Pending / Incomplete Tasks + +- **Mike/Winter reply** to the backup question (4 clients) + the Datto Workplace super-admin API + request — both still unanswered as of 2026-07-07. +- **10 machines "active <=14d"** not currently online — will only enroll on a manual autoenroll + sweep (`gps-rmm-autoenroll.sh`); the scheduled task is left DISABLED per Howard. +- Prairie `TPS-SVR` failed to scan (offline/timeout) — re-check backup on it when online. +- Envoys `OSGOOD-PAUL` offline — scan when it surfaces. +- Backup billing decisions for Mike/Winter still open (7 of 16 billed clients not backing up; + revenue leaks; $0 backup lines) — see backup-map.md. + +## Reference Information + +- Backup map: `projects/gps-rmm-audit/backup-map.md` +- Client wikis: `wiki/clients/janet-altschuler.md`, `marty-ryan.md`, `reliant-well-drilling.md` +- Autoenroll tooling: `.claude/scripts/gps-rmm-autoenroll.sh`, + `projects/gps-rmm-audit/tools/{rebuild-and-push,reassign-staging}.py` +- Memory: `reference_msp360_backup_monitoring`, `feedback_backup_targets_never_guessed` +- Discord msg IDs (edited in place): winter `1523814142128033922`, mike `1523814169705578550` diff --git a/wiki/clients/marty-ryan.md b/wiki/clients/marty-ryan.md new file mode 100644 index 00000000..ce952932 --- /dev/null +++ b/wiki/clients/marty-ryan.md @@ -0,0 +1,38 @@ +--- +type: client +name: marty-ryan +display_name: "Marty Ryan" +last_compiled: 2026-07-07 +compiled_by: HOWARD-HOME/claude-main +sources: + - projects/gps-rmm-audit/tracker.md + - live GuruRMM / Syncro / ScreenConnect 2026-07-07 +backlinks: + - wiki/projects/gps-rmm-audit.md +--- + +# Marty Ryan + +GPS client, individual-named account (Syncro cid 140717). Was a bucket-C "no footprint" +client (no RMM org, no BD/Datto) until 2026-07-07, when a machine surfaced online via the +autoenroll sweep and was onboarded. + +## Machines (1 in RMM) + +| Host | Client / Site | Added | +|---|---|---| +| `DESKTOP-OC2PH4I` | Marty Ryan / Main | 2026-07-07 — pushed the Staging installer via the autoenroll loop, then reassigned from `Staging - Auto Enroll` to the new Marty Ryan client | + +## GuruRMM + +- **Client**: Marty Ryan (`b223e7eb-8220-495b-9dcf-4cfd6d974e20`), site **Main** / `WARM-WOLF-1324`. + Onboarded 2026-07-07. Enrollment key vaulted `clients/marty-ryan/gururmm-site-main.sops.yaml`. + +## GPS billing + +- 1 GPS device billed. Svc = **A E** (AntiVirus + Email). **No Data Backup line** (Syncro-verified + 2026-07-06) — so no backup expected. See `projects/gps-rmm-audit/backup-map.md`. + +## Backlinks + +- [[projects/gps-rmm-audit]] — GPS -> GuruRMM coverage audit (onboarding source) diff --git a/wiki/clients/reliant-well-drilling.md b/wiki/clients/reliant-well-drilling.md new file mode 100644 index 00000000..e277e66f --- /dev/null +++ b/wiki/clients/reliant-well-drilling.md @@ -0,0 +1,46 @@ +--- +type: client +name: reliant-well-drilling +display_name: "Reliant Well Drilling and Pump Corporate" +last_compiled: 2026-07-07 +compiled_by: HOWARD-HOME/claude-main +sources: + - projects/gps-rmm-audit/tracker.md + - projects/gps-rmm-audit/backup-map.md + - live GuruRMM / Datto EDR / Syncro 2026-07-07 +backlinks: + - wiki/projects/gps-rmm-audit.md +--- + +# Reliant Well Drilling and Pump Corporate + +GPS client (Syncro cid 10736261). **Caveat:** Reliant's Bitdefender company historically +mixed Reliant + Farwest (`FW*`) + Wilcox (`WILCOX*`) machines — but `WILLCOXDOTADMIN` is a +genuine Reliant Syncro asset (verified 2026-07-07), so it belongs here. + +## Machines (3 in RMM) + +| Host | Added | Notes | +|---|---|---| +| `BookKeeper` | (prior) | Datto EDR + Datto RMM installed | +| `RWD-CHRIS` | (prior) | Datto EDR + Datto RMM installed | +| `WillcoxDOTAdmin` | **2026-07-07** | enrolled via autoenroll sweep (online in SC), auto-reassigned Staging -> Reliant | + +## GuruRMM + +- Client **Reliant Well Drilling and Pump Corporate**, site **Main**. All 3 agents online/reporting. + +## GPS billing & backup status + +- GPS: 9 devices billed. Svc = **B V** (Data Backup + VoIP). Backup = **1 seat, $40/mo**. +- **Backup: CONFIRMED NOT RUNNING (2026-07-06, endpoint-verified).** Both BookKeeper and + RWD-CHRIS scanned directly: no backup software, no scheduled backup task, no Windows Server + Backup, no Datto backup client — only Datto EDR + Datto RMM. Nothing in + MSP360/B2/Seafile/ownCloud/Datto Workplace either. **Pays for backup, nothing is backing up.** + Raised with Mike + Winter 2026-07-06 (awaiting reply). Do NOT provision a backup job off the + billing count — per-client decision ([[feedback_backup_targets_never_guessed]]). Detail: + `projects/gps-rmm-audit/backup-map.md`. + +## Backlinks + +- [[projects/gps-rmm-audit]] — GPS -> GuruRMM coverage audit (onboarding + backup verification)