azcomputerguru/claudetools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sync: auto-sync from HOWARD-HOME at 2026-07-09 20:26:12

Browse Source 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-09 20:26:12
This commit is contained in:
Howard Enos
2026-07-09 20:26:40 -07:00
parent 2fba62b7df
commit bf95a10685
3 changed files with 79 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

48
clients/cascades-tucson/session-logs/2026-07/2026-07-09-howard-charity-menle-caregiver-rename.md
View File

@@ -140,3 +140,51 @@ alis: error: unrecognized arguments: --json # --json is a global flag: al
- Prior art / why rename-not-recreate: `clients/cascades-tucson/reports/2026-07-01-caretaker-roster-update.md` (the `t.lassey-assiakoley` duplicate), and `clients/cascades-tucson/scripts/create-caregiver-accounts.ps1:11` (`b.sika -- Charity Sika (legal first name Bariffa drives the initial)`).
- Forced-change / `50126` phone-login rule and `PSO-Caregivers` rationale: `wiki/clients/cascades-tucson.md`, sections "Caregiver phone login -- forced-change-at-next-logon gotcha" and "Caregiver password expiry".
- New wiki section written this session: "Caregiver name changes -- rename, never re-create (Charity Menle, 2026-07-09)".
---
## Update: 19:45 UTC -- Android shared-phone enrollment (new phone) + token replace
(Timestamps in UTC. `now-phoenix.sh` returned `20:23 PT` against a real UTC time of `19:43` -- not a valid UTC-7 offset, so local time was not trusted for this entry. Same class of bug as the `GURU-BEAST-ROG` TZ friction entry in `errorlog.md` from the same day.)
### What happened
Howard needed to enroll additional Samsung shared caregiver phones. The vaulted Intune Android enrollment token was **stale** (`MVDVVDMPSHYJAGDAJOCN`, old profile `CSC - Android Shared Phones`, expired 2026-06-22). The live profile turned out to be `CSC - Android Shared Phones (Entra SDM)` (`9a0fcc6d-0a88-466e-aa53-44401bb74fca`), whose QR was pulled live from Graph and vaulted as `clients/cascades-tucson/intune-android-enrollment-token.sops.yaml`.
That token (`KJCFJUWKRCOGATEHBTGYJZXM`) was then **rejected by Google at redemption** -- the phone displayed "checking code" then an error telling the user to contact IT -- even though Graph reported it valid through 2027-05-08 and the Managed Google Play binding was `boundAndValidated` with a successful app sync that morning. Howard fixed it in the Intune portal with **Replace Token** (not Revoke, which would leave the profile with no usable token). The replacement token carries an expiry of **2091-07-10** (~65 years) and enrolled a phone immediately.
Enrollment then succeeded: `CSC-R9TX70L693H` (serial `R9TX70L693H`), enrolled 18:33:52Z, `androidEnterpriseDedicatedDevice` / `googleCloudDevicePolicyController`, company-owned, encrypted, one Intune record and one Entra object (no duplicates). It joined the dynamic group `Cascades - Shared Phones` within ~3 minutes and both config profiles reported applied by 18:41.
The phone never became usable. Apps (Managed Home Screen, Alis) installed and uninstalled repeatedly -- six-plus cycles observed by Howard on the handset. Intune-side configuration was exhaustively verified as correct and was **not** the cause. The device stopped checking in at **18:51:26Z** and never resumed across a 52-minute poll. **Howard swapped the handset out; he reports this phone had known prior issues.** Root cause was never established from the tenant side, and Graph exposes no app-install state for these devices.
### What was verified correct (so it can be ruled out next time)
- `kioskModeApps` (9) and `kioskModeWallpaperUrl` are set on `CSC - Android Shared Phones Restrictions` (`070a76c2-a8c3-4f7f-9ba7-1f4ac5084184`), and `kioskModeUseManagedHomeScreenApp: multiAppMode`.
- All 10 Android apps are assigned `required` to the shared-phone group. **No `uninstall` intent anywhere; no duplicate packageIds.**
- `playStoreMode: notConfigured`; `proxySettings: none` on the CSCNet Wi-Fi profile.
- Group membership stable; `enrollmentProfileName` present on the Entra device object.
- Eleven identical phones (same models) run this exact config and check in daily.
### Two Graph fields that are NOT evidence (both burned me this session)
- **`freeStorageSpaceInBytes` / `totalStorageSpaceInBytes` are not collected for Android Enterprise dedicated devices.** Every one of the 26 phones reports `free = 0` and an implausible `total` (4.54 / 5.38 GB). I read `0` as "out of storage" and told Howard the phone was full and was the wrong model. **Both claims were false** -- he was looking at 15 GB used of 64 GB, and `SM-S146VL` is 9 of the 26 phones including working ones. Never treat a zero here as a measurement.
- **`detectedApps` is empty on ALL these devices**, including phones that sync daily. It is not an app-inventory source for COSU. Do not use it to conclude an app did or did not install.
The only trustworthy device-side signal available from Graph is **`lastSyncDateTime`** plus `deviceConfigurationStates`.
### Fleet observation (not acted on, Howard's answer recorded)
Of 26 Android device records, 15 last synced within a day of enrollment (May 11-18) and never again; 11 sync daily. Howard confirmed: **14 of the phones are simply powered off.** Not a fault. Two records (`CSC-R92W60LRA8Z`, `CSC-R9TW20DGYKF`) are duplicate objects from re-enrollment; 22 unique physical phones + the new one. `samsungSM-F731U` in the Android list is John Trozzi's personal Galaxy Z Flip 5, `trustType: Workplace` BYOD -- correctly outside the profile and group, not a shared phone.
### Configuration changes
- **Intune (via portal, by Howard):** enrollment token on profile `9a0fcc6d` replaced. Nothing else changed. Profile name, dynamic group rule, and the enrolled phones were deliberately left untouched.
- **Vault:** `clients/cascades-tucson/intune-android-enrollment-token.sops.yaml` created, then updated with the post-Replace token + `token_expires: 2091-07-10` + a `token_replaced` note. Verified encrypted (8 `ENC[]` fields; token absent from plaintext; all 37 Cascades entries scanned clean).
- **No brightness change was applied.** `show_brightness_slider` / `show_adaptive_brightness_toggle` exist in the Managed Home Screen schema and both default `False`, which is why caregivers cannot adjust brightness. Applying them requires editing the group-targeted app config `CSC - MHS layout` (`27683709-7b78-4b52-9c53-bb4401955bbf`) -- **Intune has no per-device app config**, and a second app config for the same app on one device is a conflict. Left unapplied at Howard's direction.
### Pending
- **Brightness**: add `show_brightness_slider=true` (+ optionally `show_adaptive_brightness_toggle`, `show_volume_setting`) to the existing `payloadJson` on app config `27683709`, keeping `screen_orientation` / `set_grid_size` / `lock_home_screen`. Snapshot `payloadJson` first for rollback. Fleet-wide by necessity.
- **Bad handset `CSC-R9TX70L693H`** swapped out. Its stale Intune record + Entra object should be cleaned up so it doesn't join the duplicate pile.
- Stray **`Microsoft Launcher`** (`com.microsoft.launcher`, consumer launcher) sits in the tenant app list unassigned. Harmless now; if ever assigned it would fight Managed Home Screen. Worth deleting.
- Enrollment of the replacement phone(s) not yet observed.