Session log: SC redirect page, SAGE-SQL session manager, Howard GuruRMM account, AT Trebesch review, shared work items

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

session-logs/2026-04-17-session.md

@@ -256,8 +256,87 @@ Created `WORKITEMS.md` at repo root — shared task list that syncs via Gitea.
 - Populated with all carry-over items from this session and previous days
 - Claude can read/update it on request ("show work items", "add work item: ...")
 
-### Network issues (end of day)
+### Network issues (mid-session)
 - AD2 (192.168.0.6): ICMP ping works (23-46ms), SSH port 22 times out
 - SAGE-SQL (192.168.0.153): WinRM port 5985 unreachable from workstation
 - RMM server (172.16.3.30:3001): connection times out
 - Likely VPN/firewall filtering TCP but passing ICMP
+- **Network recovered later in session** — SSH to 172.16.3.30 and RMM API both came back
+
+### Howard's AT Trebesch client onboard — reviewed
+Howard pushed a full client intake for AT Trebesch (15 files, 626 lines). Highlights:
+- New client: 1 user, 1 desktop (DESKTOP-QNP3ON5, Lenovo Ryzen 7), no server, WORKGROUP
+- Used workstation_audit.ps1 v2.0.2 for comprehensive machine audit
+- **Critical findings:** Owner account has no password, dual AV conflict (Bitdefender + Malwarebytes), Secure Boot disabled, Win 11 Home (not Pro)
+- **High findings:** Defender Tamper Protection off, no ASR rules, two MSP backdoor accounts, 85% memory, NETLOGON errors on workgroup machine
+- Created full client folder structure with templates (network, firewall, M365, security, backup, RMM)
+- Flagged 2 audit script bugs for v2.0.3 (Syncro false positive, full scan age rendering)
+- Files at `clients/at-trebesch/` (overview, workstations, reports, network/*, cloud/*, security/*, etc.)
+
+### Howard's GuruRMM account — created
+Created platform-level admin account for Howard on GuruRMM.
+
+**Account details:**
+- Email: `howard@azcomputerguru.com`
+- Password: `GuruRMM2025!`
+- Role: admin (platform-level)
+- User ID: `294c1242-68ac-42e7-85b0-564c8b155dba`
+- Dashboard: https://rmm.azcomputerguru.com
+- API: https://rmm-api.azcomputerguru.com
+
+**How it was done (no admin user creation API exists yet):**
+1. SSH to 172.16.3.30 as guru
+2. `pip3 install argon2-cffi` (user install, already had Python 3)
+3. Hashed password with matching Argon2 params: `PasswordHasher(memory_cost=19456, time_cost=2, parallelism=1)`
+4. INSERT into users table via psql
+5. Initial hash attempt failed (Python argon2 defaults `m=65536,t=3,p=4` vs server's `m=19456,t=2,p=1`) — Rust argon2 crate verify should handle different params but didn't. Regenerated with matching params, login verified 200 OK.
+
+**Gotcha:** The Rust `argon2` crate (v0.5) does NOT verify hashes with different cost parameters than it was compiled with, even though the params are encoded in the hash. Always match the server's params when hashing externally.
+
+Instructions pushed to `.claude/messages/for-howard.md` — he'll see on next `/sync`.
+
+### Credentials (this update)
+
+#### GuruRMM — Howard's account
+- Dashboard: https://rmm.azcomputerguru.com
+- API: https://rmm-api.azcomputerguru.com
+- Email: `howard@azcomputerguru.com`
+- Password: `GuruRMM2025!`
+- Role: admin
+- UUID: `294c1242-68ac-42e7-85b0-564c8b155dba`
+
+#### GuruRMM — existing admin
+- Email: `admin@azcomputerguru.com`
+- Password: `GuruRMM2025`
+- Vault: `projects/gururmm/dashboard.sops.yaml`
+
+#### GuruRMM — database
+- Host: 172.16.3.30:5432
+- Database: gururmm
+- Username: gururmm
+- Password: `43617ebf7eb242e814ca9988cc4df5ad`
+- Vault: `projects/gururmm/database.sops.yaml`
+
+#### GuruRMM — server SSH
+- Host: 172.16.3.30
+- Username: guru
+- Password: `Gptf*77ttb123!@#-rmm`
+- Vault: `infrastructure/gururmm-server.sops.yaml`
+
+### Files created/modified (this update)
+- `WORKITEMS.md` — new, shared task board
+- `clients/dataforth/session-manager/Default.aspx` — new, session reset app
+- `clients/dataforth/session-manager/web.config` — new, IIS auth config
+- `.claude/messages/for-howard.md` — updated, added GuruRMM access instructions
+- `session-logs/2026-04-17-session.md` — updated (this file)
+
+### WinRM TrustedHosts (local workstation config)
+- Previous: `172.16.9.169`
+- Updated to: `172.16.9.169,192.168.0.153,SAGE-SQL`
+
+### Pending (carry-forward from full day)
+1. **SAGE-SQL session manager deployment** — files ready, deploy tomorrow. Steps documented above.
+2. **GuruRMM admin user creation API** — no endpoint exists. Currently database-only. Low priority (just Mike + Howard for now).
+3. **Howard password change** — no UI for password change yet. He'll need to ask Claude to update via database when ready.
+4. **AT Trebesch critical fixes** — Owner password, dual AV, Secure Boot, Win Pro upgrade (Howard's items)
+5. **All items in WORKITEMS.md** — 14 active items across multiple clients/projects