From 973f63487a4fe69b1d67ec49c7d27fa78bd6f57f Mon Sep 17 00:00:00 2001 From: Howard Enos Date: Wed, 22 Jul 2026 13:21:49 -0700 Subject: [PATCH] sync: auto-sync from HOWARD-HOME at 2026-07-22 13:21:04 Author: Howard Enos Machine: HOWARD-HOME Timestamp: 2026-07-22 13:21:04 --- ...26-07-22-howard-assistnurse-pc-closeout.md | 49 ++++++++++ ...6-07-21-howard-edservices4-laptop-setup.md | 91 +++++++++++++++++++ 2 files changed, 140 insertions(+) create mode 100644 clients/cascades/session-logs/2026-07/2026-07-22-howard-assistnurse-pc-closeout.md diff --git a/clients/cascades/session-logs/2026-07/2026-07-22-howard-assistnurse-pc-closeout.md b/clients/cascades/session-logs/2026-07/2026-07-22-howard-assistnurse-pc-closeout.md new file mode 100644 index 00000000..44a3e1ca --- /dev/null +++ b/clients/cascades/session-logs/2026-07/2026-07-22-howard-assistnurse-pc-closeout.md @@ -0,0 +1,49 @@ +# Cascades: ASSISTNURSE-PC Kiosk Closeout & Local Account Lockdown + +## User +- **User:** Howard Enos (howard) +- **Machine:** Howard-Home +- **Role:** tech + +## Session Summary + +Picked up from a prior session to close out Gitea tracker issue #29 (Cascades: ASSISTNURSE-PC nurse station kiosk config). The ticket required moving ASSISTNURSE-PC into OU=Caregiver Devices, configuring machine-level printers, and running gpupdate so the CSC - Caregiver Device Lockdown GPO would apply. + +Ran RMM verification against ASSISTNURSE-PC to confirm all ticket requirements were met: OU membership confirmed in Caregiver Devices, three GPOs applied (Caregiver Device Lockdown, Point and Print, Always Wait For Network), AppLocker service running, Point and Print configured with ServerList=CS-SERVER, and 4 HKLM printer connections registered. Posted a verification comment and closed #29. + +Howard asked whether ASSISTNURSE-PC was in kiosk mode. Investigation showed neither Assigned Access nor Shell Launcher was configured -- but a comparison run against NURSESTATION-PC confirmed the same state. The "kiosk" config at Cascades is implemented via the Caregiver Device Lockdown GPO (AppLocker + GPP restrictions), not Windows kiosk mode. Both machines matched. + +Howard then requested all local accounts be disabled on both nurse station PCs, with any logged-in local users forced off. Enumerated local accounts on both machines: NURSESTATION-PC had `localadmin` and `Nurses` (Nurses was logged in, disconnected); ASSISTNURSE-PC had `Localadmin` and `Medtechs and Care`. Disabled all four accounts and logged off the Nurses session on NURSESTATION-PC. Verified all local accounts show Enabled=False on both machines. Both PCs are now domain-login only. + +## Key Decisions + +- Closed tracker #29 based on live RMM verification rather than trusting the prior session's stated completion -- confirmed OU, GPO, AppLocker, and printer config directly on the endpoint. +- Confirmed "kiosk mode" means the Caregiver Device Lockdown GPO (AppLocker-based), not Windows Assigned Access or Shell Launcher, by comparing NURSESTATION-PC (the reference machine) to ASSISTNURSE-PC. +- Disabled all local accounts (not just the shared caregiver ones) -- `localadmin` on both machines was also disabled per Howard's directive for domain-only login. + +## Configuration Changes + +- **NURSESTATION-PC**: Disabled local accounts `localadmin` and `Nurses`; logged off `nurses` disconnected session (session ID 2) +- **ASSISTNURSE-PC**: Disabled local accounts `Localadmin` and `Medtechs and Care` +- **Gitea**: Closed issue #29 with verification comment + +## Infrastructure & Servers + +- NURSESTATION-PC: `f5a89784-834f-47b1-82e2-7e3e9dd337ff` (Cascades of Tucson, Windows, online) +- ASSISTNURSE-PC: `62d108d6-4659-499f-9006-8fd79677daab` (Cascades of Tucson, Windows, online) +- Both in OU=Caregiver Devices,OU=Staff PCs,OU=Workstations,DC=cascades,DC=local +- GPO applied from CS-SERVER.cascades.local +- Network printers via Point and Print: Nurses - Brother MFC-L8900CDW (192.168.2.75), Health Services - Konica Minolta C368 (192.168.1.138) + +## Commands & Outputs + +- `gpresult /Scope Computer /r` on both machines confirmed identical GPO application (CSC - Caregiver Device Lockdown, CSC - Point and Print, CSC - Always Wait For Network) +- `Get-LocalUser` verified all local accounts disabled on both machines (6 accounts each, all Enabled=False) +- `logoff 2` on NURSESTATION-PC terminated the disconnected `nurses` session +- `Disable-LocalUser` on both machines for the active local accounts + +## Reference Information + +- Tracker issue: https://git.azcomputerguru.com/azcomputerguru/claudetools/issues/29 (closed) +- Dev alert posted: message_id 1529527215094628364 +- RMM command IDs: verification 873cadca, 2e55c69f, 69c1ed25; disable 9502bc75 (NURSESTATION), 29eebe41 (ASSISTNURSE) diff --git a/clients/instrumental-music-center/session-logs/2026-07/2026-07-21-howard-edservices4-laptop-setup.md b/clients/instrumental-music-center/session-logs/2026-07/2026-07-21-howard-edservices4-laptop-setup.md index 6d85868b..ae7f5dd4 100644 --- a/clients/instrumental-music-center/session-logs/2026-07/2026-07-21-howard-edservices4-laptop-setup.md +++ b/clients/instrumental-music-center/session-logs/2026-07/2026-07-21-howard-edservices4-laptop-setup.md @@ -194,3 +194,94 @@ Separately, billed Syncro ticket #32573 (Cascades of Tucson - "Onsite - Memcare - **AIM RemoteApp alias:** `AIM` (collection "v12", path `S:\AIM\AIM.exe`) - **AIMRDP8.exe PDB path:** `C:\Projects\AIMsi\AIMsi V12\AIMsiRDP8\obj\Release\AIMRDP8.pdb` - **Tri-Tech docs:** https://www.tritechretail.com/topic/aim + +--- + +## Update: 13:19 PT -- M365 tenant onboarding, USER# on IMC1, billing + +### Session Summary + +Continued DESKTOP-KRHQ5TS setup. Howard identified that the USER#=4 environment variable set on the laptop would not carry into RDP sessions on IMC1 -- AIMsi reads the variable from the server's user profile, not the client. Set USER#=4 for edservices4 at the user level on IMC1 via the registry (`HKEY_USERS\\Environment`), confirmed it won't affect other users (each user has their own: leslie=8, station3=3, Dakota=22, Erik=24, system default=17). + +Onboarded IMC's M365 tenant (`instrumentalmusic.onmicrosoft.com`, tenant ID `65adab75-f1fd-4ef9-b2b4-c24f595393e3`) to the ACG remediation app suite via `/onboard365`. Consent link was sent to Howard's Discord DM. After consent, provisioned all 4 apps (Defender skipped -- no MDE license). Initial provision had transient SP replication errors ("Resource does not exist"); re-run after 10 seconds completed cleanly with all permissions granted and directory roles assigned. + +Checked license inventory: 5x O365_BUSINESS (Microsoft 365 Apps for Business), all 5 consumed (management, moo, remote, repair, retail). Zero available. Howard assigned the Management license to the edservices4 account manually. Updated the IMC M365 docs and vaulted all 5 account credentials from Leslie's spreadsheet photo. + +Billed ticket #32569 via the /syncro skill: 1.0h Labor - Remote Business, prepaid block 9.5 -> 8.5 hrs, invoice $0.00. Resolution comment included full end-user instructions for offsite (VPN + RDP) and onsite (direct AIM) workflows, plus all login credentials. + +Separately, the Cascades ASSISTNURSE-PC kiosk config (tracker issue #29) was checked -- still open, needs OU move + printers + gpupdate. Howard passed that to another session. + +### Key Decisions + +- Set USER#=4 at user level (not system level) on IMC1 to avoid conflicting with other RDP users' AIMsi workstation numbers. +- Used /syncro skill for billing (correcting the earlier hand-roll mistake on #32573). +- Included plaintext credentials in the customer-visible ticket comment per Howard's direction -- this is an internal-use workstation with generic shared credentials, not a personal account. + +### Problems Encountered + +- **M365 tenant onboarding SP replication delay:** First provision run had 10 errors ("Resource does not exist") because the newly created service principals hadn't replicated in Entra ID. Re-running after 10 seconds completed cleanly. This is a known transient issue. +- **Hand-rolled billing correction logged:** The Cascades #32573 billing earlier in the session used raw curl instead of the /syncro skill. Logged as a correction to errorlog.md. IMC #32569 billing used the skill correctly. + +### Configuration Changes (this update) + +#### IMC1 +- `HKEY_USERS\\Environment\USER#` = `4` (user-level env var for RDP sessions) + +#### IMC M365 Tenant (instrumentalmusic.onmicrosoft.com) +- ComputerGuru Tenant Admin -- consented + Conditional Access Administrator role +- ComputerGuru Security Investigator -- consented + Exchange Administrator role +- ComputerGuru Exchange Operator -- consented + Exchange Administrator role +- ComputerGuru User Manager -- consented + User Administrator + Authentication Administrator roles +- Management license assigned to edservices4 (by Howard manually) + +#### Vault +- `clients/imc/m365-accounts.sops.yaml` -- all 5 IMC M365 role-based account credentials + +#### Docs +- `clients/instrumental-music-center/docs/cloud/m365.md` -- updated with tenant info, accounts, mixed identity notes + +### Credentials & Secrets (this update) + +#### M365 (instrumentalmusic.onmicrosoft.com) +Vaulted at `clients/imc/m365-accounts.sops.yaml`: +- moo@instrumentalmusic.onmicrosoft.com / Xux27797 +- management@instrumentalmusic.onmicrosoft.com / Lom44612 +- remote@instrumentalmusic.onmicrosoft.com / Suw80728 +- repair@instrumentalmusic.onmicrosoft.com / Dun81194 +- retail@instrumentalmusic.onmicrosoft.com / Sax32322 + +### Infrastructure (this update) + +- **IMC M365 tenant ID:** 65adab75-f1fd-4ef9-b2b4-c24f595393e3 +- **Tenant domain:** instrumentalmusic.onmicrosoft.com +- **License:** O365_BUSINESS (Microsoft 365 Apps for Business), 5 seats, all consumed +- **No MDE license** (Defender tier skipped) + +### Syncro Billing (this update) + +- **Ticket #32569** (Instrumental Music Center) -- "Laptop - Set up for new user..." + - Comment: Resolution with full setup details and end-user instructions + - Line item: 1.0h Labor - Remote Business ($150.00, taxable: false) + - Invoice: $0.00 (prepaid block 9.5 -> 8.5 hrs) + - Invoice note: "Block hours remaining: 8.5." + - Status: Invoiced + - Bot alert: posted + +### Pending / Incomplete Tasks (final) + +- **Datto EDR for DESKTOP-KRHQ5TS:** Not yet enrolled. Push via /rmm once confirmed. +- **OpenVPN auto-start:** User must manually connect VPN after each login. Could automate. +- **ServerIMC phantom DC:** Fleet-wide auth degradation unresolved. No ticket opened. +- **IMC1 RMM UUID in wiki:** Stale (`fa99e913` -> `88cbf7c0`). +- **Manda's VPN account on UDM:** Still active. Confirm if still needed. +- **Cascades ASSISTNURSE-PC kiosk:** Tracker issue #29 open. Passed to another session. + +### Reference Information (this update) + +- **Syncro ticket #32569:** https://computerguru.syncromsp.com/tickets/114041531 +- **IMC M365 tenant:** 65adab75-f1fd-4ef9-b2b4-c24f595393e3 +- **Tenant Admin SP:** 400ac92e-9fab-4c39-b0ce-01d53ab5afbd +- **Security Investigator SP:** 0f1aa115-f401-4582-9b68-7b65b47af4c8 +- **Exchange Operator SP:** 5ea49994-42b1-4739-854d-b6b5163a69d6 +- **User Manager SP:** 6f566da6-0214-43fb-b83a-c323f69a5710 +- **IMC prepaid block:** 8.5 hrs remaining (after 1.0h debit from #32569)