From c72048d4d7d015384e25d46d24e169c757fc7bca Mon Sep 17 00:00:00 2001 From: Howard Enos Date: Fri, 10 Jul 2026 17:43:34 -0700 Subject: [PATCH] =?UTF-8?q?wiki:=20goldstein=20=E2=80=94=20DALLAS=20MSA->l?= =?UTF-8?q?ocal=20account=20via=20ProfWiz=20fixed=20RDP=20(Mike)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- wiki/clients/goldstein.md | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/wiki/clients/goldstein.md b/wiki/clients/goldstein.md index fee2e404..a45bb79e 100644 --- a/wiki/clients/goldstein.md +++ b/wiki/clients/goldstein.md @@ -10,6 +10,7 @@ sources: - clients/goldstein/onboarding-baselines/DALLAS-20260706T233936.md - clients/goldstein/session-logs/2026-07/2026-07-10-howard-openvpn-remote-access-sitemagic.md - Live UniFi Site Manager + GuruRMM investigation 2026-07-10 (tickets #32490, #32384) + - Howard report 2026-07-10 — DALLAS MSA->local account via ProfWiz (Mike) to fix RDP backlinks: [] --- @@ -108,7 +109,7 @@ part of the move to OpenVPN. ### Endpoints | Host | Site | IP (RDP target) | Role / Notes | |---|---|---|---| -| **DALLAS** | Dallas | **192.168.1.226** (Wi-Fi) | Michelle's Lenovo Yoga Slim 7 (`Dallas\miche`), Win 11 **Pro for Workstations** (upgraded from Home 2026-07-07, MAK). **RDP host** (fDenyTS=0, NLA, TermService Auto). Public 99.127.21.4. Modern-Standby — kept AC-no-sleep. The machine staff RDP **into**. Agent `36c7bbc8-504f-4b4a-8995-3b3e5cdc0f02`; SC `29c62473-a5cb-4e94-a190-c91f05031809`. | +| **DALLAS** | Dallas | **192.168.1.226** (Wi-Fi) | Michelle's Lenovo Yoga Slim 7, Win 11 **Pro for Workstations** (upgraded from Home 2026-07-07, MAK). **RDP host** (fDenyTS=0, NLA, TermService Auto). Public 99.127.21.4. Modern-Standby — kept AC-no-sleep. The machine staff RDP **into**. **Login account: local `Dallas\miche`, NO password — migrated from a Microsoft account via ProfWiz (Mike, 2026-07-10) because the MSA login was BLOCKING RDP; RDP verified working after.** Agent `36c7bbc8-504f-4b4a-8995-3b3e5cdc0f02`; SC `29c62473-a5cb-4e94-a190-c91f05031809`. | | **DalRes10** | Tucson | **10.1.10.170** (Wi-Fi) | Sheldon's desktop. **RDP host** (fDenyTS=0, NLA) — but **TermService StartType = Manual** (won't auto-start RDP after reboot). Target IP is on **Wi-Fi** (also Ethernet 10.10.1.149 on a *different* segment) so RDP reachability tracks Wi-Fi. Agent `81cde315-013b-4acd-80d7-5ec2b9b5f084`. | | **ASUS-2024** | Dallas (tag) | roams — Cox `192.168.0.200` when on `Gold-Scop` | **Roaming laptop (Michelle, user `miche`).** Has the OpenVPN client + RDP shortcuts to both targets. Agent `f50b17c1-a711-4e80-89c2-03cb630f5622`; SC `cfddaed7-b6b9-463c-b210-384dec88e0f8`. | | **GS-Backup** | Tucson | — | Tucson box (name implies backup). Agent `4f52ef22-89ae-4124-a2b4-d339aaf42f53`. | @@ -132,6 +133,11 @@ part of the move to OpenVPN. - **DalRes10 target IP is on Wi-Fi** and **TermService is Manual** — RDP can vanish if Wi-Fi drops or after a reboot until the service is started. - **No backup agent** detected on DALLAS (2026-07-06) — confirm cloud/local backup need. +- **Microsoft-account login blocked RDP on DALLAS** — RDP/NLA against an MSA-backed account + failed to authenticate. Fixed by migrating the profile to a **local account (no password)** + with **ProfWiz** (ForensiT User Profile Wizard). Pattern: for RDP hosts, prefer a local + account over a Microsoft/Azure-AD account. (A blank-password local account only accepts RDP + if `LimitBlankPasswordUse` is disabled — verify that policy if a no-password RDP host recurs.) ## Active Work *No open tickets in Syncro as of 2026-07-10 (#32384 "Remote - Issues with remote access" is @@ -147,6 +153,8 @@ Resolved/invoiced). Break-fix, no prepaid block. Follow-ups below are open work, - **Billing:** OpenVPN remote-access work (2026-07-10) not yet billed — confirm with Mike. ## History Highlights +- **2026-07-10** — DALLAS RDP fix: the machine was on a **Microsoft account** which blocked RDP; + **Mike migrated it to a local account (no password) with ProfWiz** and verified everything works. - **2026-07-10** — Stood up OpenVPN remote access (both UCGs, RADIUS, users Michelle/Sheldon); mapped the full UniFi/Site-Magic topology; confirmed Site Magic is LAN-only + locked; DALLAS offsite RDP working; DalRes10 taken offline by a stray WireGuard tunnel (pending console fix).