imc: Manda laptop provision (DESKTOP-KRHQ5TS) + ServerIMC phantom-DC confirmed
- New laptop provisioned onsite at IMC Speedway: joined to imc.local, AD account created for Manda (incoming GM), Outlook bound to her M365 mailbox, Office activated via retail key, AIMsi USER#=4 per Leslie. - Syncro ticket #32218 invoiced — 1.5 hrs Onsite Business labor debited from IMC's prepay block (14.0 -> 12.5 hrs). - ServerIMC (192.168.0.63) confirmed as a real authentication-degrading phantom DC: SRV/A records claim it's a DC; LDAP/Kerberos refuse connections. Promoted from "unclear, worth verifying" (2026-04-13) to confirmed AD hygiene issue. Was the root cause of the 2026-04-22 remote domain-join failure. Needs follow-up ticket: repair or ntdsutil cleanup. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
@@ -2,7 +2,7 @@
|
||||
|
||||
> READ THIS before starting work on this client.
|
||||
> UPDATE THIS when you begin work (claim a lock) and when you finish (release lock + log changes).
|
||||
> Last updated: 2026-04-20
|
||||
> Last updated: 2026-04-28
|
||||
|
||||
---
|
||||
|
||||
@@ -19,9 +19,15 @@
|
||||
## Current State
|
||||
|
||||
**Status:** ACTIVE
|
||||
**Last Activity:** 2026-04-13
|
||||
**Last Activity:** 2026-04-28
|
||||
|
||||
Music retail + repair shop running AIMsi POS on-prem. Primary server IMC1 (Dell R720, Windows Server 2016, DC for IMC.local). SQL Server 2019 Express (`IMC1\AIMSQL`). AIMsi DBs moved to dedicated SSD (`S:\SQL\Data\`). Local SQL backups running nightly; Cloudberry off-site backups configured. Known issue: component store corruption (0x80073701) blocking RDS role removal — Server 2019 migration decision pending.
|
||||
Music retail + repair shop running AIMsi POS on-prem. Primary server IMC1 (Dell R720, Windows Server 2016, DC for IMC.local). SQL Server 2019 Express (`IMC1\AIMSQL`). AIMsi DBs moved to dedicated SSD (`S:\SQL\Data\`). Local SQL backups running nightly; Cloudberry off-site backups configured.
|
||||
|
||||
**Personnel:** Manda is the new General Manager (replacing Michael Santander, already deactivated). Manda's new laptop `DESKTOP-KRHQ5TS` provisioned 2026-04-28 (AIMsi `USER#=4` per Leslie).
|
||||
|
||||
**Known issues:**
|
||||
- `IMC1` component store corruption (0x80073701) blocking RDS role removal — Server 2019 migration decision pending.
|
||||
- **`ServerIMC` (192.168.0.63) — phantom/broken DC.** Registered as a DC in DNS (A + SRV records), responds to ICMP, but **TCP/389 LDAP and TCP/88 Kerberos refuse connections.** The DC locator round-robins between IMC1 and ServerIMC; clients picking ServerIMC time out. **This degrades authentication for every domain user at IMC** — intermittent slow logons, GPO failures, and was the root cause of the 2026-04-22 remote domain-join failure for `DESKTOP-KRHQ5TS`. Needs investigation: real-but-broken DC (repair AD services) or ghost from a demoted DC (`ntdsutil` metadata cleanup). Was flagged as "unclear" on 2026-04-13; promoted to confirmed issue 2026-04-28.
|
||||
|
||||
---
|
||||
|
||||
@@ -33,9 +39,11 @@ Music retail + repair shop running AIMsi POS on-prem. Primary server IMC1 (Dell
|
||||
| SQL instance | IMC1\AIMSQL | MSSQL 2019 Express. DBs on S:\SQL\Data\ |
|
||||
|
||||
**SSH:** `ssh IMC\guru@192.168.0.2` (ed25519 key, PowerShell default shell)
|
||||
**VPN:** OpenVPN (.ovpn profile) — disconnect Tailscale first (192.168.0.0/24 conflict)
|
||||
**VPN:** OpenVPN (.ovpn profile) — disconnect Tailscale first (192.168.0.0/24 conflict). **Avoid remote domain-join over OpenVPN if your local LAN is also `192.168.0.0/24`** — DNS multi-homing race + the ServerIMC phantom-DC make it unreliable. Go onsite instead.
|
||||
**Domain admin:** `IMC\guru` — also SQL sysadmin (added via single-user recovery 2026-04-12)
|
||||
**Credentials:** Vault entry needed (`clients/imc/` — not yet created as of 2026-04-13)
|
||||
**Syncro customer ID:** 7088508 (prepay block: 12.5 hrs as of 2026-04-28)
|
||||
**Primary contact:** Leslie Stirm — leslie@imc-az.com (Syncro contact_id 731730)
|
||||
**Credentials:** vault `clients/imc/imc1.sops.yaml`
|
||||
|
||||
**Disks:** C: (OS, 77% full), E: (SQL backups + installers), F: (Windows Image Backups), S: (SSD — AIMsi DBs)
|
||||
**Backup:** Nightly SQL at 22:00 to `E:\SQL\...\Backup\`; retention script `C:\Scripts\Clean-AimsiBackups.ps1` (14 dailies + 1st-of-month); Cloudberry at `C:\ProgramData\Online Backup\`
|
||||
@@ -50,11 +58,19 @@ Music retail + repair shop running AIMsi POS on-prem. Primary server IMC1 (Dell
|
||||
|
||||
## Pending / Next Up
|
||||
|
||||
**High priority — AD hygiene**
|
||||
- [ ] **Open ticket for `ServerIMC` (192.168.0.63) phantom-DC investigation.** SRV/A records claim it's a DC; LDAP/Kerberos refuse connections. Either repair (if a real-but-broken DC) or `ntdsutil` metadata cleanup (if a ghost demoted DC). Degrades authentication for all domain clients. Confirmed root cause of 2026-04-22 remote join failure.
|
||||
|
||||
**Documentation cleanup (Manda rollout)**
|
||||
- [ ] Update `docs/overview.md` Speedway workstation table with `DESKTOP-KRHQ5TS` / Manda / AIM `USER#=4` entry
|
||||
- [ ] Confirm Manda's full name in AD; add to overview/contacts
|
||||
|
||||
**Pre-existing**
|
||||
- [ ] Decide Server 2019 migration path (in-place upgrade vs. clean build + migrate)
|
||||
- [ ] Verify Cloudberry backup continuity
|
||||
- [ ] Drop `TestConv61223` DB after confirming nothing references it
|
||||
- [ ] Disable SMB1 on IMC1
|
||||
- [ ] Add IMC vault entry for SSH/SQL/domain credentials
|
||||
- [ ] Clean up stale AD computer objects `IMC2` (last logon 2023), `IMC-VM` (last logon 2021)
|
||||
- [ ] Follow up on disk management items from 2026-04-13 session
|
||||
|
||||
---
|
||||
@@ -63,6 +79,8 @@ Music retail + repair shop running AIMsi POS on-prem. Primary server IMC1 (Dell
|
||||
|
||||
| Date | By | Change | Status |
|
||||
|------|-----|--------|--------|
|
||||
| 2026-04-28 | Howard | Provisioned `DESKTOP-KRHQ5TS` for Manda (new GM): joined to imc.local onsite, AD account created, Outlook M365 configured, Office activated, AIMsi `USER#=4` per Leslie. Ticket #32218 invoiced, 1.5 hrs from prepay (14.0 → 12.5). Confirmed `ServerIMC` (192.168.0.63) is a real authentication-degrading phantom DC (SRV/A claim DC, LDAP/Kerberos refuse). | DEPLOYED |
|
||||
| 2026-04-22 | Howard | Attempted remote domain-join of `DESKTOP-KRHQ5TS` over OpenVPN — abandoned after subnet overlap (home Wi-Fi same /24 as IMC) + phantom-DC SRV pollution defeated NRPT/hosts/locator workarounds. Went onsite instead (see 2026-04-28 entry). | ABANDONED |
|
||||
| 2026-04-12 | Mike | IMC1 cleanup and SQL move: AIMsi DBs moved to S: SSD, backup script + retention task deployed, sysadmin access restored | DEPLOYED |
|
||||
|
||||
---
|
||||
|
||||
Reference in New Issue
Block a user