sync: auto-sync from HOWARD-HOME at 2026-07-04 18:08:15

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-04 18:08:15

projects/gps-rmm-audit/session-logs/2026-07/2026-07-03-howard-gps-rmm-coverage-audit.md

@@ -242,3 +242,7 @@ Remaining no-SC (come-back): offline Windows (DESKTOP-KQSL232, DF-D2-Training-LT
 ## Update: Phase 4 kickoff — AV coverage matrix (2026-07-04 evening)
 
 Built the AV coverage matrix: GPS billed qty vs RMM vs Bitdefender vs Datto EDR per client. Join key discovery: BD company names end with _<syncro customer id> = exact cid match against targets.json (fuzzy-name matching had false NO-AV for reversed names like Sheila Heieck). Results in tracker.md Phase 4 section: 9 clients / 22 paid devices with NO AV visible; 7 partial; EDR fleet = 14 orgs (Default RMM Org has 35 unassigned agents - cleanup); AV migration scope = 27 clients / 141 BD endpoints (excl Glaztech 242 + Dataforth). Glaz-Tech BD 242 vs 159 GPS billed feeds the anomaly item. Remaining Phase 4: backup verification (B2/MSP360 vs billed backup lines), email.
+
+## Update: EDR Default-org attribution (2026-07-04 night)
+
+Dismantled Datto EDR "Default RMM Org": discovered its 23 Locations were already client-named (IMC - Speedway 10 agents, Putt 4, Reliant 4, Russo 2, etc.) - agents attributed at Location level, wrong org umbrella. Fix = re-parent Locations to per-client Organizations. Verified mechanics with [TEST] org+location first (POST /Organizations, POST /Locations, PATCH /Locations/{id} {organizationId}, DELETE both - all work; LoopBack undocumented endpoints). Executed: 18 orgs created, 21 locations re-parented (Glaztech-ALB and ACG locs to existing orgs), 0 failures. GOTCHAS: edr.py orgs agent/site counts are stale rollups after re-parenting (trust GET /Locations); one raw GET ignored the --filter (returned all 42) - verify with unfiltered fetch + group-by. Default org now = OnDemand(0)+Managed(0) only. Revised AV gap list in tracker (8 clients / 20 devices NO-AV; Andy's Mobile Fuel cleared).