From d037d82f5eef551578312652fa30c42e6162bdc6 Mon Sep 17 00:00:00 2001 From: Howard Enos Date: Wed, 8 Jul 2026 12:39:32 -0700 Subject: [PATCH] sync: auto-sync from HOWARD-HOME at 2026-07-08 12:39:04 Author: Howard Enos Machine: HOWARD-HOME Timestamp: 2026-07-08 12:39:04 --- .../4PAWS-DOC-20260708T193830.json | 762 ++++++++++++++++++ .../4PAWS-DOC-20260708T193830.md | 213 +++++ 2 files changed, 975 insertions(+) create mode 100644 clients/four-paws/onboarding-baselines/4PAWS-DOC-20260708T193830.json create mode 100644 clients/four-paws/onboarding-baselines/4PAWS-DOC-20260708T193830.md diff --git a/clients/four-paws/onboarding-baselines/4PAWS-DOC-20260708T193830.json b/clients/four-paws/onboarding-baselines/4PAWS-DOC-20260708T193830.json new file mode 100644 index 00000000..d77bae1f --- /dev/null +++ b/clients/four-paws/onboarding-baselines/4PAWS-DOC-20260708T193830.json @@ -0,0 +1,762 @@ +{ + "host": "4PAWS-DOC", + "collected_at_utc": "2026-07-08T19:37:48Z", + "os": { + "caption": "Microsoft Windows 11 Pro", + "version": "10.0.26200", + "build": "26200", + "install_date": "2025-01-28T17:35:43Z", + "last_boot_utc": "2026-07-08T04:47:17Z", + "architecture": "64-bit" + }, + "facts": { + "builtin_admin_enabled": false, + "os_eol": { + "eol_date": "2027-10-12", + "release": "Win11 25H2" + }, + "pending_updates": 2, + "pending_reboot": false, + "uptime_days": 0.6, + "acg_managed_tools": "ScreenConnect / ConnectWise Control", + "hardware": { + "model": "Vostro 3910", + "manufacturer": "Dell Inc.", + "bios_date": "2026-04-23", + "cpu_logical": 12, + "bios_version": "1.40.0", + "cpu_cores": 6, + "ram_gb": 15.7, + "serial": "FDQ5Y04", + "cpu": "12th Gen Intel(R) Core(TM) i5-12400" + }, + "third_party_av_active": false, + "os_build": "26200", + "secure_boot": false, + "backup_agents": null, + "autoruns_run_keys": [ + { + "key": "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run", + "name": "SecurityHealth", + "value": "C:\\WINDOWS\\system32\\SecurityHealthSystray.exe" + }, + { + "key": "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run", + "name": "WavesSvc", + "value": "\"C:\\WINDOWS\\System32\\DriverStore\\FileRepository\\wavesapo10de.inf_amd64_db3f3288eba6a142\\WavesSvc64.exe\" -Jack" + }, + { + "key": "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run", + "name": "DYMOWebApi", + "value": "\"C:\\Program Files (x86)\\DYMO\\DYMO Connect\\DYMO.WebApi.Win.Host.exe\" /auto" + }, + { + "key": "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run", + "name": "DymoOfficeHelper", + "value": "\"C:\\Program Files (x86)\\DYMO\\DYMO Connect\\DYMO.OfficeHelper.exe\" /w" + }, + { + "key": "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run", + "name": "M22A", + "value": "C:\\WINDOWS\\twain_64\\Brimm22a\\Common\\TwDsUiLaunch.exe" + }, + { + "key": "HKLM:\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run", + "name": "DYMOWebApi", + "value": "\"C:\\Program Files (x86)\\DYMO\\DYMO Connect\\DYMO.WebApi.Win.Host.exe\" /auto" + }, + { + "key": "HKLM:\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run", + "name": "M22A", + "value": "C:\\WINDOWS\\twain_32\\Brimm22a\\Common\\TwDsUiLaunch.exe" + }, + { + "key": "HKLM:\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run", + "name": "BrStsMon00", + "value": "C:\\Program Files (x86)\\Browny02\\Brother\\BrStMonW.exe /AUTORUN" + }, + { + "key": "HKLM:\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run", + "name": "BrotherSoftwareUpdateNotification", + "value": "C:\\Program Files (x86)\\Brother\\SoftwareUpdateNotification\\SoftwareUpdateNotificationService.exe /Autorun" + } + ], + "physical_disks": [ + { + "health": "Healthy", + "model": "SK hynix BC901 HFS512GEJ9X108N", + "media_type": "SSD" + } + ], + "local_users": [ + { + "last_logon": "2025-01-15", + "name": "Administrator", + "password_never_expires": false, + "enabled": false + }, + { + "last_logon": "", + "name": "DefaultAccount", + "password_never_expires": false, + "enabled": false + }, + { + "last_logon": "", + "name": "Guest", + "password_never_expires": false, + "enabled": false + }, + { + "last_logon": "2026-07-08", + "name": "staff", + "password_never_expires": false, + "enabled": true + }, + { + "last_logon": "", + "name": "WDAGUtilityAccount", + "password_never_expires": false, + "enabled": false + } + ], + "scheduled_tasks_count": 15, + "volumes": [ + { + "drive": "[unlabeled]", + "size_gb": 0.1, + "free_pct": 30.8, + "free_gb": 0 + }, + { + "drive": "[unlabeled]", + "size_gb": 0.8, + "free_pct": 14.2, + "free_gb": 0.1 + }, + { + "drive": "C:", + "size_gb": 476, + "free_pct": 82.5, + "free_gb": 392.8 + } + ], + "network_adapters": [ + { + "dhcp": true, + "description": "Realtek PCIe GbE Family Controller", + "gateway": [ + "192.168.0.1", + "fe80::10:18ff:fe13:98e0" + ], + "mac": "20:88:10:8E:C7:FA", + "ip": [ + "192.168.0.148", + "fe80::2635:722c:b187:5043", + "2001:579:83bc:aa0:28ca:10c6:a604:300a", + "2001:579:83bc:aa0:e1eb:2999:7092:bb44", + "2001:579:83bc:aa0:cb54:157:d896:fd93" + ], + "dns": [ + "68.105.28.15", + "68.105.29.15", + "68.105.28.17" + ] + } + ], + "failed_autostart_services": { + "name": "Intel(R) Platform License Manager Service", + "display": "Intel(R) Platform License Manager Service", + "state": "Stopped" + }, + "stability_14d": { + "unexpected_shutdowns": 0, + "disk_errors": 0, + "bugchecks": 0 + }, + "exposure": { + "smb1_enabled": false, + "laps_present": true, + "rdp_enabled": false, + "uac_enabled": true, + "rdp_nla": true + }, + "accounts_password_never_expires": [], + "installed_software": [ + { + "publisher": "Brother Industries Ltd.", + "name": "BrLauncher", + "version": "2.0.36.0" + }, + { + "publisher": "Brother Industries Ltd.", + "name": "BrLogRx", + "version": "1.0.5.0" + }, + { + "publisher": "Brother Industries, Ltd.", + "name": "Brother iPrint&Scan", + "version": "13.1.0.85" + }, + { + "publisher": "Brother Industries Ltd.", + "name": "Brother PCFax Driver", + "version": "1.4.2.3" + }, + { + "publisher": "Brother Industries Ltd.", + "name": "Brother Printer Driver", + "version": "2.1.0.0" + }, + { + "publisher": "Brother Industries Ltd.", + "name": "Brother Scanner Driver", + "version": "1.0.11.1" + }, + { + "publisher": "Brother Industries Ltd.", + "name": "Brother Scanner Driver", + "version": "1.0.21.1" + }, + { + "publisher": "Brother Industries Ltd.", + "name": "BrSupportTools", + "version": "1.0.44.0" + }, + { + "publisher": "Microsoft Corporation", + "name": "Copilot", + "version": "149.0.4022.80" + }, + { + "publisher": "Dell Technologies, Inc.", + "name": "Dell Connected Service Delivery", + "version": "1.1.1.0" + }, + { + "publisher": "Dell Technologies, Inc.", + "name": "Dell Connected Service Delivery SubAgent", + "version": "1.1.0.0" + }, + { + "publisher": "Dell, Inc.", + "name": "Dell Core Services", + "version": "1.13.21.0" + }, + { + "publisher": "Dell Inc.", + "name": "Dell SupportAssist PC Analytics", + "version": "4.10.6.48716" + }, + { + "publisher": "DYMO", + "name": "DYMO Connect", + "version": "1.4.8.3" + }, + { + "publisher": "DYMO", + "name": "DYMO Connect Web Service", + "version": "1.4.8.3" + }, + { + "publisher": "Brother Industries Ltd.", + "name": "HowToGuide", + "version": "1.0.3.0" + }, + { + "publisher": "Brother Industries Ltd.", + "name": "HttpToUsbBridge", + "version": "2.5.108.1" + }, + { + "publisher": "Microsoft Corporation", + "name": "Microsoft .NET 8.0.12 - Windows Server Hosting", + "version": "8.0.12.24603" + }, + { + "publisher": "Microsoft Corporation", + "name": "Microsoft .NET Host - 8.0.12 (x86)", + "version": "64.48.26165" + }, + { + "publisher": "Microsoft Corporation", + "name": "Microsoft .NET Host - 8.0.23 (x64)", + "version": "64.92.45415" + }, + { + "publisher": "Microsoft Corporation", + "name": "Microsoft .NET Host FX Resolver - 8.0.12 (x64)", + "version": "64.48.26165" + }, + { + "publisher": "Microsoft Corporation", + "name": "Microsoft .NET Host FX Resolver - 8.0.12 (x86)", + "version": "64.48.26165" + }, + { + "publisher": "Microsoft Corporation", + "name": "Microsoft .NET Host FX Resolver - 8.0.23 (x64)", + "version": "64.92.45415" + }, + { + "publisher": "Microsoft Corporation", + "name": "Microsoft .NET Runtime - 8.0.12 (x64)", + "version": "64.48.26165" + }, + { + "publisher": "Microsoft Corporation", + "name": "Microsoft .NET Runtime - 8.0.12 (x86)", + "version": "64.48.26165" + }, + { + "publisher": "Microsoft Corporation", + "name": "Microsoft .NET Runtime - 8.0.23 (x64)", + "version": "64.92.45415" + }, + { + "publisher": "Microsoft Corporation", + "name": "Microsoft 365 Apps for business - en-us", + "version": "16.0.20131.20112" + }, + { + "publisher": "Microsoft Corporation", + "name": "Microsoft ASP.NET Core 8.0.12 Hosting Bundle Options", + "version": "8.0.12.24603" + }, + { + "publisher": "Microsoft Corporation", + "name": "Microsoft ASP.NET Core 8.0.12 Shared Framework (x64)", + "version": "8.0.12.24603" + }, + { + "publisher": "Microsoft Corporation", + "name": "Microsoft ASP.NET Core 8.0.12 Shared Framework (x86)", + "version": "8.0.12.24603" + }, + { + "publisher": "Microsoft Corporation", + "name": "Microsoft Edge", + "version": "150.0.4078.48" + }, + { + "publisher": "Microsoft Corporation", + "name": "Microsoft Edge WebView2 Runtime", + "version": "150.0.4078.48" + }, + { + "publisher": "Microsoft Corporation", + "name": "Microsoft OneDrive", + "version": "26.108.0607.0002" + }, + { + "publisher": "Microsoft Corporation", + "name": "Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319", + "version": "10.0.30319" + }, + { + "publisher": "Microsoft Corporation", + "name": "Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319", + "version": "10.0.30319" + }, + { + "publisher": "Microsoft Corporation", + "name": "Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.44.35211", + "version": "14.44.35211.0" + }, + { + "publisher": "Microsoft Corporation", + "name": "Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.44.35211", + "version": "14.44.35211.0" + }, + { + "publisher": "Microsoft Corporation", + "name": "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.44.35211", + "version": "14.44.35211" + }, + { + "publisher": "Microsoft Corporation", + "name": "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.44.35211", + "version": "14.44.35211" + }, + { + "publisher": "Microsoft Corporation", + "name": "Microsoft Visual C++ 2022 X86 Additional Runtime - 14.44.35211", + "version": "14.44.35211" + }, + { + "publisher": "Microsoft Corporation", + "name": "Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.44.35211", + "version": "14.44.35211" + }, + { + "publisher": "Microsoft Corporation", + "name": "Microsoft Windows Desktop Runtime - 8.0.12 (x86)", + "version": "64.48.26178" + }, + { + "publisher": "Microsoft Corporation", + "name": "Microsoft Windows Desktop Runtime - 8.0.12 (x86)", + "version": "8.0.12.34404" + }, + { + "publisher": "Microsoft Corporation", + "name": "Microsoft Windows Desktop Runtime - 8.0.23 (x64)", + "version": "64.92.45458" + }, + { + "publisher": "Microsoft Corporation", + "name": "Microsoft Windows Desktop Runtime - 8.0.23 (x64)", + "version": "8.0.23.35609" + }, + { + "publisher": "Brother Industries, Ltd.", + "name": "NetworkRepairTool", + "version": "1.2.29.0" + }, + { + "publisher": "Microsoft Corporation", + "name": "Office 16 Click-to-Run Extensibility Component", + "version": "16.0.20131.20112" + }, + { + "publisher": "Brother Industries, Ltd.", + "name": "PC-FAXReceive", + "version": "1.9.11.0" + }, + { + "publisher": "Brother Industries Ltd.", + "name": "PCFaxTx", + "version": "3.7.17.1" + }, + { + "publisher": "IDrive Inc", + "name": "RemotePC Printer", + "version": "3.0.2" + }, + { + "publisher": "IDrive Inc", + "name": "RemotePC version 7.6.96", + "version": "7.6.96" + }, + { + "publisher": "Brother", + "name": "ScannerUtilityInstaller", + "version": "1.20.0.1" + }, + { + "publisher": "ScreenConnect Software", + "name": "ScreenConnect Client (1912bf3444b41a08)", + "version": "26.4.3.9662" + }, + { + "publisher": "Brother Industries, Ltd.", + "name": "SoftwareUpdateNotification", + "version": "1.0.26.0" + }, + { + "publisher": "Brother Industries, Ltd.", + "name": "StatusMonitor", + "version": "1.42.0.0" + }, + { + "publisher": "Brother Industries, Ltd.", + "name": "UsbRepairTool", + "version": "1.4.0.0" + } + ], + "tpm": { + "enabled": true, + "ready": true, + "present": true + }, + "local_groups": [ + "Access Control Assistance Operators", + "Administrators", + "Backup Operators", + "Cryptographic Operators", + "Device Owners", + "Distributed COM Users", + "Event Log Readers", + "Guests", + "Hyper-V Administrators", + "IIS_IUSRS", + "Network Configuration Operators", + "OpenSSH Users", + "Performance Log Users", + "Performance Monitor Users", + "Power Users", + "Remote Desktop Users", + "Remote Management Users", + "Replicator", + "System Managed Accounts Group", + "User Mode Hardware Operators", + "Users" + ], + "battery": { + "present": false + }, + "activation": { + "edition": "Microsoft Windows 11 Pro", + "description": "Windows(R) Operating System, OEM_DM channel", + "licensed": true, + "license_status_code": 1 + }, + "time_source": "The following error occurred: The service has not been started. (0x80070426)", + "chassis_types": [ + 3 + ], + "last_hotfix": { + "hotfix_id": "KB5094126", + "installed_on": "2026-07-08T07:00:00Z" + }, + "scheduled_tasks": [ + { + "path": "\\", + "name": "Dell SupportAssistAgent AutoUpdate", + "state": "Ready" + }, + { + "path": "\\", + "name": "MicrosoftEdgeUpdateTaskMachineCore{EB845478-3E63-44EA-9AFA-363DC485B96A}", + "state": "Ready" + }, + { + "path": "\\", + "name": "MicrosoftEdgeUpdateTaskMachineUA{9982F269-BC64-4D3B-B5D1-5279CD631569}", + "state": "Ready" + }, + { + "path": "\\", + "name": "OneDrive Per-Machine Standalone Update Task", + "state": "Ready" + }, + { + "path": "\\", + "name": "OneDrive Reporting Task-S-1-5-21-4096311219-2282814006-369346320-1002", + "state": "Ready" + }, + { + "path": "\\", + "name": "OneDrive Reporting Task-S-1-5-21-4096311219-2282814006-369346320-500", + "state": "Ready" + }, + { + "path": "\\", + "name": "OneDrive Startup Task-S-1-5-21-4096311219-2282814006-369346320-1002", + "state": "Ready" + }, + { + "path": "\\", + "name": "RemotePC", + "state": "Ready" + }, + { + "path": "\\", + "name": "RPCServiceHealthCheck", + "state": "Ready" + }, + { + "path": "\\", + "name": "ServiceMonitor", + "state": "Ready" + }, + { + "path": "\\", + "name": "StartRPCPerformanceService", + "state": "Ready" + }, + { + "path": "\\", + "name": "StartRPCPerformanceServiceOnStart", + "state": "Ready" + }, + { + "path": "\\", + "name": "StartRPCService", + "state": "Ready" + }, + { + "path": "\\SoftLanding\\S-1-5-21-4096311219-2282814006-369346320-1002\\", + "name": "SoftLandingCreativeManagementTask", + "state": "Ready" + }, + { + "path": "\\SoftLanding\\S-1-5-21-4096311219-2282814006-369346320-1002\\", + "name": "SoftLandingDeferralTask-{93c07fc1-8e63-4b72-8d15-e30d3bfad5e0}", + "state": "Ready" + } + ], + "antivirus_products": [ + "Windows Defender" + ], + "domain_joined": false, + "defender": { + "antispyware_signature_age": 0, + "tamper_protected": true, + "real_time_protection": true, + "nis_enabled": true, + "available": true, + "antivirus_enabled": true, + "am_service_enabled": true + }, + "bitlocker": { + "os_volume": "C:", + "key_protectors": [], + "recovery_key_present": false, + "available": true, + "encryption_percent": 0, + "protection_status": "Off" + }, + "is_laptop": false, + "installed_software_count": 56, + "local_administrators": [ + "4PAWS-DOC\\Administrator", + "4PAWS-DOC\\staff" + ], + "firewall_profiles": { + "Private": true, + "Domain": true, + "Public": true + }, + "domain": "WORKGROUP", + "foreign_agents": null + }, + "findings": [ + { + "id": "sec.defender.ok", + "category": "security", + "severity": "info", + "title": "Defender active and current", + "detail": "Real-time protection on, service running, signatures current.", + "evidence": "RealTimeProtectionEnabled=True; AMServiceEnabled=True; AntispywareSignatureAge=0 days; IsTamperProtected=True" + }, + { + "id": "sec.av_products.defender_only", + "category": "security", + "severity": "info", + "title": "Defender is the only registered AV", + "detail": "Only Microsoft/Windows Defender is registered in Security Center.", + "evidence": "Windows Defender" + }, + { + "id": "sec.foreign_agents.none", + "category": "security", + "severity": "info", + "title": "No competitor/leftover management agents detected", + "detail": "No known competitor RMM or unmanaged remote-access agents found in installed programs or services.", + "evidence": "Scanned uninstall hives (HKLM + WOW6432Node) and Win32_Service" + }, + { + "id": "sec.foreign_agents.acg.screenconnect_connectwise_control", + "category": "security", + "severity": "info", + "title": "Expected ACG management tooling present: ScreenConnect / ConnectWise Control", + "detail": "This is Arizona Computer Guru managed/remote-access tooling that we deploy. Its presence is expected and not a foreign-agent risk.", + "evidence": "program: ScreenConnect Client (1912bf3444b41a08) 26.4.3.9662\nservice: ScreenConnect Client (1912bf3444b41a08) (ScreenConnect Client (1912bf3444b41a08)) Running" + }, + { + "id": "sec.firewall.ok", + "category": "security", + "severity": "info", + "title": "All firewall profiles enabled", + "detail": "Domain, Private, and Public firewall profiles are all enabled.", + "evidence": "Private=True; Domain=True; Public=True" + }, + { + "id": "sec.bitlocker.unencrypted", + "category": "security", + "severity": "warning", + "title": "OS volume is NOT encrypted with BitLocker", + "detail": "The operating system volume is unencrypted. Data is exposed if the disk is removed or the device is lost. Enable BitLocker and escrow the recovery key.", + "evidence": "Volume=C:; ProtectionStatus=Off; EncryptionPercentage=0; KeyProtectors=" + }, + { + "id": "sec.local_admins.list", + "category": "security", + "severity": "info", + "title": "Local administrators (2)", + "detail": "Members of the local Administrators group. Review for unexpected or unknown accounts (especially leftover MSP/vendor accounts from a prior provider).", + "evidence": "4PAWS-DOC\\Administrator\n4PAWS-DOC\\staff" + }, + { + "id": "sec.patch.os_supported", + "category": "security", + "severity": "info", + "title": "OS build supported: Win11 25H2", + "detail": "Build 26200 (Win11 25H2) is in support until 2027-10-12.", + "evidence": "Microsoft Windows 11 Pro build 26200" + }, + { + "id": "sec.patch.pending", + "category": "security", + "severity": "warning", + "title": "2 pending Windows updates", + "detail": "Windows Update reports pending (not installed, not hidden) updates. Some may be security updates. Approve/install on the next maintenance window.", + "evidence": "Microsoft.Update.Session search IsInstalled=0 and IsHidden=0 -> 2" + }, + { + "id": "sec.patch.last_hotfix", + "category": "security", + "severity": "info", + "title": "Last hotfix: KB5094126", + "detail": "Most recently installed update (from Get-HotFix; reflects CBS/MSU packages, not all cumulative metadata).", + "evidence": "KB5094126 installed 2026-07-08T07:00:00Z" + }, + { + "id": "sec.exposure.smb1_off", + "category": "security", + "severity": "info", + "title": "SMBv1 disabled", + "detail": "SMBv1 server protocol is disabled.", + "evidence": "EnableSMB1Protocol=False" + }, + { + "id": "sec.exposure.laps_present", + "category": "security", + "severity": "info", + "title": "LAPS detected", + "detail": "A LAPS mechanism is present.", + "evidence": "Windows LAPS reg key" + }, + { + "id": "health.stability.clean", + "category": "health", + "severity": "info", + "title": "No stability events in the last 14 days", + "detail": "No unexpected shutdowns, BSODs, or disk errors logged.", + "evidence": "Unexpected shutdowns (id 41)=0; Bugchecks/BSOD (id 1001)=0; Disk errors (id 7/51/153)=0" + }, + { + "id": "health.failed_services.stopped", + "category": "health", + "severity": "warning", + "title": "1 auto-start service(s) not running", + "detail": "These services are set to start automatically but are not running. Some may be benign; review for security agents, backup agents, or AV that should be running.", + "evidence": "Intel(R) Platform License Manager Service (Intel(R) Platform License Manager Service) = Stopped" + }, + { + "id": "health.domain.workgroup", + "category": "health", + "severity": "info", + "title": "Not domain-joined (workgroup)", + "detail": "This machine is in workgroup/Azure AD only mode (Domain=WORKGROUP). No on-prem AD secure channel applies.", + "evidence": "PartOfDomain=False; Domain=WORKGROUP" + }, + { + "id": "health.time.source", + "category": "health", + "severity": "info", + "title": "Time service source", + "detail": "Current Windows Time service source.", + "evidence": "Source=The following error occurred: The service has not been started. (0x80070426)" + }, + { + "id": "health.backup.none", + "category": "health", + "severity": "info", + "title": "No backup agent detected", + "detail": "No known backup agent service found. Backup expectation varies by endpoint; confirm whether this machine is supposed to have local/cloud backup and whether server-side or M365 backup covers it.", + "evidence": "No matching backup service in Win32_Service" + } + ] +} diff --git a/clients/four-paws/onboarding-baselines/4PAWS-DOC-20260708T193830.md b/clients/four-paws/onboarding-baselines/4PAWS-DOC-20260708T193830.md new file mode 100644 index 00000000..8fdabe0e --- /dev/null +++ b/clients/four-paws/onboarding-baselines/4PAWS-DOC-20260708T193830.md @@ -0,0 +1,213 @@ +# Onboarding Diagnostic Baseline - 4PAWS-DOC + +- **Grade:** AMBER +- **Host:** 4PAWS-DOC +- **Client:** Four Paws (`four-paws`) +- **Collected (UTC):** 2026-07-08T19:37:48Z +- **Agent ID:** 79d5243b-1b7d-4097-82f6-17b7b701bee5 +- **Command ID:** b7a2000e-6e4d-48ee-b578-98418a94c671 +- **Findings:** 0 critical / 3 warning / 14 info / 0 unknown + +- **OS:** Microsoft Windows 11 Pro (build 26200) + +--- + +## WARNING (3) + +### OS volume is NOT encrypted with BitLocker +- **Category:** security +- **ID:** `sec.bitlocker.unencrypted` +- The operating system volume is unencrypted. Data is exposed if the disk is removed or the device is lost. Enable BitLocker and escrow the recovery key. + +``` +Volume=C:; ProtectionStatus=Off; EncryptionPercentage=0; KeyProtectors= +``` + +### 2 pending Windows updates +- **Category:** security +- **ID:** `sec.patch.pending` +- Windows Update reports pending (not installed, not hidden) updates. Some may be security updates. Approve/install on the next maintenance window. + +``` +Microsoft.Update.Session search IsInstalled=0 and IsHidden=0 -> 2 +``` + +### 1 auto-start service(s) not running +- **Category:** health +- **ID:** `health.failed_services.stopped` +- These services are set to start automatically but are not running. Some may be benign; review for security agents, backup agents, or AV that should be running. + +``` +Intel(R) Platform License Manager Service (Intel(R) Platform License Manager Service) = Stopped +``` + + +## INFO (14) + +### Defender active and current +- **Category:** security +- **ID:** `sec.defender.ok` +- Real-time protection on, service running, signatures current. + +``` +RealTimeProtectionEnabled=True; AMServiceEnabled=True; AntispywareSignatureAge=0 days; IsTamperProtected=True +``` + +### Defender is the only registered AV +- **Category:** security +- **ID:** `sec.av_products.defender_only` +- Only Microsoft/Windows Defender is registered in Security Center. + +``` +Windows Defender +``` + +### No competitor/leftover management agents detected +- **Category:** security +- **ID:** `sec.foreign_agents.none` +- No known competitor RMM or unmanaged remote-access agents found in installed programs or services. + +``` +Scanned uninstall hives (HKLM + WOW6432Node) and Win32_Service +``` + +### Expected ACG management tooling present: ScreenConnect / ConnectWise Control +- **Category:** security +- **ID:** `sec.foreign_agents.acg.screenconnect_connectwise_control` +- This is Arizona Computer Guru managed/remote-access tooling that we deploy. Its presence is expected and not a foreign-agent risk. + +``` +program: ScreenConnect Client (1912bf3444b41a08) 26.4.3.9662 +service: ScreenConnect Client (1912bf3444b41a08) (ScreenConnect Client (1912bf3444b41a08)) Running +``` + +### All firewall profiles enabled +- **Category:** security +- **ID:** `sec.firewall.ok` +- Domain, Private, and Public firewall profiles are all enabled. + +``` +Private=True; Domain=True; Public=True +``` + +### Local administrators (2) +- **Category:** security +- **ID:** `sec.local_admins.list` +- Members of the local Administrators group. Review for unexpected or unknown accounts (especially leftover MSP/vendor accounts from a prior provider). + +``` +4PAWS-DOC\Administrator +4PAWS-DOC\staff +``` + +### OS build supported: Win11 25H2 +- **Category:** security +- **ID:** `sec.patch.os_supported` +- Build 26200 (Win11 25H2) is in support until 2027-10-12. + +``` +Microsoft Windows 11 Pro build 26200 +``` + +### Last hotfix: KB5094126 +- **Category:** security +- **ID:** `sec.patch.last_hotfix` +- Most recently installed update (from Get-HotFix; reflects CBS/MSU packages, not all cumulative metadata). + +``` +KB5094126 installed 2026-07-08T07:00:00Z +``` + +### SMBv1 disabled +- **Category:** security +- **ID:** `sec.exposure.smb1_off` +- SMBv1 server protocol is disabled. + +``` +EnableSMB1Protocol=False +``` + +### LAPS detected +- **Category:** security +- **ID:** `sec.exposure.laps_present` +- A LAPS mechanism is present. + +``` +Windows LAPS reg key +``` + +### No stability events in the last 14 days +- **Category:** health +- **ID:** `health.stability.clean` +- No unexpected shutdowns, BSODs, or disk errors logged. + +``` +Unexpected shutdowns (id 41)=0; Bugchecks/BSOD (id 1001)=0; Disk errors (id 7/51/153)=0 +``` + +### Not domain-joined (workgroup) +- **Category:** health +- **ID:** `health.domain.workgroup` +- This machine is in workgroup/Azure AD only mode (Domain=WORKGROUP). No on-prem AD secure channel applies. + +``` +PartOfDomain=False; Domain=WORKGROUP +``` + +### Time service source +- **Category:** health +- **ID:** `health.time.source` +- Current Windows Time service source. + +``` +Source=The following error occurred: The service has not been started. (0x80070426) +``` + +### No backup agent detected +- **Category:** health +- **ID:** `health.backup.none` +- No known backup agent service found. Backup expectation varies by endpoint; confirm whether this machine is supposed to have local/cloud backup and whether server-side or M365 backup covers it. + +``` +No matching backup service in Win32_Service +``` + + +--- + +## Inventory Baseline Summary + +- **Manufacturer / Model:** Dell Inc. / Vostro 3910 +- **Serial:** FDQ5Y04 +- **CPU:** 12th Gen Intel(R) Core(TM) i5-12400 (6 cores / 12 logical) +- **RAM (GB):** 15.7 +- **BIOS:** 1.40.0 (2026-04-23) +- **Chassis is laptop:** false +- **TPM present / Secure Boot:** true / ? +- **Domain joined:** false (WORKGROUP) +- **OS activation licensed:** true +- **Uptime (days):** 0.6 +- **Pending reboot:** false +- **Installed software count:** 56 +- **Scheduled tasks (non-MS, enabled):** 15 +- **Local administrators:** 4PAWS-DOC\Administrator, 4PAWS-DOC\staff + +### Fixed volumes + +- [unlabeled] - 0 GB free of 0.1 GB (30.8%) +- [unlabeled] - 0.1 GB free of 0.8 GB (14.2%) +- C: - 392.8 GB free of 476 GB (82.5%) + +### Network adapters + +- Realtek PCIe GbE Family Controller - IP: 192.168.0.148, fe80::2635:722c:b187:5043, 2001:579:83bc:aa0:28ca:10c6:a604:300a, 2001:579:83bc:aa0:e1eb:2999:7092:bb44, 2001:579:83bc:aa0:cb54:157:d896:fd93 - DNS: 68.105.28.15, 68.105.29.15, 68.105.28.17 - DHCP: true + +--- + +## Diff vs Prior Baseline + +- No prior baseline found for this host. This is the first baseline. + +--- + +_Generated by run-onboarding-diagnostic.sh (GuruRMM onboarding diagnostic, Phase 1). Raw snapshot: `4PAWS-DOC-20260708T193830.json` (immutable)._