sync: auto-sync from HOWARD-HOME at 2026-07-05 13:42:15

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-05 13:42:15

projects/gps-rmm-audit/tracker.md

@@ -317,3 +317,49 @@ Deploy recipe per machine (Monday): RMM online -> POST /api/agents/:id/command p
 no Syncro checkin, and no Bitdefender go to `onsite-check-list.md` — handled at the next
 site visit, not chased remotely. IMC-PRINTSERVER pending Mike's ruling (TLS lockdown by
 design vs fix — DM sent 2026-07-05).
+
+## AV switch (Bitdefender -> Datto EDR) mass deploy — 2026-07-05
+
+Throttled push via GuruRMM (one command at a time, 20s gaps) using per-client vaulted
+reg keys. Tool: `tools/edr-deploy.py` (recomputes coverage from a live `edr.py --json
+agents` dump each run; targets ONLINE Windows RMM agents of GPS clients with a vaulted
+key that are not already in EDR; Glaztech excluded by design).
+
+- **Result: ~78 machines newly protected across ~25 clients.** Datto EDR authorized-agent
+  count 228 -> 302 over the session. Run 1: 74/79 clean "Installed RTS agent". Follow-up
+  runs cleared the rest except the two legacy boxes below.
+- **Horseshoe key gap closed:** org+group already existed, key `jthm976pwo` was just never
+  vaulted -> added to `msp-tools/datto-edr-regkeys.sops.yaml`.
+- **AD1 (Dataforth, Server 2016):** had a broken partial EDR install (huntAgent service
+  present but Stopped, no binary) -> Install-EDR silently skipped it (the "already
+  installed" early-return is gagged in non-interactive mode). Fixed with **-Force** reinstall
+  -> Success, service Running.
+- **DESKTOP-PL2RCGL (Robyn Pittman):** the 7/4 mid-delivery failure — online now, deployed
+  clean (key pittman001), service Running.
+
+### Genuinely BLOCKED — legacy OS (need prerequisites or onsite)
+- **AMT-PC** (Arizona Medical Transit) — Windows 7 Home SP1, **PowerShell 2.0**. The modern
+  Datto EDR `agent.windows.exe` (v3.17.1) **crashes on execution** (process tree dies, zero
+  output, even to a file). Downloads fine; won't run. Needs Win7 SHA-2 servicing + WMF/.NET
+  prereqs, or the legacy-agent path, or onsite. Same box that needed the manual legacy
+  GuruRMM install.
+- **SRV02** (Curtis Plumbing) — Windows **Server 2008 R2**. Agent downloads + launches but
+  `--version` emits nothing (silent no-op, missing runtime prereq). Same legacy class.
+
+### Loose ends to verify (protected, but console visibility unclear)
+- **SS-SP1** (Safesite, Server 2016): huntAgent=Running + agent.exe present locally, but NOT
+  visible in the EDR console under "sp1" — likely registered under its real hostname or
+  awaiting approval. Verify it reports in.
+- **DFORTH-Ship vs DForth-Shipp** (Dataforth): the Win11 box is in EDR as `dforth-shipp`;
+  the single-p "DFORTH-Ship" RMM record is a duplicate-hostname artifact of the same machine.
+
+### Diagnostic insight (reusable)
+Install-EDR is SILENT in non-interactive mode — every status/error line is gated behind
+`if ($Interactive)`. A "completed / blank output" RMM result means nothing; the visible
+"Installed RTS agent" text comes from `agent.windows.exe` itself, so its ABSENCE = the exe
+never ran (early-return or crash). Use `-Interactive *> file` + read-back, or check
+`Get-Service huntAgent` + `C:\Program Files\infocyte\agent\agent.exe`, to know true state.
+Reg keys are per-target-group; `-Force` reinstalls over a stale huntAgent service.
+
+**Bitdefender removal still deferred** — per-client, only after that client's EDR is
+confirmed ACTIVE. Not started.