diff --git a/clients/instrumental-music-center/session-logs/2026-07/2026-07-21-howard-edservices4-laptop-setup.md b/clients/instrumental-music-center/session-logs/2026-07/2026-07-21-howard-edservices4-laptop-setup.md
new file mode 100644
index 00000000..c2070d3a
--- /dev/null
+++ b/clients/instrumental-music-center/session-logs/2026-07/2026-07-21-howard-edservices4-laptop-setup.md
@@ -0,0 +1,119 @@
+# IMC Ed Services 4 Laptop Setup (DESKTOP-KRHQ5TS)
+
+## User
+- **User:** Howard Enos (howard)
+- **Machine:** Howard-Home
+- **Role:** tech
+
+## Session Summary
+
+Set up DESKTOP-KRHQ5TS (formerly Manda's laptop) as a generic "Ed Services 4" workstation for Instrumental Music Center, per Syncro ticket #32569. The ticket called for a new user setup with an existing MS365 license, VPN, and remote desktop access to the server, with a request to test for slowness during remote access.
+
+Started by pulling the Syncro ticket details and locating the machine in GuruRMM (agent 182d120d). Retrieved the IMC UDM-IMC-L1 OpenVPN server configuration via the UniFi Site Manager cloud API and discovered 10 existing VPN RADIUS users. Created a VPN account "edservices4" on the UDM for the new generic login. The original ticket referenced "Darren Bachtel" but Howard clarified the machine should be a generic "Ed Services 4" workstation, not a named user setup.
+
+OpenVPN Connect 3.8.0 was installed on the laptop but refused to connect due to the UDM's hardcoded `comp-lzo` compression push, which OpenVPN Connect 3.4+ no longer supports. Resolved by installing OpenVPN Community 2.6.12 (which handles comp-lzo natively) and removing OpenVPN Connect. The forced removal of Connect also destroyed the Community binaries, requiring a clean reinstall.
+
+Created the domain account `IMC\edservices4` on IMC1 and set the system-level AIMsi USER#=4 environment variable (reusing Manda's assignment per Leslie's approval). Manda's AD account was briefly disabled in error but was re-enabled immediately -- no password was changed. DNS resolution was a major bottleneck: `imc.local` took 1,539ms to resolve due to the phantom DC ServerIMC (192.168.0.63) in the DNS round-robin. Fixed with hosts file entries pointing imc.local directly to IMC1 (192.168.0.2), bringing resolution to 29ms. Disabled Dell SupportAssist and TechHub services that were consuming 2.3 GB of RAM.
+
+Investigated AIMsi slowness over VPN. Server-side diagnostics showed IMC1 was healthy (36% CPU, 10 GB free RAM, sub-1ms disk latency). UniFi showed no traffic shaping or QoS rules. The root cause is structural: OpenVPN uses `proto tcp` (TCP-over-TCP), and AIMsi makes hundreds of chatty SQL/SMB calls on startup, each paying the 9ms VPN round-trip. The correct solution is RDP into IMC1 and running AIM inside the remote session. Set up an RDP shortcut on the laptop desktop with stored credentials in Credential Manager. RemoteApp was attempted (IMC1 already had an RDS collection "v12" with AIM published) but hung during session configuration -- abandoned in favor of a full RDP desktop session which connects fast. Created an AIM shortcut on edservices4's desktop inside IMC1.
+
+## Key Decisions
+
+- Chose generic "edservices4" account over a named "Darren Bachtel" account per Howard's direction -- the machine is a shared workstation role, not a personal device.
+- Used OpenVPN Community 2.6.12 instead of OpenVPN Connect 3.8.0 -- Connect dropped comp-lzo support, and the UDM hardcodes comp-lzo in the server push with no API toggle to disable it.
+- Set USER#=4 at machine level (not per-user) since the machine is a dedicated Ed Services 4 workstation and Leslie approved sharing Manda's session number.
+- Added hosts file entries on the laptop to bypass the phantom DC (ServerIMC) DNS round-robin rather than fixing ServerIMC itself -- the hosts file fix is laptop-specific and doesn't require changes to the domain infrastructure.
+- Abandoned RemoteApp in favor of a full RDP desktop session -- RemoteApp hung during "configuring session" (likely Connection Broker overhead on the single-server deployment) while full RDP connected instantly.
+- Disabled Dell SupportAssist and TechHub services (2.3 GB RAM) -- bloatware with no value on a managed endpoint.
+
+## Problems Encountered
+
+- **OpenVPN Connect 3.8.0 compression rejection:** Server pushes `comp-lzo`; Connect 3.4+ drops all compression support. `allow-compression yes` and `pull-filter` directives don't work in Connect. Fixed by switching to OpenVPN Community 2.6.12.
+- **OpenVPN Connect uninstall destroyed Community binaries:** Force-removing Connect's directory also removed shared TAP/Wintun drivers or collided with Community's install path. Required a clean reinstall of Community after removing the Connect remnants.
+- **VPN DNS resolution (1,539ms):** The VPN adapter's DNS pointed to 192.168.2.1 (UDM gateway), which doesn't know about `imc.local`. Even after fixing DNS to point to IMC1, the phantom DC ServerIMC in DNS round-robin added 1.5s latency ~50% of the time. Hosts file entries bypass DNS entirely.
+- **Domain login failed after user switch:** VPN connection dropped when switching from Localadmin to edservices4 because OpenVPN GUI ran in the user session. Temporarily ran VPN as a service with stored credentials to get the first domain login cached, then reverted to GUI mode.
+- **RMM commands running as SYSTEM:** Credential Manager entries and desktop shortcuts created via RMM landed in SYSTEM's profile, not edservices4's. Required `context: user_session` for credential storage and explicit path targeting for file writes.
+- **Dell service stop timed out and crashed agent:** The `Stop-Service` command for Dell SupportAssist hung past the 30s timeout, and the server-side reaper killed the command, which also disrupted the RMM agent. Required a reboot to recover.
+- **RemoteApp hung on "configuring session":** IMC1 has the Connection Broker role on a single-server deployment. RemoteApp session setup goes through the broker which adds overhead. Full RDP bypasses this and connects instantly.
+
+## Configuration Changes
+
+### DESKTOP-KRHQ5TS (laptop)
+- `C:\Windows\System32\drivers\etc\hosts` -- added `192.168.0.2 imc.local`, `192.168.0.2 IMC1.imc.local`, `192.168.0.2 IMC1`
+- `C:\Program Files\OpenVPN\config\IMC-VPN.ovpn` -- OpenVPN config with `dhcp-option DNS 192.168.0.2` and `comp-lzo`
+- OpenVPN Connect 3.8.0 -- uninstalled
+- OpenVPN Community 2.6.12 -- installed
+- OpenVPN service -- set to Manual (user runs GUI manually)
+- Dell SupportAssist service -- disabled
+- Dell TechHub service -- disabled
+- System environment variable `USER#` = `4`
+- `C:\Users\edservices4\Desktop\IMC1 Remote Desktop.rdp` -- RDP shortcut to IMC1
+- Windows Credential Manager (edservices4) -- stored TERMSRV/192.168.0.2 and TERMSRV/IMC1.imc.local credentials
+
+### IMC1 (server)
+- `C:\Users\edservices4\Desktop\AIM.lnk` -- shortcut to `S:\AIM\AIM.exe`
+- `C:\Users\Default\Desktop\AIM.lnk` -- shortcut for any new RDP user profile
+- AD account `edservices4` created (Ed Services 4, enabled, password never expires)
+
+### UDM-IMC-L1 (UniFi gateway)
+- VPN RADIUS account `edservices4` created
+- VPN RADIUS account `darren` created then deleted (scope change)
+
+### Vault
+- `clients/imc/openvpn-guru.sops.yaml` -- IMC OpenVPN guru tech account credentials
+- `clients/imc/openvpn-edservices4.sops.yaml` -- IMC OpenVPN edservices4 account credentials
+- `clients/imc/edservices4-domain.sops.yaml` -- IMC domain account edservices4 credentials
+- `clients/imc/openvpn-darren.sops.yaml` -- created then deleted (scope change)
+
+## Credentials & Secrets
+
+### VPN (UDM-IMC-L1 RADIUS)
+- **guru:** `guru` / `r3tr0gradE99!` -- tech account, vaulted at `clients/imc/openvpn-guru.sops.yaml`
+- **edservices4:** `edservices4` / `EdSvc2026!` -- vaulted at `clients/imc/openvpn-edservices4.sops.yaml`
+
+### Domain (IMC.local)
+- **edservices4:** `IMC\edservices4` / `EdSvc2026!` -- vaulted at `clients/imc/edservices4-domain.sops.yaml`
+
+## Infrastructure & Servers
+
+- **UDM-IMC-L1:** 72.194.57.2, UDM Pro Max, OpenVPN on port 1194 (proto tcp), VPN subnet 192.168.2.0/24, WAN 189/187 Mbps, 4ms latency
+- **UDM-IMC-MOO:** 68.107.177.170, UDM Pro, site-to-site WireGuard mesh to L1
+- **IMC1:** 192.168.0.2, Windows Server 2016 Standard, DC/DNS/RDS/SQL, 32 GB RAM, RDS collection "v12" with AIM RemoteApp published
+- **DESKTOP-KRHQ5TS:** AMD Ryzen 5 220, 15.3 GB RAM, 100 Mbps USB ethernet, GuruRMM agent 182d120d-d1e6-4488-a96c-94881a921831
+- **Syncro ticket:** #32569 (id 114041531), customer 7088508, prepaid 9.5 hrs
+
+## Commands & Outputs
+
+Key diagnostics:
+- `imc.local` DNS resolution: 1,539ms before hosts fix, 29ms after
+- IMC1 SQL port 61151: 29ms TCP connect time over VPN
+- IMC1: 7 active RDP sessions, 209 SQL connections from 9 clients
+- Ping to IMC1 over VPN: 9ms consistent
+- DESKTOP-KRHQ5TS: 100 Mbps USB ethernet, VPN MTU 1400 clean (no fragmentation)
+- AIMsi executables at `S:\AIM\`: AIM.exe (32-bit launcher), AIM32.exe, AIM64.exe, AIMRDP8.exe (RDP-optimized build by Tri-Tech), AIMTraining.exe
+- `AIM.ini`: `ForceVersion 64` -- forces AIM64.exe
+- `DatabaseConfig.dat`: encrypted SQL connection string shared by all AIM builds
+- RDS collection "v12": AIM published as RemoteApp alias "AIM", session host IMC1.IMC.LOCAL
+- AIMRDP8.exe: Tri-Tech official build v12.0.3.49, compiled from `AIMsiRDP8` project, designed for RDP sessions
+
+## Pending / Incomplete Tasks
+
+- **M365 license setup:** Ticket says "use an existing MS365 license" -- not yet addressed. Need to determine which license (Manda's? A spare?) and configure Outlook/email for the Ed Services 4 role if needed.
+- **Manda's VPN account:** Still active on the UDM (id `69f8fdac16b23be6d7034a9e`). Confirm whether she still needs VPN access or if it should be removed.
+- **AIMsi over RDP testing:** User was testing AIM inside the RDP session at end of session. Need to confirm it runs fast and is usable for daily work.
+- **OpenVPN auto-start:** Currently the user must manually launch OpenVPN GUI and connect after each login. Could add a startup shortcut or configure the service for auto-connect if desired.
+- **ServerIMC phantom DC:** Still the root cause of domain auth degradation fleet-wide at IMC. The hosts file fix is laptop-specific. A proper fix (ntdsutil metadata cleanup or AD service repair) is tracked in the wiki but no ticket has been opened.
+- **Datto EDR:** DESKTOP-KRHQ5TS needs EDR enrollment (was queued via SC for RMM install; now that RMM is enrolled, push EDR via /rmm).
+- **Syncro ticket billing/close:** Work not yet billed on ticket #32569.
+- **IMC1 RMM agent UUID changed:** Wiki lists `fa99e913-1027-4e33-a928-7695e31068e7` but live UUID is `88cbf7c0-abfa-4f12-846c-96274f718bff`. Wiki needs update.
+
+## Reference Information
+
+- **Syncro ticket:** https://computerguru.syncromsp.com/tickets/114041531
+- **UniFi Site Manager API:** `https://api.ui.com`, key vaulted at `services/unifi-site-manager`
+- **UDM-IMC-L1 console ID:** `28704E7141BF00000000084707E60000000008B793950000000066CC83AC:1219071989`
+- **OpenVPN server config ID:** `6874748326a9c564bbc24a7e`
+- **VPN RADIUS edservices4 ID:** `6a5eb5b8f39b98f56840c18e`
+- **AIM RemoteApp alias:** `AIM` (collection "v12", path `S:\AIM\AIM.exe`)
+- **AIMRDP8.exe PDB path:** `C:\Projects\AIMsi\AIMsi V12\AIMsiRDP8\obj\Release\AIMRDP8.pdb`
+- **Tri-Tech docs:** https://www.tritechretail.com/topic/aim