From e359702837801ca1e229e7b575669e952a559bf8 Mon Sep 17 00:00:00 2001 From: Howard Enos Date: Sun, 5 Jul 2026 01:00:48 -0700 Subject: [PATCH] gps-rmm-audit: CP-QB WMI-repaired+enrolled (112/189); IMC-PRINTSERVER agent installed, blocked by box-wide outbound TLS drop MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CP-QB: corrupt WMI class store (Win32_Processor invalid class) killed the universal installer's arch check; mofcomp cimwin32.mof fixed it; enrolled + reassigned to Curtis Plumbing. IMC-PRINTSERVER: agent+watchdog installed manually over LAN HTTP from IMC1 (PowerShell dead on box, SMB hangs, SC extension eats chains/multiline); box drops ALL outbound TLS (incl google) so agent cannot connect — fix is at IMC UniFi gateway or local filter; no reinstall needed. Session log + tracker updated. Co-Authored-By: Claude Fable 5 --- ...d-cpqb-fixed-imcprintserver-tls-blocked.md | 85 +++++++++++++++++++ projects/gps-rmm-audit/tracker.md | 22 +++++ 2 files changed, 107 insertions(+) create mode 100644 projects/gps-rmm-audit/session-logs/2026-07/2026-07-05-howard-cpqb-fixed-imcprintserver-tls-blocked.md diff --git a/projects/gps-rmm-audit/session-logs/2026-07/2026-07-05-howard-cpqb-fixed-imcprintserver-tls-blocked.md b/projects/gps-rmm-audit/session-logs/2026-07/2026-07-05-howard-cpqb-fixed-imcprintserver-tls-blocked.md new file mode 100644 index 00000000..2ff5cfe8 --- /dev/null +++ b/projects/gps-rmm-audit/session-logs/2026-07/2026-07-05-howard-cpqb-fixed-imcprintserver-tls-blocked.md @@ -0,0 +1,85 @@ +# GPS->RMM audit: CP-QB fixed+enrolled (WMI repair); IMC-PRINTSERVER installed but TLS-blocked + +**Date:** 2026-07-05 (late 2026-07-04 MST evening through ~01:00) +**Session:** HOWARD-HOME/claude-main +**Context:** Continuing the GPS->GuruRMM coverage audit (projects/gps-rmm-audit). The only two +target machines online over the holiday weekend were CP-QB (Curtis Plumbing) and +IMC-PRINTSERVER (Instrumental Music Center) — both Monday-queue items whose installer pushes +had failed with unreadable error files. + +## User +- **User:** Howard Enos (howard) +- **Machine:** Howard-Home +- **Role:** tech + +## Outcome summary + +- **CP-QB: FIXED + ENROLLED.** Root cause: corrupt WMI class store (`Win32_Processor` = + Invalid class, HRESULT 0x80041010; broken since ~2022 — also why its SC GuestInfo was + frozen at 2022). The universal installer dies on `Get-CimInstance Win32_Processor` (line 30). + `winmgmt /verifyrepository` reported CONSISTENT (self-check does not catch a missing class); + `mofcomp %windir%\system32\wbem\cimwin32.mof` restored the class. Re-ran the installer clean, + service Running, enrolled into Staging, reassigned to **Curtis Plumbing** via + reassign-staging.py. Enrollment now **112/189**. Curtis Plumbing 5/6. +- **IMC-PRINTSERVER: agent fully installed, service RUNNING, but CANNOT connect** — + the box silently drops **ALL outbound TLS** (rmm.azcomputerguru.com/Cloudflare, + rmm-api direct IP 72.194.62.10, even https://www.google.com — all hang right after + ClientHello; no error, no ServerHello). ScreenConnect still works because its relay + protocol is not TLS. LAN traffic works. DNS resolves correctly (no sinkholing). + **The installed agent will self-connect the moment TLS egress is unblocked** — nothing + more to do on the box itself. + +## IMC-PRINTSERVER diagnostic findings (hard-won, reusable) + +Machine: Win10 Pro 22H2 (19045), 192.168.0.79/24, gw 192.168.0.254, DNS/DHCP = IMC1 +(192.168.0.2). SC session `ccbd66a7-f94a-4d87-a18b-5f81a30784d0`. + +1. **powershell.exe never executes** via SC on this box (every installer push is a PS + one-liner -> all silently died; also wedges the SC command queue when tried). + Plain single-line `cmd /c ...` commands work. +2. **SC extension command constraints (likely instance-wide, discovered here):** + - `SendCommandToSession` output is NOT retrievable via the API; session model holds ONE + queued event slot; a hung command wedges the queue and later sends are lost. + - Commands containing `&` chains or embedded newlines (multi-line batch) never execute. + - Rapid-fire sequential single commands work while the executor is healthy. +3. **Readback channel built:** temporary PowerShell HttpListener on IMC1 (via RMM command, + port 8765/8766 + temp firewall rule, auto-removed) — PRINTSERVER reports via + `curl.exe -G --data-urlencode d@` over LAN. Nginx-access-log-as-channel also works + for boxes with working egress: GET `https://rmm.azcomputerguru.com/install//windows?gpsdiag=&d=` + (CF allows the install path; /gps-diag paths get CF 403), read via the gururmm server's + own root agent (`grep gpsdiag /var/log/nginx/access.log`). +4. **SMB copy from \\IMC1\NETLOGON hung** (possibly broken secure channel — box is + generally rotten). Workaround that worked: HTTP file server on IMC1:8766 (HttpListener + serving the agent exe+toml), PRINTSERVER downloads via curl. Files verified on disk: + `C:\Program Files\GuruRMM\gururmm-agent-new.exe` (5,673,288 bytes) + agent.toml. +5. **Manual no-PowerShell install recipe (worked):** short paths avoid quoting — + `cmd /c C:\PROGRA~1\GuruRMM\gururmm-agent-new.exe install` then `cmd /c net start GuruRMMAgent`. + Agent log confirms: service installed, watchdog installed, config loaded, + "Connecting to wss://rmm-api.azcomputerguru.com/ws" — then silence (TLS black-hole). +6. **TLS block evidence:** curl schannel verbose stops after ALPN offer for BOTH Cloudflare + hosts AND google.com; no "Connected to" / no handshake failure line; -o file never + created. All-destination TLS drop => per-device gateway rule (IMC UniFi?) or local + WFP/AV filter remnant. NOT domain filtering, NOT DNS. + +## Next actions (IMC-PRINTSERVER) + +- Check IMC's UniFi gateway (192.168.0.254) for a per-device/VLAN rule throttling + 192.168.0.79 / MAC A0-1E-0B-11-60-1D (TLS/DPI, IoT isolation, or ad-block profile). +- If gateway clean: hands-on look for broken local network filter (AV remnant/WFP). + Bitdefender presence unconfirmed (probe was stopped). +- No reinstall needed afterward — agent + watchdog are installed and will connect on + their own once TLS egress works. Then reassign out of Staging + (`reassign-staging.py`) and push Datto EDR per the Monday recipe. + +## Also this session + +- Verified plan state at start: 111/189, 24 clients short (progress-check dry-run); + GPS-RMM-AutoEnroll (Mon 06:00, 30-min) and GPS-RMM-Progress (daily 8:07) tasks armed. +- GuruRMM install-reports endpoint checked: empty (installs die before reporting). +- Scratch files left in repo root (gitignored-ish dotfiles): `.gps-diag-cmds*.txt`, + `.gps-fix-cpqb*.txt`, `.gps-imc-listener*.json`, `.gps-imc1-stage.json`, + `.gps-listener-cid.txt`, `.gps-diag-imc*.txt`, `.gps-imc-fileserver.json` — safe to delete. +- Coord messages received (other session, FYI): SPEC-030 edits swept into repair-batch-2 + commit 333ceef (being split back out); 2 CONFIRMED review findings on + uninstall-engine.ps1 (PID-recycle kill risk at :459; missing never-kill guard at :432) + to fix before committing SPEC-030 work. diff --git a/projects/gps-rmm-audit/tracker.md b/projects/gps-rmm-audit/tracker.md index c1485f51..7a5ee826 100644 --- a/projects/gps-rmm-audit/tracker.md +++ b/projects/gps-rmm-audit/tracker.md @@ -290,3 +290,25 @@ Every migration/GPS client now has a Datto EDR org + target group + registration Deploy recipe per machine (Monday): RMM online -> POST /api/agents/:id/command powershell elevated: Install-EDR -URL https://azcomp4587.infocyte.com -RegKey . **Rule (Howard 2026-07-05): backup targets are never guessed.** The backup matrix above is a BILLING-reconciliation input only. A billed qty higher than machines-currently-backing-up is a question for Mike/Winter (bill wrong? machine offline? deliberate?), NOT an instruction to add backup to more machines. Which machine gets backed up is a deliberate per-client decision - do not infer targets, do not deploy backup jobs from this audit. + +## 2026-07-05 overnight — CP-QB FIXED+ENROLLED; IMC-PRINTSERVER installed but TLS-blocked + +- **CP-QB (Curtis Plumbing) DONE:** WMI class store was corrupt (Win32_Processor Invalid + class 0x80041010, broken since ~2022 — universal installer dies at its Get-CimInstance + arch check; also why SC GuestInfo was frozen at 2022). verifyrepository said CONSISTENT + (does not catch missing classes); `mofcomp cimwin32.mof` fixed it. Installer re-ran clean, + enrolled, reassigned to Curtis Plumbing (5/6). **Enrollment 112/189.** +- **IMC-PRINTSERVER (IMC) agent INSTALLED, service RUNNING, watchdog installed — but the + box drops ALL outbound TLS** (CF hosts, rmm-api direct IP, even google.com: ClientHello + then silence; SC works only because its relay protocol is not TLS; LAN + DNS fine). + Agent log ends at "Connecting to wss://rmm-api...". **It will self-enroll the moment TLS + egress is unblocked — do NOT reinstall.** Next: check IMC UniFi gateway (192.168.0.254) + for a per-device rule on 192.168.0.79 / A0-1E-0B-11-60-1D; else hands-on for a broken + local WFP/AV filter. Then reassign-staging.py + EDR push. +- **Box quirks (reusable):** powershell.exe never executes via SC on this box (all PS + one-liner pushes silently die + wedge the SC queue); only single-line cmd commands run; + SC extension eats `&`-chains and multi-line commands; SMB to \IMC1\NETLOGON hangs. + Working channels: curl.exe over LAN; HTTP file-serve from IMC1 via temp HttpListener + (RMM command); readback via listener query log or nginx access log on the RMM server + (`/install//windows?gpsdiag=...` — CF passes the install path). + Full detail: session-logs/2026-07/2026-07-05-howard-cpqb-fixed-imcprintserver-tls-blocked.md