sync: auto-sync from HOWARD-HOME at 2026-06-30 17:28:00
Author: Howard Enos Machine: HOWARD-HOME Timestamp: 2026-06-30 17:28:00
This commit is contained in:
@@ -0,0 +1,53 @@
|
||||
## User
|
||||
- **User:** Howard Enos (howard)
|
||||
- **Machine:** Howard-Home
|
||||
- **Role:** tech
|
||||
|
||||
## Session Summary
|
||||
|
||||
Short recall/reference session. Howard asked to pull up the ALIS online setup done for Cascades of Tucson and confirm the staff login model: whether usernames just need to match the email address, and whether an ALIS password needs to be set.
|
||||
|
||||
Invoked the `alis` skill for the staff-import/roster context, then read the authoritative record in `wiki/clients/cascades-tucson.md` ("ALIS SSO" section) plus the skill's `references/api-reference.md` and `import_builder.py` login/password logic. Confirmed the setup: ALIS at Cascades is wired for Entra OIDC SSO (tenant-wide admin consent granted 2026-06-03), the per-user join key is the ALIS staff Email field equalling the Entra UPN, and no local ALIS password is required because authentication is delegated to Microsoft/Entra.
|
||||
|
||||
Answered Howard directly: set Login Enabled = Yes with Email = the user's UPN (email), leave Password blank for SSO users. Flagged that the import builder auto-defaults Login Enabled to No when no password is present, so SSO rows must set Login Enabled = Yes explicitly. Also surfaced the still-pending related item from the 2026-06-05 notes: lowering the ALIS app session timeout 20->15 min (Howard, ALIS admin).
|
||||
|
||||
## Key Decisions
|
||||
|
||||
- Treated `wiki/clients/cascades-tucson.md` as the source of truth for the ALIS SSO join model rather than re-deriving from the API — the wiki explicitly records "Per-user join key = ALIS staff Email must equal the Entra UPN."
|
||||
- No file changes or import build performed — this was a reference/confirmation session only.
|
||||
|
||||
## Problems Encountered
|
||||
|
||||
- None.
|
||||
|
||||
## Configuration Changes
|
||||
|
||||
- None (recall session). Session log created only.
|
||||
|
||||
## Credentials & Secrets
|
||||
|
||||
- None discovered or created. (ALIS API user login remains vaulted at `clients/cascades-tucson/alis-api-howard-user.sops.yaml`; not accessed this session.)
|
||||
|
||||
## Infrastructure & Servers
|
||||
|
||||
- ALIS tenant: Cascades of Tucson, communityId 622; tenant subdomain `cascadestucson`; API host `api.alisonline.com`.
|
||||
- Identity: hybrid AD `cascades.local` -> Entra/M365 (Entra Connect, PHS + Seamless SSO), UPN suffix `cascadestucson.com`. Windows login = email = M365 = ALIS identity.
|
||||
- ALIS SSO: Entra app registration -> OIDC into ALIS; tenant-wide admin consent granted 2026-06-03.
|
||||
|
||||
## Commands & Outputs
|
||||
|
||||
- `Skill alis` — loaded staff-import/roster reference.
|
||||
- Read `wiki/clients/cascades-tucson.md` (ALIS SSO section, lines ~116-146).
|
||||
- Grep `import_builder.py` — confirmed Login Enabled auto-defaults to No when Email+Password not both present (lines 214-226).
|
||||
|
||||
## Pending / Incomplete Tasks
|
||||
|
||||
- ALIS app session timeout 20->15 min (Howard as ALIS admin) — still pending per 2026-06-05 wiki notes. Not actioned this session.
|
||||
- No import file was requested/built; offered to build one (Login Enabled=Yes, Email=UPN, no passwords) if needed.
|
||||
|
||||
## Reference Information
|
||||
|
||||
- Wiki: `wiki/clients/cascades-tucson.md` ("ALIS SSO" + "Entra Access Architecture" sections).
|
||||
- Skill: `C:\Users\Howard\.claude\skills\alis\` — `references/api-reference.md`, `references/role-map.json`, `scripts/import_builder.py`.
|
||||
- ALIS staff endpoints are READ-ONLY; staff/login writes happen via web UI Staff -> Import (.xls).
|
||||
- Related prior log: `2026-06-29-howard-alis-caregiver-phoneonly-caretaker-crosscheck.md`.
|
||||
@@ -114,3 +114,28 @@ Continued the VLAN 20 printer migration with several **workgroup** (not-domain-j
|
||||
- All workgroup machines (DESKTOP-MD6UQI3, CHEF-PC, MEMCARE-STATION, MEMRECEPT-PC, DESKTOP-LPOPV30): domain-join + GPO migration still pending.
|
||||
|
||||
New IPs/printers this update: Dining Canon MF743CDW 10.0.20.228; Chef Brother MFC-9330CDW 10.0.20.236; MedTech Brother MFC-L8900CDW 10.0.20.74; MemCare front desk Epson ET-5800 10.0.20.78 (not yet set up).
|
||||
|
||||
## Update: 17:27 PT — printer GPO inspection, Point-and-Print GPO build, single-machine pilot (revealed silent-install gap)
|
||||
|
||||
Shifted from per-machine printer setup to the **printer GPO** ("go over it, update docs + policies, keep building"). Inspected the live GPO state, built the missing Point-and-Print policy GPO dark, and piloted it on one machine before going live (per Howard: "not make it live until we can test on a machine that mapping works correctly"). The pilot surfaced a real gap.
|
||||
|
||||
**GPO inspection (live, via CS-SERVER RMM + Get-GPOReport):**
|
||||
- **No GPO sets the Point-and-Print policy** anywhere (the missing prerequisite; explains the 0xBCB failures).
|
||||
- Printer deployment = **User-side GPP Printers**, per-department OU:
|
||||
- `CSC - Caregiver Workstation` -> OU `Departments/Caregivers` (ComputerSettingsDisabled): deploys 6 shares `\\CS-SERVER\`{NursesPrinter, HealthServices, MCMedTech, MCReception, MCDirector, CopyRoom}; defaults = NursesPrinter + MCMedTech (default=1 entries, no item-level targeting currently).
|
||||
- `CSC - Life Enrichment Printers` -> OU `Departments/Life Enrichment`: deploys ONE printer `\\CS-SERVER\RecRoom-Canon` = **STALE share name** (now `LifeEnrichment`).
|
||||
- `CSC - Reception Workstation Policy` -> OU `Workstations/Staff PCs`: Registry only, no printers.
|
||||
- `CSC - Printer Deployment`: not linked, empty. Dead.
|
||||
- Gotcha: reading SYSVOL Printers.xml via `\\$env:USERDNSDOMAIN\...` FAILS under SYSTEM (that env var is empty for SYSTEM) -> use Get-GPOReport XML (SelectNodes local-name()='SharedPrinter') or the GPO's gpcFileSysPath instead.
|
||||
|
||||
**Built the P&P policy GPO (dark):** `CSC - Point and Print (CS-SERVER)` guid `{BFAB721A-513D-4C14-8255-DEB1D4266830}`, Computer config: `RestrictDriverInstallationToAdministrators=0` + `PointAndPrint`{Restricted=1,TrustedServers=1,ServerList=CS-SERVER,InForest=0,NoWarningNoElevationOnInstall=1,UpdatePromptSettings=2}. Created via New-GPO + Set-GPRegistryValue as the DC's SYSTEM (SYSTEM CAN create/manage GPOs on this DC). Left UNLINKED initially.
|
||||
|
||||
**Pilot (scoped to ONE machine):** DESKTOP-H6QHRR7 (Lauren Hasselman, Staff PCs OU, domain-joined). Scoped via security filter (H6QHRR7=Apply, Authenticated Users=Read) + linked to `OU=Staff PCs,OU=Workstations`. gpupdate -> **policy registry landed correctly on the machine** (verified). BUT the in-session test (map `\\CS-SERVER\FrontDesk`, whose Epson ET-5800 driver was NOT present) **STILL prompted** (watchdog-timeout = elevation dialog), even after a spooler restart; driver did not install. The earlier LE-machine "silent" maps only worked because that driver was already present -> the install path was never actually exercised before.
|
||||
|
||||
**Conclusion:** the P&P policy (manual or GPO) is necessary but NOT sufficient alone to make a brand-new driver install silent in a running session. Likely `RestrictDriverInstallationToAdministrators=0` needs a **reboot** to take effect (CVE-2021-34527 mitigation) and/or v3 (Epson/Canon Generic Plus) drivers still elevate. Two paths proposed to Howard: (1) reboot-test a machine; (2) **pre-stage drivers** machine-wide (computer GPO startup script installing from CS-SERVER as SYSTEM) so GPP connections always attach to a present driver = silent forever (RECOMMENDED). Awaiting Howard's choice.
|
||||
|
||||
**State:** P&P GPO is scoped to DESKTOP-H6QHRR7 ONLY (security-filtered; not fleet-live, harmless). Lauren's machine cleaned (back to Accounting + Copy Room, no test artifacts, Epson driver NOT installed). Full current-state + target-state design + action list captured in `clients/cascades-tucson/docs/printer-gpo-map.md`.
|
||||
|
||||
**DC gotcha:** the GroupPolicy module (Get-GPOReport / Get-GPO / New-GPLink) is SLOW on the R610 DC via RMM (frequently hit the 90-170s server-side reaper). New-GPO/Set-GPRegistryValue DO complete (only the trailing report render times out) — verify GPO state via fast LDAP (`[adsisearcher]"(objectClass=groupPolicyContainer)"`) + read registry.pol from gpcFileSysPath, NOT Get-GPOReport. Pass big PS scripts via `jq --rawfile` (a file) not `--arg` (inline) — the inline heredoc payloads kept breaking jq ("Invalid numeric literal").
|
||||
|
||||
Pending (GPO): decide reboot-test vs pre-stage-drivers; then repoint `CSC - Life Enrichment Printers` RecRoom-Canon->LifeEnrichment; update CS-SERVER share ports (MCMedTech .53->.74); broaden the P&P GPO link/filter to go live; add per-printer GPP items as printers migrate.
|
||||
|
||||
Reference in New Issue
Block a user