sync: auto-sync from HOWARD-HOME at 2026-07-04 18:34:08

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-04 18:34:08

projects/gps-rmm-audit/session-logs/2026-07/2026-07-03-howard-gps-rmm-coverage-audit.md

@@ -246,3 +246,7 @@ Built the AV coverage matrix: GPS billed qty vs RMM vs Bitdefender vs Datto EDR
 ## Update: EDR Default-org attribution (2026-07-04 night)
 
 Dismantled Datto EDR "Default RMM Org": discovered its 23 Locations were already client-named (IMC - Speedway 10 agents, Putt 4, Reliant 4, Russo 2, etc.) - agents attributed at Location level, wrong org umbrella. Fix = re-parent Locations to per-client Organizations. Verified mechanics with [TEST] org+location first (POST /Organizations, POST /Locations, PATCH /Locations/{id} {organizationId}, DELETE both - all work; LoopBack undocumented endpoints). Executed: 18 orgs created, 21 locations re-parented (Glaztech-ALB and ACG locs to existing orgs), 0 failures. GOTCHAS: edr.py orgs agent/site counts are stale rollups after re-parenting (trust GET /Locations); one raw GET ignored the --filter (returned all 42) - verify with unfiltered fetch + group-by. Default org now = OnDemand(0)+Managed(0) only. Revised AV gap list in tracker (8 clients / 20 devices NO-AV; Andy's Mobile Fuel cleared).
+
+## Update: NO-AV remediation round 1 (2026-07-04 night)
+
+Created 3 EDR orgs + target groups + reg keys (Ridgetop/ridgetop01, Gary A Hartman/hartman001, Robyn Pittman/pittman001) via the datto-edr skill (create-group -> mint-key). Pushed Install-EDR through RMM to the 5 online NO-AV machines. 4/5 registered ACTIVE in the correct orgs within minutes (RGI-DC needed a Start-Service kick after os error 1053). DESKTOP-PL2RCGL install still running at wrap - verify. avInstalled null right after registration - confirm Datto AV enables via org policy Monday. Remaining NO-AV clients (Little Hearts 8, R&R Eng 2, Altschuler 2, BSoT 2, Marty Ryan 1) unreachable tonight - autoenroll->RMM->EDR path as they surface.