azcomputerguru/claudetools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

wiki(sif-oidak): correct identity model, add printer + onboarding runbook

Browse Source 
Sif-oidak was documented as a hybrid AD/M365 environment. It is not: there is no
Entra Connect on either DC, no AD object carries msDS-ConsistencyGuid, and every
M365 user has onPremisesSyncEnabled=null. AD and M365 are disjoint, and email is a
third system entirely (sifoidak.com at GoDaddy; the O365_BUSINESS SKU carries the
EXCHANGE_S_FOUNDATION no-mailbox stub).

That mismatch caused a real failure: Dwayne Ortega had a cloud account only, so he
could not log in to a domain-joined workstation. Created his AD account and recorded
the two-account onboarding rule.

Also documented: printer error 740 (Point-and-Print driver install needs admin,
UAC prompt never surfaces), a GPO pushing the MX-6240N queue from the wrong server,
SIF-SERVER2 confirmed as a backup DC, and refreshed stale laptop agent UUIDs.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Howard Enos
2026-07-09 16:18:20 -07:00
parent 5a463ae133
commit d9f877661e
2 changed files with 226 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
errorlog.md
View File

@@ -23,6 +23,16 @@ Categories (the `[type]` tag): _(none)_ = skill/command execution failure ·
2026-07-09 | GURU-BEAST-ROG | remediation-tool | reset-password: failed to remove JIT Privileged Auth Admin role - standing privilege left behind, REMOVE MANUALLY [ctx: tenant=568eb763-3b95-4271-8443-530c74b1c6bb assignment=ikzke6-tKk6E1qsmSeCKE7PwwTzAbMNNrIysDtlMU0E-1 http=400]
2026-07-09 | Howard-Home | bash/rmm-dispatch | [friction] UNC path SIF-SERVERprint$ collapsed to single-backslash inside a jq --arg PowerShell payload, producing a bogus 'path not found' that nearly read as a real diagnostic finding; use ps-encoded.sh for any payload containing UNC/backslashes [ctx: ref=feedback_windows_quote_stripping client=sif-oidak]
2026-07-09 | Howard-Home | bash/git | [friction] chained 'git push -q 2>&1 | tail -5 && echo [OK]' — the && tested tail's exit status, not git's, so a REJECTED push printed [OK]. Never pipe a command whose exit code you intend to test; capture output then check ${PIPESTATUS[0]} or run the command bare and test $?. [ctx: client=sif-oidak repo=vault]
2026-07-09 | Howard-Home | remediation-tool/get-token.sh | [friction] get-token.sh resolved identity.json from $HOME (/c/Users/Howard/.claude/identity.json) instead of the repo .claude/identity.json and died with 'vault_path not set'; fix is to export VAULT_ROOT_ENV=<vault_path> before calling, or make the script fall back to the repo identity [ctx: ref=vault-skill-gotchas client=sif-oidak]
2026-07-09 | Howard-Home | wiki-lint | [friction] command hardcodes 'cd D:/claudetools' but repo root is machine-specific (identity.json claudetools_root=C:/claudetools on HOWARD-HOME). Same path-drift family as remediation-tool scripts reading ~/.claude/identity.json instead of repo .claude/identity.json. Fix: resolve root from identity.json claudetools_root, never hardcode a drive letter. [ctx: ref=identity.json/claudetools_root machine=HOWARD-HOME]
2026-07-09 | Howard-Home | remediation-tool/consent-audit.sh | consent-audit graded tenant RED 'app NOT consented' for all 4 tiers, but the real cause was a local vault-path lookup failure (scripts read ~/.claude/identity.json; actual identity+vault_path live in repo .claude/identity.json -> D:/vault). Tenant was fully consented; token minted fine with VAULT_ROOT_ENV=D:/vault. Risk: would have sent a client an unnecessary admin-consent link. Fix: consent-audit should fail loud on vault-path error instead of reporting it as a consent gap. [ctx: tenant=cascadestucson.com machine=HOWARD-HOME]
2026-07-09 | GURU-BEAST-ROG | bash/env | [friction] reported wrong current time: Git Bash 'TZ=America/Phoenix date' silently ignored TZ and printed UTC mislabeled as AZ; use PowerShell Get-Date (or explicit UTC-7 math) on Windows for time reporting [ctx: thread=lens-auto-browser-hijack corrected_by=Winter]
2026-07-09 | Howard-Home | bash/env | [friction] used $UID as a variable in a Bash tool script; UID is readonly in bash so the assignment failed and the downstream Graph calls silently ran with an empty id - use a non-reserved name (OBJ/USER_ID)