azcomputerguru/claudetools
1
0
Fork 0
Code Issues 78 Pull Requests Actions Packages Projects Releases Wiki Activity

sync: auto-sync from HOWARD-HOME at 2026-07-03 17:00:12

Browse Source 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-03 17:00:12
This commit is contained in:
Howard Enos
2026-07-03 17:00:47 -07:00
parent 78f794a924
commit e0e3dd0d82
9 changed files with 478 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

73
projects/gps-rmm-audit/session-logs/2026-07/2026-07-03-howard-gps-rmm-coverage-audit.md Normal file
View File

@@ -0,0 +1,73 @@
## User
- **User:** Howard Enos (howard)
- **Machine:** Howard-Home
- **Role:** tech
## Session Summary
Ran a full audit of every Syncro business paying for GPS (Guru Protection Service) and reconciled it against GuruRMM coverage. Started by identifying the 44 GPS clients (40 active, 4 paused) from Syncro recurring schedules, then built a machine-readable reconciliation: Syncro billed GPS device counts (the "should have") vs live GuruRMM `/api/agents` (the reality), cross-checked against Datto EDR and Bitdefender for AV/backup context. Produced a durable tracker at `projects/gps-rmm-audit/tracker.md` splitting clients into Bucket A (7 count-match), Bucket B (8 present-but-short), and Bucket C (25 with no RMM org).
Bucket A was verified end-to-end across all layers: machine reconciliation, backups (B2/MSP360), AV (Datto EDR + Bitdefender — coverage is split across both tools), vault entries, and wiki (created the missing Arizona Medical Transit article). Surfaced several findings: Dataforth +8 machines over billed, Cascades duplicate agent + unbilled backup bucket, Len's LAB-SVR offline since Jun 18, AMT billed backup with no B2 destination. Backup billing mismatches were flagged and held for Winter per Howard's instruction (an early DM to Winter was retracted via the bot).
Fixed a data error in RMM: the org "Russo, Steve" was mislabeled — it is Russo Law Firm (Steve Russo owner, Shannon Trionfo main contact); renamed via `PUT /api/clients/:id`. Captured a standing AV strategy: migrate Bitdefender -> Datto EDR for all clients except Glaztech and Dataforth.
Bucket B reconciled with a RMM-vs-Datto-vs-Bitdefender coverage matrix, cleanly splitting into real deploy gaps (IMC, Safesite, Horseshoe, Grabb, QWM) and billing flags (Jimmy, Stamback, Glaz-Tech). Built and registered a daily Windows scheduled task (GPS-RMM-Progress, 8:07am) that compares live RMM counts to GPS targets and DMs Howard the remaining gaps until complete; verified working (baseline 46/189 devices, 32 clients short).
Executed the IMC deploy as the template. Determined the true fleet (~22 active AD/Bitdefender machines vs 1 in RMM). Remote-exec from the DC failed on Win10/11 client defaults (DCOM firewalled, schtasks version-rejected by Win11, WinRM off, SYSTEM can't create GPOs, SSH route not up). The working channel was ScreenConnect send-command (runs as SYSTEM on the guest). Pushed the site installer to 20 of 21 targets; RMM IMC agents climbed from 1 to 12 (online now, offline queued in SC). Saved the deploy pattern as reusable memory.
## Key Decisions
- Built a machine-readable `targets.json` rather than parsing the markdown tracker daily (fragile).
- AV coverage must be checked in BOTH Datto EDR and Bitdefender before declaring a gap — coverage is split (Datto for big clients, Bitdefender for small).
- Bitdefender inventory is now a discovery source only (which machines exist), not a coverage target, given the Bitdefender->Datto EDR migration (except Glaztech + Dataforth).
- Daily reminder implemented as a LOCAL Windows scheduled task (has vault/RMM/Discord creds) rather than a cloud routine (which lacks vault access).
- IMC deploy via ScreenConnect, not GPO — GPO's only advantage (no stored cred) evaporated once SYSTEM proved unable to create GPOs, and ScreenConnect send-command runs as SYSTEM with no creds at all.
- Any DA-password use through the RMM channel was immediately scrubbed via `DELETE /api/commands/:id`.
## Problems Encountered
- RMM org "Russo, Steve" mislabeled -> renamed to Russo Law Firm (owner/contact confirmed by Howard).
- Winter DM sent before Howard said "hold until verified" -> deleted from her DM channel via the bot (HTTP 204).
- Remote agent deploy from the DC failed across four methods (New-PSDrive, WMI/DCOM, schtasks/S, sc.exe) due to Win11 client firewall/version defaults -> pivoted to ScreenConnect send-command, which worked.
- `iconv` absent in Git-Bash -> computed base64 (UTF-16LE) for the encoded command via `py -c`.
- `schtasks /TR` has a 261-char cap -> used bare `powershell -enc` instead of the full inline command.
## Configuration Changes
- Created `projects/gps-rmm-audit/tracker.md` — master audit tracker/checklist.
- Created `projects/gps-rmm-audit/targets.json` — machine-readable enrollment targets.
- Created `.claude/scripts/gps-rmm-progress-check.sh` — daily progress check + Discord DM.
- Created `wiki/clients/arizona-medical-transit.md` — new client wiki article.
- Created `.claude/memory/project_av_migration_bitdefender_to_edr.md` + `.claude/memory/reference_rmm_deploy_via_screenconnect.md` (+ MEMORY.md index lines).
- Registered Windows scheduled task `GPS-RMM-Progress` (daily 8:07am, Howard-Home).
- RMM: renamed client `b83b0c29-81e6-4ce4-98ec-74639998d2ce` "Russo, Steve" -> "Russo Law Firm".
- RMM: enrolled ~11 new IMC agents (deploy in progress).
- errorlog.md: one [correction] entry (Russo).
## Credentials & Secrets
- No new credentials created. Used existing vault entries: `clients/imc/imc1.sops.yaml` (IMC\guru Domain Admin — used transiently for DC deploy attempts, scrubbed from RMM logs), `clients/imc/gururmm-site-main.sops.yaml` (site code INNER-BRIDGE-8354).
- Note: IMC1 SSH `password-fallback` is stored in `clients/imc/imc1.sops.yaml` (vault) — not reproduced here.
## Infrastructure & Servers
- GuruRMM API: http://172.16.3.30:3001 (auth via vault `infrastructure/gururmm-server.sops.yaml`).
- IMC1 = Primary DC, domain IMC.local, 192.168.0.2, Server 2016. GuruRMM client_id 4fb591e7-... / agent 88cbf7c0-abfa-4f12-846c-96274f718bff. IMC RMM site IMCMain / INNER-BRIDGE-8354.
- IMC reachable only via Tailscale subnet router pfsense-2 (100.119.153.74) advertising 192.168.0.0/24 — route not currently accepted on Howard-Home.
- ScreenConnect: https://computerguru.screenconnect.com (RESTful API Manager ext) — deploy channel for IMC.
- Datto EDR orgs: Instrumental Music Center not a distinct org (agents land in Default RMM Org); Dataforth 51, Cascades 34, Safesite 48, Horseshoe 6, Glaztech 5.
## Commands & Outputs
- Deploy one-liner (per client, site-coded): `irm 'https://rmm.azcomputerguru.com/install/<SITE-CODE>/windows'|iex` — pushed via ScreenConnect send-command as `powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand <base64-UTF16LE>`.
- Daily check: `bash .claude/scripts/gps-rmm-progress-check.sh [--dry-run]`. Baseline: 46/189 devices in RMM, 32 clients short.
- RMM command scrub: `DELETE /api/commands/:id` -> HTTP 204.
## Pending / Incomplete Tasks
- IMC: ~8 offline machines queued in SC (install on reconnect); IMC-L1-GRAPHICS has no SC session (stale, handle separately). Verify final 20/20 via daily check.
- Bucket B remaining real-deploy clients: Safesite (~6+), Horseshoe (~5-8), Grabb & Durando (~3), Quantum Wealth (~1) — same ScreenConnect channel.
- Bucket B billing flags (Jimmy, Stamback, Glaz-Tech) — document for Winter/Mike, no action.
- Bucket C: 25 clients with no RMM org — onboard + deploy.
- AV migration (Bitdefender -> Datto EDR, except Glaztech + Dataforth) — after RMM everywhere.
- Backup billing flags (AMT/Cascades/Len's) — send Winter the full verified list once complete.
- Task #4: confirm Glaz-Tech 159 GPS billing anomaly with Mike.
## Reference Information
- Tracker: `projects/gps-rmm-audit/tracker.md`; targets: `projects/gps-rmm-audit/targets.json`.
- Memory: `project_av_migration_bitdefender_to_edr`, `reference_rmm_deploy_via_screenconnect`.
- Syncro base: https://computerguru.syncromsp.com/api/v1. GuruRMM install page: https://rmm.azcomputerguru.com/install/<SITE-CODE>.
- Scheduled task: `GPS-RMM-Progress` (daily 8:07am Howard-Home).