sync: auto-sync from HOWARD-HOME at 2026-07-22 13:21:04
Author: Howard Enos Machine: HOWARD-HOME Timestamp: 2026-07-22 13:21:04
This commit is contained in:
@@ -0,0 +1,49 @@
|
|||||||
|
# Cascades: ASSISTNURSE-PC Kiosk Closeout & Local Account Lockdown
|
||||||
|
|
||||||
|
## User
|
||||||
|
- **User:** Howard Enos (howard)
|
||||||
|
- **Machine:** Howard-Home
|
||||||
|
- **Role:** tech
|
||||||
|
|
||||||
|
## Session Summary
|
||||||
|
|
||||||
|
Picked up from a prior session to close out Gitea tracker issue #29 (Cascades: ASSISTNURSE-PC nurse station kiosk config). The ticket required moving ASSISTNURSE-PC into OU=Caregiver Devices, configuring machine-level printers, and running gpupdate so the CSC - Caregiver Device Lockdown GPO would apply.
|
||||||
|
|
||||||
|
Ran RMM verification against ASSISTNURSE-PC to confirm all ticket requirements were met: OU membership confirmed in Caregiver Devices, three GPOs applied (Caregiver Device Lockdown, Point and Print, Always Wait For Network), AppLocker service running, Point and Print configured with ServerList=CS-SERVER, and 4 HKLM printer connections registered. Posted a verification comment and closed #29.
|
||||||
|
|
||||||
|
Howard asked whether ASSISTNURSE-PC was in kiosk mode. Investigation showed neither Assigned Access nor Shell Launcher was configured -- but a comparison run against NURSESTATION-PC confirmed the same state. The "kiosk" config at Cascades is implemented via the Caregiver Device Lockdown GPO (AppLocker + GPP restrictions), not Windows kiosk mode. Both machines matched.
|
||||||
|
|
||||||
|
Howard then requested all local accounts be disabled on both nurse station PCs, with any logged-in local users forced off. Enumerated local accounts on both machines: NURSESTATION-PC had `localadmin` and `Nurses` (Nurses was logged in, disconnected); ASSISTNURSE-PC had `Localadmin` and `Medtechs and Care`. Disabled all four accounts and logged off the Nurses session on NURSESTATION-PC. Verified all local accounts show Enabled=False on both machines. Both PCs are now domain-login only.
|
||||||
|
|
||||||
|
## Key Decisions
|
||||||
|
|
||||||
|
- Closed tracker #29 based on live RMM verification rather than trusting the prior session's stated completion -- confirmed OU, GPO, AppLocker, and printer config directly on the endpoint.
|
||||||
|
- Confirmed "kiosk mode" means the Caregiver Device Lockdown GPO (AppLocker-based), not Windows Assigned Access or Shell Launcher, by comparing NURSESTATION-PC (the reference machine) to ASSISTNURSE-PC.
|
||||||
|
- Disabled all local accounts (not just the shared caregiver ones) -- `localadmin` on both machines was also disabled per Howard's directive for domain-only login.
|
||||||
|
|
||||||
|
## Configuration Changes
|
||||||
|
|
||||||
|
- **NURSESTATION-PC**: Disabled local accounts `localadmin` and `Nurses`; logged off `nurses` disconnected session (session ID 2)
|
||||||
|
- **ASSISTNURSE-PC**: Disabled local accounts `Localadmin` and `Medtechs and Care`
|
||||||
|
- **Gitea**: Closed issue #29 with verification comment
|
||||||
|
|
||||||
|
## Infrastructure & Servers
|
||||||
|
|
||||||
|
- NURSESTATION-PC: `f5a89784-834f-47b1-82e2-7e3e9dd337ff` (Cascades of Tucson, Windows, online)
|
||||||
|
- ASSISTNURSE-PC: `62d108d6-4659-499f-9006-8fd79677daab` (Cascades of Tucson, Windows, online)
|
||||||
|
- Both in OU=Caregiver Devices,OU=Staff PCs,OU=Workstations,DC=cascades,DC=local
|
||||||
|
- GPO applied from CS-SERVER.cascades.local
|
||||||
|
- Network printers via Point and Print: Nurses - Brother MFC-L8900CDW (192.168.2.75), Health Services - Konica Minolta C368 (192.168.1.138)
|
||||||
|
|
||||||
|
## Commands & Outputs
|
||||||
|
|
||||||
|
- `gpresult /Scope Computer /r` on both machines confirmed identical GPO application (CSC - Caregiver Device Lockdown, CSC - Point and Print, CSC - Always Wait For Network)
|
||||||
|
- `Get-LocalUser` verified all local accounts disabled on both machines (6 accounts each, all Enabled=False)
|
||||||
|
- `logoff 2` on NURSESTATION-PC terminated the disconnected `nurses` session
|
||||||
|
- `Disable-LocalUser` on both machines for the active local accounts
|
||||||
|
|
||||||
|
## Reference Information
|
||||||
|
|
||||||
|
- Tracker issue: https://git.azcomputerguru.com/azcomputerguru/claudetools/issues/29 (closed)
|
||||||
|
- Dev alert posted: message_id 1529527215094628364
|
||||||
|
- RMM command IDs: verification 873cadca, 2e55c69f, 69c1ed25; disable 9502bc75 (NURSESTATION), 29eebe41 (ASSISTNURSE)
|
||||||
@@ -194,3 +194,94 @@ Separately, billed Syncro ticket #32573 (Cascades of Tucson - "Onsite - Memcare
|
|||||||
- **AIM RemoteApp alias:** `AIM` (collection "v12", path `S:\AIM\AIM.exe`)
|
- **AIM RemoteApp alias:** `AIM` (collection "v12", path `S:\AIM\AIM.exe`)
|
||||||
- **AIMRDP8.exe PDB path:** `C:\Projects\AIMsi\AIMsi V12\AIMsiRDP8\obj\Release\AIMRDP8.pdb`
|
- **AIMRDP8.exe PDB path:** `C:\Projects\AIMsi\AIMsi V12\AIMsiRDP8\obj\Release\AIMRDP8.pdb`
|
||||||
- **Tri-Tech docs:** https://www.tritechretail.com/topic/aim
|
- **Tri-Tech docs:** https://www.tritechretail.com/topic/aim
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Update: 13:19 PT -- M365 tenant onboarding, USER# on IMC1, billing
|
||||||
|
|
||||||
|
### Session Summary
|
||||||
|
|
||||||
|
Continued DESKTOP-KRHQ5TS setup. Howard identified that the USER#=4 environment variable set on the laptop would not carry into RDP sessions on IMC1 -- AIMsi reads the variable from the server's user profile, not the client. Set USER#=4 for edservices4 at the user level on IMC1 via the registry (`HKEY_USERS\<SID>\Environment`), confirmed it won't affect other users (each user has their own: leslie=8, station3=3, Dakota=22, Erik=24, system default=17).
|
||||||
|
|
||||||
|
Onboarded IMC's M365 tenant (`instrumentalmusic.onmicrosoft.com`, tenant ID `65adab75-f1fd-4ef9-b2b4-c24f595393e3`) to the ACG remediation app suite via `/onboard365`. Consent link was sent to Howard's Discord DM. After consent, provisioned all 4 apps (Defender skipped -- no MDE license). Initial provision had transient SP replication errors ("Resource does not exist"); re-run after 10 seconds completed cleanly with all permissions granted and directory roles assigned.
|
||||||
|
|
||||||
|
Checked license inventory: 5x O365_BUSINESS (Microsoft 365 Apps for Business), all 5 consumed (management, moo, remote, repair, retail). Zero available. Howard assigned the Management license to the edservices4 account manually. Updated the IMC M365 docs and vaulted all 5 account credentials from Leslie's spreadsheet photo.
|
||||||
|
|
||||||
|
Billed ticket #32569 via the /syncro skill: 1.0h Labor - Remote Business, prepaid block 9.5 -> 8.5 hrs, invoice $0.00. Resolution comment included full end-user instructions for offsite (VPN + RDP) and onsite (direct AIM) workflows, plus all login credentials.
|
||||||
|
|
||||||
|
Separately, the Cascades ASSISTNURSE-PC kiosk config (tracker issue #29) was checked -- still open, needs OU move + printers + gpupdate. Howard passed that to another session.
|
||||||
|
|
||||||
|
### Key Decisions
|
||||||
|
|
||||||
|
- Set USER#=4 at user level (not system level) on IMC1 to avoid conflicting with other RDP users' AIMsi workstation numbers.
|
||||||
|
- Used /syncro skill for billing (correcting the earlier hand-roll mistake on #32573).
|
||||||
|
- Included plaintext credentials in the customer-visible ticket comment per Howard's direction -- this is an internal-use workstation with generic shared credentials, not a personal account.
|
||||||
|
|
||||||
|
### Problems Encountered
|
||||||
|
|
||||||
|
- **M365 tenant onboarding SP replication delay:** First provision run had 10 errors ("Resource does not exist") because the newly created service principals hadn't replicated in Entra ID. Re-running after 10 seconds completed cleanly. This is a known transient issue.
|
||||||
|
- **Hand-rolled billing correction logged:** The Cascades #32573 billing earlier in the session used raw curl instead of the /syncro skill. Logged as a correction to errorlog.md. IMC #32569 billing used the skill correctly.
|
||||||
|
|
||||||
|
### Configuration Changes (this update)
|
||||||
|
|
||||||
|
#### IMC1
|
||||||
|
- `HKEY_USERS\<edservices4-SID>\Environment\USER#` = `4` (user-level env var for RDP sessions)
|
||||||
|
|
||||||
|
#### IMC M365 Tenant (instrumentalmusic.onmicrosoft.com)
|
||||||
|
- ComputerGuru Tenant Admin -- consented + Conditional Access Administrator role
|
||||||
|
- ComputerGuru Security Investigator -- consented + Exchange Administrator role
|
||||||
|
- ComputerGuru Exchange Operator -- consented + Exchange Administrator role
|
||||||
|
- ComputerGuru User Manager -- consented + User Administrator + Authentication Administrator roles
|
||||||
|
- Management license assigned to edservices4 (by Howard manually)
|
||||||
|
|
||||||
|
#### Vault
|
||||||
|
- `clients/imc/m365-accounts.sops.yaml` -- all 5 IMC M365 role-based account credentials
|
||||||
|
|
||||||
|
#### Docs
|
||||||
|
- `clients/instrumental-music-center/docs/cloud/m365.md` -- updated with tenant info, accounts, mixed identity notes
|
||||||
|
|
||||||
|
### Credentials & Secrets (this update)
|
||||||
|
|
||||||
|
#### M365 (instrumentalmusic.onmicrosoft.com)
|
||||||
|
Vaulted at `clients/imc/m365-accounts.sops.yaml`:
|
||||||
|
- moo@instrumentalmusic.onmicrosoft.com / Xux27797
|
||||||
|
- management@instrumentalmusic.onmicrosoft.com / Lom44612
|
||||||
|
- remote@instrumentalmusic.onmicrosoft.com / Suw80728
|
||||||
|
- repair@instrumentalmusic.onmicrosoft.com / Dun81194
|
||||||
|
- retail@instrumentalmusic.onmicrosoft.com / Sax32322
|
||||||
|
|
||||||
|
### Infrastructure (this update)
|
||||||
|
|
||||||
|
- **IMC M365 tenant ID:** 65adab75-f1fd-4ef9-b2b4-c24f595393e3
|
||||||
|
- **Tenant domain:** instrumentalmusic.onmicrosoft.com
|
||||||
|
- **License:** O365_BUSINESS (Microsoft 365 Apps for Business), 5 seats, all consumed
|
||||||
|
- **No MDE license** (Defender tier skipped)
|
||||||
|
|
||||||
|
### Syncro Billing (this update)
|
||||||
|
|
||||||
|
- **Ticket #32569** (Instrumental Music Center) -- "Laptop - Set up for new user..."
|
||||||
|
- Comment: Resolution with full setup details and end-user instructions
|
||||||
|
- Line item: 1.0h Labor - Remote Business ($150.00, taxable: false)
|
||||||
|
- Invoice: $0.00 (prepaid block 9.5 -> 8.5 hrs)
|
||||||
|
- Invoice note: "Block hours remaining: 8.5."
|
||||||
|
- Status: Invoiced
|
||||||
|
- Bot alert: posted
|
||||||
|
|
||||||
|
### Pending / Incomplete Tasks (final)
|
||||||
|
|
||||||
|
- **Datto EDR for DESKTOP-KRHQ5TS:** Not yet enrolled. Push via /rmm once confirmed.
|
||||||
|
- **OpenVPN auto-start:** User must manually connect VPN after each login. Could automate.
|
||||||
|
- **ServerIMC phantom DC:** Fleet-wide auth degradation unresolved. No ticket opened.
|
||||||
|
- **IMC1 RMM UUID in wiki:** Stale (`fa99e913` -> `88cbf7c0`).
|
||||||
|
- **Manda's VPN account on UDM:** Still active. Confirm if still needed.
|
||||||
|
- **Cascades ASSISTNURSE-PC kiosk:** Tracker issue #29 open. Passed to another session.
|
||||||
|
|
||||||
|
### Reference Information (this update)
|
||||||
|
|
||||||
|
- **Syncro ticket #32569:** https://computerguru.syncromsp.com/tickets/114041531
|
||||||
|
- **IMC M365 tenant:** 65adab75-f1fd-4ef9-b2b4-c24f595393e3
|
||||||
|
- **Tenant Admin SP:** 400ac92e-9fab-4c39-b0ce-01d53ab5afbd
|
||||||
|
- **Security Investigator SP:** 0f1aa115-f401-4582-9b68-7b65b47af4c8
|
||||||
|
- **Exchange Operator SP:** 5ea49994-42b1-4739-854d-b6b5163a69d6
|
||||||
|
- **User Manager SP:** 6f566da6-0214-43fb-b83a-c323f69a5710
|
||||||
|
- **IMC prepaid block:** 8.5 hrs remaining (after 1.0h debit from #32569)
|
||||||
|
|||||||
Reference in New Issue
Block a user