From 996041406ce1e4e449912489a08cd3111f65152d Mon Sep 17 00:00:00 2001 From: Mike Swanson Date: Fri, 10 Jul 2026 15:57:55 -0700 Subject: [PATCH] sync: auto-sync from GURU-5070 at 2026-07-10 15:57:23 Author: Mike Swanson Machine: GURU-5070 Timestamp: 2026-07-10 15:57:23 --- ...-10-mike-haubner-ltobey-address-invalid.md | 69 +++++++++++++++++++ 1 file changed, 69 insertions(+) create mode 100644 clients/dataforth/session-logs/2026-07/2026-07-10-mike-haubner-ltobey-address-invalid.md diff --git a/clients/dataforth/session-logs/2026-07/2026-07-10-mike-haubner-ltobey-address-invalid.md b/clients/dataforth/session-logs/2026-07/2026-07-10-mike-haubner-ltobey-address-invalid.md new file mode 100644 index 00000000..8ffdb6d3 --- /dev/null +++ b/clients/dataforth/session-logs/2026-07/2026-07-10-mike-haubner-ltobey-address-invalid.md @@ -0,0 +1,69 @@ +## User +- **User:** Mike Swanson (mike) +- **Machine:** GURU-5070 +- **Role:** admin + +## Session Summary + +Diagnosed a Dataforth email complaint: Georg Haubner (ghaubner@dataforth.com) gets "the address is no longer valid" in Outlook when sending to Logan Tobey (ltobey@dataforth.com). Investigated server-side first via the remediation-tool (tenant 7dfa3ce8-c496-4b51-ab8d-bd3dcd78b584). Confirmed ltobey@dataforth.com is a valid, enabled, single directory object (created 2023-12-07, correct primary SMTP, no recreation, no duplicate contact/object). Haubner's mailbox showed NO recent NDR to ltobey, which means the failure is a pre-send resolution block on Haubner's Outlook client, not a delivery/transport failure. + +Attempted to inspect Haubner's contacts and Exchange recipient legacy DNs via API but hit two permission gaps in the Dataforth tenant: the Security Investigator app lacks Contacts.Read (Graph /contacts returned ErrorAccessDenied), and the Exchange REST admin API returned HTTP 401 (our SP is not authorized/assigned Exchange Admin in this tenant). A raw X500 LegacyExchangeDN that appeared as a "from" on two of Haubner's messages turned out to be Haubner's OWN LegacyExchangeDN (normal serialization on his sent items), a red herring. + +Pivoted to GuruRMM to inspect the actual Outlook autocomplete cache on Haubner's workstation. Located the machine via rmm-search: HGHAUBNER (Dataforth Corp, site D1, online, agent id 2aefe0d5-2357-4bdd-965a-abfccb4767a5). Dispatched a read-only PowerShell probe (via ps-encoded.sh) that scanned all user profiles' Outlook RoamCache autocomplete streams. Found ghaubner logged on (console session, Outlook open), two Stream_Autocomplete_*.dat files (active one modified 2026-07-10 15:20), Logan Tobey cached in both displaying the correct "Logan Tobey ", and a large set of legacy EX/X500 routing addresses in the cache (many /o=ExchangeLabs/... plus one old on-prem /o=Dataforth/...cn=Jaime Becerra). + +Concluded the classic autocomplete trap: the cached Logan entry DISPLAYS the SMTP but ROUTES via a stored EX/LegacyExchangeDN that no longer resolves, so it looks correct in the dropdown but fails pre-send. Recommended the surgical fix (Haubner deletes the Logan autocomplete entry in Outlook and re-picks from the GAL); remote cache-clear is more disruptive because the RoamCache file is locked while Outlook is open and clearing it nukes all cached names. Awaiting Mike's direction on delivery (send steps to Haubner vs schedule a remote clear). + +## Key Decisions + +- **Server-side check before touching the endpoint** - confirmed the directory address is genuinely valid and no NDR exists, which localized the fault to Haubner's client rather than the tenant/mailbox. +- **Used RMM to read the autocomplete cache directly** (at Mike's direction) - the definitive source, since the Contacts/Exchange APIs were blocked in this tenant. +- **Read-only probe scanning all user profiles** - the agent runs as SYSTEM (so $env:LOCALAPPDATA is SYSTEM's); scanned C:\Users\*\...\RoamCache instead, and only inspected (did not modify) the locked cache. +- **Recommended the in-Outlook single-entry delete over a remote cache wipe** - only Logan's entry is stale; nuking the whole autocomplete would lose all of Haubner's cached names and needs Outlook closed anyway. + +## Problems Encountered + +- **Contacts.Read not held by the investigator app in Dataforth** - Graph /users/ghaubner/contacts returned ErrorAccessDenied; cannot enumerate his saved contacts via API. +- **Exchange REST 401 in Dataforth** - our Security Investigator SP is not authorized for Exchange Online in this tenant (Exchange Admin role/consent not assigned), so could not pull ltobey's LegacyExchangeDN or add an X500 proxy server-side. +- **Red-herring legacy DN** - an X500 seen as a message "from" was Haubner's own LegacyExchangeDN, not Logan's; resolved by re-querying with full from/sender fields (showed ghaubner@dataforth.com). + +## Configuration Changes + +No repo or tenant changes. Read-only investigation only. One RMM read-only command dispatched to HGHAUBNER (no endpoint modification). Probe script staged in scratchpad (inspect-autocomplete.ps1), not committed. + +## Credentials & Secrets + +No new credentials. Used existing: remediation-tool investigator/investigator-exo tokens (apps in vault msp-tools/computerguru-security-investigator.sops.yaml); GuruRMM API creds (infrastructure/gururmm-server.sops.yaml). + +## Infrastructure & Servers + +- **Dataforth M365 tenant:** 7dfa3ce8-c496-4b51-ab8d-bd3dcd78b584 (dataforth.com). +- **ltobey@dataforth.com:** valid mailbox, enabled, created 2023-12-07, proxies SMTP:ltobey@dataforth.com + smtp:ltobey@dataforthcom.onmicrosoft.com. mailNickname ltobey. +- **ghaubner@dataforth.com:** enabled; own LegacyExchangeDN observed as .../cn=973BC49D...-C6DE9A8D-5B. +- **HGHAUBNER:** GuruRMM agent id 2aefe0d5-2357-4bdd-965a-abfccb4767a5, Dataforth Corp, site D1, Windows, online. Logged-on user ghaubner (console session 1). Outlook RoamCache: two Stream_Autocomplete_*.dat (…31C73ACDF… modified 2025-10-07; …533C3133C… active, modified 2026-07-10 15:20). +- **remediation-tool investigator app roles (Dataforth):** Application.Read.All, AuditLog.Read.All, Directory.Read.All, IdentityRiskyUser.Read.All, Mail.Read, MailboxSettings.Read, Organization.Read.All, Policy.Read.All, User.Read.All, UserAuthenticationMethod.Read.All. NO Contacts.Read. investigator-exo token aud outlook.office365.com role full_access_as_app but Exchange REST returns 401 (not authorized in this tenant). + +## Commands & Outputs + +```bash +# find the machine +rmm-search.sh haubner -c dataforth # HGHAUBNER 2aefe0d5-... +# read-only autocomplete probe (all user profiles, agent=SYSTEM) +ps-encoded.sh rmm 2aefe0d5-2357-4bdd-965a-abfccb4767a5 inspect-autocomplete.ps1 --timeout 120 # exit 0 +``` +- Autocomplete match (both streams): `Logan Tobey` / `Logan Tobey ` (display correct). +- Legacy addresses present in cache: many `/o=ExchangeLabs/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/...` and one old on-prem `/o=Dataforth/...cn=Jaime Becerra559`. +- RMM dispatch alert: cmd 9916f859, #dev-alerts message_id 1525273459167592550. + +## Pending / Incomplete Tasks + +- **Fix Haubner's stale Logan autocomplete entry.** Preferred: Haubner, in Outlook, type `ltobey`/`Logan` in To:, click the X on the suggestion, re-pick Logan from the GAL, send. AWAITING Mike's call on delivery (send steps via /mailbox or /discord-dm) vs scheduling a remote cache clear (needs Outlook closed; wipes ALL autocomplete). +- Optional/future: if API access to Dataforth contacts/Exchange is wanted, grant the app Contacts.Read + assign Exchange Admin role (consent-audit / assign-exchange-role) in that tenant. +- If the problem recurs for MULTIPLE senders to ltobey, that would indicate a changed LegacyExchangeDN and the fix would be adding the old DN back as an X500 proxy on ltobey (needs Exchange access we currently lack in this tenant). + +## Reference Information + +- Dataforth tenant: 7dfa3ce8-c496-4b51-ab8d-bd3dcd78b584 +- HGHAUBNER agent: 2aefe0d5-2357-4bdd-965a-abfccb4767a5 +- Skills used: remediation-tool, rmm-search, rmm; probe via .claude/scripts/ps-encoded.sh +- Autocomplete cache path: C:\Users\ghaubner\AppData\Local\Microsoft\Outlook\RoamCache\Stream_Autocomplete_*.dat +- In-Outlook clear: type name -> X on suggestion; full reset: outlook.exe /CleanAutoCompleteCache (needs user session)