sync: auto-sync from HOWARD-HOME at 2026-07-14 19:13:30
Author: Howard Enos Machine: HOWARD-HOME Timestamp: 2026-07-14 19:13:30
This commit is contained in:
@@ -1,97 +1,64 @@
|
||||
# The Prairie Schooner — Cutover Runbook (tonight + tomorrow morning)
|
||||
# The Prairie Schooner — Cutover Runbook
|
||||
|
||||
Prepared 2026-07-14 for the after-hours data move + morning UDM Pro cable swap.
|
||||
REVISED 2026-07-14 evening (Howard's call): **decouple the two migrations.**
|
||||
Tomorrow morning = NETWORK SWAP ONLY (SonicWall/USG out, UDM Pro in). Nothing else
|
||||
changes — Q: keeps pointing at \\tps-server, QB keeps running off the OLD server.
|
||||
If QB works after the cable move, the network is proven. The QB/file-server move to
|
||||
TPS-SVR happens LATER as its own step with its own test.
|
||||
Companion file: `udm-dhcp-plan.md` (LAN/DHCP/reservations detail).
|
||||
|
||||
## Facts this plan is built on (verified today via RMM/SC)
|
||||
## State as of tonight (all verified)
|
||||
|
||||
- Data to move: `C:\Share\Quickbooks` (154.8 GB, 55,915 files) + `C:\Share\Deployment`
|
||||
(24.0 GB, 10,623 files). Everything else is empty Essentials defaults (Company, Users,
|
||||
Folder Redirection: 0 bytes) or role data (SYSVOL/NETLOGON/CertEnroll — replicates via AD,
|
||||
do NOT copy).
|
||||
- TPS-SVR: C: 5.3 TB, 4.83 TB free. Already shares `Share -> C:\Share` — copy into
|
||||
`C:\Share\Quickbooks` / `C:\Share\Deployment` and paths mirror the old server.
|
||||
- The ONLY client-side dependency is drive **Q: -> \\tps-server\quickbooks**, delivered as a
|
||||
**GPP drive map in Default Domain Policy** (User Prefs > Drives, action=U, persistent=0,
|
||||
bypassErrors=1). Same on all 3 workstations (TINA, JAYMI, MEL-PC). No logon scripts, no
|
||||
other maps, DFS root unused ("Shared Folders" — legacy, empty).
|
||||
- QB ACLs show QBDataServiceUser27/28/31/34 (QB 2017/2018/2021/2024 DB managers installed
|
||||
over the years on the old box). robocopy /COPYALL carries these SIDs.
|
||||
- 3x Yealink phones (.141/.142/.146) + Dahua NVR (.145) — outbound-only, unaffected except
|
||||
brief outage during the swap.
|
||||
- QuickBooks CLOSED everywhere: MEL-PC killed clean; TINA + JAYMI had kernel-zombie
|
||||
QBW (unkillable, hung SMB handle) -> users logged off, both machines rebooted,
|
||||
QBCFMonitorService stopped on all 3. Zero open handles on the server's Quickbooks share.
|
||||
- Data ALREADY STAGED on TPS-SVR (held in reserve for the later server move):
|
||||
robocopy delta completed 18:40 with FAILED=0 — Quickbooks 144.2 GB / Deployment 22.4 GB
|
||||
in C:\Share\*. Company file: schoonerQB2025.QBW (2.9 GB) + consistent ND/DSN/TLG set.
|
||||
- Q: -> \\tps-server\quickbooks via GPP in Default Domain Policy — **NOT touched** (stays
|
||||
on the old server for tomorrow's test).
|
||||
- Client-visible network today: gateway .1, DHCP from SonicWall, DNS handed = .125.
|
||||
|
||||
## TONIGHT — after users leave
|
||||
## TONIGHT — UDM Pro config only (UniFi app, Pro LAN ISOLATED)
|
||||
|
||||
### 1. Data copy (run in ScreenConnect session on TPS-SVR as TPS\guru)
|
||||
Values in `udm-dhcp-plan.md`. Summary:
|
||||
- LAN 192.168.1.1/24 (Pro takes the SonicWall's IP), domain tps.local
|
||||
- DHCP pool 192.168.1.100–199
|
||||
- DNS handed to clients: **.125, .135** — SAME primary as today. Zero observable change.
|
||||
(Flip to .135-first later, after the network is proven — that control is the point
|
||||
of this swap.)
|
||||
- 7 fixed-IP reservations: 3 PCs, 3 Yealink phones, Dahua NVR (MACs in the plan file)
|
||||
- Content filtering / DNS Shield / ad-block OFF
|
||||
- WAN already live on the Cox modem (public DHCP)
|
||||
|
||||
QuickBooks must be CLOSED on all workstations (QBW/TLG lock + change under copy).
|
||||
## TOMORROW MORNING — cables + test
|
||||
|
||||
```bat
|
||||
robocopy \\TPS-SERVER\C$\Share\Quickbooks C:\Share\Quickbooks /E /COPYALL /DCOPY:DAT /R:1 /W:1 /MT:16 /NP /TEE /LOG:C:\Backups\robocopy-quickbooks.log
|
||||
robocopy \\TPS-SERVER\C$\Share\Deployment C:\Share\Deployment /E /COPYALL /DCOPY:DAT /R:1 /W:1 /MT:16 /NP /TEE /LOG:C:\Backups\robocopy-deployment.log
|
||||
```
|
||||
1. Pull SonicWall (.1) and USG; patch the office switch into the Pro's LAN port.
|
||||
2. On one workstation: `ipconfig /renew` -> expect SAME IP, gw .1, DNS .125/.135,
|
||||
internet up.
|
||||
3. Log on as a user (Howard has passwords): Q: maps to \\tps-server\Quickbooks
|
||||
(unchanged), open the company file — QB works exactly as yesterday.
|
||||
-> proves the network move broke nothing.
|
||||
4. Phones: dial tone / registration on all 3 Yealinks. NVR: local UI + remote view.
|
||||
5. Run `bash clients/prairie-schooner/verify-cutover.sh` from ClaudeTools for the
|
||||
scripted pass/fail readout.
|
||||
|
||||
- ~179 GB over gigabit: expect roughly 30–60 min total.
|
||||
- Verify: tail of each log — `FAILED` column must be 0. Re-run the same command for a
|
||||
delta/repair pass (robocopy is idempotent here; do NOT add /MIR on the first night —
|
||||
nothing to mirror-delete anyway).
|
||||
- Run as guru (SYSTEM/RMM cannot auth to \\TPS-SERVER\C$ — that is why this step is
|
||||
interactive, not dispatched).
|
||||
**Rollback:** plug the SonicWall back in — nothing else was changed.
|
||||
|
||||
### 2. Create the shares on TPS-SVR (match old server exactly)
|
||||
## LATER (separate visit) — QB/file-server move to TPS-SVR
|
||||
|
||||
```powershell
|
||||
New-SmbShare -Name Quickbooks -Path C:\Share\Quickbooks -Description "QuickBooks data" -FullAccess Everyone
|
||||
New-SmbShare -Name Deployment -Path C:\Share\Deployment -FullAccess "NT AUTHORITY\Authenticated Users" -ReadAccess Everyone
|
||||
```
|
||||
Data is already staged; refresh + cut when ready:
|
||||
1. QB closed everywhere -> re-run the robocopy delta (seconds).
|
||||
2. On TPS-SVR: create shares
|
||||
`New-SmbShare -Name Quickbooks -Path C:\Share\Quickbooks -FullAccess Everyone`
|
||||
`New-SmbShare -Name Deployment -Path C:\Share\Deployment -FullAccess "NT AUTHORITY\Authenticated Users" -ReadAccess Everyone`
|
||||
3. Install QB Database Server Manager (match their QB Desktop year) -> scan C:\Share\Quickbooks.
|
||||
4. GPMC: Default Domain Policy -> User Prefs -> Drive Maps -> Q: -> \\tps-svr\Quickbooks.
|
||||
5. Relogon test on one PC, open company file multi-user.
|
||||
6. Flip Pro DHCP DNS order to .135, .125.
|
||||
|
||||
- NTFS perms arrive with /COPYALL — do not re-ACL.
|
||||
- Old empty shares (Company, Users, "Folder Redirection", "Shared Folders" DFS root):
|
||||
intentionally NOT recreated — zero bytes, no map/script references them.
|
||||
## Then the AD retirement (unchanged)
|
||||
|
||||
### 3. QuickBooks Database Server Manager on TPS-SVR
|
||||
|
||||
- Install the QB DBSM matching the client's current QB year (ACL evidence: 27/28/31/34 =
|
||||
2017/2018/2021/2024 — 2024 is presumably live; confirm the .QBW's version).
|
||||
- Run DBSM -> scan `C:\Share\Quickbooks` -> confirm company file(s) found; it fixes
|
||||
service-user ACLs itself.
|
||||
- Firewall: DBSM installer opens its ports; verify QBDBMgrN service running.
|
||||
|
||||
### 4. Repoint the Q: drive GPP (GPMC on TPS-SVR)
|
||||
|
||||
Default Domain Policy -> User Configuration -> Preferences -> Windows Settings ->
|
||||
Drive Maps -> Q: -> change path `\\tps-server\quickbooks` -> **`\\tps-svr\Quickbooks`**.
|
||||
(persistent=0 + action=Update means every morning logon re-applies it — no per-PC work.)
|
||||
|
||||
Optional immediate test tonight: `gpupdate /force` + logoff/logon on one workstation,
|
||||
open the company file on Q:, confirm multi-user mode works — while the old server is
|
||||
still fully up. Zero-risk rollback window.
|
||||
|
||||
### 5. Enter the UDM Pro config (UniFi app, Pro LAN still ISOLATED)
|
||||
|
||||
Full detail in `udm-dhcp-plan.md`:
|
||||
- LAN 192.168.1.1/24, domain tps.local
|
||||
- DHCP pool 192.168.1.100–199, DNS handed to clients: **.135, .125**
|
||||
- 7 fixed-IP reservations (3 PCs, 3 Yealink phones, Dahua NVR)
|
||||
- Content filtering / DNS Shield OFF
|
||||
|
||||
## TOMORROW MORNING — cable swap + test
|
||||
|
||||
1. Pull SonicWall (.1) and USG; patch the office switch into the UDM Pro LAN port.
|
||||
2. On one workstation: `ipconfig /renew` -> expect SAME IP, gateway .1, DNS .135/.125,
|
||||
internet up. (`nslookup tps.local` should answer from .135.)
|
||||
3. Log users on normally -> Q: now maps to \\tps-svr\Quickbooks (GPP applies at logon).
|
||||
4. Open QuickBooks on 2 workstations -> company file opens multi-user.
|
||||
5. Phones: confirm dial tone / registration on all 3 Yealinks (reboot any that sulk).
|
||||
6. NVR: confirm local UI (https://192.168.1.145) and remote/P2P view.
|
||||
7. Spot-check internet + printing.
|
||||
|
||||
**Rollback (if the Pro misbehaves):** plug the SonicWall back in — nothing on the old
|
||||
path was changed. Q:/shares work under either gateway since both servers are on the LAN.
|
||||
|
||||
## Explicitly OUT of scope for tomorrow (old server stays ON)
|
||||
|
||||
TPS-SERVER remains DC/DNS/CA until the AD migration completes: FSMO transfer, CA
|
||||
migration (test `Backup-CARoleService` key export first), DNS role checks, demote +
|
||||
power off, then shrink the DHCP DNS list to .135 only (or add .1). Do NOT power off
|
||||
the old server after the file cutover — .125 is still second DNS and a live DC.
|
||||
FSMO transfer, CA migration (test Backup-CARoleService key export first), QB checks,
|
||||
demote TPS-SERVER + power off, real backup. Old server stays ON until this completes —
|
||||
it is still a DC, DNS (.125), CA, and (for now) the QB host.
|
||||
|
||||
@@ -9,8 +9,10 @@ against the 2026-07-14 onsite ping sweep. Goal: every device keeps its current I
|
||||
- Domain name: `tps.local`
|
||||
- DHCP pool (superset of today's clients): **192.168.1.100 – 192.168.1.199**
|
||||
- Statics .125 and .135 are OUTSIDE reservations but INSIDE this range — see exclusions below.
|
||||
- DHCP DNS handed to clients: **192.168.1.135, 192.168.1.125** (new DC first — this is the
|
||||
migration unblock)
|
||||
- DHCP DNS handed to clients: **192.168.1.125, 192.168.1.135** for the swap (SAME primary as
|
||||
the SonicWall hands today — the gateway swap must change nothing observable). AFTER the
|
||||
network is proven, flip the order to .135 first on the Pro (the migration unblock — now a
|
||||
10-second change we control).
|
||||
- Disable content filtering / DNS Shield / ad-block (DCs do DNS)
|
||||
|
||||
## Fixed-IP reservations (MAC -> IP)
|
||||
|
||||
@@ -9,9 +9,9 @@ eval "$(bash .claude/scripts/rmm-auth.sh 2>/dev/null)" || { echo "[ERROR] RMM au
|
||||
|
||||
AGENTS=$(curl -s "$RMM/api/agents" -H "Authorization: Bearer $TOKEN")
|
||||
resolve(){ echo "$AGENTS" | jq -r --arg h "$1" '[.[]|select(.hostname|ascii_downcase==($h|ascii_downcase))][0].id // empty'; }
|
||||
TINA=$(resolve TPS-Tina); SVR=$(resolve TPS-SVR)
|
||||
[ -z "$TINA" ] || [ -z "$SVR" ] && { echo "[ERROR] could not resolve agents (TINA=$TINA SVR=$SVR)"; exit 1; }
|
||||
echo "[INFO] TPS-Tina=$TINA TPS-SVR=$SVR"
|
||||
TINA=$(resolve TPS-Tina); SVR=$(resolve TPS-SERVER)
|
||||
[ -z "$TINA" ] || [ -z "$SVR" ] && { echo "[ERROR] could not resolve agents (TINA=$TINA SERVER=$SVR)"; exit 1; }
|
||||
echo "[INFO] TPS-Tina=$TINA TPS-SERVER=$SVR"
|
||||
|
||||
WS_SYS='
|
||||
$ErrorActionPreference="Continue"
|
||||
@@ -20,9 +20,10 @@ Write-Output ("IP: " + $ip.IPv4Address.IPAddress + " GW: " + $ip.IPv4DefaultGat
|
||||
Write-Output ("DNS: " + (($ip.DNSServer | ForEach-Object{$_.ServerAddresses}) -join ", "))
|
||||
Write-Output ("GW ping: " + (Test-Connection 192.168.1.1 -Count 1 -Quiet))
|
||||
Write-Output ("Internet ping 1.1.1.1: " + (Test-Connection 1.1.1.1 -Count 1 -Quiet))
|
||||
try{$r=Resolve-DnsName tps.local -Server 192.168.1.135 -ErrorAction Stop; Write-Output ("DNS via .135 tps.local: OK -> " + (($r|ForEach-Object{$_.IPAddress}) -join ","))}catch{Write-Output "DNS via .135: FAIL"}
|
||||
Write-Output ("UNC \\tps-svr\Quickbooks: " + (Test-Path "\\tps-svr\Quickbooks"))
|
||||
Write-Output ("UNC \\tps-svr\Deployment: " + (Test-Path "\\tps-svr\Deployment"))
|
||||
try{$r=Resolve-DnsName tps.local -Server 192.168.1.125 -ErrorAction Stop; Write-Output ("DNS via .125 tps.local: OK -> " + (($r|ForEach-Object{$_.IPAddress}) -join ","))}catch{Write-Output "DNS via .125: FAIL"}
|
||||
try{$r=Resolve-DnsName tps.local -Server 192.168.1.135 -ErrorAction Stop; Write-Output "DNS via .135: OK"}catch{Write-Output "DNS via .135: FAIL"}
|
||||
Write-Output ("UNC \\tps-server\Quickbooks (LIVE QB path): " + (Test-Path "\\tps-server\Quickbooks"))
|
||||
Write-Output ("UNC \\tps-svr\Share (staging): " + (Test-Path "\\tps-svr\Share"))
|
||||
foreach($d in @("192.168.1.141","192.168.1.142","192.168.1.146","192.168.1.145")){ Write-Output ("ping " + $d + ": " + (Test-Connection $d -Count 1 -Quiet)) }
|
||||
$c=New-Object Net.Sockets.TcpClient; $h=$c.BeginConnect("192.168.1.145",443,$null,$null)
|
||||
Write-Output ("NVR 443: " + ($h.AsyncWaitHandle.WaitOne(1500) -and $c.Connected)); $c.Close()
|
||||
@@ -30,12 +31,12 @@ $ext=(Resolve-DnsName myip.opendns.com -Server resolver1.opendns.com -ErrorActio
|
||||
Write-Output ("Public egress: " + $ext + " (SonicWall was 184.176.147.183 - should be DIFFERENT now)")'
|
||||
|
||||
WS_USER='net use | Select-String "Q:"
|
||||
Get-ItemProperty "Registry::HKEY_CURRENT_USER\Network\Q" 2>$null | ForEach-Object{ Write-Output ("HKCU Q: -> " + $_.RemotePath) }
|
||||
Write-Output ("Q:\ accessible: " + (Test-Path Q:\))'
|
||||
Write-Output ("Q:\ accessible: " + (Test-Path Q:\))
|
||||
Write-Output ("company file visible: " + (Test-Path "Q:\schoonerQB2025.QBW"))'
|
||||
|
||||
SVR_SYS='
|
||||
Get-Service | Where-Object{$_.Name -like "QBDBMgr*" -or $_.Name -eq "DNS" -or $_.Name -eq "NTDS"} | ForEach-Object{ Write-Output ($_.Name + ": " + $_.Status) }
|
||||
Get-SmbShare | Where-Object{$_.Name -in @("Quickbooks","Deployment")} | ForEach-Object{ Write-Output ("share " + $_.Name + " -> " + $_.Path) }
|
||||
Get-Service | Where-Object{$_.Name -like "QBDBMgr*" -or $_.Name -like "QBCFMonitor*" -or $_.Name -eq "DNS" -or $_.Name -eq "NTDS"} | ForEach-Object{ Write-Output ($_.Name + ": " + $_.Status) }
|
||||
Get-SmbShare | Where-Object{$_.Name -eq "Quickbooks"} | ForEach-Object{ Write-Output ("share " + $_.Name + " -> " + $_.Path) }
|
||||
Get-SmbSession | Group-Object ClientComputerName | ForEach-Object{ Write-Output ("SMB client: " + $_.Name + " (" + $_.Count + ")") }
|
||||
Write-Output ("Internet: " + (Test-Connection 1.1.1.1 -Count 1 -Quiet))'
|
||||
|
||||
@@ -63,11 +64,11 @@ echo "[INFO] dispatched: tina-net=$C1 tina-user=$C2 svr=$C3"
|
||||
|
||||
echo; echo "##### TPS-TINA network/UNC #####"; poll "$C1"
|
||||
echo; echo "##### TPS-TINA Q: mapping (user session — needs someone logged in) #####"; poll "$C2"
|
||||
echo; echo "##### TPS-SVR services/shares #####"; poll "$C3"
|
||||
echo; echo "##### TPS-SERVER (old, still the QB host) services/shares #####"; poll "$C3"
|
||||
|
||||
bash .claude/scripts/post-bot-alert.sh "[RMM] Howard ran post-cutover verification on TPS-Tina + TPS-SVR (Prairie Schooner UDM swap) -> cmd:${C1:0:8},${C2:0:8},${C3:0:8}" >/dev/null 2>&1
|
||||
|
||||
echo
|
||||
echo "[INFO] PASS looks like: GW ping True, internet True, DNS via .135 OK, both UNC True,"
|
||||
echo "[INFO] Q: -> \\\\tps-svr\\Quickbooks + Q:\\ True, QBDBMgr Running, phones+NVR ping True,"
|
||||
echo "[INFO] public egress != 184.176.147.183. Phones/NVR checks need the swap completed first."
|
||||
echo "[INFO] NETWORK-SWAP-ONLY pass criteria: GW ping True, internet True, DNS .125 + .135 OK,"
|
||||
echo "[INFO] UNC \\\\tps-server\\Quickbooks True, Q: -> \\\\tps-server\\Quickbooks + company file True,"
|
||||
echo "[INFO] QBDBMgr Running on TPS-SERVER, phones+NVR ping True, egress != 184.176.147.183."
|
||||
Reference in New Issue
Block a user