client/cascades: Phase 2.6 COMPLETE — 13 printers, 4 GPOs, 5 accounts disabled
Detailed context: - Task: Cascades of Tucson Phase 2.6 — printer migration, GPO deployment, account cleanup - Changes: - phase2-print-server.ps1: all 13 printers complete, Epson driver/share notes added - active-directory.md: 5 stale accounts disabled, 4 GPOs created, pending issues cleared, printer share table updated - Session log: 2026-05-20 Howard session covering all Phase 2.6 work - Status: Phase 2.6 complete Files modified: - clients/cascades-tucson/docs/migration/scripts/phase2-print-server.ps1 - clients/cascades-tucson/docs/servers/active-directory.md - clients/cascades-tucson/session-logs/2026-05-20-howard-phase2.6-printers-gpos-account-cleanup.md Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
@@ -0,0 +1,194 @@
|
||||
# Cascades of Tucson — Phase 2.6 Session Log
|
||||
|
||||
**Date:** 2026-05-20
|
||||
**Duration:** Multi-session (continued from context-limit session)
|
||||
|
||||
## User
|
||||
- **User:** Howard Enos (howard)
|
||||
- **Machine:** HOWARD-HOME
|
||||
- **Role:** tech
|
||||
|
||||
## Summary
|
||||
|
||||
Completed Phase 2.6: print server build-out, GPO creation, and AD account cleanup. All 13 printers are now installed and shared on CS-SERVER. Four CSC GPOs are created and staged (unlinked until Phase 3 domain join cutover).
|
||||
|
||||
---
|
||||
|
||||
## Work Completed
|
||||
|
||||
### 1. Front Desk Epson ET-5800 — Printer Installation
|
||||
|
||||
**Problem:** EPWizard.exe fails on Windows Server 2019 — `wlanapi.dll` stub is present but the WLAN stack is absent.
|
||||
|
||||
**Fix:**
|
||||
1. Ran EPWizard.exe on CS-SERVER, let it extract drivers to `AppData\Local\Temp\ET-5800\` before dismissing the error
|
||||
2. Copied extracted INFs to `C:\Users\sysadmin\Documents\ComputerGuru Connect v2\Files\epsonetdrivers\`
|
||||
3. `pnputil /add-driver <INF> /install` staged the driver in Windows Driver Store
|
||||
4. `Add-PrinterDriver -Name "EPSON ET-5800 Series"` registered it with the Print Spooler
|
||||
5. `Add-Printer` / `Add-PrinterPort` created the printer at 192.168.2.147, shared as `FrontDesk`
|
||||
|
||||
**Driver name (from INF):** `EPSON ET-5800 Series`
|
||||
**INF location:** E_WF1XCE.INF (UTF-16 LE with BOM FF FE — `Select-String` fails on it; must use `[System.IO.File]::ReadAllBytes()`)
|
||||
|
||||
### 2. Memory Care Director + MedTech Printers
|
||||
|
||||
Added to CS-SERVER (via GuruRMM remote PowerShell):
|
||||
|
||||
| Printer | Share | IP | Driver |
|
||||
|---------|-------|----|--------|
|
||||
| Memory Care Director - Canon MF751CDW | MCDirector | 192.168.3.52 | Canon Generic Plus PCL6 |
|
||||
| Memory Care MedTech - Brother | MCMedTech | 192.168.2.53 | Brother Generic Jpeg Type2 Class Driver |
|
||||
|
||||
Both reachable and shared. Total shared printers on CS-SERVER: **13**.
|
||||
|
||||
### 3. Script: phase2-print-server.ps1
|
||||
|
||||
Updated `clients/cascades-tucson/docs/migration/scripts/phase2-print-server.ps1`:
|
||||
- Status header updated to **COMPLETE 2026-05-20** (all 13 printers)
|
||||
- Added FrontDesk, MCDirector, MCMedTech to `$printers` array
|
||||
- Documented Epson ET-5800 workaround in header comments
|
||||
- KM driver archived to `D:\Shares\Server\Drivers\KM_Universal_PCL6\`
|
||||
|
||||
### 4. AD Account Cleanup (5 accounts)
|
||||
|
||||
Executed via GuruRMM remote PowerShell on CS-SERVER. All `Disable-ADAccount` calls succeeded.
|
||||
|
||||
| Account | OU | Reason |
|
||||
|---------|----|--------|
|
||||
| britney.thompson | Care-Assisted Living | Departed 2026-04-22 |
|
||||
| Richard.Adams | Transportation | Drivers no longer get IT access |
|
||||
| Julian.Crim | Transportation | Drivers no longer get IT access |
|
||||
| Christopher.Holick | Transportation | Drivers no longer get IT access |
|
||||
| Shontiel.Nunn | Resident Services | Old-format account — s.nunn (Caregivers) is correct |
|
||||
|
||||
**Note:** britney.thompson's M365 license is still active and not yet harvested. Action needed before next billing cycle.
|
||||
|
||||
### 5. CSC - Security Baseline GPO
|
||||
|
||||
Created via `New-GPO` + `Set-GPRegistryValue` + direct SYSVOL writes.
|
||||
|
||||
**Screen saver (HKCU via GPP):**
|
||||
- ScreenSaveTimeOut = 900 (15 min)
|
||||
- ScreenSaveActive = 1
|
||||
- ScreenSaverIsSecure = 1
|
||||
- SCRNSAVE.EXE = scrnsave.scr
|
||||
|
||||
**GptTmpl.inf (Machine security — written as Unicode UTF-16):**
|
||||
```
|
||||
MinimumPasswordLength = 12
|
||||
PasswordComplexity = 1
|
||||
PasswordHistorySize = 24
|
||||
MaximumPasswordAge = 90
|
||||
MinimumPasswordAge = 1
|
||||
LockoutBadCount = 5
|
||||
ResetLockoutCount = 30
|
||||
LockoutDuration = 30
|
||||
```
|
||||
|
||||
**GPT.INI:** machine version bumped, security extension GUID `{827D319E-6EAC-11D2-A4EA-00C04F79F83A}{803E14A0-B4FB-11D0-A0D0-00A0C90F574B}` added.
|
||||
|
||||
**Status: UNLINKED.** Link to domain root at Phase 3 cutover.
|
||||
|
||||
### 6. CSC - Windows Update GPO
|
||||
|
||||
Created via `New-GPO` + `Set-GPRegistryValue` (HKLM AU key).
|
||||
|
||||
| Setting | Value |
|
||||
|---------|-------|
|
||||
| NoAutoUpdate | 0 |
|
||||
| AUOptions | 4 (auto download + install) |
|
||||
| ScheduledInstallDay | 1 (Sunday) |
|
||||
| ScheduledInstallTime | 3 (3:00 AM) |
|
||||
| NoAutoRebootWithLoggedOnUsers | 1 |
|
||||
| EnableFeaturedSoftware | 0 |
|
||||
|
||||
**Status: UNLINKED.** Link to domain root at Phase 3 cutover.
|
||||
|
||||
### 7. CSC - Printer Deployment GPO
|
||||
|
||||
Created `Printers.xml` in SYSVOL at `{GPO-GUID}\User\Preferences\Printers\`.
|
||||
|
||||
13 printers with OU-based item-level targeting (`FilterOrgUnit`):
|
||||
|
||||
| Share | ILT |
|
||||
|-------|-----|
|
||||
| CopyRoom | No filter — all staff |
|
||||
| BusinessOffice | OU=Administrative |
|
||||
| Accounting | OU=Administrative |
|
||||
| AdminOffice | OU=Administrative OR OU=Resident Services |
|
||||
| ExecDirector | OU=Administrative |
|
||||
| SalesMarketing | OU=Marketing |
|
||||
| Kitchen | OU=Culinary |
|
||||
| CulinaryChef | OU=Culinary |
|
||||
| FrontDesk | OU=Resident Services |
|
||||
| HealthServices | OU=Care-Assisted Living OR OU=Care-Memorycare |
|
||||
| LifeEnrichment | OU=Life Enrichment |
|
||||
| MCDirector | OU=Care-Memorycare |
|
||||
| MCMedTech | OU=Caregivers OR OU=Care-Memorycare |
|
||||
|
||||
**CSE GUID:** `{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}{D02B1F72-3407-48AE-BA88-E8213C6761F1}`
|
||||
|
||||
**Status: UNLINKED.** Link to OU=Workstations at Phase 3 cutover.
|
||||
|
||||
### 8. CSC - Drive Mappings GPO
|
||||
|
||||
Created `Drives.xml` in SYSVOL at `{GPO-GUID}\User\Preferences\Drives\`.
|
||||
|
||||
| Drive | Share | ILT |
|
||||
|-------|-------|-----|
|
||||
| M: | \\CS-SERVER\Management | FilterGroup: CASCADES\SG-Mgmt-RW |
|
||||
| S: | \\CS-SERVER\Sales | FilterGroup: CASCADES\SG-Sales-RW |
|
||||
| T: | \\CS-SERVER\Activities | FilterGroup: CASCADES\SG-Activities-RW |
|
||||
| K: | \\CS-SERVER\Culinary | FilterOrgUnit: OU=Culinary,OU=Departments |
|
||||
| R: | \\CS-SERVER\Receptionist | FilterOrgUnit: OU=Resident Services,OU=Departments |
|
||||
|
||||
**CSE GUID:** `{5794DAFD-BE60-433f-88A2-1A31939AC01F}{D02B1F72-3407-48AE-BA88-E8213C6761F1}`
|
||||
|
||||
**Status: UNLINKED.** Link to OU=Departments at Phase 3 cutover.
|
||||
|
||||
---
|
||||
|
||||
## Final CSC GPO Inventory (8 GPOs, all AllSettingsEnabled)
|
||||
|
||||
```
|
||||
CSC - Always Wait For Network (pre-existing)
|
||||
CSC - Drive Mappings UNLINKED — link to OU=Departments at Phase 3
|
||||
CSC - Folder Redirection UNLINKED — blocked on Phase 3 domain joins
|
||||
CSC - Folder Redirection (LE) LIVE — linked to OU=Life Enrichment
|
||||
CSC - Life Enrichment Printers LIVE — linked to OU=Life Enrichment
|
||||
CSC - Printer Deployment UNLINKED — link to OU=Workstations at Phase 3
|
||||
CSC - Security Baseline UNLINKED — link to domain root at Phase 3
|
||||
CSC - Windows Update UNLINKED — link to domain root at Phase 3
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Docs Updated
|
||||
|
||||
- `clients/cascades-tucson/docs/migration/scripts/phase2-print-server.ps1` — Complete status + all 13 printers
|
||||
- `clients/cascades-tucson/docs/servers/active-directory.md` — Accounts disabled, GPO table updated, pending issues updated, printer shares table updated
|
||||
|
||||
---
|
||||
|
||||
## Phase 3 Prerequisites (next major work)
|
||||
|
||||
Domain join order (per `migration/phase3-domain-join.md`):
|
||||
1. DESKTOP-KQSL232 (10.0.20.227)
|
||||
2. CHEF-PC (10.0.20.232)
|
||||
3. SALES4-PC (10.0.20.203)
|
||||
4. MDIRECTOR-PC (192.168.3.20) — **needs Windows 10 Pro upgrade first** (currently Home)
|
||||
|
||||
After first successful join — link GPOs per phase3-domain-join.md step 5c.
|
||||
|
||||
---
|
||||
|
||||
## Open Items
|
||||
|
||||
| Item | Priority | Notes |
|
||||
|------|----------|-------|
|
||||
| britney.thompson M365 license harvest | Medium | Account disabled; license still active |
|
||||
| Phase 3 domain joins | High | Block on MDIRECTOR-PC needing Win10 Pro upgrade |
|
||||
| krbtgt password rotation | Medium | 569+ days old — deferred |
|
||||
| Remove Meredith.Kuhn + John.Trozzi from Domain Admins | Low | Deferred |
|
||||
| SG-Mgmt-RW + SG-Sales-RW membership | Medium | Populate before Phase 3 GPO linking |
|
||||
| CSC - Folder Redirection (full) | Medium | Blocked on Phase 3 — check OneDrive KFM on each PC first |
|
||||
Reference in New Issue
Block a user