sync: auto-sync from HOWARD-HOME at 2026-07-04 18:34:08

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-04 18:34:08

projects/gps-rmm-audit/session-logs/2026-07/2026-07-03-howard-gps-rmm-coverage-audit.md

@@ -246,3 +246,7 @@ Built the AV coverage matrix: GPS billed qty vs RMM vs Bitdefender vs Datto EDR
 ## Update: EDR Default-org attribution (2026-07-04 night)
 
 Dismantled Datto EDR "Default RMM Org": discovered its 23 Locations were already client-named (IMC - Speedway 10 agents, Putt 4, Reliant 4, Russo 2, etc.) - agents attributed at Location level, wrong org umbrella. Fix = re-parent Locations to per-client Organizations. Verified mechanics with [TEST] org+location first (POST /Organizations, POST /Locations, PATCH /Locations/{id} {organizationId}, DELETE both - all work; LoopBack undocumented endpoints). Executed: 18 orgs created, 21 locations re-parented (Glaztech-ALB and ACG locs to existing orgs), 0 failures. GOTCHAS: edr.py orgs agent/site counts are stale rollups after re-parenting (trust GET /Locations); one raw GET ignored the --filter (returned all 42) - verify with unfiltered fetch + group-by. Default org now = OnDemand(0)+Managed(0) only. Revised AV gap list in tracker (8 clients / 20 devices NO-AV; Andy's Mobile Fuel cleared).
+
+## Update: NO-AV remediation round 1 (2026-07-04 night)
+
+Created 3 EDR orgs + target groups + reg keys (Ridgetop/ridgetop01, Gary A Hartman/hartman001, Robyn Pittman/pittman001) via the datto-edr skill (create-group -> mint-key). Pushed Install-EDR through RMM to the 5 online NO-AV machines. 4/5 registered ACTIVE in the correct orgs within minutes (RGI-DC needed a Start-Service kick after os error 1053). DESKTOP-PL2RCGL install still running at wrap - verify. avInstalled null right after registration - confirm Datto AV enables via org policy Monday. Remaining NO-AV clients (Little Hearts 8, R&R Eng 2, Altschuler 2, BSoT 2, Marty Ryan 1) unreachable tonight - autoenroll->RMM->EDR path as they surface.

projects/gps-rmm-audit/tracker.md

@@ -245,3 +245,13 @@ Datto EDR "Default RMM Org" dismantled: its 21 client-named Locations re-parente
 Corrected EDR coverage this reveals: IMC 10, Reliant 4 (+Home), PUTT 4, Russo 2, MVAN 2, Andy's Mobile Fuel 2, Key Paul 2, Roharbach 2, BG Builders 2, Rednour 1, Len's 1, JANC 1, Bardach 1.
 
 REVISED AV gaps: NO-AV now 8 clients / 20 paid devices (Andy's Mobile Fuel came off the list): Little Hearts Little Hands(8), Ridgetop(3), Residential and Renovation Engineering(2 - EDR org+location exist, 0 agents), Janet Altschuler(2 - own location empty; NOTE org "JANC Excavation and Construction"(1 agent, janc-qb) may be her business - verify), Business Services of Tucson(2), Gary A Hartman(1), Robyn Pittman(1), Marty Ryan(1). PARTIAL improved: MVAN now 4/4 OK, Len's 7/8, IMC 12BD+10EDR (overlap likely; effectively covered).
+
+## Phase 4 — NO-AV remediation round 1 (2026-07-04 night)
+
+Deployed Datto EDR to the 5 reachable NO-AV machines via RMM push (Install-EDR one-liner, visible stdout):
+- Ridgetop Group (org 3db1059a, group 436d7e55, key ridgetop01): CNX-LAB-00 [OK] RGI-DC [OK after service kick, 1053 on first start] RTG-host01 [OK] - all 3 ACTIVE in EDR
+- Gary A Hartman LLC (org 962e2986, key hartman001): DESKTOP-EVA4H1A [OK] ACTIVE
+- Robyn Pittman (org dc47a7a5, key pittman001): DESKTOP-PL2RCGL install still running at wrap - VERIFY next session
+Note: avInstalled field null right after registration - verify Datto AV component enables per org policy (check Monday).
+
+Remaining NO-AV (machines unreachable, need online windows / discovery / onsite): Little Hearts Little Hands (8 - no RMM/SC at all, biggest gap), Residential and Renovation Engineering (2 - EDR org ready, 0 agents), Janet Altschuler (2 - verify if JANC Excavation org/janc-qb is hers), Business Services of Tucson (2), Marty Ryan (1). Path: autoenroll loop -> RMM -> EDR push (same as tonight).