azcomputerguru/claudetools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sync: auto-sync from HOWARD-HOME at 2026-07-06 08:31:47

Browse Source 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-06 08:31:47
This commit is contained in:
Howard Enos
2026-07-06 08:32:15 -07:00
parent f88c7d1739
commit e08f6c534e
2 changed files with 174 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files

75
projects/gps-rmm-audit/needs-screenconnect.md
View File

@@ -4,41 +4,30 @@ Online = ActiveConnections ProcessType==2 (guest agent connected). Recency = Gue
Rebuilt 2026-07-04. Staging installer pushed to all ONLINE machines (land in Staging -> reassign-staging.py).
## ONLINE now (2)
- CP-QB [Curtis Plumbing] (1563d)
- IMC-PRINTSERVER [Instrumental Music Center] (0d)
## active <=14d (25)
- KAT1 [Business Services of Tucson LLC] (0d)
- HSM-CATHY [Horseshoe Management] (2d)
- IMC-LUIS [Instrumental Music Center] (1d)
- IMC-M-EDSERVICE [Instrumental Music Center] (2d)
- LAPTOP-PNVA9G51 [Instrumental Music Center] (4d)
- REPAIRADMIN [Instrumental Music Center] (1d)
- DESKTOP-OC2PH4I [Marty Ryan] (0d)
- CHRISTIPC2024 [Mineralogical Record] (0d)
- PLS-SERVER [PUTT LAND SURVEYING, INC.] (8d)
- DESKTOP-EKC9PRV [Pro-Tech Services] (0d)
- LAPTOP-73UDDTTK [Pro-Tech Services] (1d)
- RWD-CHRIS [Reliant Well Drilling and Pump Corporate] (2d)
- WILLCOXDOTADMIN [Reliant Well Drilling and Pump Corporate] (2d)
- DESKTOP-8KQIDKH [Safesite] (0d)
- DESKTOP-ARNPE1U [Safesite] (2d)
- DESKTOP-B3ELJF5 [Safesite] (2d)
- DESKTOP-FUB3PAV [Safesite] (3d)
- DESKTOP-V3H99FC [Safesite] (2d)
- DESKTOP-V9F9L23 [Safesite] (9d)
- LAPTOP-NFB98THE [Safesite] (2d)
- JEREE [Stamback Septic] (2d)
- DESKTOP-6HT5SJ9 [The Marc Group] (0d)
- ZEUS-ACCOUNTING [Zeus Nestora] (0d)
- IMC-PRINTSERVER [Instrumental Music Center] (1d)
- ZEUS-SHERRI [Zeus Nestora] (0d)
- ZEUS1 [Zeus Nestora] (1d)
## active <=14d (14)
- KAT1 [Business Services of Tucson LLC] (0d)
- HSM-CATHY [Horseshoe Management] (3d)
- IMC-M-EDSERVICE [Instrumental Music Center] (4d)
- LAPTOP-PNVA9G51 [Instrumental Music Center] (6d)
- REPAIRADMIN [Instrumental Music Center] (3d)
- PLS-SERVER [PUTT LAND SURVEYING, INC.] (9d)
- LAPTOP-73UDDTTK [Pro-Tech Services] (3d)
- WILLCOXDOTADMIN [Reliant Well Drilling and Pump Corporate] (3d)
- DESKTOP-ARNPE1U [Safesite] (3d)
- DESKTOP-V3H99FC [Safesite] (3d)
- DESKTOP-V9F9L23 [Safesite] (0d)
- JEREE [Stamback Septic] (3d)
- DESKTOP-6HT5SJ9 [The Marc Group] (0d)
- ZEUS1 [Zeus Nestora] (2d)
## stale 15-45d (4)
- GND-L-3 [Grabb & Durando Law Office] (20d)
- DESKTOP-KRHQ5TS [Instrumental Music Center] (16d)
- RWD-ALLENDESKTO [Reliant Well Drilling and Pump Corporate] (18d)
- DESKTOP-FMDIK0Q [Safesite] (43d)
- GND-L-3 [Grabb & Durando Law Office] (22d)
- DESKTOP-KRHQ5TS [Instrumental Music Center] (17d)
- RWD-ALLENDESKTO [Reliant Well Drilling and Pump Corporate] (19d)
- DESKTOP-FMDIK0Q [Safesite] (44d)
## dead/no-session (58)
- DESKTOP-SUFJR0J [Bill Tedards] (no SC)
@@ -53,22 +42,22 @@ Rebuilt 2026-07-04. Staging installer pushed to all ONLINE machines (land in Sta
- Sheila’s MacBook Pro [Heieck, Sheila] (no SC)
- HSM-RANDI [Horseshoe Management] (no SC)
- HSM-SURFACE [Horseshoe Management] (no SC)
- DESKTOP-JQ0D38J [Instrumental Music Center] (106d)
- DESKTOP-URV3UGR [Instrumental Music Center] (80d)
- IMC-EVENTS [Instrumental Music Center] (110d)
- DESKTOP-JQ0D38J [Instrumental Music Center] (107d)
- DESKTOP-URV3UGR [Instrumental Music Center] (81d)
- IMC-EVENTS [Instrumental Music Center] (112d)
- IMC-L1-GRAPHICS [Instrumental Music Center] (no SC)
- PHIL [Instrumental Music Center] (no SC)
- PHIL2021LAPTOP [Instrumental Music Center] (141d)
- PURCHASINGCOMP [Instrumental Music Center] (80d)
- PHIL2021LAPTOP [Instrumental Music Center] (143d)
- PURCHASINGCOMP [Instrumental Music Center] (81d)
- LHLH [Little Hearts Little Hands] (no SC)
- WIN-KNVO6MUMMEM [Little Hearts Little Hands] (no SC)
- CPC-chris-UZR6E [MVAN Enterprises Inc] (no SC)
- DESKTOP-I7504C5 [MVAN Enterprises Inc] (no SC)
- June’s MacBook Pro [MVAN Enterprises Inc] (no SC)
- MITCH-LAPTOP [MVAN Enterprises Inc] (139d)
- MITCH-LAPTOP [MVAN Enterprises Inc] (140d)
- DESKTOP-3VPT017 [Mineralogical Record] (no SC)
- DESKTOP-9QHSCIT [Mineralogical Record] (no SC)
- DESKTOP-S1HPLDF [Multicultural Counseling Center] (65d)
- DESKTOP-S1HPLDF [Multicultural Counseling Center] (66d)
- PLS-FOUR [PUTT LAND SURVEYING, INC.] (no SC)
- PLS-FRONT [PUTT LAND SURVEYING, INC.] (no SC)
- PLS-LAPTOP [PUTT LAND SURVEYING, INC.] (no SC)
@@ -85,10 +74,10 @@ Rebuilt 2026-07-04. Staging installer pushed to all ONLINE machines (land in Sta
- RELIANT-L01 [Reliant Well Drilling and Pump Corporate] (no SC)
- RELIANT-L02 [Reliant Well Drilling and Pump Corporate] (no SC)
- RELIANT-L03 [Reliant Well Drilling and Pump Corporate] (no SC)
- RWD-ALANLAPTOP [Reliant Well Drilling and Pump Corporate] (127d)
- RWD-ALANLAPTOP [Reliant Well Drilling and Pump Corporate] (128d)
- WILCOXADMIN [Reliant Well Drilling and Pump Corporate] (no SC)
- 1225-LENOVO-E16 [Safesite] (49d)
- DESKTOP-QAR6D04 [Safesite] (142d)
- 1225-LENOVO-E16 [Safesite] (51d)
- DESKTOP-QAR6D04 [Safesite] (144d)
- DEREK-LAPTOP [Stamback Septic] (no SC)
- DESKTOP-1BS5JL4 [Stamback Septic] (no SC)
- DESKTOP-JVLQQIJ [Stamback Septic] (no SC)
@@ -96,6 +85,6 @@ Rebuilt 2026-07-04. Staging installer pushed to all ONLINE machines (land in Sta
- STAMBACK-JBECK [Stamback Septic] (no SC)
- STAMBACK-NEW06 [Stamback Septic] (no SC)
- STAMBACK-NEW06 [Stamback Septic] (no SC)
- LAPTOP-JMUNGO [The Marc Group] (54d)
- LAPTOP-JMUNGO [The Marc Group] (56d)
- DESKTOP-SRUOH4R [The Prairie Schooner] (no SC)
- DESKTOP-TS1P9MT [The Prairie Schooner] (no SC)

142
session-logs/2026-07/2026-07-06-howard-tech03l-pro-upgrade-tailscale-skill.md Normal file
View File

@@ -0,0 +1,142 @@
## User
- **User:** Howard Enos (howard)
- **Machine:** Howard-Home
- **Role:** tech
## Session Summary
Two deliverables. First, upgraded ACG-Tech03L (Howard's tech laptop, GuruRMM agent id
`86d9a24f-8aba-4e85-96c9-0325c1346379`, client "AZ Computer Guru") from Windows 11 Home to a
permanently-activated Pro-tier edition, entirely over `/rmm` (agent runs as SYSTEM). Second,
built a new fleet `tailscale` skill that manages an ACG-administered tailnet via the Tailscale
REST API v2 with admin add/delete rights.
The upgrade ran: probe edition/license state -> flip edition -> reboot -> install MAK + activate
-> verify. Probe confirmed Windows 11 Home (EditionID Core), build 26200, OEM-Home activated, no
Windows.old, and no interactive user logged in (safe to reboot). The first edition-flip attempt
via `DISM /online /Set-Edition:Professional` failed with Error 50 ("Setting an edition is not
supported with online images") despite Professional appearing in `/Get-TargetEditions`, so I
pivoted to `changepk.exe /ProductKey <generic Pro>`, which flipped EditionID Core -> Professional
live and set a pending reboot. Two `shutdown /r /t 15` dispatches returned exit 0 but never
rebooted the box (silently dropped in the SYSTEM service session; the first also had its `/c
"comment"` quotes stripped by the RMM->cmd.exe layer). The machine did eventually reboot (LastBoot
advanced to 12:06 AM local), completing the edition change.
Post-reboot, installing the vaulted MAK `BP2XJ-CGNYY-7K8TK-GWXXJ-HMJ4K` via `slmgr /ipk` +
`/ato` activated the machine — but as **Pro for Workstations**, not plain Pro. The MAK, labeled
"Windows Pro MAK" in the vault, is actually a Pro-for-Workstations MAK; installing it auto-upgraded
the edition Professional -> ProfessionalWorkstation. Final verified state: EditionID
ProfessionalWorkstation, "Microsoft Windows 11 Pro for Workstations", 25H2 build 26200.8037,
`slmgr /xpr` = "permanently activated", VOLUME_MAK channel, key ...HMJ4K. Howard confirmed the
laptop is activated and working.
The `tailscale` skill was built by a sub-agent (modeled on the screenconnect skill) and
code-reviewed by reading the full script: SKILL.md + `tailscale-api.sh` + `/tailscale` command.
It wraps the Tailscale API v2 (devices list/detail/delete/authorize, keys list/create/delete),
vault-first auth (OAuth client preferred, API-token fallback; secret via stdin, bearer in a 0600
curl config), every write gated behind `--confirm`, name->id resolution that stops on ambiguous
match, and `[TAILSCALE]` bot alerts on writes. No-cred paths (`--help`, `status`) were smoke-tested
locally. The live add/delete verification is blocked: there is no Tailscale API credential in the
vault or 1Password, and one cannot be minted without Tailscale console access. Work committed and
pushed (rebased over a fleet auto-sync, errorlog conflict resolved by keeping both sides).
## Key Decisions
- Used `changepk.exe`, not DISM, for the online Home->Pro edition flip after DISM returned Error 50.
- Delivered all PowerShell to the agent via `-EncodedCommand` (UTF-16LE base64 built with the
PowerShell tool, since `iconv` is missing on this machine and broke `ps-encoded.sh`) to dodge the
RMM->cmd.exe quote/backslash mangling.
- Rebooted with the machine unattended (no logged-in user) rather than confirming a reboot window —
the upgrade was the explicitly requested work and no live session was at risk.
- Built + reviewed the tailscale skill without live API calls (no creds), keeping the live add/delete
test as a separate blocked task rather than fabricating a credential.
- Corrected the vault MAK entry's note (Pro -> Pro for Workstations) and captured the whole verified
upgrade path as a reference memory, since the gotchas are reusable fleet-wide.
- Committed only this session's files (explicit `git add`), leaving pre-existing dirty submodule
pointers and scratch `.rmm-*.ps1` files untouched.
## Problems Encountered
- **DISM Set-Edition Error 50** — online image edition change unsupported; used `changepk.exe`.
- **`shutdown /r /t 15` silently dropped** in the SYSTEM session (exit 0, no reboot, twice). The
first also failed outright because the `/c "comment"` quotes were stripped (quote-stripping
friction). Machine rebooted on its own; documented `Restart-Computer -Force` / `shutdown /r /t 0`
as the reliable path for next time. Logged as friction.
- **`ps-encoded.sh` broke** — `iconv: command not found` on Howard-Home Git Bash. Worked around by
encoding UTF-16LE base64 with the PowerShell tool. Logged (encode-empty-output).
- **Reboot-detection monitor missed the downtime** — a 30s-interval `last_seen` poll never saw a gap
because the reboot window was short; `is_connected` is null fleet-wide so it can't be trusted.
Confirmed the reboot via `LastBootUpTime` advancing instead.
- **MAK produced Pro for Workstations, not Pro** — the vaulted key is a PfW MAK. Acceptable (PfW is a
Pro superset, fully activated); corrected the vault label and flagged to Howard.
## Configuration Changes
Created:
- `.claude/skills/tailscale/SKILL.md`
- `.claude/skills/tailscale/scripts/tailscale-api.sh`
- `.claude/commands/tailscale.md`
- `.claude/memory/reference_windows_edition_upgrade_rmm.md`
Modified:
- `.claude/memory/MEMORY.md` — index line for the new reference memory.
- `errorlog.md` — quote-stripping + shutdown-drop friction, PfW-MAK correction, encode-empty friction.
- Vault `infrastructure/windows-pro-mak.sops.yaml` — corrected note (PfW MAK + verified upgrade path);
committed + pushed in the vault repo (D:/vault).
Scratch (not committed): `.rmm-preflight/targeted/setedition/changepk/state/activate/verify.ps1`
and `.*-b64.txt` were created in the repo root during the RMM work and removed at the end.
## Credentials & Secrets
- **Windows Pro-for-Workstations MAK** — `BP2XJ-CGNYY-7K8TK-GWXXJ-HMJ4K`. Vault:
`infrastructure/windows-pro-mak.sops.yaml` (`credentials.product_key`). VOLUME_MAK channel;
auto-upgrades a Pro machine to Pro for Workstations. Each activation consumes one MAK count =
$99 to the customer (ACG-internal machines: no invoice, still burns a count). ACG-Tech03L
consumed one count 2026-07-06.
- **Generic Windows 11 Pro key** (Microsoft-published, non-secret) — `VK7JG-NPHTM-C97JM-9MPGT-3V66T`.
Used with `changepk.exe` to flip edition; never activates on its own (Status 5 Notification).
- **Tailscale API credential** — DOES NOT EXIST yet. Skill reads `tailscale/api-access.sops.yaml`
(not created). Needs an OAuth client (scopes `devices:core` + `auth_keys`) or an API access token.
## Infrastructure & Servers
- **ACG-Tech03L** — Howard's tech laptop. GuruRMM agent id `86d9a24f-8aba-4e85-96c9-0325c1346379`,
client "AZ Computer Guru", site "Main Office". Tailnet IP 100.113.45.7 (howard@). Now Windows 11
Pro for Workstations 25H2 (26200.8037), permanently activated.
- **GuruRMM** — `http://172.16.3.30:3001`; creds vault `infrastructure/gururmm-server.sops.yaml`.
- **Tailscale API** — base `https://api.tailscale.com/api/v2`; OAuth token exchange at `/oauth/token`.
## Commands & Outputs
- Edition flip: `changepk.exe /ProductKey VK7JG-NPHTM-C97JM-9MPGT-3V66T` -> exit 0, EditionID
Core -> Professional, CBS RebootPending True.
- DISM (failed): `Dism /online /Set-Edition:Professional /ProductKey:... /AcceptEula /norestart`
-> `Error: 50 Setting an edition is not supported with online images.`
- Activate: `cscript //nologo slmgr.vbs /ipk BP2XJ-...HMJ4K` -> "Installed product key ...
successfully"; `/ato` -> `Error: 0xC004E028` (activation already in progress — benign);
`/xpr` -> "Windows(R), ProfessionalWorkstation edition: The machine is permanently activated."
- Final: EditionID ProfessionalWorkstation | LicenseStatus 1 | Partial HMJ4K | VOLUME_MAK.
- Skill smoke test: `bash -n tailscale-api.sh` -> parses; `status` (no cred) -> clean `[BLOCKED]`.
## Pending / Incomplete Tasks
- **Tailscale skill live verification (BLOCKED).** Provision a Tailscale API credential into the
vault, then run `status` -> `devices` -> `create-key`/`delete-key` -> a device delete to verify
end-to-end. Provision (OAuth, preferred):
```
bash .claude/skills/vault/scripts/vault-helper.sh new tailscale/api-access.sops.yaml \
--kind oauth-client --name "ACG Tailscale API (OAuth client)" \
--url https://api.tailscale.com/api/v2 --tag tailscale \
--set client_id='<ID>' --set client_secret='<SECRET>' --set tailnet='-'
```
OAuth client needs scopes `devices:core` + `auth_keys`. Token variant: `--kind api-key
--set api_key='tskey-api-...'`.
## Reference Information
- Commit: `f88c7d1` "tailscale skill (admin add/delete) + verified Windows edition-upgrade procedure".
- Repo: `git.azcomputerguru.com/azcomputerguru/claudetools` (main).
- Memory: `.claude/memory/reference_windows_edition_upgrade_rmm.md` — verified Home->Pro/PfW path + gotchas.
- Wiki pattern: `wiki/patterns/tailscale-client-management.md` — per-client tailnet doctrine.
- Tailscale API docs: https://tailscale.com/api ; auth keys https://tailscale.com/kb/1085/auth-keys .