diff --git a/projects/gps-rmm-audit/needs-screenconnect.md b/projects/gps-rmm-audit/needs-screenconnect.md index 51c091b7..4cdc3fd4 100644 --- a/projects/gps-rmm-audit/needs-screenconnect.md +++ b/projects/gps-rmm-audit/needs-screenconnect.md @@ -4,41 +4,30 @@ Online = ActiveConnections ProcessType==2 (guest agent connected). Recency = Gue Rebuilt 2026-07-04. Staging installer pushed to all ONLINE machines (land in Staging -> reassign-staging.py). ## ONLINE now (2) -- CP-QB [Curtis Plumbing] (1563d) -- IMC-PRINTSERVER [Instrumental Music Center] (0d) - -## active <=14d (25) -- KAT1 [Business Services of Tucson LLC] (0d) -- HSM-CATHY [Horseshoe Management] (2d) -- IMC-LUIS [Instrumental Music Center] (1d) -- IMC-M-EDSERVICE [Instrumental Music Center] (2d) -- LAPTOP-PNVA9G51 [Instrumental Music Center] (4d) -- REPAIRADMIN [Instrumental Music Center] (1d) -- DESKTOP-OC2PH4I [Marty Ryan] (0d) -- CHRISTIPC2024 [Mineralogical Record] (0d) -- PLS-SERVER [PUTT LAND SURVEYING, INC.] (8d) -- DESKTOP-EKC9PRV [Pro-Tech Services] (0d) -- LAPTOP-73UDDTTK [Pro-Tech Services] (1d) -- RWD-CHRIS [Reliant Well Drilling and Pump Corporate] (2d) -- WILLCOXDOTADMIN [Reliant Well Drilling and Pump Corporate] (2d) -- DESKTOP-8KQIDKH [Safesite] (0d) -- DESKTOP-ARNPE1U [Safesite] (2d) -- DESKTOP-B3ELJF5 [Safesite] (2d) -- DESKTOP-FUB3PAV [Safesite] (3d) -- DESKTOP-V3H99FC [Safesite] (2d) -- DESKTOP-V9F9L23 [Safesite] (9d) -- LAPTOP-NFB98THE [Safesite] (2d) -- JEREE [Stamback Septic] (2d) -- DESKTOP-6HT5SJ9 [The Marc Group] (0d) -- ZEUS-ACCOUNTING [Zeus Nestora] (0d) +- IMC-PRINTSERVER [Instrumental Music Center] (1d) - ZEUS-SHERRI [Zeus Nestora] (0d) -- ZEUS1 [Zeus Nestora] (1d) + +## active <=14d (14) +- KAT1 [Business Services of Tucson LLC] (0d) +- HSM-CATHY [Horseshoe Management] (3d) +- IMC-M-EDSERVICE [Instrumental Music Center] (4d) +- LAPTOP-PNVA9G51 [Instrumental Music Center] (6d) +- REPAIRADMIN [Instrumental Music Center] (3d) +- PLS-SERVER [PUTT LAND SURVEYING, INC.] (9d) +- LAPTOP-73UDDTTK [Pro-Tech Services] (3d) +- WILLCOXDOTADMIN [Reliant Well Drilling and Pump Corporate] (3d) +- DESKTOP-ARNPE1U [Safesite] (3d) +- DESKTOP-V3H99FC [Safesite] (3d) +- DESKTOP-V9F9L23 [Safesite] (0d) +- JEREE [Stamback Septic] (3d) +- DESKTOP-6HT5SJ9 [The Marc Group] (0d) +- ZEUS1 [Zeus Nestora] (2d) ## stale 15-45d (4) -- GND-L-3 [Grabb & Durando Law Office] (20d) -- DESKTOP-KRHQ5TS [Instrumental Music Center] (16d) -- RWD-ALLENDESKTO [Reliant Well Drilling and Pump Corporate] (18d) -- DESKTOP-FMDIK0Q [Safesite] (43d) +- GND-L-3 [Grabb & Durando Law Office] (22d) +- DESKTOP-KRHQ5TS [Instrumental Music Center] (17d) +- RWD-ALLENDESKTO [Reliant Well Drilling and Pump Corporate] (19d) +- DESKTOP-FMDIK0Q [Safesite] (44d) ## dead/no-session (58) - DESKTOP-SUFJR0J [Bill Tedards] (no SC) @@ -53,22 +42,22 @@ Rebuilt 2026-07-04. Staging installer pushed to all ONLINE machines (land in Sta - Sheila’s MacBook Pro [Heieck, Sheila] (no SC) - HSM-RANDI [Horseshoe Management] (no SC) - HSM-SURFACE [Horseshoe Management] (no SC) -- DESKTOP-JQ0D38J [Instrumental Music Center] (106d) -- DESKTOP-URV3UGR [Instrumental Music Center] (80d) -- IMC-EVENTS [Instrumental Music Center] (110d) +- DESKTOP-JQ0D38J [Instrumental Music Center] (107d) +- DESKTOP-URV3UGR [Instrumental Music Center] (81d) +- IMC-EVENTS [Instrumental Music Center] (112d) - IMC-L1-GRAPHICS [Instrumental Music Center] (no SC) - PHIL [Instrumental Music Center] (no SC) -- PHIL2021LAPTOP [Instrumental Music Center] (141d) -- PURCHASINGCOMP [Instrumental Music Center] (80d) +- PHIL2021LAPTOP [Instrumental Music Center] (143d) +- PURCHASINGCOMP [Instrumental Music Center] (81d) - LHLH [Little Hearts Little Hands] (no SC) - WIN-KNVO6MUMMEM [Little Hearts Little Hands] (no SC) - CPC-chris-UZR6E [MVAN Enterprises Inc] (no SC) - DESKTOP-I7504C5 [MVAN Enterprises Inc] (no SC) - June’s MacBook Pro [MVAN Enterprises Inc] (no SC) -- MITCH-LAPTOP [MVAN Enterprises Inc] (139d) +- MITCH-LAPTOP [MVAN Enterprises Inc] (140d) - DESKTOP-3VPT017 [Mineralogical Record] (no SC) - DESKTOP-9QHSCIT [Mineralogical Record] (no SC) -- DESKTOP-S1HPLDF [Multicultural Counseling Center] (65d) +- DESKTOP-S1HPLDF [Multicultural Counseling Center] (66d) - PLS-FOUR [PUTT LAND SURVEYING, INC.] (no SC) - PLS-FRONT [PUTT LAND SURVEYING, INC.] (no SC) - PLS-LAPTOP [PUTT LAND SURVEYING, INC.] (no SC) @@ -85,10 +74,10 @@ Rebuilt 2026-07-04. Staging installer pushed to all ONLINE machines (land in Sta - RELIANT-L01 [Reliant Well Drilling and Pump Corporate] (no SC) - RELIANT-L02 [Reliant Well Drilling and Pump Corporate] (no SC) - RELIANT-L03 [Reliant Well Drilling and Pump Corporate] (no SC) -- RWD-ALANLAPTOP [Reliant Well Drilling and Pump Corporate] (127d) +- RWD-ALANLAPTOP [Reliant Well Drilling and Pump Corporate] (128d) - WILCOXADMIN [Reliant Well Drilling and Pump Corporate] (no SC) -- 1225-LENOVO-E16 [Safesite] (49d) -- DESKTOP-QAR6D04 [Safesite] (142d) +- 1225-LENOVO-E16 [Safesite] (51d) +- DESKTOP-QAR6D04 [Safesite] (144d) - DEREK-LAPTOP [Stamback Septic] (no SC) - DESKTOP-1BS5JL4 [Stamback Septic] (no SC) - DESKTOP-JVLQQIJ [Stamback Septic] (no SC) @@ -96,6 +85,6 @@ Rebuilt 2026-07-04. Staging installer pushed to all ONLINE machines (land in Sta - STAMBACK-JBECK [Stamback Septic] (no SC) - STAMBACK-NEW06 [Stamback Septic] (no SC) - STAMBACK-NEW06 [Stamback Septic] (no SC) -- LAPTOP-JMUNGO [The Marc Group] (54d) +- LAPTOP-JMUNGO [The Marc Group] (56d) - DESKTOP-SRUOH4R [The Prairie Schooner] (no SC) - DESKTOP-TS1P9MT [The Prairie Schooner] (no SC) diff --git a/session-logs/2026-07/2026-07-06-howard-tech03l-pro-upgrade-tailscale-skill.md b/session-logs/2026-07/2026-07-06-howard-tech03l-pro-upgrade-tailscale-skill.md new file mode 100644 index 00000000..76695eb6 --- /dev/null +++ b/session-logs/2026-07/2026-07-06-howard-tech03l-pro-upgrade-tailscale-skill.md @@ -0,0 +1,142 @@ +## User +- **User:** Howard Enos (howard) +- **Machine:** Howard-Home +- **Role:** tech + +## Session Summary + +Two deliverables. First, upgraded ACG-Tech03L (Howard's tech laptop, GuruRMM agent id +`86d9a24f-8aba-4e85-96c9-0325c1346379`, client "AZ Computer Guru") from Windows 11 Home to a +permanently-activated Pro-tier edition, entirely over `/rmm` (agent runs as SYSTEM). Second, +built a new fleet `tailscale` skill that manages an ACG-administered tailnet via the Tailscale +REST API v2 with admin add/delete rights. + +The upgrade ran: probe edition/license state -> flip edition -> reboot -> install MAK + activate +-> verify. Probe confirmed Windows 11 Home (EditionID Core), build 26200, OEM-Home activated, no +Windows.old, and no interactive user logged in (safe to reboot). The first edition-flip attempt +via `DISM /online /Set-Edition:Professional` failed with Error 50 ("Setting an edition is not +supported with online images") despite Professional appearing in `/Get-TargetEditions`, so I +pivoted to `changepk.exe /ProductKey `, which flipped EditionID Core -> Professional +live and set a pending reboot. Two `shutdown /r /t 15` dispatches returned exit 0 but never +rebooted the box (silently dropped in the SYSTEM service session; the first also had its `/c +"comment"` quotes stripped by the RMM->cmd.exe layer). The machine did eventually reboot (LastBoot +advanced to 12:06 AM local), completing the edition change. + +Post-reboot, installing the vaulted MAK `BP2XJ-CGNYY-7K8TK-GWXXJ-HMJ4K` via `slmgr /ipk` + +`/ato` activated the machine — but as **Pro for Workstations**, not plain Pro. The MAK, labeled +"Windows Pro MAK" in the vault, is actually a Pro-for-Workstations MAK; installing it auto-upgraded +the edition Professional -> ProfessionalWorkstation. Final verified state: EditionID +ProfessionalWorkstation, "Microsoft Windows 11 Pro for Workstations", 25H2 build 26200.8037, +`slmgr /xpr` = "permanently activated", VOLUME_MAK channel, key ...HMJ4K. Howard confirmed the +laptop is activated and working. + +The `tailscale` skill was built by a sub-agent (modeled on the screenconnect skill) and +code-reviewed by reading the full script: SKILL.md + `tailscale-api.sh` + `/tailscale` command. +It wraps the Tailscale API v2 (devices list/detail/delete/authorize, keys list/create/delete), +vault-first auth (OAuth client preferred, API-token fallback; secret via stdin, bearer in a 0600 +curl config), every write gated behind `--confirm`, name->id resolution that stops on ambiguous +match, and `[TAILSCALE]` bot alerts on writes. No-cred paths (`--help`, `status`) were smoke-tested +locally. The live add/delete verification is blocked: there is no Tailscale API credential in the +vault or 1Password, and one cannot be minted without Tailscale console access. Work committed and +pushed (rebased over a fleet auto-sync, errorlog conflict resolved by keeping both sides). + +## Key Decisions + +- Used `changepk.exe`, not DISM, for the online Home->Pro edition flip after DISM returned Error 50. +- Delivered all PowerShell to the agent via `-EncodedCommand` (UTF-16LE base64 built with the + PowerShell tool, since `iconv` is missing on this machine and broke `ps-encoded.sh`) to dodge the + RMM->cmd.exe quote/backslash mangling. +- Rebooted with the machine unattended (no logged-in user) rather than confirming a reboot window — + the upgrade was the explicitly requested work and no live session was at risk. +- Built + reviewed the tailscale skill without live API calls (no creds), keeping the live add/delete + test as a separate blocked task rather than fabricating a credential. +- Corrected the vault MAK entry's note (Pro -> Pro for Workstations) and captured the whole verified + upgrade path as a reference memory, since the gotchas are reusable fleet-wide. +- Committed only this session's files (explicit `git add`), leaving pre-existing dirty submodule + pointers and scratch `.rmm-*.ps1` files untouched. + +## Problems Encountered + +- **DISM Set-Edition Error 50** — online image edition change unsupported; used `changepk.exe`. +- **`shutdown /r /t 15` silently dropped** in the SYSTEM session (exit 0, no reboot, twice). The + first also failed outright because the `/c "comment"` quotes were stripped (quote-stripping + friction). Machine rebooted on its own; documented `Restart-Computer -Force` / `shutdown /r /t 0` + as the reliable path for next time. Logged as friction. +- **`ps-encoded.sh` broke** — `iconv: command not found` on Howard-Home Git Bash. Worked around by + encoding UTF-16LE base64 with the PowerShell tool. Logged (encode-empty-output). +- **Reboot-detection monitor missed the downtime** — a 30s-interval `last_seen` poll never saw a gap + because the reboot window was short; `is_connected` is null fleet-wide so it can't be trusted. + Confirmed the reboot via `LastBootUpTime` advancing instead. +- **MAK produced Pro for Workstations, not Pro** — the vaulted key is a PfW MAK. Acceptable (PfW is a + Pro superset, fully activated); corrected the vault label and flagged to Howard. + +## Configuration Changes + +Created: +- `.claude/skills/tailscale/SKILL.md` +- `.claude/skills/tailscale/scripts/tailscale-api.sh` +- `.claude/commands/tailscale.md` +- `.claude/memory/reference_windows_edition_upgrade_rmm.md` + +Modified: +- `.claude/memory/MEMORY.md` — index line for the new reference memory. +- `errorlog.md` — quote-stripping + shutdown-drop friction, PfW-MAK correction, encode-empty friction. +- Vault `infrastructure/windows-pro-mak.sops.yaml` — corrected note (PfW MAK + verified upgrade path); + committed + pushed in the vault repo (D:/vault). + +Scratch (not committed): `.rmm-preflight/targeted/setedition/changepk/state/activate/verify.ps1` +and `.*-b64.txt` were created in the repo root during the RMM work and removed at the end. + +## Credentials & Secrets + +- **Windows Pro-for-Workstations MAK** — `BP2XJ-CGNYY-7K8TK-GWXXJ-HMJ4K`. Vault: + `infrastructure/windows-pro-mak.sops.yaml` (`credentials.product_key`). VOLUME_MAK channel; + auto-upgrades a Pro machine to Pro for Workstations. Each activation consumes one MAK count = + $99 to the customer (ACG-internal machines: no invoice, still burns a count). ACG-Tech03L + consumed one count 2026-07-06. +- **Generic Windows 11 Pro key** (Microsoft-published, non-secret) — `VK7JG-NPHTM-C97JM-9MPGT-3V66T`. + Used with `changepk.exe` to flip edition; never activates on its own (Status 5 Notification). +- **Tailscale API credential** — DOES NOT EXIST yet. Skill reads `tailscale/api-access.sops.yaml` + (not created). Needs an OAuth client (scopes `devices:core` + `auth_keys`) or an API access token. + +## Infrastructure & Servers + +- **ACG-Tech03L** — Howard's tech laptop. GuruRMM agent id `86d9a24f-8aba-4e85-96c9-0325c1346379`, + client "AZ Computer Guru", site "Main Office". Tailnet IP 100.113.45.7 (howard@). Now Windows 11 + Pro for Workstations 25H2 (26200.8037), permanently activated. +- **GuruRMM** — `http://172.16.3.30:3001`; creds vault `infrastructure/gururmm-server.sops.yaml`. +- **Tailscale API** — base `https://api.tailscale.com/api/v2`; OAuth token exchange at `/oauth/token`. + +## Commands & Outputs + +- Edition flip: `changepk.exe /ProductKey VK7JG-NPHTM-C97JM-9MPGT-3V66T` -> exit 0, EditionID + Core -> Professional, CBS RebootPending True. +- DISM (failed): `Dism /online /Set-Edition:Professional /ProductKey:... /AcceptEula /norestart` + -> `Error: 50 Setting an edition is not supported with online images.` +- Activate: `cscript //nologo slmgr.vbs /ipk BP2XJ-...HMJ4K` -> "Installed product key ... + successfully"; `/ato` -> `Error: 0xC004E028` (activation already in progress — benign); + `/xpr` -> "Windows(R), ProfessionalWorkstation edition: The machine is permanently activated." +- Final: EditionID ProfessionalWorkstation | LicenseStatus 1 | Partial HMJ4K | VOLUME_MAK. +- Skill smoke test: `bash -n tailscale-api.sh` -> parses; `status` (no cred) -> clean `[BLOCKED]`. + +## Pending / Incomplete Tasks + +- **Tailscale skill live verification (BLOCKED).** Provision a Tailscale API credential into the + vault, then run `status` -> `devices` -> `create-key`/`delete-key` -> a device delete to verify + end-to-end. Provision (OAuth, preferred): + ``` + bash .claude/skills/vault/scripts/vault-helper.sh new tailscale/api-access.sops.yaml \ + --kind oauth-client --name "ACG Tailscale API (OAuth client)" \ + --url https://api.tailscale.com/api/v2 --tag tailscale \ + --set client_id='' --set client_secret='' --set tailnet='-' + ``` + OAuth client needs scopes `devices:core` + `auth_keys`. Token variant: `--kind api-key + --set api_key='tskey-api-...'`. + +## Reference Information + +- Commit: `f88c7d1` "tailscale skill (admin add/delete) + verified Windows edition-upgrade procedure". +- Repo: `git.azcomputerguru.com/azcomputerguru/claudetools` (main). +- Memory: `.claude/memory/reference_windows_edition_upgrade_rmm.md` — verified Home->Pro/PfW path + gotchas. +- Wiki pattern: `wiki/patterns/tailscale-client-management.md` — per-client tailnet doctrine. +- Tailscale API docs: https://tailscale.com/api ; auth keys https://tailscale.com/kb/1085/auth-keys .