gps-rmm-audit: CP-QB WMI-repaired+enrolled (112/189); IMC-PRINTSERVER agent installed, blocked by box-wide outbound TLS drop

CP-QB: corrupt WMI class store (Win32_Processor invalid class) killed the universal
installer's arch check; mofcomp cimwin32.mof fixed it; enrolled + reassigned to
Curtis Plumbing. IMC-PRINTSERVER: agent+watchdog installed manually over LAN HTTP
from IMC1 (PowerShell dead on box, SMB hangs, SC extension eats chains/multiline);
box drops ALL outbound TLS (incl google) so agent cannot connect — fix is at IMC
UniFi gateway or local filter; no reinstall needed. Session log + tracker updated.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

projects/gps-rmm-audit/tracker.md

@@ -290,3 +290,25 @@ Every migration/GPS client now has a Datto EDR org + target group + registration
 Deploy recipe per machine (Monday): RMM online -> POST /api/agents/:id/command powershell elevated: Install-EDR -URL https://azcomp4587.infocyte.com -RegKey <client key from vault>.
 
 **Rule (Howard 2026-07-05): backup targets are never guessed.** The backup matrix above is a BILLING-reconciliation input only. A billed qty higher than machines-currently-backing-up is a question for Mike/Winter (bill wrong? machine offline? deliberate?), NOT an instruction to add backup to more machines. Which machine gets backed up is a deliberate per-client decision - do not infer targets, do not deploy backup jobs from this audit.
+
+## 2026-07-05 overnight — CP-QB FIXED+ENROLLED; IMC-PRINTSERVER installed but TLS-blocked
+
+- **CP-QB (Curtis Plumbing) DONE:** WMI class store was corrupt (Win32_Processor Invalid
+  class 0x80041010, broken since ~2022 — universal installer dies at its Get-CimInstance
+  arch check; also why SC GuestInfo was frozen at 2022). verifyrepository said CONSISTENT
+  (does not catch missing classes); `mofcomp cimwin32.mof` fixed it. Installer re-ran clean,
+  enrolled, reassigned to Curtis Plumbing (5/6). **Enrollment 112/189.**
+- **IMC-PRINTSERVER (IMC) agent INSTALLED, service RUNNING, watchdog installed — but the
+  box drops ALL outbound TLS** (CF hosts, rmm-api direct IP, even google.com: ClientHello
+  then silence; SC works only because its relay protocol is not TLS; LAN + DNS fine).
+  Agent log ends at "Connecting to wss://rmm-api...". **It will self-enroll the moment TLS
+  egress is unblocked — do NOT reinstall.** Next: check IMC UniFi gateway (192.168.0.254)
+  for a per-device rule on 192.168.0.79 / A0-1E-0B-11-60-1D; else hands-on for a broken
+  local WFP/AV filter. Then reassign-staging.py + EDR push.
+- **Box quirks (reusable):** powershell.exe never executes via SC on this box (all PS
+  one-liner pushes silently die + wedge the SC queue); only single-line cmd commands run;
+  SC extension eats `&`-chains and multi-line commands; SMB to \IMC1\NETLOGON hangs.
+  Working channels: curl.exe over LAN; HTTP file-serve from IMC1 via temp HttpListener
+  (RMM command); readback via listener query log or nginx access log on the RMM server
+  (`/install/<code>/windows?gpsdiag=...` — CF passes the install path).
+  Full detail: session-logs/2026-07/2026-07-05-howard-cpqb-fixed-imcprintserver-tls-blocked.md