sync: auto-sync from HOWARD-HOME at 2026-07-05 13:42:15

Author: Howard Enos Machine: HOWARD-HOME Timestamp: 2026-07-05 13:42:15
2026-07-05 13:42:45 -07:00
parent 6ad608c3bf
commit a5b8f6e7b1
6 changed files with 6196 additions and 618 deletions
--- a/.chk2.ps1
+++ b/.chk2.ps1
@@ -0,0 +1,8 @@
+Import-Module BitsTransfer
+'--- all BITS jobs (AllUsers) ---'
+Get-BitsTransfer -AllUsers -ErrorAction SilentlyContinue | Select-Object DisplayName,JobState,BytesTransferred,BytesTotal,OwnerAccount | Format-Table -AutoSize | Out-String
+'--- desktop files ---'
+Get-ChildItem 'C:\Users\howar\Desktop' -Filter '*.iso*' -Force -ErrorAction SilentlyContinue | Select-Object Name,Length,LastWriteTime | Format-Table -AutoSize | Out-String
+'--- tmp BITS file? ---'
+Get-ChildItem 'C:\Users\howar\Desktop' -Filter 'BIT*' -Force -Hidden -ErrorAction SilentlyContinue | Select-Object Name,Length | Format-Table -AutoSize | Out-String
+'uptime-min: ' + [math]::Round(((Get-Date) - (Get-CimInstance Win32_OperatingSystem).LastBootUpTime).TotalMinutes,0)
--- a/.mt.ps1
+++ b/.mt.ps1
@@ -0,0 +1,13 @@
+$iso = 'C:\Users\howar\Desktop\Win11_25H2_English_Arm64_v2.iso'
+$m = Mount-DiskImage -ImagePath $iso -PassThru
+$dl = ($m | Get-Volume).DriveLetter
+'mounted at ' + $dl + ':'
+Get-ChildItem ($dl + ':\') | Select-Object Name | Format-Table -AutoSize | Out-String
+$wim = $dl + ':\sources\install.wim'
+$esd = $dl + ':\sources\install.esd'
+if (Test-Path $wim) { 'install.wim: ' + [math]::Round((Get-Item $wim).Length/1GB,2) + ' GB' }
+if (Test-Path $esd) { 'install.esd: ' + [math]::Round((Get-Item $esd).Length/1GB,2) + ' GB' }
+'boot.wim: ' + (Test-Path ($dl + ':\sources\boot.wim'))
+'setup.exe: ' + (Test-Path ($dl + ':\setup.exe'))
+Dismount-DiskImage -ImagePath $iso | Out-Null
+'dismounted'
--- a/projects/gps-rmm-audit/.edr-agents-now.json
+++ b/projects/gps-rmm-audit/.edr-agents-now.json
--- a/projects/gps-rmm-audit/edr-deploy-results.md
+++ b/projects/gps-rmm-audit/edr-deploy-results.md
@@ -0,0 +1,90 @@
+
+## Run 2026-07-05 11:00 — 74/79 completed
+- completed | AT Trebesch | DESKTOP-QNP3ON5 | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Arizona Medical Transit | AMT-HYPERV | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Arizona Medical Transit | AMT-PC | 
+- pending | Brett Interiors | BrettWarehouse | 
+- completed | Brett Interiors | sharon | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Curtis Plumbing | CP-QB | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Curtis Plumbing | CURTIS-001 | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Curtis Plumbing | CURTIS-002-W7 | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Curtis Plumbing | CURTIS-HOME | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Curtis Plumbing | SRV02 | 
+- completed | Dataforth Corp | AD1 | 
+- completed | Dataforth Corp | AD2 | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Dataforth Corp | D2-10D-TS1 | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- running | Dataforth Corp | D2-LEETEST | 
+- completed | Dataforth Corp | D2-RCVG-003 | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Dataforth Corp | DF-GAGETRAK | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Dataforth Corp | DF-HYPERV-B | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Dataforth Corp | DF-SVR-D2-Sync | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Dataforth Corp | DFORTH-Ship | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Dataforth Corp | FILES-D1 | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Dataforth Corp | SAGE-SQL | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- interrupted | Design and Brand Envoys | DESKTOP-BCLOLSI | 
+- completed | Design and Brand Envoys | DESKTOP-I51630E | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Gonzvar Tax Services | GTS-SVR25 | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Gonzvar Tax Services | GTS-W0 | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Gonzvar Tax Services | GTS-W1 | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Gonzvar Tax Services | GTS-W2 | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Gonzvar Tax Services | SERVER | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Grabb & Durando Law Office | DESKTOP-NFK4F5P | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Grabb & Durando Law Office | GND-BOB-PC | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Grabb & Durando Law Office | GND-JEFF-2 | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Grabb & Durando Law Office | GND-Reyna | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Grabb & Durando Law Office | GND-SERVER | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Grabb & Durando Law Office | GND-TDIAZ | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Instrumental Music Center | DESKTOP-44L80C0 | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Instrumental Music Center | DESKTOP-GHG12G3 | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Instrumental Music Center | DESKTOP-MR3ALTK | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Instrumental Music Center | IMC1 | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Instrumental Music Center | LAPTOP-DCHQ3F92 | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Instrumental Music Center | LAPTOP-UBTI0IE3 | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Kittle Design & Construction LLC | DESKTOP-2560Q7R | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Kittle Design & Construction LLC | SERVER | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Kittle Design & Construction LLC | WINDOWS-QV1B0EL | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Len's Auto Brokerage | DESKTOP-JDQMLCE | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Len's Auto Brokerage | EV-DAWG | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Len's Auto Brokerage | Josh-Lens | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Len's Auto Brokerage | LAB-Becky | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Mineralogical Record | DESKTOP-ERBA22G | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Mineralogical Record | Puget-CW | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | PUTT LAND SURVEYING, INC. | PLS-THREE | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | PUTT LAND SURVEYING, INC. | PLS-TWO | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Peaceful Spirit | PST-DC-NW | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Peaceful Spirit | PST-SERVER | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- pending | Quantum Wealth Management | DESKTOP-K89A8CF | 
+- completed | Quantum Wealth Management | QUANTUMSERVER | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Quantum Wealth Management | QWM-JOHN | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Quantum Wealth Management | QWM-SHEILA | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Rednour Law Offices | FrontDeskReception | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Reliant Well Drilling and Pump Corporate | BookKeeper | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Russo Law Firm | STRIONFO | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Safesite | 0624Dell3550 | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Safesite | DESKTOP-2KKLG2B | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Safesite | DESKTOP-BA45FRS | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Safesite | DESKTOP-EJM109L | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Safesite | SS-SP1 | 
+- completed | Stamback Septic | STAMBACK-NEW05 | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- interrupted | T & C Sorensen | CHRISTINE-WIN7 | 
+- completed | T & C Sorensen | TOM-WIN7 | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | T & C Sorensen | TVROOM-WIN7 | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | The Prairie Schooner | Mel-PC | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | The Prairie Schooner | TPS-SERVER | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | The Prairie Schooner | TPS-SVR | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | The Prairie Schooner | TPS-Tina | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Valley Wide Plastering | WIN-AD-SRVR-2 | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Valley Wide Plastering | WINFileSvr | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Zeus Nestora | CindyW | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Zeus Nestora | SERVER | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Zeus Nestora | SERVER-OLD | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- completed | Zeus Nestora | White-PC | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+
+## Run 2026-07-05 11:23 — 6/7 completed
+- completed | Arizona Medical Transit | AMT-PC | 
+- completed | Curtis Plumbing | SRV02 | 
+- completed | Dataforth Corp | AD1 | 
+- completed | Dataforth Corp | DForth-Shipp | 
+- completed | Jimmy Company | Blaster2 | Installing to C:\Program Files\infocyte\agent Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe 
+- pending | Safesite | DESKTOP-VJFLIAR | 
+- completed | Safesite | SS-SP1 | 
--- a/projects/gps-rmm-audit/session-logs/2026-07/2026-07-05-howard-edr-mass-deploy-imc-printserver.md
+++ b/projects/gps-rmm-audit/session-logs/2026-07/2026-07-05-howard-edr-mass-deploy-imc-printserver.md
@@ -0,0 +1,163 @@
+## User
+- **User:** Howard Enos (howard)
+- **Machine:** Howard-Home
+- **Role:** tech
+
+## Session Summary
+
+Continued the GPS->GuruRMM coverage audit. The session had two arcs: (1) closing out the
+two straggler machines from the Monday queue (CP-QB, IMC-PRINTSERVER), then (2) executing
+the full Bitdefender->Datto EDR AV switch across every reachable GPS-client machine.
+
+CP-QB (Curtis Plumbing) was fixed and enrolled: its WMI class store was corrupt
+(`Win32_Processor` = Invalid class, broken since ~2022), which killed the universal
+installer's architecture-detection call and also froze its ScreenConnect inventory.
+`mofcomp cimwin32.mof` restored the class; the installer then ran clean and the agent
+enrolled and was reassigned to Curtis Plumbing. IMC-PRINTSERVER was diagnosed but left
+blocked: the GuruRMM agent was manually installed over the LAN (PowerShell is dead on the
+box, SMB hangs, the SC extension eats chained/multi-line commands, so the binary was served
+over HTTP from IMC1 and installed with plain cmd), but the box drops ALL outbound TLS (even
+google.com), so the installed agent cannot reach the server. DM'd Mike to ask whether that
+lockdown is by design or should be cleared.
+
+The main work was the AV switch. Built `tools/edr-deploy.py` — a throttled deployer that
+recomputes coverage from a live Datto EDR agent dump each run, targets ONLINE Windows RMM
+agents of GPS clients that have a vaulted registration key and are not already in EDR, and
+pushes the official Install-EDR one-liner through the RMM one machine at a time with a 20s
+gap (retry-on-5xx, poll-to-completion). Glaz-Tech excluded by design. Run 1 hit 79 machines
+across 24 clients: 74 installed cleanly. Follow-up runs cleared the rest except two legacy
+boxes.
+
+The five apparent failures were run to ground individually. Install-EDR is silent in
+non-interactive mode (every status/error line is gated behind `if ($Interactive)`), so a
+"completed / blank output" RMM result is meaningless — the visible "Installed RTS agent"
+text actually comes from `agent.windows.exe` itself. Investigating: DForth-Shipp (Win11)
+and SS-SP1 (Server 2016) already had huntAgent running (false negatives); AD1 (Server 2016)
+had a broken partial install (stale stopped service, no binary) that Install-EDR silently
+skipped, fixed with `-Force`; AMT-PC (Win7 SP1 / PowerShell 2.0) and SRV02 (Server 2008 R2)
+are genuine legacy failures where the modern agent binary crashes or no-ops on execution.
+Also deployed EDR to DESKTOP-PL2RCGL (Robyn Pittman, the 7/4 mid-delivery retry) once it
+came online. Datto EDR authorized-agent count rose 228 -> 302.
+
+## Key Decisions
+
+- Deferred Bitdefender REMOVAL entirely — EDR-first, per-client, only after that client's
+  EDR is confirmed ACTIVE. Nothing removed this session.
+- Kept the deploy strictly throttled (sequential, 20s gaps, single command in flight) per
+  Howard's "go slow, don't hammer the RMM server" instruction.
+- Built a reusable coverage-recomputing tool rather than a one-shot script, so re-runs are
+  idempotent and safe (targets only genuinely-missing online machines each time).
+- Classified AMT-PC and SRV02 as legacy-OS blocked rather than continuing to brute-force
+  installs on incompatible boxes; flagged for prerequisites/onsite.
+- Created an onsite-check list (`onsite-check-list.md`) for machines/clients with no SC, no
+  Syncro checkin, and no Bitdefender — to be handled at the next site visit, not chased
+  remotely (Howard's rule).
+- Added Horseshoe's existing EDR key to the vault rather than minting a new one (org+group
+  already existed; only the vault entry was missing).
+
+## Problems Encountered
+
+- CP-QB universal installer failed: corrupt WMI (`Win32_Processor` Invalid class). Fixed via
+  `mofcomp %windir%\system32\wbem\cimwin32.mof` (verifyrepository reported CONSISTENT — it
+  does not catch a missing class).
+- IMC-PRINTSERVER cannot connect: drops all outbound TLS (Cloudflare hosts, rmm-api direct
+  IP, and google.com — ClientHello then silence). SC survives because its relay is not TLS.
+  Agent installed but dormant. Escalated to Mike (by-design vs fix). No reinstall needed once
+  TLS is unblocked.
+- Five EDR "failures" were mostly false negatives. Root-caused via the fact that Install-EDR
+  is silent unless `-Interactive`; used `-Interactive *> file` + read-back and direct
+  service/binary checks. Two real legacy blocks remain (AMT-PC Win7/PS2, SRV02 2008 R2).
+- AD1 had a stale huntAgent service with no binary; Install-EDR's "already installed"
+  early-return silently skipped it. `-Force` reinstalled successfully.
+- edr.py needed `DATTO_EDR_TOKEN` exported from the vault (`msp-tools/datto-edr.sops.yaml`
+  field `credentials.api_token`) — the repo skill copy path differs from the user-home copy.
+
+## Configuration Changes
+
+- Created `projects/gps-rmm-audit/tools/edr-deploy.py` — throttled BD->EDR deployer.
+- Created `projects/gps-rmm-audit/onsite-check-list.md` — no-remote-channel machines/clients.
+- Created `projects/gps-rmm-audit/session-logs/2026-07/2026-07-05-howard-cpqb-fixed-imcprintserver-tls-blocked.md`
+  (earlier in the session; CP-QB + IMC-PRINTSERVER detail).
+- Appended to `projects/gps-rmm-audit/tracker.md` — CP-QB/IMC-PRINTSERVER outcome, onsite
+  group pointer, and the full AV-switch deploy section.
+- Vault: added `Horseshoe Management: jthm976pwo` to `msp-tools/datto-edr-regkeys.sops.yaml`.
+- Deploy artifacts (gitignored/scratch): `edr-deploy-live.log`, `edr-deploy-run3.log`,
+  `edr-deploy-results.md`, `.edr-agents-now.json` under `projects/gps-rmm-audit/`.
+
+## Credentials & Secrets
+
+- Datto EDR per-client registration keys — vault `msp-tools/datto-edr-regkeys.sops.yaml`
+  (field map under `credentials:`). Used verbatim as `Install-EDR -RegKey`. Newly added this
+  session: **Horseshoe Management = jthm976pwo** (key already existed in Datto; only the vault
+  entry was missing). Keys used directly this session incl. Arizona Medical Transit
+  `arizonam01`, Dataforth `27lzj6npdb`, Robyn Pittman `pittman001`.
+- Datto EDR API token — vault `msp-tools/datto-edr.sops.yaml` field `credentials.api_token`
+  (export as `DATTO_EDR_TOKEN` for `edr.py`).
+- ScreenConnect API secret — vault `msp-tools/screenconnect.sops.yaml` field
+  `credentials.api_secret`.
+- GuruRMM staging site key `DARK-STORM-3150` — vault
+  `infrastructure/gururmm-staging-site.sops.yaml`.
+
+## Infrastructure & Servers
+
+- GuruRMM API: `http://172.16.3.30:3001` (via `rmm-auth.sh`); dashboard rmm.azcomputerguru.com;
+  agent WS `wss://rmm-api.azcomputerguru.com/ws` (rmm-api resolves to direct IP 72.194.62.10,
+  NOT Cloudflare). GuruRMM root Linux agent id `9b92b187-98c7-41b0-9e97-1698d263c42d`
+  (hostname `gururmm`) used to read the server's own nginx access log.
+- Datto EDR: `https://azcomp4587.infocyte.com`; agent binary
+  `https://s3.us-east-2.amazonaws.com/infocyte-support/executables/agent.windows64.exe`
+  (v3.17.1.5409). Authorized agents 228 -> 302 this session.
+- IMC-PRINTSERVER: Win10 22H2, 192.168.0.79/24, gw 192.168.0.254, DNS/DHCP = IMC1
+  (192.168.0.2), MAC A0-1E-0B-11-60-1D. SC session ccbd66a7-f94a-4d87-a18b-5f81a30784d0.
+  IMC1 RMM agent id 88cbf7c0-abfa-4f12-846c-96274f718bff.
+- Straggler agent ids: AMT-PC 2471f636-c73d-4d90-aabf-7da42a58917d; SRV02
+  4628e665-ac21-4ff7-bde2-c649682f6241; AD1 bf7bc5ee-4167-4a62-912a-c88b11a5943d;
+  DForth-Shipp 9974ca3c-02d0-4632-8532-508d34344b8c; SS-SP1
+  0db6ed6b-48a6-4dcd-9366-e9a67eefa3d2; DESKTOP-PL2RCGL b12cd995-016e-4eff-bdcb-1033aa9f3e78.
+- Horseshoe EDR: org e40037bf-37ee-4767-9e36-889253df03de, group
+  49d5fbf2-f377-4ede-9e4c-1c8655939b63.
+
+## Commands & Outputs
+
+- EDR deploy (throttled): `RMM=.. TOK=.. python projects/gps-rmm-audit/tools/edr-deploy.py
+  --dry | --live [--gap 20]`.
+- Official install one-liner (per box, via RMM powershell elevated):
+  `[System.Net.ServicePointManager]::SecurityProtocol=[Enum]::ToObject([System.Net.SecurityProtocolType],3072);
+  (new-object Net.WebClient).DownloadString("https://raw.githubusercontent.com/Infocyte/PowershellTools/master/AgentDeployment/install_huntagent.ps1")
+  | iex; Install-EDR -URL "https://azcomp4587.infocyte.com" -RegKey <key>`.
+- True-state check on a box: `Get-Service huntAgent` + `Test-Path "C:\Program
+  Files\infocyte\agent\agent.exe"`. Verbose install: add `-Interactive *> C:\Windows\Temp\x.log`
+  then read the file (Install-EDR is silent otherwise).
+- `-Force` reinstalls over a stale huntAgent service (fixed AD1: log "[Success] Installation
+  Succeeded! Agent associated to https://azcomp4587.infocyte.com").
+- AMT-PC diagnosis: `Get-CimInstance` "not recognized" => PowerShell 2.0 => legacy Win7;
+  agent.windows64.exe downloads (38472512 bytes) but crashes the process tree on exec.
+
+## Pending / Incomplete Tasks
+
+- IMC-PRINTSERVER: awaiting Mike's ruling (TLS lockdown by design vs fix). Agent installed +
+  dormant; self-enrolls when TLS egress is unblocked. If by design, tag onsite-check.
+- Two legacy EDR blocks: AMT-PC (Win7 SP1/PS2), SRV02 (Server 2008 R2) — need OS prereqs
+  (SHA-2 servicing, WMF/.NET, VC++ runtime) or onsite/legacy-agent handling.
+- Verify SS-SP1 (Safesite) reports into the EDR console — huntAgent runs locally but not
+  visible under "sp1"; likely registered under its real hostname or awaiting approval.
+- Bitdefender REMOVAL not started — per-client, after EDR confirmed ACTIVE. Glaztech stays BD.
+- Confirm `avInstalled` enables via org policy for the newly-deployed agents (stale-field
+  quirk — read the org policy, not the raw field).
+- Autoenroll (Mon 06:00) will surface more offline GPS machines; re-run edr-deploy.py to
+  sweep them (now includes Horseshoe with the vaulted key).
+- Onsite-check list clients to locate/confirm-unmanaged: Little Hearts Little Hands,
+  Residential & Renovation Engineering, Janet Altschuler, Business Services of Tucson,
+  Marty Ryan.
+
+## Reference Information
+
+- EDR install script (readable): raw.githubusercontent.com/Infocyte/PowershellTools/master/AgentDeployment/install_huntagent.ps1
+  — Install-EDR early-returns: line 63 (no URL), 69 (not admin), 95 (huntAgent service exists,
+  skip unless -Force). All status/error output gated behind `if ($Interactive)`.
+- Tool: `projects/gps-rmm-audit/tools/edr-deploy.py`. Results: `edr-deploy-results.md`,
+  `edr-deploy-live.log`, `edr-deploy-run3.log`.
+- Deploy recipe + EDR skill: `.claude/skills/datto-edr/` (`edr.py deploy-cmd --group|--regkey`,
+  `create-group`, `mint-key`). URL must be full `-URL "https://azcomp4587.infocyte.com"`, not
+  `-InstanceName` (loose `.com` regex bug).
+- Prior session log (this session, earlier): 2026-07-05-howard-cpqb-fixed-imcprintserver-tls-blocked.md.
--- a/projects/gps-rmm-audit/tracker.md
+++ b/projects/gps-rmm-audit/tracker.md
@@ -317,3 +317,49 @@ Deploy recipe per machine (Monday): RMM online -> POST /api/agents/:id/command p
 no Syncro checkin, and no Bitdefender go to `onsite-check-list.md` — handled at the next
 site visit, not chased remotely. IMC-PRINTSERVER pending Mike's ruling (TLS lockdown by
 design vs fix — DM sent 2026-07-05).
+
+## AV switch (Bitdefender -> Datto EDR) mass deploy — 2026-07-05
+
+Throttled push via GuruRMM (one command at a time, 20s gaps) using per-client vaulted
+reg keys. Tool: `tools/edr-deploy.py` (recomputes coverage from a live `edr.py --json
+agents` dump each run; targets ONLINE Windows RMM agents of GPS clients with a vaulted
+key that are not already in EDR; Glaztech excluded by design).
+
+- **Result: ~78 machines newly protected across ~25 clients.** Datto EDR authorized-agent
+  count 228 -> 302 over the session. Run 1: 74/79 clean "Installed RTS agent". Follow-up
+  runs cleared the rest except the two legacy boxes below.
+- **Horseshoe key gap closed:** org+group already existed, key `jthm976pwo` was just never
+  vaulted -> added to `msp-tools/datto-edr-regkeys.sops.yaml`.
+- **AD1 (Dataforth, Server 2016):** had a broken partial EDR install (huntAgent service
+  present but Stopped, no binary) -> Install-EDR silently skipped it (the "already
+  installed" early-return is gagged in non-interactive mode). Fixed with **-Force** reinstall
+  -> Success, service Running.
+- **DESKTOP-PL2RCGL (Robyn Pittman):** the 7/4 mid-delivery failure — online now, deployed
+  clean (key pittman001), service Running.
+
+### Genuinely BLOCKED — legacy OS (need prerequisites or onsite)
+- **AMT-PC** (Arizona Medical Transit) — Windows 7 Home SP1, **PowerShell 2.0**. The modern
+  Datto EDR `agent.windows.exe` (v3.17.1) **crashes on execution** (process tree dies, zero
+  output, even to a file). Downloads fine; won't run. Needs Win7 SHA-2 servicing + WMF/.NET
+  prereqs, or the legacy-agent path, or onsite. Same box that needed the manual legacy
+  GuruRMM install.
+- **SRV02** (Curtis Plumbing) — Windows **Server 2008 R2**. Agent downloads + launches but
+  `--version` emits nothing (silent no-op, missing runtime prereq). Same legacy class.
+
+### Loose ends to verify (protected, but console visibility unclear)
+- **SS-SP1** (Safesite, Server 2016): huntAgent=Running + agent.exe present locally, but NOT
+  visible in the EDR console under "sp1" — likely registered under its real hostname or
+  awaiting approval. Verify it reports in.
+- **DFORTH-Ship vs DForth-Shipp** (Dataforth): the Win11 box is in EDR as `dforth-shipp`;
+  the single-p "DFORTH-Ship" RMM record is a duplicate-hostname artifact of the same machine.
+
+### Diagnostic insight (reusable)
+Install-EDR is SILENT in non-interactive mode — every status/error line is gated behind
+`if ($Interactive)`. A "completed / blank output" RMM result means nothing; the visible
+"Installed RTS agent" text comes from `agent.windows.exe` itself, so its ABSENCE = the exe
+never ran (early-return or crash). Use `-Interactive *> file` + read-back, or check
+`Get-Service huntAgent` + `C:\Program Files\infocyte\agent\agent.exe`, to know true state.
+Reg keys are per-target-group; `-Force` reinstalls over a stale huntAgent service.
+
+**Bitdefender removal still deferred** — per-client, only after that client's EDR is
+confirmed ACTIVE. Not started.