sync: auto-sync from GURU-5070 at 2026-06-11 08:00:04

Author: Mike Swanson Machine: GURU-5070 Timestamp: 2026-06-11 08:00:04
2026-06-11 08:00:19 -07:00
parent 23299a661e
commit cfc065b097
14 changed files with 186 additions and 483 deletions
--- a/clients/wolkin/onboarding-baselines/FRONT-20260606T133142.json
+++ b/clients/wolkin/onboarding-baselines/FRONT-20260606T133142.json
@@ -0,0 +1,701 @@
+{
+  "host": "FRONT",
+  "collected_at_utc": "2026-06-06T13:30:54Z",
+  "os": {
+    "caption": "Microsoft Windows 11 Home",
+    "version": "10.0.26200",
+    "build": "26200",
+    "install_date": "2025-09-30T12:42:52Z",
+    "last_boot_utc": "2026-05-27T07:31:35Z",
+    "architecture": "64-bit"
+  },
+  "facts": {
+    "builtin_admin_enabled": false,
+    "os_eol": {
+      "eol_date": "2027-10-12",
+      "release": "Win11 25H2"
+    },
+    "pending_updates": 4,
+    "pending_reboot": true,
+    "uptime_days": 10.2,
+    "acg_managed_tools": "ScreenConnect / ConnectWise Control",
+    "hardware": {
+      "model": "ASUS P500MV_V500MVC",
+      "manufacturer": "ASUSTeK COMPUTER INC.",
+      "bios_date": "2025-06-23",
+      "cpu_logical": 12,
+      "bios_version": "P500MV.324",
+      "cpu_cores": 8,
+      "ram_gb": 15.6,
+      "serial": "T7PFAG00B454281",
+      "cpu": "13th Gen Intel(R) Core(TM) i5-13420H"
+    },
+    "third_party_av_active": false,
+    "os_build": "26200",
+    "secure_boot": true,
+    "backup_agents": null,
+    "autoruns_run_keys": [
+      {
+        "key": "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
+        "name": "SecurityHealth",
+        "value": "C:\\WINDOWS\\system32\\SecurityHealthSystray.exe"
+      },
+      {
+        "key": "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
+        "name": "RtkAudUService",
+        "value": "\"C:\\WINDOWS\\System32\\DriverStore\\FileRepository\\realtekservice.inf_amd64_7a71ba2a71a6f3c2\\RtkAudUService64.exe\" -background"
+      },
+      {
+        "key": "HKLM:\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run",
+        "name": "Dropbox",
+        "value": "\"C:\\Program Files (x86)\\Dropbox\\Client\\Dropbox.exe\" /systemstartup"
+      },
+      {
+        "key": "HKLM:\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run",
+        "name": "Adobe CCXProcess",
+        "value": "C:\\Program Files (x86)\\Adobe\\Adobe Creative Cloud Experience\\CCXProcess.exe"
+      },
+      {
+        "key": "HKLM:\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run",
+        "name": "Adobe Creative Cloud",
+        "value": "\"C:\\Program Files\\Adobe\\Adobe Creative Cloud\\ACC\\Creative Cloud.exe\" --showwindow=false --onOSstartup=true"
+      },
+      {
+        "key": "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce",
+        "name": "Delete Cached Update Binary",
+        "value": "C:\\WINDOWS\\system32\\cmd.exe /q /c del /q \"C:\\Program Files\\Microsoft OneDrive\\Update\\OneDriveSetup.exe\""
+      },
+      {
+        "key": "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce",
+        "name": "Delete Cached Standalone Update Binary",
+        "value": "C:\\WINDOWS\\system32\\cmd.exe /q /c del /q \"C:\\Program Files\\Microsoft OneDrive\\StandaloneUpdater\\OneDriveSetup.exe\""
+      }
+    ],
+    "physical_disks": [
+      {
+        "health": "Healthy",
+        "model": "CT1000P3PSSD8",
+        "media_type": "SSD"
+      }
+    ],
+    "local_users": [
+      {
+        "last_logon": "",
+        "name": "Administrator",
+        "password_never_expires": false,
+        "enabled": false
+      },
+      {
+        "last_logon": "",
+        "name": "DefaultAccount",
+        "password_never_expires": false,
+        "enabled": false
+      },
+      {
+        "last_logon": "",
+        "name": "Guest",
+        "password_never_expires": false,
+        "enabled": false
+      },
+      {
+        "last_logon": "2026-06-05",
+        "name": "Localadmin",
+        "password_never_expires": false,
+        "enabled": true
+      },
+      {
+        "last_logon": "2026-01-09",
+        "name": "Owner",
+        "password_never_expires": false,
+        "enabled": true
+      },
+      {
+        "last_logon": "",
+        "name": "WDAGUtilityAccount",
+        "password_never_expires": false,
+        "enabled": false
+      },
+      {
+        "last_logon": "2025-12-11",
+        "name": "WsiAccount",
+        "password_never_expires": false,
+        "enabled": false
+      }
+    ],
+    "scheduled_tasks_count": 22,
+    "volumes": [
+      {
+        "drive": "C:",
+        "size_gb": 930.6,
+        "free_pct": 57.5,
+        "free_gb": 534.7
+      },
+      {
+        "drive": "[unlabeled]",
+        "size_gb": 0.1,
+        "free_pct": 27.6,
+        "free_gb": 0
+      },
+      {
+        "drive": "[unlabeled]",
+        "size_gb": 0.8,
+        "free_pct": 14.1,
+        "free_gb": 0.1
+      }
+    ],
+    "network_adapters": [
+      {
+        "dhcp": true,
+        "description": "Intel(R) Ethernet Connection (16) I219-V",
+        "gateway": [
+          "192.168.1.1",
+          "fe80::7690:bcff:fead:c6c5"
+        ],
+        "mac": "A0:AD:9F:95:C4:01",
+        "ip": [
+          "192.168.1.153",
+          "fe80::12de:34bc:e5b4:3089",
+          "2600:1011:a03d:3fca:95fc:53:683e:6871",
+          "2600:1011:a03d:3fca:5b1c:75e9:fa33:f3f6"
+        ],
+        "dns": [
+          "192.168.1.1"
+        ]
+      }
+    ],
+    "failed_autostart_services": [
+      {
+        "name": "DropboxUpdaterInternalService123.0.6299.144",
+        "display": "DropboxUpdater InternalService 123.0.6299.144 (DropboxUpdaterInternalService123.0.6299.144)",
+        "state": "Stopped"
+      },
+      {
+        "name": "DropboxUpdaterService123.0.6299.144",
+        "display": "DropboxUpdater Service 123.0.6299.144 (DropboxUpdaterService123.0.6299.144)",
+        "state": "Stopped"
+      },
+      {
+        "name": "gpsvc",
+        "display": "Group Policy Client",
+        "state": "Stopped"
+      },
+      {
+        "name": "Intel(R) Platform License Manager Service",
+        "display": "Intel(R) Platform License Manager Service",
+        "state": "Stopped"
+      },
+      {
+        "name": "GoogleUpdaterInternalService150.0.7863.0",
+        "display": "Google Updater Internal Service (GoogleUpdaterInternalService150.0.7863.0)",
+        "state": "Stopped"
+      },
+      {
+        "name": "GoogleUpdaterService150.0.7863.0",
+        "display": "Google Updater Service (GoogleUpdaterService150.0.7863.0)",
+        "state": "Stopped"
+      }
+    ],
+    "stability_14d": {
+      "unexpected_shutdowns": 0,
+      "disk_errors": 2,
+      "bugchecks": 0
+    },
+    "exposure": {
+      "smb1_enabled": false,
+      "laps_present": true,
+      "rdp_enabled": false,
+      "uac_enabled": true,
+      "rdp_nla": true
+    },
+    "accounts_password_never_expires": [],
+    "installed_software": [
+      {
+        "publisher": "Adobe",
+        "name": "Adobe Acrobat (64-bit)",
+        "version": "26.001.21563"
+      },
+      {
+        "publisher": "Adobe Inc.",
+        "name": "Adobe Creative Cloud",
+        "version": "6.9.1.1.3"
+      },
+      {
+        "publisher": "Adobe Systems Incorporated",
+        "name": "Adobe Refresh Manager",
+        "version": "1.8.0"
+      },
+      {
+        "publisher": "Microsoft Corporation",
+        "name": "Copilot",
+        "version": "148.0.3967.96"
+      },
+      {
+        "publisher": "Dropbox, Inc.",
+        "name": "Dropbox",
+        "version": "254.4.2518"
+      },
+      {
+        "publisher": "Dropbox, Inc.",
+        "name": "Dropbox Update Helper",
+        "version": "1.3.983.1"
+      },
+      {
+        "publisher": "OEM",
+        "name": "Generic Local Scan 1.7.8 Scan Driver",
+        "version": "1.7.8.0"
+      },
+      {
+        "publisher": "Google LLC",
+        "name": "Google Chrome",
+        "version": "148.0.7778.217"
+      },
+      {
+        "publisher": "Logitech",
+        "name": "Logitech Solar App 1.10",
+        "version": "1.10.3"
+      },
+      {
+        "publisher": "Microsoft Corporation",
+        "name": "Microsoft 365 - en-us",
+        "version": "16.0.20026.20112"
+      },
+      {
+        "publisher": "Microsoft Corporation",
+        "name": "Microsoft Edge",
+        "version": "148.0.3967.96"
+      },
+      {
+        "publisher": "Microsoft Corporation",
+        "name": "Microsoft Edge WebView2 Runtime",
+        "version": "148.0.3967.96"
+      },
+      {
+        "publisher": "Microsoft Corporation",
+        "name": "Microsoft OneDrive",
+        "version": "26.088.0510.0004"
+      },
+      {
+        "publisher": "Microsoft Corporation",
+        "name": "Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.44.35211",
+        "version": "14.44.35211.0"
+      },
+      {
+        "publisher": "Microsoft Corporation",
+        "name": "Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.44.35211",
+        "version": "14.44.35211.0"
+      },
+      {
+        "publisher": "Microsoft Corporation",
+        "name": "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.44.35211",
+        "version": "14.44.35211"
+      },
+      {
+        "publisher": "Microsoft Corporation",
+        "name": "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.44.35211",
+        "version": "14.44.35211"
+      },
+      {
+        "publisher": "Microsoft Corporation",
+        "name": "Microsoft Visual C++ 2022 X86 Additional Runtime - 14.44.35211",
+        "version": "14.44.35211"
+      },
+      {
+        "publisher": "Microsoft Corporation",
+        "name": "Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.44.35211",
+        "version": "14.44.35211"
+      },
+      {
+        "publisher": "Mozilla",
+        "name": "Mozilla Firefox (x64 en-US)",
+        "version": "143.0.1"
+      },
+      {
+        "publisher": "Mozilla",
+        "name": "Mozilla Maintenance Service",
+        "version": "143.0.1"
+      },
+      {
+        "publisher": "Sharp",
+        "name": "My Sharp MICAS Agent",
+        "version": "1.0.0"
+      },
+      {
+        "publisher": "Microsoft Corporation",
+        "name": "Office 16 Click-to-Run Extensibility Component",
+        "version": "16.0.20026.20076"
+      },
+      {
+        "publisher": "OEM",
+        "name": "Printer Network Twain Scan Driver",
+        "version": "1.31.191.0"
+      },
+      {
+        "publisher": "OEM",
+        "name": "Printer Universal Fax Driver",
+        "version": "3.0.11.0"
+      },
+      {
+        "publisher": "OEM",
+        "name": "Printer Universal v2 XL Print Driver",
+        "version": "3.0.13.0"
+      },
+      {
+        "publisher": "ScreenConnect Software",
+        "name": "ScreenConnect Client (1912bf3444b41a08)",
+        "version": "26.1.24.9579"
+      },
+      {
+        "publisher": "Printer",
+        "name": "Windows Driver Package - Printer Printer  (01/10/2016 3.0.13.0)",
+        "version": "01/10/2016 3.0.13.0"
+      },
+      {
+        "publisher": "Printer",
+        "name": "Windows Driver Package - Printer Printer  (10/02/2015 3.0.11.0)",
+        "version": "10/02/2015 3.0.11.0"
+      }
+    ],
+    "tpm": {
+      "enabled": true,
+      "ready": true,
+      "present": true
+    },
+    "local_groups": [
+      "Administrators",
+      "Device Owners",
+      "Distributed COM Users",
+      "Event Log Readers",
+      "Guests",
+      "Hyper-V Administrators",
+      "IIS_IUSRS",
+      "OpenSSH Users",
+      "Performance Log Users",
+      "Performance Monitor Users",
+      "Remote Management Users",
+      "System Managed Accounts Group",
+      "User Mode Hardware Operators",
+      "Users"
+    ],
+    "battery": {
+      "present": false
+    },
+    "activation": {
+      "edition": "Microsoft Windows 11 Home",
+      "description": "Windows(R) Operating System, OEM_DM channel",
+      "licensed": true,
+      "license_status_code": 1
+    },
+    "time_source": "The following error occurred: The service has not been started. (0x80070426)",
+    "chassis_types": [
+      3
+    ],
+    "last_hotfix": {
+      "hotfix_id": "KB5089573",
+      "installed_on": "2026-05-27T07:00:00Z"
+    },
+    "scheduled_tasks": [
+      {
+        "path": "\\",
+        "name": "Adobe Acrobat Update Task",
+        "state": "Ready"
+      },
+      {
+        "path": "\\",
+        "name": "ASUS Optimization 36D18D69AFC3",
+        "state": "Ready"
+      },
+      {
+        "path": "\\",
+        "name": "ASUS Update Checker 2.0",
+        "state": "Ready"
+      },
+      {
+        "path": "\\",
+        "name": "AsusSystemDiagnosis_DriverQuality",
+        "state": "Ready"
+      },
+      {
+        "path": "\\",
+        "name": "iGoAudioTask",
+        "state": "Running"
+      },
+      {
+        "path": "\\",
+        "name": "iGoAudioTaskSession",
+        "state": "Running"
+      },
+      {
+        "path": "\\",
+        "name": "Launch Adobe CCXProcess",
+        "state": "Ready"
+      },
+      {
+        "path": "\\",
+        "name": "MicrosoftEdgeUpdateTaskMachineCore{6E13E31D-880E-4316-9B0C-5B858582936B}",
+        "state": "Ready"
+      },
+      {
+        "path": "\\",
+        "name": "MicrosoftEdgeUpdateTaskMachineUA{A2DC128A-8B08-42ED-9CE8-024A6CE61721}",
+        "state": "Ready"
+      },
+      {
+        "path": "\\",
+        "name": "OneDrive Per-Machine Standalone Update Task",
+        "state": "Ready"
+      },
+      {
+        "path": "\\",
+        "name": "OneDrive Reporting Task-S-1-5-21-3040628439-82149349-1671918666-1001",
+        "state": "Ready"
+      },
+      {
+        "path": "\\",
+        "name": "OneDrive Reporting Task-S-1-5-21-3040628439-82149349-1671918666-1002",
+        "state": "Ready"
+      },
+      {
+        "path": "\\",
+        "name": "OneDrive Reporting Task-S-1-5-21-3040628439-82149349-1671918666-1003",
+        "state": "Ready"
+      },
+      {
+        "path": "\\",
+        "name": "OneDrive Startup Task-S-1-5-21-3040628439-82149349-1671918666-1001",
+        "state": "Ready"
+      },
+      {
+        "path": "\\",
+        "name": "OneDrive Startup Task-S-1-5-21-3040628439-82149349-1671918666-1002",
+        "state": "Ready"
+      },
+      {
+        "path": "\\",
+        "name": "OneDrive Startup Task-S-1-5-21-3040628439-82149349-1671918666-1003",
+        "state": "Ready"
+      },
+      {
+        "path": "\\DropboxSystem\\DropboxUpdater\\",
+        "name": "DropboxUpdaterTaskSystem123.0.6299.144{1AAD67EB-F75A-44FC-AC29-ED7FA24595E8}",
+        "state": "Ready"
+      },
+      {
+        "path": "\\GoogleSystem\\GoogleUpdater\\",
+        "name": "GoogleUpdaterTaskSystem150.0.7863.0{BC637345-BE23-49E9-A319-1B58C7622B7F}",
+        "state": "Ready"
+      },
+      {
+        "path": "\\Lenovo\\Lenovo Service Bridge\\",
+        "name": "S-1-5-21-3040628439-82149349-1671918666-1001",
+        "state": "Ready"
+      },
+      {
+        "path": "\\Mozilla\\",
+        "name": "Firefox Default Browser Agent 308046B0AF4A39CB",
+        "state": "Ready"
+      },
+      {
+        "path": "\\SoftLanding\\S-1-5-21-3040628439-82149349-1671918666-1002\\",
+        "name": "SoftLandingCreativeManagementTask",
+        "state": "Ready"
+      },
+      {
+        "path": "\\SoftLanding\\S-1-5-21-3040628439-82149349-1671918666-1002\\",
+        "name": "SoftLandingDeferralTask-{4ed43a00-c1a0-47dc-a50a-55ed56e7ce24}",
+        "state": "Ready"
+      }
+    ],
+    "antivirus_products": [
+      "Windows Defender"
+    ],
+    "domain_joined": false,
+    "defender": {
+      "antispyware_signature_age": 0,
+      "tamper_protected": false,
+      "real_time_protection": true,
+      "nis_enabled": true,
+      "available": true,
+      "antivirus_enabled": true,
+      "am_service_enabled": true
+    },
+    "bitlocker": {
+      "os_volume": "C:",
+      "key_protectors": [
+        "RecoveryPassword",
+        "Tpm"
+      ],
+      "recovery_key_present": true,
+      "available": true,
+      "encryption_percent": 100,
+      "protection_status": "On"
+    },
+    "is_laptop": false,
+    "installed_software_count": 29,
+    "local_administrators": [
+      "FRONT\\Administrator",
+      "FRONT\\Localadmin",
+      "FRONT\\Owner"
+    ],
+    "firewall_profiles": {
+      "Private": true,
+      "Domain": true,
+      "Public": true
+    },
+    "domain": "WORKGROUP",
+    "foreign_agents": null
+  },
+  "findings": [
+    {
+      "id": "sec.defender.tamper_off",
+      "category": "security",
+      "severity": "warning",
+      "title": "Defender tamper protection is OFF",
+      "detail": "Tamper protection is disabled, so malware or a local admin can silently disable Defender. Enable tamper protection (typically via Intune / Security Center).",
+      "evidence": "RealTimeProtectionEnabled=True; AMServiceEnabled=True; AntispywareSignatureAge=0 days; IsTamperProtected=False"
+    },
+    {
+      "id": "sec.defender.ok",
+      "category": "security",
+      "severity": "info",
+      "title": "Defender active and current",
+      "detail": "Real-time protection on, service running, signatures current.",
+      "evidence": "RealTimeProtectionEnabled=True; AMServiceEnabled=True; AntispywareSignatureAge=0 days; IsTamperProtected=False"
+    },
+    {
+      "id": "sec.av_products.defender_only",
+      "category": "security",
+      "severity": "info",
+      "title": "Defender is the only registered AV",
+      "detail": "Only Microsoft/Windows Defender is registered in Security Center.",
+      "evidence": "Windows Defender"
+    },
+    {
+      "id": "sec.foreign_agents.none",
+      "category": "security",
+      "severity": "info",
+      "title": "No competitor/leftover management agents detected",
+      "detail": "No known competitor RMM or unmanaged remote-access agents found in installed programs or services.",
+      "evidence": "Scanned uninstall hives (HKLM + WOW6432Node) and Win32_Service"
+    },
+    {
+      "id": "sec.foreign_agents.acg.screenconnect_connectwise_control",
+      "category": "security",
+      "severity": "info",
+      "title": "Expected ACG management tooling present: ScreenConnect / ConnectWise Control",
+      "detail": "This is Arizona Computer Guru managed/remote-access tooling that we deploy. Its presence is expected and not a foreign-agent risk.",
+      "evidence": "program: ScreenConnect Client (1912bf3444b41a08) 26.1.24.9579\nservice: ScreenConnect Client (1912bf3444b41a08) (ScreenConnect Client (1912bf3444b41a08)) Running"
+    },
+    {
+      "id": "sec.firewall.ok",
+      "category": "security",
+      "severity": "info",
+      "title": "All firewall profiles enabled",
+      "detail": "Domain, Private, and Public firewall profiles are all enabled.",
+      "evidence": "Private=True; Domain=True; Public=True"
+    },
+    {
+      "id": "sec.bitlocker.ok",
+      "category": "security",
+      "severity": "info",
+      "title": "OS volume encrypted with recovery protector present",
+      "detail": "BitLocker is on for the OS volume and a recovery password protector exists.",
+      "evidence": "Volume=C:; ProtectionStatus=On; EncryptionPercentage=100; KeyProtectors=RecoveryPassword,Tpm"
+    },
+    {
+      "id": "sec.local_admins.list",
+      "category": "security",
+      "severity": "info",
+      "title": "Local administrators (3)",
+      "detail": "Members of the local Administrators group. Review for unexpected or unknown accounts (especially leftover MSP/vendor accounts from a prior provider).",
+      "evidence": "FRONT\\Administrator\nFRONT\\Localadmin\nFRONT\\Owner"
+    },
+    {
+      "id": "sec.patch.os_supported",
+      "category": "security",
+      "severity": "info",
+      "title": "OS build supported: Win11 25H2",
+      "detail": "Build 26200 (Win11 25H2) is in support until 2027-10-12.",
+      "evidence": "Microsoft Windows 11 Home build 26200"
+    },
+    {
+      "id": "sec.patch.pending",
+      "category": "security",
+      "severity": "warning",
+      "title": "4 pending Windows updates",
+      "detail": "Windows Update reports pending (not installed, not hidden) updates. Some may be security updates. Approve/install on the next maintenance window.",
+      "evidence": "Microsoft.Update.Session search IsInstalled=0 and IsHidden=0 -> 4"
+    },
+    {
+      "id": "sec.patch.last_hotfix",
+      "category": "security",
+      "severity": "info",
+      "title": "Last hotfix: KB5089573",
+      "detail": "Most recently installed update (from Get-HotFix; reflects CBS/MSU packages, not all cumulative metadata).",
+      "evidence": "KB5089573 installed 2026-05-27T07:00:00Z"
+    },
+    {
+      "id": "sec.exposure.smb1_off",
+      "category": "security",
+      "severity": "info",
+      "title": "SMBv1 disabled",
+      "detail": "SMBv1 server protocol is disabled.",
+      "evidence": "EnableSMB1Protocol=False"
+    },
+    {
+      "id": "sec.exposure.laps_present",
+      "category": "security",
+      "severity": "info",
+      "title": "LAPS detected",
+      "detail": "A LAPS mechanism is present.",
+      "evidence": "Windows LAPS reg key"
+    },
+    {
+      "id": "health.stability.some",
+      "category": "health",
+      "severity": "warning",
+      "title": "Stability events present in the last 14 days",
+      "detail": "One or more unexpected shutdowns, BSODs, or disk errors occurred recently. Monitor and correlate with user reports.",
+      "evidence": "Unexpected shutdowns (id 41)=0; Bugchecks/BSOD (id 1001)=0; Disk errors (id 7/51/153)=2"
+    },
+    {
+      "id": "health.reboot_uptime.pending",
+      "category": "health",
+      "severity": "warning",
+      "title": "Reboot pending",
+      "detail": "A reboot is pending. Pending reboots can block patches and leave the system in a half-updated state. Schedule a restart.",
+      "evidence": "PendingFileRenameOperations"
+    },
+    {
+      "id": "health.failed_services.stopped",
+      "category": "health",
+      "severity": "warning",
+      "title": "6 auto-start service(s) not running",
+      "detail": "These services are set to start automatically but are not running. Some may be benign; review for security agents, backup agents, or AV that should be running.",
+      "evidence": "DropboxUpdaterInternalService123.0.6299.144 (DropboxUpdater InternalService 123.0.6299.144 (DropboxUpdaterInternalService123.0.6299.144)) = Stopped\nDropboxUpdaterService123.0.6299.144 (DropboxUpdater Service 123.0.6299.144 (DropboxUpdaterService123.0.6299.144)) = Stopped\ngpsvc (Group Policy Client) = Stopped\nIntel(R) Platform License Manager Service (Intel(R) Platform License Manager Service) = Stopped\nGoogleUpdaterInternalService150.0.7863.0 (Google Updater Internal Service (GoogleUpdaterInternalService150.0.7863.0)) = Stopped\nGoogleUpdaterService150.0.7863.0 (Google Updater Service (GoogleUpdaterService150.0.7863.0)) = Stopped"
+    },
+    {
+      "id": "health.domain.workgroup",
+      "category": "health",
+      "severity": "info",
+      "title": "Not domain-joined (workgroup)",
+      "detail": "This machine is in workgroup/Azure AD only mode (Domain=WORKGROUP). No on-prem AD secure channel applies.",
+      "evidence": "PartOfDomain=False; Domain=WORKGROUP"
+    },
+    {
+      "id": "health.time.source",
+      "category": "health",
+      "severity": "info",
+      "title": "Time service source",
+      "detail": "Current Windows Time service source.",
+      "evidence": "Source=The following error occurred: The service has not been started. (0x80070426)"
+    },
+    {
+      "id": "health.backup.none",
+      "category": "health",
+      "severity": "info",
+      "title": "No backup agent detected",
+      "detail": "No known backup agent service found. Backup expectation varies by endpoint; confirm whether this machine is supposed to have local/cloud backup and whether server-side or M365 backup covers it.",
+      "evidence": "No matching backup service in Win32_Service"
+    }
+  ]
+}
--- a/clients/wolkin/onboarding-baselines/FRONT-20260606T133142.md
+++ b/clients/wolkin/onboarding-baselines/FRONT-20260606T133142.md
@@ -0,0 +1,237 @@
+# Onboarding Diagnostic Baseline - FRONT
+
+- **Grade:** AMBER
+- **Host:** FRONT
+- **Client:** Wolkin, Robert (`rswolkin`)
+- **Collected (UTC):** 2026-06-06T13:30:54Z
+- **Agent ID:** 877d311a-4b24-462c-97b1-d2a0f7730a71
+- **Command ID:** ab55e360-9c8b-4a1a-9cc7-9b6ef178e457
+- **Findings:** 0 critical / 5 warning / 14 info / 0 unknown
+
+- **OS:** Microsoft Windows 11 Home (build 26200)
+
+---
+
+## WARNING (5)
+
+### Defender tamper protection is OFF
+- **Category:** security
+- **ID:** `sec.defender.tamper_off`
+- Tamper protection is disabled, so malware or a local admin can silently disable Defender. Enable tamper protection (typically via Intune / Security Center).
+
+```
+RealTimeProtectionEnabled=True; AMServiceEnabled=True; AntispywareSignatureAge=0 days; IsTamperProtected=False
+```
+
+### 4 pending Windows updates
+- **Category:** security
+- **ID:** `sec.patch.pending`
+- Windows Update reports pending (not installed, not hidden) updates. Some may be security updates. Approve/install on the next maintenance window.
+
+```
+Microsoft.Update.Session search IsInstalled=0 and IsHidden=0 -> 4
+```
+
+### Stability events present in the last 14 days
+- **Category:** health
+- **ID:** `health.stability.some`
+- One or more unexpected shutdowns, BSODs, or disk errors occurred recently. Monitor and correlate with user reports.
+
+```
+Unexpected shutdowns (id 41)=0; Bugchecks/BSOD (id 1001)=0; Disk errors (id 7/51/153)=2
+```
+
+### Reboot pending
+- **Category:** health
+- **ID:** `health.reboot_uptime.pending`
+- A reboot is pending. Pending reboots can block patches and leave the system in a half-updated state. Schedule a restart.
+
+```
+PendingFileRenameOperations
+```
+
+### 6 auto-start service(s) not running
+- **Category:** health
+- **ID:** `health.failed_services.stopped`
+- These services are set to start automatically but are not running. Some may be benign; review for security agents, backup agents, or AV that should be running.
+
+```
+DropboxUpdaterInternalService123.0.6299.144 (DropboxUpdater InternalService 123.0.6299.144 (DropboxUpdaterInternalService123.0.6299.144)) = Stopped
+DropboxUpdaterService123.0.6299.144 (DropboxUpdater Service 123.0.6299.144 (DropboxUpdaterService123.0.6299.144)) = Stopped
+gpsvc (Group Policy Client) = Stopped
+Intel(R) Platform License Manager Service (Intel(R) Platform License Manager Service) = Stopped
+GoogleUpdaterInternalService150.0.7863.0 (Google Updater Internal Service (GoogleUpdaterInternalService150.0.7863.0)) = Stopped
+GoogleUpdaterService150.0.7863.0 (Google Updater Service (GoogleUpdaterService150.0.7863.0)) = Stopped
+```
+
+
+## INFO (14)
+
+### Defender active and current
+- **Category:** security
+- **ID:** `sec.defender.ok`
+- Real-time protection on, service running, signatures current.
+
+```
+RealTimeProtectionEnabled=True; AMServiceEnabled=True; AntispywareSignatureAge=0 days; IsTamperProtected=False
+```
+
+### Defender is the only registered AV
+- **Category:** security
+- **ID:** `sec.av_products.defender_only`
+- Only Microsoft/Windows Defender is registered in Security Center.
+
+```
+Windows Defender
+```
+
+### No competitor/leftover management agents detected
+- **Category:** security
+- **ID:** `sec.foreign_agents.none`
+- No known competitor RMM or unmanaged remote-access agents found in installed programs or services.
+
+```
+Scanned uninstall hives (HKLM + WOW6432Node) and Win32_Service
+```
+
+### Expected ACG management tooling present: ScreenConnect / ConnectWise Control
+- **Category:** security
+- **ID:** `sec.foreign_agents.acg.screenconnect_connectwise_control`
+- This is Arizona Computer Guru managed/remote-access tooling that we deploy. Its presence is expected and not a foreign-agent risk.
+
+```
+program: ScreenConnect Client (1912bf3444b41a08) 26.1.24.9579
+service: ScreenConnect Client (1912bf3444b41a08) (ScreenConnect Client (1912bf3444b41a08)) Running
+```
+
+### All firewall profiles enabled
+- **Category:** security
+- **ID:** `sec.firewall.ok`
+- Domain, Private, and Public firewall profiles are all enabled.
+
+```
+Private=True; Domain=True; Public=True
+```
+
+### OS volume encrypted with recovery protector present
+- **Category:** security
+- **ID:** `sec.bitlocker.ok`
+- BitLocker is on for the OS volume and a recovery password protector exists.
+
+```
+Volume=C:; ProtectionStatus=On; EncryptionPercentage=100; KeyProtectors=RecoveryPassword,Tpm
+```
+
+### Local administrators (3)
+- **Category:** security
+- **ID:** `sec.local_admins.list`
+- Members of the local Administrators group. Review for unexpected or unknown accounts (especially leftover MSP/vendor accounts from a prior provider).
+
+```
+FRONT\Administrator
+FRONT\Localadmin
+FRONT\Owner
+```
+
+### OS build supported: Win11 25H2
+- **Category:** security
+- **ID:** `sec.patch.os_supported`
+- Build 26200 (Win11 25H2) is in support until 2027-10-12.
+
+```
+Microsoft Windows 11 Home build 26200
+```
+
+### Last hotfix: KB5089573
+- **Category:** security
+- **ID:** `sec.patch.last_hotfix`
+- Most recently installed update (from Get-HotFix; reflects CBS/MSU packages, not all cumulative metadata).
+
+```
+KB5089573 installed 2026-05-27T07:00:00Z
+```
+
+### SMBv1 disabled
+- **Category:** security
+- **ID:** `sec.exposure.smb1_off`
+- SMBv1 server protocol is disabled.
+
+```
+EnableSMB1Protocol=False
+```
+
+### LAPS detected
+- **Category:** security
+- **ID:** `sec.exposure.laps_present`
+- A LAPS mechanism is present.
+
+```
+Windows LAPS reg key
+```
+
+### Not domain-joined (workgroup)
+- **Category:** health
+- **ID:** `health.domain.workgroup`
+- This machine is in workgroup/Azure AD only mode (Domain=WORKGROUP). No on-prem AD secure channel applies.
+
+```
+PartOfDomain=False; Domain=WORKGROUP
+```
+
+### Time service source
+- **Category:** health
+- **ID:** `health.time.source`
+- Current Windows Time service source.
+
+```
+Source=The following error occurred: The service has not been started. (0x80070426)
+```
+
+### No backup agent detected
+- **Category:** health
+- **ID:** `health.backup.none`
+- No known backup agent service found. Backup expectation varies by endpoint; confirm whether this machine is supposed to have local/cloud backup and whether server-side or M365 backup covers it.
+
+```
+No matching backup service in Win32_Service
+```
+
+
+---
+
+## Inventory Baseline Summary
+
+- **Manufacturer / Model:** ASUSTeK COMPUTER INC. / ASUS P500MV_V500MVC
+- **Serial:** T7PFAG00B454281
+- **CPU:** 13th Gen Intel(R) Core(TM) i5-13420H (8 cores / 12 logical)
+- **RAM (GB):** 15.6
+- **BIOS:** P500MV.324 (2025-06-23)
+- **Chassis is laptop:** false
+- **TPM present / Secure Boot:** true / true
+- **Domain joined:** false (WORKGROUP)
+- **OS activation licensed:** true
+- **Uptime (days):** 10.2
+- **Pending reboot:** true
+- **Installed software count:** 29
+- **Scheduled tasks (non-MS, enabled):** 22
+- **Local administrators:** FRONT\Administrator, FRONT\Localadmin, FRONT\Owner
+
+### Fixed volumes
+
+- C: - 534.7 GB free of 930.6 GB (57.5%)
+- [unlabeled] - 0 GB free of 0.1 GB (27.6%)
+- [unlabeled] - 0.1 GB free of 0.8 GB (14.1%)
+
+### Network adapters
+
+- Intel(R) Ethernet Connection (16) I219-V - IP: 192.168.1.153, fe80::12de:34bc:e5b4:3089, 2600:1011:a03d:3fca:95fc:53:683e:6871, 2600:1011:a03d:3fca:5b1c:75e9:fa33:f3f6 - DNS: 192.168.1.1 - DHCP: true
+
+---
+
+## Diff vs Prior Baseline
+
+- No prior baseline found for this host. This is the first baseline.
+
+---
+
+_Generated by run-onboarding-diagnostic.sh (GuruRMM onboarding diagnostic, Phase 1). Raw snapshot: `FRONT-20260606T133142.json` (immutable)._
--- a/clients/wolkin/remote-printing-tailscale-plan.md
+++ b/clients/wolkin/remote-printing-tailscale-plan.md
@@ -0,0 +1,87 @@
+# Wolkin Remote Printing - Tailscale Solution
+
+**Date:** 2026-06-06
+**Status:** Pending deployment
+**Decision:** Use Tailscale mesh VPN for remote laptop → office printer connectivity
+
+## Use Case
+
+- Remote laptop (not yet in RMM) needs to print to office printer
+- Office network: Verizon home internet router (likely CGNAT/dynamic IP)
+- No existing VPN infrastructure
+- Single user remote printing scenario
+
+## Solution: Tailscale
+
+**Deployment targets:**
+1. Office PC: **FRONT** (already in RMM - 877d311a-4b24-462c-97b1-d2a0f7730a71)
+2. Remote laptop: (to be enrolled in RMM)
+
+**Architecture:**
+- Install Tailscale client on both machines
+- Create shared Tailscale network (tailnet)
+- Office printer shared from FRONT via SMB
+- Laptop connects to printer using FRONT's Tailscale IP
+
+**Benefits:**
+- Works through CGNAT without port forwarding
+- Free for personal use (up to 100 devices)
+- Zero-config mesh networking
+- Secure (WireGuard-based)
+- ACG can manage via RMM once deployed
+
+## Implementation Steps
+
+1. **Enroll remote laptop in GuruRMM**
+   - Generate enrollment key for Wolkin site
+   - Install agent on laptop
+   - Run onboarding diagnostic
+
+2. **Install Tailscale on FRONT**
+   - Download: https://tailscale.com/download/windows
+   - Install via RMM command or ScreenConnect
+   - Sign in with Wolkin Tailscale account (or create new)
+   - Note FRONT's Tailscale IP (100.x.x.x range)
+
+3. **Install Tailscale on remote laptop**
+   - Same download/install process
+   - Join same tailnet
+   - Note laptop's Tailscale IP
+
+4. **Configure printer sharing**
+   - Share office printer from FRONT (if not already shared)
+   - On laptop: Add network printer using `\\<FRONT-tailscale-IP>\<PrinterName>`
+   - Test print job
+
+5. **Documentation**
+   - Document Tailscale credentials in vault: `clients/rswolkin/tailscale.sops.yaml`
+   - Add printer name and share path to this doc
+   - Update wiki/clients/wolkin.md (when created)
+
+## Alternative Considered
+
+- ScreenConnect print redirection: Wrong direction (office→laptop, not laptop→office)
+- GuruConnect: Not yet production-ready for this use case
+- Commercial cloud print: Overkill/expensive for single user
+- DIY VPN: Complex, CGNAT issues, maintenance burden
+
+## Notes
+
+- FRONT uptime: 10.2 days (as of 2026-06-06) - stable enough for print server role
+- FRONT has pending reboot (dispatched 2026-06-06) - Tailscale install can happen after
+- Office printer make/model: (to be documented)
+- Remote laptop specs: (to be documented after enrollment)
+
+## Follow-up Tasks
+
+- [ ] Create Tailscale account for Wolkin (if needed)
+- [ ] Enroll remote laptop in RMM
+- [ ] Deploy Tailscale to both machines
+- [ ] Configure printer sharing
+- [ ] Test remote print job
+- [ ] Vault Tailscale credentials
+- [ ] Document printer details
+
+---
+
+**Ticket/Session reference:** 2026-06-06 RMM diagnostic + remote printing planning
--- a/clients/wolkin/session-logs/2026-06-05-julie-guda-provisioning.md
+++ b/clients/wolkin/session-logs/2026-06-05-julie-guda-provisioning.md
@@ -0,0 +1,41 @@
+# rswolkin.com — Tenant Onboarding + Julie Guda Provisioning
+
+## User
+- **User:** Mike Swanson (mike)
+- **Machine:** GURU-5070
+- **Role:** admin
+- **Date:** 2026-06-05
+
+## Summary
+Onboarded the rswolkin.com M365 tenant into ACG's ComputerGuru app suite (365 tools), then provisioned a new user — Julie Guda — as Robert Wolkin's executive assistant, at Winter's request.
+
+## Tenant
+- **Org:** Wolkin, Robert
+- **Domain:** rswolkin.com (primary, verified) / rswolkin.onmicrosoft.com
+- **Tenant ID:** ceb6dbe7-82c8-4d8f-9c6b-49aa26208e9b
+- **Onboarded:** 2026-06-05 — all 5 apps consented, directory roles assigned (Tenant Admin = Conditional Access Administrator; Security Investigator + Exchange Operator = Exchange Administrator; User Manager = User Administrator + Authentication Administrator). No MDE license → Defender Add-on skipped. Recorded in `.claude/skills/remediation-tool/references/tenants.md`.
+- **Existing users (pre-Julie):** Mike Swanson `admin@rswolkin.onmicrosoft.com` (ACG admin, unlicensed); Robert Wolkin `robert@rswolkin.com` (Exchange Standard).
+- **Licenses:** O365 Business Premium had 1 free seat (now used by Julie); Exchange Standard fully consumed.
+
+## Julie Guda — account
+- **UPN / sign-in:** julie@rswolkin.com
+- **Object ID:** acaeb49c-6264-4d7e-bf10-d1cda6049b10
+- **Initial password (customer-requested):** Jaylen0607!  (forceChangeAtNextSignIn = false)
+- **License:** O365 Business Premium (skuId f245ecc8-75af-4f8e-b61f-27d8114de5f3)
+- **Usage location:** US
+- **Recovery email (otherMails):** JulieAnneGuda@gmail.com
+- **Mobile:** 702-624-3765 (also pre-registered as MFA phone method, id 3179e48a-750b-4051-897c-87b9720928f7)
+
+## Access granted (EA for Robert Wolkin)
+- **Robert's Calendar:** Julie = Editor + Delegate (receives/manages meeting requests)
+- **Robert's Contacts:** Julie = Editor
+- **Send-on-Behalf:** robert@rswolkin.com GrantSendOnBehalfTo includes Julie (messages appear "Julie Guda on behalf of Robert Wolkin")
+
+## Pending / tomorrow
+- Confirm with Winter/Robert whether EA should have **Send As** (appear purely as Robert) instead of/in addition to Send-on-Behalf, and whether she needs **Full Access** to triage Robert's inbox.
+- Optional baseline breach/hygiene sweep of the tenant (inbox rules, forwarding, OAuth consents, risky sign-ins) now that it's onboarded.
+- Verify Julie's first sign-in + MFA enrollment went smoothly.
+
+## Reference
+- Apps/tiers + scripts: `.claude/skills/remediation-tool/` (get-token.sh, onboard-tenant.sh). Tenant tracker: `references/tenants.md`.
+- Tools used: User Manager (create/license/MFA), Exchange Operator (folder perms, send-on-behalf), Security Investigator (read/verify).
--- a/clients/wolkin/session-logs/2026-06-06-mike-gemini-install-rmm-diagnostic-tailscale-planning.md
+++ b/clients/wolkin/session-logs/2026-06-06-mike-gemini-install-rmm-diagnostic-tailscale-planning.md
@@ -0,0 +1,393 @@
+# Session Log - Gemini CLI Install + Wolkin RMM Diagnostic + Remote Printing Planning
+
+## User
+- **User:** Mike Swanson (mike)
+- **Machine:** Mikes-MacBook-Air (Mac)
+- **Role:** admin
+
+## Date
+2026-06-06
+
+## Summary
+
+Installed Google Gemini CLI on Mac as second fleet host for AGY skill, fixed macOS compatibility issue in GuruRMM onboarding diagnostic script, ran comprehensive security/health diagnostic on Wolkin's FRONT machine (AMBER grade - 5 warnings including tamper protection disabled and pending updates), dispatched reboot to clear pending reboot flag, and documented Tailscale mesh VPN solution for remote laptop printing to office printer.
+
+## Context
+
+Following the recent addition of the AGY skill (Google Gemini CLI router for second-opinion verification and code review), needed to expand Gemini CLI availability beyond GURU-5070 to the Mac. Wolkin client needed RMM system health assessment and has an upcoming requirement for remote printing without traditional VPN infrastructure.
+
+## Work Performed
+
+### 1. Gemini CLI Installation and Configuration
+
+**Objective:** Install and configure Google Gemini CLI on Mac to serve as second fleet host for AGY skill capabilities.
+
+**Steps:**
+
+1. **Read AGY skill documentation** - Reviewed `.claude/skills/agy/SKILL.md` to understand installation requirements and configuration structure
+
+2. **Verified npm availability** - Confirmed npm 11.6.2 installed via Homebrew at `/opt/homebrew/bin/npm`
+
+3. **Installed Gemini CLI globally:**
+   ```bash
+   npm install -g @google/gemini-cli
+   ```
+   - Installed successfully in 4 seconds
+   - Version: 0.45.1
+   - Binary location: `/opt/homebrew/bin/gemini`
+
+4. **Updated identity.json** - Added Gemini configuration block to `.claude/identity.json`:
+   ```json
+   "gemini": {
+     "installed": true,
+     "binary": "/opt/homebrew/bin/gemini",
+     "auth": "oauth",
+     "is_fleet_host": true,
+     "capabilities": [
+       "text",
+       "verify",
+       "review",
+       "review-files",
+       "review-diff",
+       "image-analyze",
+       "search"
+     ]
+   }
+   ```
+
+5. **Documented next step:** User needs to run `gemini` interactively once to complete Google OAuth login. Credentials will be stored at `~/.gemini/oauth_creds.json`.
+
+**Outcome:** Mac is now configured as a Gemini CLI fleet host alongside GURU-5070. All AGY skill modes (text, verify, review, image-analyze, search) are available once OAuth is completed.
+
+**Technical Note:** Gemini uses Google OAuth (no API key required), supports vision input and live web search in keyless mode, and provides genuinely independent second-model verification for Claude's findings.
+
+---
+
+### 2. Repository Synchronization (2 cycles)
+
+**First Sync (12:12 UTC):**
+- Pulled 15 commits (12 Mike, 3 Howard)
+- Key additions: AGY skill, Mailprotector skill, M365 remediation updates, CDP Chrome driver script
+- Wiki updates: Cascades Tucson client article, index
+- Vault: 2 commits (Cascades sysadmin password rotation, Mailprotector API key)
+
+**Second Sync (16:03 UTC):**
+- Pulled 17 commits (13 Mike, 4 Howard)
+- Major updates:
+  - Sync infrastructure: sync-lock.sh for per-machine locking, prevents concurrent sync conflicts
+  - human-flow skill: AST-based scanner v2 with Friction Index rubric, "elevate (polish & redesign)" heuristics
+  - Radio show website: keyboard accessibility improvements (skip link, focus-visible, mobile menu)
+  - Cascades Tucson: Multiple GPO scripts (caregiver lockdown, device lockdown, SCP config)
+  - New wiki article: IX server (233 lines) - full hosting server inventory
+  - Memory feedback: AGY review not read-only, verify committed state before push
+- Global commands updated: checkpoint.md, save.md, scc.md, sync.md
+
+**Identity.json warning noted:** Machine name shows 'Mikes-MacBook-Air' but hostname resolves to 'Mac' - discrepancy should be corrected for proper attribution.
+
+---
+
+### 3. Wolkin RMM Health Diagnostic
+
+**Objective:** Run comprehensive onboarding security and health diagnostic on Wolkin's office PC to establish baseline and identify issues.
+
+**Agent Resolution:**
+- Client: Wolkin, Robert
+- Hostname: front
+- Agent ID: `877d311a-4b24-462c-97b1-d2a0f7730a71`
+- OS: Windows 11 Home 25H2 (build 26200)
+- Hardware: ASUS P500MV, Intel i5-13420H (8c/12t), 15.6GB RAM
+- Last seen: 2026-06-06 13:29 UTC (online)
+
+**Diagnostic Script Issue Discovered:**
+
+Encountered macOS/Linux compatibility issue in `run-onboarding-diagnostic.sh` line 221:
+```bash
+base64 -w0 "$PROBE" > "$B64_FILE"  # GNU flag, fails on BSD/macOS
+```
+
+**Fix applied:**
+```bash
+# macOS (BSD) base64 uses -i for input file and has no line-wrap flag.
+# GNU base64 accepts file as positional arg and uses -w0 for no wrap.
+if base64 -i "$PROBE" > "$B64_FILE" 2>/dev/null; then
+    : # macOS/BSD path succeeded
+elif base64 -w0 "$PROBE" > "$B64_FILE" 2>/dev/null; then
+    : # GNU path succeeded
+else
+    # Fallback: stdin input, strip newlines
+    base64 < "$PROBE" | tr -d '\n' > "$B64_FILE"
+fi
+```
+
+This fix makes the script portable across macOS (BSD base64) and Linux (GNU base64).
+
+**Diagnostic Execution:**
+
+- Probe size: 70,739 bytes → chunked into 4 x 24KB base64-encoded uploads
+- Dispatched via RMM API, executed as SYSTEM context on endpoint
+- Timeout: 240 seconds
+- Result: Completed successfully, exit code 0
+- JSON output: 17,509 bytes extracted from fenced markers
+
+**Grade: AMBER**
+- 0 critical findings
+- 5 warning findings
+- 14 info findings
+- 0 unknown (all checks executed successfully)
+
+**WARNING Findings (Priority Issues):**
+
+1. **Defender Tamper Protection OFF** (`sec.defender.tamper_off`)
+   - Impact: Malware or local admin can silently disable Defender
+   - Current state: RTP enabled, service running, signatures current (0 days old), but tamper protection disabled
+   - Recommendation: Enable via Intune/Security Center
+
+2. **4 Pending Windows Updates** (`sec.patch.pending`)
+   - May include security patches
+   - Recommendation: Install during next maintenance window
+
+3. **Stability Events - 2 Disk Errors** (`health.stability.some`)
+   - Event IDs 7/51/153 (disk errors) detected in last 14 days
+   - 0 unexpected shutdowns, 0 BSODs
+   - Recommendation: Run Check Disk or SMART diagnostics to assess disk health
+
+4. **Reboot Pending** (`health.reboot_uptime.pending`)
+   - Flag: PendingFileRenameOperations
+   - Impact: Blocks patch installation, leaves system in half-updated state
+   - Recommendation: Schedule restart (dispatched during this session)
+
+5. **6 Auto-Start Services Not Running** (`health.failed_services.stopped`)
+   - Dropbox Updater services (2) - benign
+   - Google Updater services (2) - benign
+   - **Group Policy Client (gpsvc)** - notable, should run even on workgroup machines
+   - Intel Platform License Manager - benign
+   - Recommendation: Investigate Group Policy Client status
+
+**POSITIVE Findings (Security/Health):**
+
+- [OK] BitLocker enabled on OS volume with TPM + recovery password protector (100% encrypted)
+- [OK] Defender active: RTP on, service running, signatures current
+- [OK] Only Defender registered as AV (no conflicts)
+- [OK] All firewall profiles enabled (Domain, Private, Public)
+- [OK] No competitor/leftover RMM agents detected
+- [OK] ScreenConnect client present (expected ACG tooling)
+- [OK] SMBv1 disabled
+- [OK] LAPS detected
+- [OK] OS build in support until 2027-10-12
+- [OK] Last hotfix: KB5089573 (2026-05-27)
+
+**Inventory Baseline:**
+
+- Manufacturer: ASUSTeK COMPUTER INC.
+- Model: ASUS P500MV_V500MVC
+- Serial: T7PFAG00B454281
+- CPU: Intel i5-13420H (8 cores, 12 logical)
+- RAM: 15.6 GB
+- BIOS: P500MV.324 (2025-06-23)
+- Chassis: Desktop (not laptop)
+- TPM: Present / Secure Boot: Enabled
+- Domain: Workgroup (not domain-joined)
+- OS Activation: Licensed
+- Uptime: 10.2 days
+- Storage: C: drive 534.7 GB free of 930.6 GB (57.5% free)
+- Network: Intel I219-V @ 192.168.1.153 (DHCP)
+- Installed software: 29 packages
+- Scheduled tasks (non-MS, enabled): 22
+- Local administrators: FRONT\Administrator, FRONT\Localadmin, FRONT\Owner
+
+**Baselines Written:**
+- JSON (immutable snapshot): `clients/rswolkin/onboarding-baselines/FRONT-20260606T133142.json`
+- Markdown (human report): `clients/rswolkin/onboarding-baselines/FRONT-20260606T133142.md`
+
+This is the first baseline for this host. Future diagnostics will diff against this to show new/resolved/regressed findings and software changes.
+
+**Reboot Dispatched:**
+
+To clear the pending reboot flag and allow pending updates to complete:
+```powershell
+Restart-Computer -Force
+```
+- Command ID: `c7d3a53f-a503-4136-b757-d79f18e94136`
+- Status: Running (system restarted immediately)
+- Alert posted to #dev-alerts: `[RMM] Mike dispatched reboot to FRONT (windows) - clear pending reboot + install updates -> cmd:c7d3a53f`
+
+**Outcome:** Comprehensive baseline established for FRONT. Reboot will clear pending flag and allow update installation. Follow-up required for tamper protection, Group Policy Client service, and disk health assessment.
+
+---
+
+### 4. Remote Printing Solution - Tailscale Planning
+
+**Requirement:** Remote laptop (not yet enrolled in RMM) needs to print to office printer. Office is on Verizon home internet (likely CGNAT, dynamic IP). No existing VPN infrastructure.
+
+**Challenge:** Traditional VPN solutions don't work well with residential ISP CGNAT and dynamic IPs. Port forwarding not viable.
+
+**Solution Evaluation:**
+
+| Option | Pros | Cons | Decision |
+|--------|------|------|----------|
+| **Tailscale** | Works through CGNAT, free (≤100 devices), zero-config, WireGuard-based, ACG manageable via RMM | Requires client on both machines | ✓ **Selected** |
+| GuruConnect | ACG-controlled, no third-party dependency | Not production-ready yet | Deferred |
+| ScreenConnect Print Redirect | Already deployed, no new infrastructure | Only works office→laptop direction, not laptop→office | Won't work |
+| Cloud Print (PrinterLogic, etc.) | Professional, works anywhere | Expensive ($10-30/user/month), overkill | Rejected |
+| DIY VPN Server | Full control | CGNAT blocks inbound, needs static IP/DDNS, complex | Rejected |
+
+**Selected Solution: Tailscale Mesh VPN**
+
+**Architecture:**
+1. Install Tailscale on office PC (FRONT - already in RMM)
+2. Install Tailscale on remote laptop (to be enrolled in RMM)
+3. Both join same tailnet (Tailscale network)
+4. Share office printer from FRONT via SMB
+5. Laptop adds network printer using FRONT's Tailscale IP (100.x.x.x range)
+
+**Deployment Plan Documented:** `clients/rswolkin/remote-printing-tailscale-plan.md`
+
+**Plan Contents:**
+- Use case and requirements
+- Architecture diagram (text)
+- Step-by-step implementation checklist:
+  1. Enroll remote laptop in GuruRMM
+  2. Install Tailscale on FRONT (download from tailscale.com/download/windows)
+  3. Install Tailscale on remote laptop
+  4. Configure printer sharing from FRONT
+  5. Add network printer on laptop via Tailscale IP
+  6. Test print job
+  7. Vault Tailscale credentials: `clients/rswolkin/tailscale.sops.yaml`
+  8. Document printer details and Tailscale IPs
+- Alternative solutions considered and rejected (with rationale)
+- Follow-up task checklist
+
+**Why Tailscale Wins:**
+- Zero configuration mesh networking (no manual IP/routing setup)
+- Survives network changes (DHCP, roaming, etc.)
+- Peer-to-peer where possible, relay where NAT traversal fails
+- Free for personal/small business use
+- Can be deployed and managed via RMM scripts once laptops are enrolled
+- Secure by default (WireGuard, cryptographic identity)
+
+**Next Steps:**
+1. Create Tailscale account for Wolkin (or use existing if available)
+2. Enroll remote laptop in GuruRMM (generate site enrollment key)
+3. Deploy Tailscale to both machines (can script via RMM)
+4. Configure and test printer connectivity
+5. Vault credentials and document final configuration
+
+**Outcome:** Clear deployment path documented for remote printing without traditional VPN complexity. Solution scales to additional remote workers if needed in future.
+
+---
+
+## Files Modified
+
+1. `.claude/scripts/run-onboarding-diagnostic.sh`
+   - Fixed macOS base64 compatibility (BSD vs GNU flag differences)
+   - Now portable across macOS and Linux
+
+2. `.claude/identity.json`
+   - Added Gemini configuration block
+   - Set machine as fleet host with full AGY capabilities
+
+## Files Created
+
+1. `clients/rswolkin/onboarding-baselines/FRONT-20260606T133142.json`
+   - Immutable diagnostic snapshot (17,509 bytes)
+   - Complete system state: security, health, inventory
+   - Source of truth for future diffs
+
+2. `clients/rswolkin/onboarding-baselines/FRONT-20260606T133142.md`
+   - Human-readable diagnostic report
+   - Grade: AMBER (0 critical, 5 warning, 14 info)
+   - Detailed findings with remediation guidance
+
+3. `clients/rswolkin/remote-printing-tailscale-plan.md`
+   - Complete Tailscale deployment plan
+   - Architecture, implementation steps, alternatives evaluated
+   - Follow-up task checklist
+
+## Alerts Posted
+
+- `[RMM] Mike dispatched reboot to FRONT (windows) - clear pending reboot + install updates -> cmd:c7d3a53f`
+  - Posted to #dev-alerts (message_id: 1512812299428302908)
+
+## Follow-up Required
+
+### Immediate (This Week)
+
+1. **Complete Gemini OAuth** - Run `gemini` interactively on Mac to log in with Google account
+
+2. **Fix identity.json machine name** - Update `machine` field from "Mikes-MacBook-Air" to match actual hostname "Mac" for correct attribution
+
+3. **Monitor FRONT reboot** - Verify system came back online after restart (expected 2-5 minutes)
+
+### Short-term (Next 1-2 Weeks)
+
+4. **Address FRONT AMBER findings:**
+   - Enable Defender tamper protection (via Intune/Security Center or local policy)
+   - Install 4 pending Windows updates (schedule maintenance window)
+   - Investigate stopped Group Policy Client service (should auto-start on workgroup machines)
+   - Run Check Disk or SMART diagnostics to assess disk health (2 disk errors detected)
+
+5. **Deploy Tailscale remote printing solution:**
+   - Create/confirm Tailscale account for Wolkin
+   - Enroll remote laptop in GuruRMM (generate site enrollment key)
+   - Deploy Tailscale to FRONT and laptop
+   - Configure printer sharing from FRONT
+   - Test remote print job end-to-end
+   - Vault Tailscale credentials: `clients/rswolkin/tailscale.sops.yaml`
+   - Document printer make/model/share name and Tailscale IPs
+
+6. **Re-run diagnostic after remediation** - Establish second baseline showing improvements
+
+## Technical Notes
+
+### macOS base64 Compatibility
+
+BSD base64 (macOS) vs GNU base64 (Linux) syntax differences:
+
+```bash
+# BSD (macOS) - uses -i flag for input file, no line wrapping by default
+base64 -i input.txt > output.b64
+
+# GNU (Linux) - accepts file as positional arg, uses -w0 to disable line wrapping
+base64 -w0 input.txt > output.b64
+
+# Portable fallback - stdin input with newline stripping
+base64 < input.txt | tr -d '\n' > output.b64
+```
+
+The diagnostic script now tries BSD first, falls back to GNU, then uses portable stdin method if both fail. This ensures compatibility across all fleet machines.
+
+### GuruRMM Onboarding Diagnostic
+
+- Probe size: ~70KB PowerShell script
+- Uploaded in 24KB base64-encoded chunks to stay under agent command body limit (~32-40KB)
+- Executes as SYSTEM context
+- Output: JSON fenced between `===DIAG-JSON-START===` and `===DIAG-JSON-END===` markers
+- Grading: RED (≥1 critical), AMBER (≥1 warning, 0 critical), GREEN (0 critical, 0 warning)
+- Checks: Defender state, AV conflicts, foreign RMM agents, firewall, BitLocker, local admins, patch posture, OS EOL, RDP/NLA, SMBv1, UAC, LAPS, disk health, stability, services, domain channel, time source, battery (laptops), backup agent
+- Inventory: hardware/BIOS, OS details, installed software, network, scheduled tasks, autoruns
+- Baselines immutable and append-only; diffs show changes between runs
+
+### Tailscale Architecture
+
+- Mesh VPN using WireGuard protocol
+- Coordination server (Tailscale's) handles NAT traversal and key exchange
+- Peer-to-peer connections where possible; relay (DERP servers) when direct fails
+- Each device gets stable 100.x.x.x IP that persists across networks
+- Access control via ACLs (can restrict which devices talk to which)
+- Works through CGNAT without port forwarding or static IPs
+- Free tier: up to 100 devices, 1 admin, community support
+- Paid tier ($6/user/month): multiple admins, SSO, device approval, audit logs
+
+For Wolkin's use case (2 devices, simple printer sharing), free tier is sufficient.
+
+## Session Metadata
+
+- **Duration:** ~2 hours
+- **Mode:** General → Client (Wolkin)
+- **Primary tools:** RMM skill, Bash, Read, Edit, Write
+- **Commits:** 1 fix (base64 compatibility), 1 config (Gemini), 3 new files (baselines + plan)
+- **RMM commands dispatched:** 1 (reboot to FRONT)
+
+---
+
+**Session complete.** Gemini CLI operational on Mac (pending OAuth), Wolkin FRONT system baselined and rebooting, remote printing solution documented and ready for deployment.
--- a/clients/wolkin/session-logs/2026-06-07-mike-zerotier-setup.md
+++ b/clients/wolkin/session-logs/2026-06-07-mike-zerotier-setup.md
@@ -0,0 +1,285 @@
+# Wolkin Law - ZeroTier VPN Setup for Remote Access
+
+## User
+- **User:** Mike Swanson (mike)
+- **Machine:** Mikes-MacBook-Air
+- **Role:** admin
+
+## Session Summary
+
+Deployed ZeroTier mesh VPN to connect Wolkin Law's office PC (FRONT) with Julie's remote laptop (RSW-Laptop) for file sharing and remote access. Removed existing Tailscale installation from both machines and installed ZeroTier 1.16.2, joining network 17d709436c834c9b. FRONT received IP 10.147.19.199 and RSW-Laptop received 10.147.19.54. Added bidirectional hosts file entries for name resolution between the machines.
+
+Created julie user accounts on both machines with matching M365 credentials. Discovered critical GuruRMM bug where password setting commands (PowerShell Set-LocalUser, net user in both PowerShell and CMD contexts) complete with exit 0 but fail to actually set passwords. User manually set passwords via ScreenConnect using identical commands which worked successfully. Documented the bug in memory with HIGH priority flag for investigation. Made julie an Administrator on the laptop for full system access.
+
+Configured SMB file sharing over the ZeroTier mesh network. Discovered FRONT's desktop is redirected to OneDrive. Created shares for three folders (Scans at C:\Scans, Forms and Pleadings in OneDrive\Desktop), granted julie NTFS permissions on all three, and mapped persistent network drives (S:, F:, P:) on the laptop. Created desktop shortcuts initially pointing to drive letters, later updated to UNC paths using the FRONT hostname for better resilience. Initiated Office 365 and Adobe Creative Cloud Desktop installations on the laptop.
+
+Granted julie@rswolkin.com FullAccess permissions to robert@rswolkin.com's M365 mailbox using the ComputerGuru Exchange Operator app via the remediation tool. Enabled AutoMapping so Robert's mailbox will appear automatically in Julie's Outlook. Investigated printer sharing for the RICOH network printer (172.17.110.110) but encountered access denied errors from the laptop. Deferred printer access for later investigation after choosing to fix sharing over ZeroTier rather than routing the entire office subnet through the mesh.
+
+## Key Decisions
+
+- **ZeroTier over Tailscale**: Switched from Tailscale to ZeroTier for the peer-to-peer VPN connection per user preference
+- **Hostname-based UNC paths**: Updated desktop shortcuts to use \\FRONT\ hostname instead of drive letters for better resilience if mapped drives disconnect or IPs change
+- **Administrator access for julie**: Made julie a full Administrator on the laptop rather than standard user to simplify access and troubleshooting
+- **AutoMapping enabled**: Enabled AutoMapping for mailbox delegation so Robert's mailbox appears automatically in Julie's Outlook without manual configuration
+- **Printer sharing vs routing**: Chose Option 2 (fix printer sharing over ZeroTier) instead of Option 1 (route entire 172.17.0.0/16 office subnet) for security and simplicity
+- **Deferred printer troubleshooting**: Postponed printer access investigation to focus on completing file sharing and mailbox access first
+
+## Problems Encountered
+
+### GuruRMM Password Setting Commands Fail Silently
+
+**Problem**: All password setting commands via GuruRMM return exit 0 and "The command completed successfully" but passwords don't actually get set. Tested:
+- PowerShell: `Set-LocalUser -Name "julie" -Password $securePassword`
+- PowerShell: `net user julie Jaylen0607!`
+- CMD (shell type): `net user julie Jaylen0607!`
+
+All three methods failed. `net user julie` showed "Password required: No" and authentication with the password failed.
+
+**Resolution**: User manually set passwords via ScreenConnect using `net user julie Jaylen0607!` which worked. Both GuruRMM and ScreenConnect run commands as SYSTEM, ruling out privilege issues. The bug is specific to GuruRMM agent's process spawning mechanism. Documented in `.claude/memory/feedback_rmm_password_limitation.md` with HIGH priority flag.
+
+**Workaround**: Use ScreenConnect for password operations until GuruRMM agent bug is fixed.
+
+### Forms and Pleadings Folders Access Denied
+
+**Problem**: After creating SMB shares and mapping drives, `Test-Path F:\` and `Test-Path P:\` returned False with access denied errors.
+
+**Cause**: NTFS permissions weren't granted on the OneDrive-redirected folders. Share permissions alone weren't sufficient.
+
+**Resolution**: Granted julie full NTFS permissions on both folders using `Get-Acl`/`Set-Acl` with FileSystemAccessRule for FullControl with ContainerInherit and ObjectInherit flags.
+
+### Scans Folder Access Denied
+
+**Problem**: After Forms/Pleadings fix worked, user reported Scans folder showed "You don't currently have access to this folder."
+
+**Cause**: C:\Scans (not in OneDrive) didn't have NTFS permissions for julie, only share permissions.
+
+**Resolution**: Applied same NTFS permission grant to C:\Scans.
+
+### Drive Mapping Timeout
+
+**Problem**: Attempted to remap drives from IP addresses (10.147.19.199) to hostname (FRONT) but command timed out after 30 seconds.
+
+**Resolution**: Remapped drives later using hostname with a longer timeout (60 seconds). All three drives mapped successfully with persistent connections.
+
+### Desktop Shortcuts Stopped Working
+
+**Problem**: User reported desktop shortcuts suddenly didn't work.
+
+**Cause**: Network drives (S:, F:, P:) had disconnected and weren't mapped.
+
+**Resolution**: Remapped all three drives using `net use` with `/persistent:yes` flag and FRONT hostname. Updated desktop shortcuts to use UNC paths (\\FRONT\...) instead of drive letters for better resilience.
+
+### RICOH Printer Access Denied
+
+**Problem**: Shared RICOH printer from FRONT as "RICOH" but laptop couldn't access it (Test-Path returned access denied).
+
+**Cause**: Investigation incomplete. The RICOH PCL6 UniversalDriver connects to network printer at 172.17.110.110 on office LAN. Printer sharing permissions may need additional configuration or the issue may be related to credential passthrough over ZeroTier.
+
+**Status**: Deferred for later investigation. User prioritized completing file sharing and mailbox access first.
+
+## Configuration Changes
+
+### Files Created
+- `.claude/memory/feedback_rmm_password_limitation.md` - Documented GuruRMM password setting bug
+- `clients/wolkin-law/session-logs/2026-06-07-mike-zerotier-setup.md` - This session log
+
+### Files Modified
+- `.claude/memory/MEMORY.md` - Added index entry for RMM password limitation
+
+### Windows Registry/System Changes (FRONT)
+- Uninstalled Tailscale 1.98.4
+- Installed ZeroTier 1.16.2
+- Joined ZeroTier network 17d709436c834c9b (assigned 10.147.19.199)
+- Added hosts file entry: `10.147.19.54    RSW-Laptop`
+- Created SMB share: Forms → C:\Users\Owner\OneDrive\Desktop\Forms
+- Created SMB share: Pleadings → C:\Users\Owner\OneDrive\Desktop\Pleading Forms and Filing
+- Shared printer: RICOH (RICOH PCL6 UniversalDriver V4.33)
+- Granted NTFS permissions: FRONT\julie FullControl on C:\Scans, Forms, Pleadings
+
+### Windows Registry/System Changes (RSW-Laptop)
+- Uninstalled Tailscale 1.98.4
+- Installed ZeroTier 1.16.2
+- Joined ZeroTier network 17d709436c834c9b (assigned 10.147.19.54)
+- Added hosts file entry: `10.147.19.199   FRONT`
+- Created local user: julie (Administrator group)
+- Mapped network drives:
+  - S: → \\FRONT\Scans (persistent)
+  - F: → \\FRONT\Forms (persistent)
+  - P: → \\FRONT\Pleadings (persistent)
+- Created desktop shortcuts:
+  - Scans.lnk → \\FRONT\Scans
+  - Forms.lnk → \\FRONT\Forms
+  - Pleading Forms and Filing.lnk → \\FRONT\Pleadings
+- Started Microsoft 365 installation (Office Deployment Tool, O365BusinessRetail, 64-bit, silent)
+- Started Adobe Creative Cloud Desktop installation (silent)
+
+### M365 Tenant Changes (rswolkin.com / ceb6dbe7-82c8-4d8f-9c6b-49aa26208e9b)
+- Granted julie@rswolkin.com FullAccess to robert@rswolkin.com mailbox (AutoMapping enabled)
+
+## Credentials & Secrets
+
+### Local Accounts
+- **julie** (both machines): `Jaylen0607!` (matches M365 password)
+- User is Administrator on RSW-Laptop
+
+### M365 Accounts
+- **julie@rswolkin.com**: `Jaylen0607!` (for Office 365 sign-in)
+- **robert@rswolkin.com**: `Alissa16$!` (for Adobe Creative Cloud sign-in)
+
+### ZeroTier Network
+- **Network ID**: `17d709436c834c9b`
+- **FRONT Node ID**: `0c00b9917a`
+- **RSW-Laptop Node ID**: `2a497be947`
+
+## Infrastructure & Servers
+
+### Machines
+- **FRONT**: Office PC, Windows, ZeroTier IP 10.147.19.199
+- **RSW-Laptop**: Remote laptop, Windows, ZeroTier IP 10.147.19.54
+
+### Network Configuration
+- **ZeroTier Network**: 17d709436c834c9b
+- **Hosts file entries**: Bidirectional (FRONT ↔ RSW-Laptop)
+- **Office printer**: RICOH at 172.17.110.110 (Standard TCP/IP Port 9100)
+
+### M365 Tenant
+- **Domain**: rswolkin.com
+- **Tenant ID**: ceb6dbe7-82c8-4d8f-9c6b-49aa26208e9b
+
+### SMB Shares (from FRONT)
+- **\\FRONT\Scans** → C:\Scans
+- **\\FRONT\Forms** → C:\Users\Owner\OneDrive\Desktop\Forms
+- **\\FRONT\Pleadings** → C:\Users\Owner\OneDrive\Desktop\Pleading Forms and Filing
+- **\\FRONT\RICOH** → RICOH PCL6 UniversalDriver V4.33 (printer share)
+
+## Commands & Outputs
+
+### ZeroTier Installation
+```powershell
+$zt_url = "https://download.zerotier.com/dist/ZeroTier%20One.msi"
+$installer = "$env:TEMP\zerotier-one.msi"
+Invoke-WebRequest -Uri $zt_url -OutFile $installer -UseBasicParsing
+Start-Process msiexec.exe -ArgumentList "/i `"$installer`" /qn" -Wait
+& "C:\Program Files (x86)\ZeroTier\One\zerotier-cli.bat" join 17d709436c834c9b
+```
+
+Output (FRONT):
+```
+200 join OK
+200 info 0c00b9917a 1.16.2 ONLINE
+200 listnetworks 17d709436c834c9b ... OK_PRIVATE 10.147.19.199/24
+```
+
+### Hosts File Entries
+```powershell
+# On FRONT
+Add-Content -Path "C:\Windows\System32\drivers\etc\hosts" -Value "`n# ZeroTier - Wolkin laptop`n10.147.19.54    RSW-Laptop"
+
+# On RSW-Laptop
+Add-Content -Path "C:\Windows\System32\drivers\etc\hosts" -Value "`n# ZeroTier - Office PC`n10.147.19.199   FRONT"
+```
+
+### Drive Mapping
+```cmd
+net use S: \\FRONT\Scans /user:FRONT\julie Jaylen0607! /persistent:yes
+net use F: \\FRONT\Forms /user:FRONT\julie Jaylen0607! /persistent:yes
+net use P: \\FRONT\Pleadings /user:FRONT\julie Jaylen0607! /persistent:yes
+```
+
+Output:
+```
+The command completed successfully.
+
+Status       Local     Remote                    Network
+-------------------------------------------------------------------------------
+OK           F:        \\FRONT\Forms             Microsoft Windows Network
+OK           P:        \\FRONT\Pleadings         Microsoft Windows Network
+OK           S:        \\FRONT\Scans             Microsoft Windows Network
+```
+
+### M365 Mailbox Permission
+```bash
+# Via remediation tool with Exchange Operator app
+curl -X POST "https://outlook.office365.com/adminapi/beta/$TENANT_ID/InvokeCommand" \
+  -H "Authorization: Bearer $TOKEN" \
+  -d '{"CmdletInput":{"CmdletName":"Add-MailboxPermission","Parameters":{"Identity":"robert@rswolkin.com","User":"julie@rswolkin.com","AccessRights":"FullAccess","InheritanceType":"All","AutoMapping":true}}}'
+```
+
+Response:
+```json
+{
+  "AccessRights": ["FullAccess"],
+  "Deny": "False",
+  "InheritanceType": "All",
+  "User": "S-1-5-21-3469244227-2178789719-3906049723-52332070",
+  "Identity": "Robert Wolkin",
+  "IsInherited": false,
+  "IsValid": true
+}
+```
+
+### GuruRMM Password Bug Examples
+All returned exit 0 but failed to actually set passwords:
+
+```powershell
+# PowerShell Set-LocalUser - FAILED
+Set-LocalUser -Name "julie" -Password (ConvertTo-SecureString "Jaylen0607!" -AsPlainText -Force)
+
+# PowerShell net user - FAILED
+net user julie Jaylen0607!
+
+# CMD net user - FAILED (via command_type: "shell")
+net user julie Jaylen0607!
+```
+
+ScreenConnect (same command as SYSTEM) - WORKED:
+```cmd
+net user julie Jaylen0607!
+```
+
+## Pending / Incomplete Tasks
+
+### High Priority
+1. **Fix GuruRMM password setting bug** - Commands return exit 0 but passwords don't set. Affects both PowerShell and CMD execution contexts. ScreenConnect works with identical commands. Investigation needed on GuruRMM Windows agent process spawning code.
+
+### Medium Priority
+2. **Fix RICOH printer access** - Printer is shared from FRONT as "RICOH" but laptop gets access denied. Need to investigate printer share permissions and credential passthrough over ZeroTier.
+
+3. **Verify Office 365 and Adobe installations** - Both installations were started but running in background when session ended. Verify completion status and test functionality.
+
+4. **Test mailbox access** - Verify julie can access Robert's mailbox in Outlook after AutoMapping propagates (5-15 minutes).
+
+### Low Priority
+5. **Test file share access from Julie's user session** - All testing was done from SYSTEM context. Verify julie can actually access the shares when logged in.
+
+6. **Document ZeroTier network in wiki** - Add ZeroTier network configuration and node IDs to Wolkin Law wiki article.
+
+## Reference Information
+
+### GuruRMM Agent IDs
+- **FRONT**: `04765560-3e8a-46e5-a507-c5f5f4ead6eb`
+- **RSW-Laptop**: `043fd673-35a2-4d3d-8f91-ed73ce70cc1e`
+
+### Command IDs (for reference)
+- ZeroTier installation FRONT: Various
+- ZeroTier installation laptop: Various
+- Hosts file FRONT: `9f3fc33a-590a-4e94-8ced-519b1f0a139d`
+- Hosts file laptop: `042f7eda-187a-4d9b-baeb-2f6aab0d9b08`
+- Drive mapping (final): `a16553df-0131-4dec-ba36-65248e185b25`
+- Desktop shortcuts update: `f441a9d9-488c-4db8-9387-6fa68fe63a9c`
+- Julie admin access: `638355c6-1dc6-45b9-88da-48e84581a415`
+
+### Vault Paths
+- GuruRMM API credentials: `infrastructure/gururmm-server.sops.yaml`
+- Exchange Operator app: `msp-tools/computerguru-exchange-operator.sops.yaml`
+
+### Software Versions
+- ZeroTier: 1.16.2
+- Tailscale (removed): 1.98.4
+- Office Deployment Tool: 17830-20162
+- Adobe Creative Cloud Desktop: 6.0.0.660
+
+### URLs
+- ZeroTier MSI: https://download.zerotier.com/dist/ZeroTier%20One.msi
+- Office Deployment Tool: https://download.microsoft.com/download/2/7/A/27AF1BE6-DD20-4CB4-B154-EBAB8A7D4A7E/officedeploymenttool_17830-20162.exe
+- Adobe CC Desktop: https://ccmdl.adobe.com/AdobeProducts/KCCC/CCD/6_0/win64/ACCCx6_0_0_660.exe
--- a/clients/wolkin/session-logs/2026-06/2026-06-11-mike-printer-rediagnosis-and-slug-consolidation.md
+++ b/clients/wolkin/session-logs/2026-06/2026-06-11-mike-printer-rediagnosis-and-slug-consolidation.md
@@ -0,0 +1,72 @@
+# Wolkin Law — Printer re-diagnosis (error 67) + client-slug consolidation
+
+## User
+- **User:** Mike Swanson (mike)
+- **Machine:** GURU-5070
+- **Role:** admin
+
+## Session Summary
+
+Julie reported "no printers" on RSW-Laptop. Via GuruRMM, confirmed Spooler + ZeroTier running, then established that the only real printer is `\\front\Sharp` (Point-and-Print off FRONT; physical Sharp MX-B557F at office LAN 192.168.1.158). Exhaustively verified the path: ZeroTier up, name resolves (front→10.147.19.199), TCP 445/139 open, **MTU 2800 carries full DF packets** (MTU ruled out), FRONT healthy (spooler running, `Sharp` shared, profile Private, SMB-In allowed), laptop ZT adapter bindings (`ms_msclient`/`ms_server`) all present, both ends' ZT profile Private. Yet `net use \\front\IPC$` (and by IP) fails with **System error 67** and `net view` with **RPC 1702** — and error 67 persists **even with valid `FRONT\julie` credentials**, ruling out auth/firewall/MTU/bindings/profile. Rebooted both machines mid-session (user request); did not change it.
+
+Mike flagged this as a failure of the session-logs/wiki systems — we "spent two days" on this user/laptop. Investigation showed the work WAS captured but the client was **fragmented across four slugs** (`wolkin`, `wolkin-law`, `rswolkin`, `robert-wolkin`), so neither recall nor I found it, and I re-derived a diagnosis that the 2026-06-07 log already had. That log showed the **same error 67 / RPC 1702** and that Mike cleared it by connecting `\\front\Sharp` **manually/interactively** (scripted `Add-Printer` failed there too). It also flagged "migrate front\julie creds to vault" and "consolidate the slugs" as pending — never actioned.
+
+Per Mike's "Do all", executed the full remediation: (1) restore-printer test with the recovered credential — confirmed error 67 is NOT auth, so the scripted path can't fix it (needs ScreenConnect/interactive, same as before); (2) vaulted `front\julie` + the M365 user passwords; (3) consolidated the four slugs into canonical `wolkin` (moved logs/baselines, merged + corrected the wiki, stubbed the duplicates), corrected a cross-client agent-id error, and wrote a memory so this fragmentation failure doesn't recur.
+
+## Key Decisions
+
+- Canonical slug = `wolkin`. Moved all `rswolkin`/`wolkin-law` logs+baselines into `clients/wolkin/`; left README pointer stubs; merged 3 wiki articles into `wiki/clients/wolkin.md` with `aliases:` for recall; stubbed `wolkin-law.md` + `robert-wolkin.md`.
+- Did NOT keep chasing the error-67 SMB quirk scripted — it's a documented wall requiring an interactive fix; logged it loudly in the wiki Patterns instead of burning more cycles.
+- Vault secrets only under `credentials:` via the new `vault` skill helper; infra facts stay in the wiki (plaintext, searchable).
+- Recommend rotating `front\julie` since its password transited the RMM command log during the authenticated-mount test.
+
+## Problems Encountered
+
+- **Error 67 / RPC 1702 SMB wall (RSW-Laptop → FRONT over ZeroTier):** all underlying layers verified healthy; persists with valid creds. Same as 2026-06-07. Resolution: interactive/ScreenConnect connection (pending); root cause of the redirector quirk still unidentified.
+- **Client-slug fragmentation:** one client under 4 slugs → 2-day build looked lost. Consolidated. Memory written (`feedback_client_slug_fragmentation.md`).
+- **Cross-client data error:** retired `wolkin-law.md` listed FRONT's RMM agent id as `04765560-…` = actually Rednour's FrontDeskReception. Corrected (FRONT = `877d311a-…`).
+- **Plaintext creds in wiki:** `wolkin-law.md` held robert/julie passwords in clear — moved to vault, scrubbed by stubbing the file.
+- **`Get-NetAdapterBinding -Name "ZeroTier One [..]"` returns empty** — the `[ ]` in the adapter name are PowerShell wildcards; query by `-InterfaceDescription "ZeroTier Virtual Port"` or pipe the adapter object. (This made me twice misread the bindings as missing.)
+
+## Configuration Changes
+
+- **Vault (new):** `clients/wolkin/front-julie.sops.yaml` (front\julie local acct); `clients/wolkin/m365-users.sops.yaml` (robert@/julie@ rswolkin.com).
+- **Repo moves:** `clients/rswolkin/*` and `clients/wolkin-law/session-logs/*` → `clients/wolkin/` (session-logs, onboarding-baselines, remote-printing-tailscale-plan.md). README stubs left in `clients/rswolkin/`, `clients/wolkin-law/`.
+- **Wiki:** rewrote/enriched `wiki/clients/wolkin.md` (canonical — added GuruRMM agent IDs + Site ID, tenant, error-67 Patterns entry, vault pointers, consolidation banner, 2026-06-11 history). Stubbed `wiki/clients/wolkin-law.md` + `wiki/clients/robert-wolkin.md` → `[[wolkin]]`.
+- **Memory:** `feedback_client_slug_fragmentation.md` + MEMORY.md index line.
+- No repo code changes; RMM dispatches were read-only diagnostics + the two reboots.
+
+## Credentials & Secrets
+
+- `front\julie` (local on FRONT + RSW-Laptop) = `Jaylen0607!` → vault `clients/wolkin/front-julie.sops.yaml`. **Recommend rotation** (transited RMM command log during diagnosis).
+- M365: robert@rswolkin.com = `Alissa16$!`; julie@rswolkin.com = `Jaylen0607!` → vault `clients/wolkin/m365-users.sops.yaml`.
+- `front\Localadmin` exists on both machines (Mike's suggested admin) but its password was never recorded anywhere — still unknown/unvaulted.
+
+## Infrastructure & Servers
+
+- ZeroTier mesh `17d709436c834c9b` (10.147.19.0/24): front 10.147.19.199, RSW-Laptop 10.147.19.54. Laptop hosts entry `10.147.19.199 FRONT`.
+- FRONT: LAN 192.168.1.153/24, ZeroTier 10.147.19.199. Sharp MX-B557F printer @ 192.168.1.158:9100, shared `\\front\Sharp`. RMM agent `877d311a-4b24-462c-97b1-d2a0f7730a71`. Local admins: Administrator, Localadmin, Owner.
+- RSW-Laptop: ZeroTier 10.147.19.54, Wi-Fi 192.168.0.106. Logged-on user `rsw-laptop\julie`. RMM agent `043fd673-35a2-4d3d-8f91-ed73ce70cc1e`.
+- DESKTOP-V1JT1SE (Bob's personal, out of scope): RMM `30f6af79-ab19-4ed3-9ebc-71b2bffc2d27`.
+- M365 tenant rswolkin.com (`ceb6dbe7-82c8-4d8f-9c6b-49aa26208e9b` — from prior article, unverified). RMM client `Wolkin, Robert` / site `Main` / Site ID `2bb05f85-9fc8-4a7e-a5e5-ffe0c46431ac`.
+
+## Commands & Outputs
+
+- `net use \\10.147.19.199\IPC$ /user:FRONT\julie Jaylen0607!` → System error 67 (auth ruled out).
+- DF ping sweep laptop→front: payload 2772 (pkt 2800) OK → MTU not the issue.
+- `Get-NetAdapterBinding -InterfaceDescription "ZeroTier Virtual Port"` → ms_msclient/ms_server/ms_tcpip all True (bindings fine; `-Name` with brackets returns empty).
+- Reboots: RSW-Laptop cmd `5505cdc8`, front cmd `53ac28e1` (both /r /t 15 /f).
+
+## Pending / Incomplete Tasks
+
+- **[CRITICAL] Restore Julie's printer** — reconnect `\\front\Sharp` interactively via ScreenConnect as Julie (scripted hits error 67). This is the actual unresolved issue.
+- **Rotate `front\julie`** password (exposed in RMM command log); re-vault.
+- Identify/vault `front\Localadmin` password (never recorded).
+- Root-cause the error-67 SMB-over-ZeroTier redirector quirk (currently worked around manually each time).
+- Verify the M365 tenant ID; capture Syncro customer ID + billing model (still `verify`).
+
+## Reference Information
+
+- Canonical: `clients/wolkin/`, `wiki/clients/wolkin.md`. Vault: `clients/wolkin/`.
+- Syncro ticket #32369 (Remote Work Access Setup).
+- Memory: `feedback_client_slug_fragmentation.md`, `feedback_rmm_password_limitation.md`.