azcomputerguru/claudetools
1
0
Fork 0
Code Issues 59 Pull Requests Actions Packages Projects Releases Wiki Activity

sync: auto-sync from HOWARD-HOME at 2026-07-20 16:39:49

Browse Source 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-20 16:39:49
This commit is contained in:
Howard Enos
2026-07-20 16:40:15 -07:00
parent 61a875bc00
commit a79a107142
3 changed files with 196 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

121
clients/lens-auto-brokerage/PROJECT_STATE.md
View File

@@ -16,12 +16,66 @@
## Current State
**Status:** ACTIVE — PLANNING (Server 2008 Decommission)
**Status:** ACTIVE — SERVER PREP COMPLETE, READY FOR DATA COPY + CUTOVER
**Last Activity:** 2026-07-20
**Tracker Issue:** claudetools #71
Full inventory of lab-server gathered 2026-07-20 via ScreenConnect backstage commands.
All data needed for migration planning is now captured. Decision points documented below.
LAB-SVR server-side prep is complete: AD domain (LAB.lan) with OUs, groups, 10 user
accounts, DeskMan + shares SMB shares with NTFS permissions, Print Services role with
RICOH IM 600SR shared as `\\LAB-SVR\RICOH-IM600SR`, and Point and Print GPO configured
to allow non-admin driver install from LAB-SVR. Next: copy DeskMan data from lab-server
(tonight when users are off), then cutover workstations one at a time with ForensIT
ProfWiz for profile migration.
### What's Done on LAB-SVR (2026-07-20)
**Active Directory:**
- OU structure: `OU=LensAuto,DC=LAB,DC=lan` with Users, Computers, Groups sub-OUs
- Security groups: DeskMan Users, DeskMan Admins, LAB-Staff
- 10 domain accounts created (password `Welcome2LAB!`, must change at logon):
becky (Becky Kahn, DeskMan Admin), dana, brian, tina, madonna, gloss, josh, turner,
parke, guru (ACG Admin, Domain Admins)
**SMB Shares:**
- `\\LAB-SVR\DeskMan` -> `C:\DeskMan` (DeskMan Users=Modify, DeskMan Admins=Full)
- `\\LAB-SVR\shares` -> `C:\shares` with subdirs Backups, FileCabinet, IT Services, Profiles (LAB-Staff=Modify)
- Data NOT yet copied — shares are empty, ready to receive robocopy
**Print Server:**
- Print Services role installed
- RICOH driver: "PCL6 Driver for Universal Print" (Ricoh Universal PCL6 v4.45, staged from `C:\PrintDrivers\Ricoh\extracted\disk1\oemsetup.inf`)
- Printer: "RICOH IM 600SR" shared as `RICOH-IM600SR`, port TCP_192.168.1.105
- Brother HL-L2350DW NOT yet added (need to find its IP and assign static)
**GPO: "Printers and Point-and-Print":**
- Linked to `OU=Computers,OU=LensAuto,DC=LAB,DC=lan`
- Point and Print Restrictions: Enabled, approved servers LAB-SVR.LAB.lan + LAB-SVR
- No warning/elevation on install or update
- RestrictDriverInstallationToAdministrators = 0 (non-admins can install from approved servers)
- LegacyDefaultPrinterMode = 1 (disables "Let Windows manage my default printer")
- All 6 registry values verified from PowerShell on LAB-SVR
**Network discovery (from ARP table):**
- 192.168.1.41 = HP OfficeJet Pro 9010 (MAC f8:b4:6a = HP Inc.) — network printer, can be GPO-deployed
- 192.168.1.50 = Amcrest security camera (MAC 9c:8e:cd = Amcrest Technologies)
- 192.168.1.105 = RICOH IM 600SR copier (confirmed)
- 192.168.1.114 = Unknown device (MAC 0c:96:e6 = Cloud Network Technology)
- 192.168.1.135 = Dana's unknown workstation (MAC 30:13:8b = HP Inc.)
**DeskMan findings (from lab-server inventory):**
- FoxPro/DBF app, no database engine, no Windows service
- Install: `C:\DeskMan`, data: `C:\DeskMan\Data` (~1.05GB, 422 files)
- Shared as `\\lab-server\DeskMan`, config `amPath.ini`: `apPath=\\lab-server\DeskMan`
- 6 workstations connected concurrently via SMB (271-281 open files each)
- DeskMan does NOT need to be installed on the server — server is just a file share
- QuickBooks is NOT on lab-server (only on LAB-Becky workstation) — removed from scope
- Migration = copy files + recreate share + update amPath.ini (or DNS alias)
**Profile migration approach:**
- ForensIT User Profile Wizard (ProfWiz) — remaps local profile SID to domain account
- User keeps same desktop, documents, app settings, browser data
- Run on each workstation during domain-join cutover
- Free version is fine for 7 machines
---
@@ -115,15 +169,17 @@ to identify this endpoint and get it managed.**
- Not a print server (only XPS Document Writer, not shared)
- No mapped drives from this server to elsewhere
**Target: LAB-SVR (Server 2019)**
**Target: LAB-SVR (Server 2019) — SERVER PREP COMPLETE**
- HPE ProLiant MicroServer Gen10 Plus v2, Xeon E-2314, 16GB RAM
- IP 192.168.1.82, AD DC for LAB.lan, DNS at 127.0.0.1 (self)
- C: 1.77TB total, 1.6TB free — more than enough space
- Roles: AD DS, DNS, File Server, DFS, GPMC
- Roles: AD DS, DNS, File Server, DFS, GPMC, **Print Services**
- MSP360 backup running
- NO DeskMan, NO QuickBooks installed
- GuruRMM 0.6.66 (needs update to 0.6.79)
- No user-facing shares yet (only NETLOGON/SYSVOL)
- **AD configured:** OUs (LensAuto/Users/Computers/Groups), 3 security groups, 10 domain users
- **Shares ready:** `\\LAB-SVR\DeskMan` + `\\LAB-SVR\shares` (empty, awaiting data copy)
- **Print server:** RICOH IM 600SR shared as `\\LAB-SVR\RICOH-IM600SR` (PCL6 Universal v4.45)
- **GPO:** "Printers and Point-and-Print" with Point and Print restrictions (verified)
**QuickBooks — RESOLVED: not part of migration scope.**
- QuickBooks Enterprise 20.0 + 24.0 is ONLY on LAB-Becky (workstation)
@@ -223,30 +279,34 @@ to identify this endpoint and get it managed.**
- [ ] Test DeskMan on Server 2019 (install on LAB-SVR, verify it runs)
- [ ] Update LAB-SVR GuruRMM agent to 0.6.79
- [ ] Discuss hours/budget with Len/Becky (3.75 hrs won't cover it)
- [ ] Decide: domain-join or stay WORKGROUP
- [ ] If domain-join: plan workstation join order, budget Win11 Home->Pro for Brian
- [x] Decide: domain-join -- YES, proceeding with domain join
- [ ] Budget Win11 Home->Pro upgrade for Brian's machine (DESKTOP-0J55V6L)
**Phase 1: Prepare Target (LAB-SVR) — no downtime needed**
- [ ] Create DeskMan directory on LAB-SVR
- [ ] Initial robocopy of C:\DeskMan from lab-server to LAB-SVR (bulk copy while live)
- [ ] Robocopy C:\shares from lab-server to LAB-SVR
- [ ] Create SMB shares on LAB-SVR: DeskMan, shares (match permissions)
- [ ] Install DeskMan on LAB-SVR and verify it launches
- [ ] If domain-joining: create domain user accounts for all staff
- [ ] If domain-joining: set up GPO for printers and drive mappings
- [x] Create AD OUs, security groups, domain user accounts (2026-07-20)
- [x] Create DeskMan + shares SMB shares with NTFS permissions (2026-07-20)
- [x] Install Print Services role (2026-07-20)
- [x] Install RICOH driver + create shared printer \\LAB-SVR\RICOH-IM600SR (2026-07-20)
- [x] Create and configure GPO "Printers and Point-and-Print" with Point and Print restrictions (2026-07-20)
- [ ] Initial robocopy of C:\DeskMan from lab-server to LAB-SVR (TONIGHT when users off)
- [ ] Robocopy C:\shares from lab-server to LAB-SVR (TONIGHT)
- [ ] Add Brother HL-L2350DW as second shared printer (find IP, assign static)
- [ ] Add HP OfficeJet Pro 9010 (at 192.168.1.41) as shared printer if feasible
- [ ] Download ForensIT ProfWiz and stage on LAB-SVR for profile migration
- [ ] Update LAB-SVR GuruRMM agent to 0.6.79
**Phase 2: Cutover (REQUIRES DOWNTIME — schedule after hours or weekend)**
- [ ] Notify all staff — DeskMan will be unavailable during cutover
- [ ] Close all DeskMan sessions on all workstations
- [ ] Final robocopy /MIR from lab-server to LAB-SVR (delta sync)
- [ ] Create/verify SMB share on LAB-SVR
- [ ] Option A: Update amPath.ini on every workstation to \\LAB-SVR\DeskMan
- [ ] Option B: Add DNS CNAME "lab-server" -> LAB-SVR (simpler, fewer touchpoints)
- [ ] Recreate user accounts on LAB-SVR share (or use domain accounts)
- [ ] If domain-joining: join workstations to LAB.lan domain
- [ ] Test DeskMan access from each workstation
- [ ] Test file share access from each workstation
- [ ] Fix Brian's Guest access (create proper account or domain-join)
**Phase 2: Cutover (per-workstation, one at a time — NO BIG BANG)**
- [ ] Notify staff of the plan
- [ ] For EACH workstation:
- [ ] Point DNS to LAB-SVR (192.168.1.82)
- [ ] Join to LAB.lan domain
- [ ] Reboot
- [ ] Run ForensIT ProfWiz to remap local profile to domain account
- [ ] Update DeskMan amPath.ini to `\\LAB-SVR\DeskMan` (or use DNS CNAME)
- [ ] Verify DeskMan, printers, file shares work
- [ ] Clean up old WSD/local printer entries
- [ ] Final robocopy /MIR from lab-server for last delta
- [ ] Fix Brian's machine: upgrade to Pro first, then domain-join
**Phase 3: Validation (run both servers in parallel)**
- [ ] Monitor DeskMan usage for 1 week on new server
@@ -314,7 +374,10 @@ See wiki article: `wiki/clients/lens-auto-brokerage.md` (compiled 2026-07-20)
| Date | By | Change | Status |
|------|-----|--------|--------|
| 2026-07-20 | Howard | Full lab-server inventory via SC backstage; migration plan drafted with decision points | PLANNING |
| 2026-07-20 | Howard | LAB-SVR server prep: AD (OUs/groups/10 users), SMB shares, Print Services, RICOH shared printer, Point and Print GPO | DONE |
| 2026-07-20 | Howard | Network discovery: HP 9010 at .41, Amcrest cam at .50, dana's HP at .135 | DONE |
| 2026-07-20 | Howard | DeskMan research: FoxPro app, server is just file share, no install needed on server | DONE |
| 2026-07-20 | Howard | Full lab-server inventory via SC backstage; migration plan drafted with decision points | DONE |
| 2026-07-20 | Howard | Fleet inventory from RMM/SC/Syncro; wiki updated | DONE |
| 2026-06-17 | Howard | Deskman crash investigation (transient, self-resolved) | RESOLVED |
| 2026-06-01 | Howard | GuruRMM deployment complete (8 agents) | DONE |

100
clients/lens-auto-brokerage/session-logs/2026-07/2026-07-20-howard-server-migration-planning.md
View File

@@ -108,3 +108,103 @@ ScreenConnect backstage commands run on lab-server (via sc.py send-command):
- Contacts: Becky Kahn 520-247-1089, Michale Haubert 520-318-1040
- PROJECT_STATE.md: clients/lens-auto-brokerage/PROJECT_STATE.md (full migration plan)
- Wiki: wiki/clients/lens-auto-brokerage.md (compiled 2026-07-20)
---
## Update: 16:30 PT — Server prep and AD setup
### Session Summary (continued)
After the initial planning session, moved to execution. Created the full AD structure on LAB-SVR: OU hierarchy (LensAuto with Users/Computers/Groups sub-OUs), three security groups (DeskMan Users, DeskMan Admins, LAB-Staff), and 10 domain user accounts with temporary passwords. Created DeskMan and shares SMB shares with proper NTFS permissions matching the security groups.
Installed the Print Services role on LAB-SVR. The RICOH IM 600SR driver download from Ricoh's site (34MB) timed out twice via RMM due to the MicroServer's slow internet. Howard downloaded the driver manually and pushed it via ScreenConnect. Staged the "PCL6 Driver for Universal Print" (Ricoh Universal v4.45) and created the RICOH IM 600SR as a shared printer at `\\LAB-SVR\RICOH-IM600SR`.
Created GPO "Printers and Point-and-Print" linked to the Computers OU with all 6 Point and Print registry values configured — this is the PrintNightmare fix that prevents "Access Denied" when non-admin users connect to the print server. Howard verified all values from a PowerShell session on LAB-SVR.
Discovered network device IPs from ARP table: HP OfficeJet Pro 9010 is at 192.168.1.41 (network-capable, can be GPO-deployed), Amcrest security camera at .50, and confirmed dana's unknown workstation at .135 is an HP machine.
Researched AutoManager DeskManager: it's a FoxPro/DBF car dealership management app that does NOT need to be installed on the server — the server is just a file share. Migration is fundamentally copy files + recreate share + update amPath.ini. AutoManager also offers a cloud version (DMO) for future consideration.
Discussed profile migration approach: ForensIT User Profile Wizard (ProfWiz) remaps local profile SIDs to domain accounts so users keep their existing desktop, documents, and app settings when switching to domain logins.
### Key Decisions (continued)
- Domain-join confirmed as the approach — AD is already running, Guest SMB access to credit card data is a security issue, and this is the natural break point.
- Print server with Point and Print GPO instead of direct TCP/IP — new/reimaged machines need the driver, and the print server handles driver distribution. PrintNightmare fix via GPO whitelist.
- Cutover will be per-workstation (one at a time) not big-bang — less risk, can validate each machine before moving to the next.
- ForensIT ProfWiz for profile migration instead of fresh profiles — preserves user data and settings.
### Problems Encountered (continued)
- RICOH driver download timed out twice via RMM (34MB download, MicroServer's internet too slow for 3-5 minute timeout). Resolved by Howard downloading manually and pushing via ScreenConnect.
- GPO PowerShell script too large for RMM encoded command (>6KB limit). Sent via ScreenConnect backstage commands instead (5 sequential commands).
- Get-GPRegistryValue and Get-GPOReport consistently timed out via RMM on the MicroServer (GroupPolicy module is heavy on Xeon E-2314 with 16GB). Verified directly from PowerShell on LAB-SVR.
- Stuck z07106L24.exe from failed BITS download could not be deleted (process lock). Cleared BITS transfers but file remained locked. Will delete after next reboot.
- Here-string quoting issues when sending PowerShell scripts through RMM JSON dispatch (nested quotes, @' terminators). Workaround: use ScreenConnect for complex scripts, simple one-liners for RMM.
### Configuration Changes (continued)
**Created on LAB-SVR (via RMM remote script):**
- AD OUs: LensAuto, Users, Computers, Groups under DC=LAB,DC=lan
- AD Groups: DeskMan Users, DeskMan Admins, LAB-Staff
- AD Users: becky, dana, brian, tina, madonna, gloss, josh, turner, parke, guru (all with Welcome2LAB! must-change password)
- SMB Share: DeskMan -> C:\DeskMan (DeskMan Users=Modify, DeskMan Admins=Full)
- SMB Share: shares -> C:\shares with subdirs (LAB-Staff=Modify)
- Print Services role installed
- TCP/IP Printer Port: TCP_192.168.1.105
- Printer Driver: "PCL6 Driver for Universal Print" (Ricoh Universal PCL6 v4.45)
- Shared Printer: "RICOH IM 600SR" as RICOH-IM600SR
**Created on LAB-SVR (via ScreenConnect backstage):**
- GPO: "Printers and Point-and-Print" linked to OU=Computers,OU=LensAuto
- GPO Registry: 6 Point and Print values (Restricted, TrustedServers, ServerList, NoWarningNoElevationOnInstall, UpdatePromptSettings, RestrictDriverInstallationToAdministrators)
- GPO Registry: LegacyDefaultPrinterMode=1
**Modified:** clients/lens-auto-brokerage/PROJECT_STATE.md — updated with server prep completion status
### Commands & Outputs (continued)
RMM commands dispatched to LAB-SVR (8afb1430-c8f2-4fa2-8335-35b13d8a732f):
- AD setup script: OUs + groups + users + shares — exit 0
- Print Services install: `Install-WindowsFeature Print-Services` — Success, no reboot needed
- RICOH driver staging: `pnputil /add-driver oemsetup.inf /install` — Published as oem108.inf
- RICOH driver add: `Add-PrinterDriver -Name "PCL6 Driver for Universal Print"` — exit 0
- RICOH printer create: `Add-Printer -Name "RICOH IM 600SR" -Shared -ShareName "RICOH-IM600SR"` — exit 0
- GPO verify: `Get-GPO -All` — confirmed "Printers and Point-and-Print" exists
Printer port data from LAB-Becky (fd898f1b-fa70-4587-b827-40c03252f9b0):
- RICOH IM 600SR on USB006/USB002, HP 9010 on WSD, Brother L2350DW on WSD, Brother L2340D on USB
ARP table from LAB-MADONNA (0e845264-9b2c-4db2-aacb-96c5deac251a):
- .41 = HP (OfficeJet Pro 9010), .50 = Amcrest (camera), .105 = RICOH, .114 = Cloud Network Tech, .135 = HP (dana's machine)
### Pending / Incomplete Tasks (updated)
- [ ] Robocopy DeskMan data + C:\shares from lab-server to LAB-SVR (tonight when users off)
- [ ] Find Brother HL-L2350DW IP, assign static, add as shared printer on LAB-SVR
- [ ] Add HP OfficeJet Pro 9010 (192.168.1.41) as shared printer if feasible
- [ ] Download ForensIT ProfWiz and stage on LAB-SVR
- [ ] Identify machine at 192.168.1.135 (dana's HP workstation)
- [ ] Update LAB-SVR GuruRMM agent from 0.6.66 to 0.6.79
- [ ] Delete stuck z07106L24.exe after reboot
- [ ] Discuss hours with Len/Becky (3.75 hrs remaining, need 8-12)
- [ ] Budget Win 11 Home -> Pro for Brian's machine
- [ ] Deploy Datto EDR to LAB-DAWN, LAB-MADONNA, DESKTOP-0J55V6L, LAB-SVR
- [ ] Begin per-workstation cutover (domain join + ProfWiz + DeskMan repoint)
### Reference Information (continued)
- RICOH driver download URL: https://support.ricoh.com/bb/pub_e/dr_ut_e/0001346/0001346104/V44500/z07106L24.exe
- RICOH driver name on LAB-SVR: "PCL6 Driver for Universal Print"
- RICOH driver INF: C:\PrintDrivers\Ricoh\extracted\disk1\oemsetup.inf (published as oem108.inf)
- RICOH printer share: \\LAB-SVR\RICOH-IM600SR
- GPO name: "Printers and Point-and-Print"
- HP OfficeJet Pro 9010 IP: 192.168.1.41
- Amcrest camera IP: 192.168.1.50
- Unknown device IP: 192.168.1.114 (Cloud Network Technology)
- Dana's unknown HP workstation: 192.168.1.135 (MAC 30:13:8b:68:7d:0c)
- ForensIT User Profile Wizard: https://www.intacct.com/forensit/downloads/
- AutoManager DeskManager support: 800-300-2808, support@automanager.com
- DeskMan version: DMain.exe v11.98.0.30 (June 2023)
- Domain user temp password: Welcome2LAB! (must change at logon)
- RMM command IDs: AD setup=131413d5, print services=7c9dca51, RICOH driver=cd1ae9a7, GPO list=89daf39f

4
errorlog.md
View File

@@ -19,6 +19,10 @@ Categories (the `[type]` tag): _(none)_ = skill/command execution failure ·
<!-- Append entries below this line -->
2026-07-20 | Howard-Home | tailscale | Skill blocked: no vault entry at tailscale/api-access.sops.yaml -- need OAuth client_id+client_secret or API key provisioned [ctx: ref=skill-testing-2026-07-20]
2026-07-20 | Howard-Home | bash/parallel-tools | [friction] Ran Skill call parallel with a Bash call that errored -- system cancelled the Skill. Must not pair fragile Bash calls with Skill calls in the same parallel block. [ctx: ref=parallel-tool-cancel]
2026-07-20 | Howard-Home | gururmm-agent | installer fails on Server 2008 SP2 (6.0.6002) -- api-ms-win-core-synch-l1-2-0.dll missing. UCRT/VC++ redist also fails (VersionNT64 condition false -- likely 32-bit OS). No legacy build exists yet (gururmm#88). [ctx: host=LAB-SERVER client=lens-auto os=server2008sp2]
2026-07-20 | Howard-Home | remediation-tool | get-token: token request failed (no access_token) [ctx: tenant=207fa277-e9d8-4eb7-ada1-1064d2221498 tier=investigator auth=secret err=7000215]