azcomputerguru/claudetools
1
0
Fork 0
Code Issues 73 Pull Requests Actions Packages Projects Releases Wiki Activity

sync: auto-sync from HOWARD-HOME at 2026-06-05 16:17:06

Browse Source 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-06-05 16:17:06
This commit is contained in:
Howard Enos
2026-06-05 16:17:15 -07:00
parent 18250eb7c2
commit be30af771f
3 changed files with 174 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

54
clients/cascades-tucson/session-logs/2026-06-05-session.md
View File

@@ -173,3 +173,57 @@ Entra Connect syncs USERS (PHS + Seamless SSO) — that's set up. **Hybrid Azure
- [ ] GPO for caregiver devices: disable Windows Hello (`Use Windows Hello for Business`=Disabled), idle screen-lock (machine inactivity limit), security baseline; folder handling so no local data.
- [ ] Users sign in with **email/UPN** (works on domain/hybrid devices since UPN suffix = cascadestucson.com). Each caregiver uses their OWN account (shared device, individual logins) — required for ALIS SSO email-match + audit.
- [ ] Resume per-user testing via `SG-Caregivers-DeviceTest`, then promote to `SG-Caregivers`.
## Update: 16:14 MST — Hybrid join COMPLETE + ALIS SSO validated end-to-end; caregiver GPO build in progress
### MILESTONE: NURSESTATION hybrid-joined, pilot.test ALIS SSO works on a desktop
The whole hybrid pivot is proven on one machine:
- Added `OU=Caregiver Devices,OU=Staff PCs,OU=Workstations` to the **Entra Connect sync scope** (Optional features left as-is: PHS + Password writeback on; Group writeback + Device writeback OFF — neither is needed for Hybrid Join). Ran `Start-ADSyncSyncCycle` (a full sync was already auto-running from the wizard "Configure"); all connector runs **success**.
- NURSESTATION computer object synced to Entra as **`trustType: ServerAd`** (= Hybrid Entra Join). New **deviceId `d3bf931f-f128-4261-8398-b46c34a4b342`** (object id `de199a15-3f5d-4da3-8b17-3faade7f7dad`).
- On reboot, client-side join completed: `dsregcmd /status` → **AzureAdJoined: YES, DomainJoined: YES (CASCADES)**, DeviceAuthStatus SUCCESS, TpmProtected YES.
- As **pilot.test** (non-elevated `dsregcmd`): **AzureAdPrt: YES** → PRT issued, silent SSO chain complete. **ALIS opened via silent SSO — no second credential prompt. Full caregiver desktop experience validated.**
- `Ngc Prerequisite Check` = `PolicyEnabled: NO` → `WillNotProvision` = **Windows Hello will NOT auto-provision** on hybrid-joined machines (PIN/Hello popup does not appear). This is the behavior we want for shared caregiver devices — no separate Hello-disable step needed on the hybrid path.
### Allow-list CA rule updated to the NEW deviceId (the old one was stale)
Removing Entra + re-domain-joining created a brand-new device object. Old Entra-joined deviceId `e16c4af5-cb0e-49e1-90be-674a216f5e9c` no longer exists in Entra (confirmed empty lookup).
- Policy `CSC - Caregivers: allow-listed devices only (TEST GROUP)` (`1b7fd025-1aad-47c8-9274-c32c3e0b163c`, deviceFilter mode=**exclude** = allow-list) rule now:
`(device.displayName -startsWith "CSC-") -or (device.extensionAttribute1 -eq "CSCCaregiverDevice") -or (device.deviceId -eq "d3bf931f-f128-4261-8398-b46c34a4b342")`
- Also tagged the device `extensionAttribute1 = CSCCaregiverDevice` (durable; survives future deviceId changes). NURSESTATION now allow-listed by deviceId (lag-free) AND tag.
- Reminder (Graph): PATCH returns 204 then read-back lags a few seconds (replication) — re-read to confirm.
### Reception-policy false alarm (resolved, no change made)
`CSC - Reception Workstation Policy` showed as "inherited" by `OU=Caregiver Devices` (it's linked at parent `OU=Staff PCs`), but its **security filtering is `GpoApply: SG-Reception-PCs` only**, and that group contains **only RECEPTIONIST-PC**. So it never applies to NURSESTATION. Nothing unlinked. (`Get-GPInheritance` lists in-scope links before security filtering.)
### NEW WORK: proper GPO for all caregivers/medtechs (shortcuts + printers) — IN PROGRESS
Decision (per Howard): do NOT place shortcuts/printers manually — build a real, scalable GPO driven by the SG/OU structure ("how a medical company should work"), and **mirror it in a test scope (pilot.test only) so the 38 real caregivers are untouched** until validated.
**Discovery:**
- **CS-SERVER is the print server** (15 shared queues `\\CS-SERVER\<share>`).
- `SG-Caregivers` = real on-prem Global Security group, **38 members**, `OU=Groups` — same group synced to Entra for the CA policies (one group drives GPO + CA).
- All 38 caregivers live in `OU=Caregivers,OU=Departments` (42 users total there; others: c.lassey, p.sandoval-beck [likely medtechs to add], n.castro [TERMINATED], pilot.test).
- pilot.test DN = `CN=Pilot Test,OU=Caregivers,OU=Departments` (correct OU), no on-prem groups.
- Existing printer GPOs: `CSC - Life Enrichment Printers` (WORKING, linked to OU=Life Enrichment) and **`CSC - Printer Deployment` which is BROKEN** — it has a full User Printers.xml (all departments, ILT by OU/group) but **`gPCUserExtensionNames` is EMPTY and `versionNumber=0`**, so the CSE is unregistered and it never applies even if linked. (It also has a bug: the NursesPrinter entry path is `\CS-SERVER\NursesPrinter` — single backslash. Worth fixing/retiring this GPO separately.)
**Proven GPP schema cloned from this domain (for the new GPO):**
- Working `gPCUserExtensionNames` for **Printers** = `[{00000000-0000-0000-0000-000000000000}{A8C42CEA-CDB8-4388-97F4-5831F933DA84}][{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}{A8C42CEA-CDB8-4388-97F4-5831F933DA84}]` (tool-ext GUID this domain uses = `{A8C42CEA-CDB8-4388-97F4-5831F933DA84}`).
- To ADD **Shortcuts** CSE, append `[{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}{A8C42CEA-CDB8-4388-97F4-5831F933DA84}]` (CSE GUIDs stay sorted: 00000000 < BC75 < C418). Must also bump `versionNumber`.
- Printers.xml: `<Printers clsid="{1F577D12-...}">` → `<SharedPrinter clsid="{9A5E9697-9095-436d-A0EE-4D128FDFBCE5}" name="\\CS-SERVER\<share>" ...><Properties action="U|C" path="\\CS-SERVER\<share>" default="0|1" skipLocal="1" ...><Filters>...</Filters></Properties></SharedPrinter>`. **Filters go INSIDE `<Properties>`.** `FilterGroup ... userContext="1"` = check USER's group; **`userContext="0"` = check COMPUTER's group** (this is how device-location default targeting works).
**GROUPS CREATED this session (in `OU=Groups`):**
- `SG-Caregivers-Test` — GPO security-filter for the pilot. Member: **pilot.test** only. (Go-live = swap filter to `SG-Caregivers`.)
- `SG-PC-MainTower` — caregiver DEVICE location = main tower / assisted living. Member: **NURSESTATION-PC**. Drives default-printer = Nurses via ILT (computer context).
- `SG-PC-MemoryCare` — caregiver DEVICE location = memory care. Empty (ready). Drives default-printer = MC MedTech.
**Design — GPO `CSC - Caregiver Workstation` (User config GPP), NOT YET CREATED:**
- Shortcuts (Desktop): **ALIS** `https://cascadestucson.alisonline.com/Login`, **LinkRx** `https://pharmcare.linkrxnow.com/Login.aspx`, **Safe Living** `https://app.safe-living.com/login`. (Existing ALIS/LinkRx today are per-profile `.url` files placed manually — this GPO replaces that.)
- Printers (Howard-approved set, all `\\CS-SERVER\`): `NursesPrinter`, `HealthServices`, `MCMedTech`, `MCReception`, `MCDirector`, `CopyRoom` — deployed to all (no filter). Plus conditional default via two extra `default="1"` entries with ILT: `NursesPrinter` when computer ∈ `SG-PC-MainTower`; `MCMedTech` when computer ∈ `SG-PC-MemoryCare` (`userContext="0"`).
- Link at `OU=Caregivers,OU=Departments`; **security filter = `SG-Caregivers-Test`** (remove Authenticated Users Apply) so only pilot.test applies it; 38 real caregivers see it in scope but filtered out = zero impact.
- Set `gPCUserExtensionNames` (printers+shortcuts CSEs), bump version, set Computer-side disabled.
### Next steps (resume here)
- [ ] Create GPO `CSC - Caregiver Workstation`; write `User\Preferences\Printers\Printers.xml` + `User\Preferences\Shortcuts\Shortcuts.xml`; set `gPCUserExtensionNames` + bump `versionNumber`.
- [ ] Link at `OU=Caregivers,OU=Departments`; set security filtering to `SG-Caregivers-Test` only.
- [ ] Test on NURSESTATION as pilot.test: `gpupdate /force` → logoff/logon → verify 3 desktop shortcuts + 6 printers mapped + Nurses default.
- [ ] When validated: swap GPO filter `SG-Caregivers-Test` → `SG-Caregivers`; for CA, promote allow-list policy from test group to `SG-Caregivers`; move real caregiver machines into `OU=Caregiver Devices` + correct `SG-PC-*` location group one at a time; ALIS email-match the 38 + medtechs.
- [x] `CSC - Printer Deployment` (domain-wide, empty CSE/version 0) is **intentionally not enabled and is NOT to be used domain-wide** (per Howard). Leave it alone — do not link, enable, or "fix" it. Our entire scope is the single caregiver/medtech GPO. It's useful only as a read-only reference for printer shares/ILT examples.
- [ ] Microsoft case for `INTUNE_A PendingInput` (independent — does NOT block caregiver access; the hybrid+GPO path replaces the Intune dependency).