azcomputerguru/claudetools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sync: auto-sync from HOWARD-HOME at 2026-06-29 16:19:10

Browse Source 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-06-29 16:19:10
This commit is contained in:
Howard Enos
2026-06-29 16:19:44 -07:00
parent aae5b4cdd6
commit e692bff2bc
1 changed files with 81 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

81
clients/michaeljohnson/session-logs/2026-06/2026-06-29-howard-rmm-onboard-edr-billing.md Normal file
View File

@@ -0,0 +1,81 @@
## User
- **User:** Howard Enos (howard)
- **Machine:** Howard-Home
- **Role:** tech
## Session Summary
Onboarded Michael Johnson (Syncro customer 152567, long-standing break-fix legal client) to GuruRMM and Datto EDR/AV, built the customer wiki, and billed the onsite ticket. The session opened with an unrelated Rednour item — checking whether Nick Pafford's M365 license grants document access. His license is Exchange Online (Plan 1), email-only (no SharePoint/OneDrive/Office); the Rednour tenant had zero free seats, so a Business Standard seat would need purchasing. Winter handled the license assignment, so no further action was taken there.
Created the GuruRMM client + site for Michael Johnson via the `/rmm onboard` flow: client `99022a2e-6b8f-472b-9269-6a746ef0970b`, site "Main" (`BRIGHT-RIVER-8998`). The one-time enrollment key was vaulted at `clients/michaeljohnson/gururmm-site-main.sops.yaml`. The user then pushed the installers to both endpoints. Both agents checked in (DESKTOP-GG4LKSL = Michael, MJ-PARALEGAL = Crystal), and onboarding diagnostics were run against each: DESKTOP-GG4LKSL graded AMBER (BitLocker off, 4 pending updates, D: 14.6% free, Alibaba NTP source), MJ-PARALEGAL graded RED (firewall off on Private+Public, E: 0% free, anomalous DNS 172.16.132.1, BitLocker off). Neither machine has a backup agent. Built `wiki/clients/michaeljohnson.md` from the diagnostics + Syncro history + the ~50-ticket record, and added the index entry. The auto-sync process committed those before the manual save.
For endpoint security, the request was "remove Bitdefender and install the EDR." Direct RMM verification confirmed neither machine had Bitdefender (Defender-only; clean uninstall hive, no Bitdefender services) — the diagnostics had already flagged Defender as the sole AV — so removal was a no-op. The user created the "Michael Johnson" org in the Datto console; I created the "Main" target group (`3b844ef0-d792-4be9-bc0e-7d4848b99180`), minted a registration key (`wTgQ23T0Al`), and pushed the Datto EDR install one-liner to both machines via RMM. Both installed cleanly (exit 0), registered, and came online (agent v3.17.1.5409 → self-updated to 5552). AV initially read "-" (policy-driven, lagging); on re-check after the user applied a policy, both show AV "on". The reg key + org/group IDs were vaulted at `clients/michaeljohnson/datto-edr.sops.yaml`.
Finally, billed Syncro ticket #32477 (id 113125174, "Onsite - Check machine connections and printers"): 0.5h onsite labor (product 26118 @ $175, taxable false), customer has no prepaid block so it's a real $87.50 charge. Resolution comment per the user: set Michael's machine to a static IP and reconfigured the paralegal machine to reach the share via the new IP. Invoice #1650843860 created, block-rate upsell note set, ticket marked Invoiced, bot alert posted.
## Key Decisions
- Logged this session under `clients/michaeljohnson` (primary work) despite the opening Rednour/Nick read-only check, which was minor and resolved by Winter.
- Verified Bitdefender presence directly via RMM before acting rather than trusting the request — confirmed absent, so the removal step was correctly skipped instead of blindly running an uninstaller.
- Did NOT create the Datto Organization via the unverified raw `POST /Organizations` against the live production tenant; surfaced the decision and the user created it in the console. I only created the group/key (skill-supported, gated) under the existing org.
- Used `/rmm onboard` and `datto-edr` skills rather than free-handing the APIs (skill-first rule); vaulted both the RMM enrollment key and the EDR reg key as discovered/created credentials.
- Billed as a real charge (not a prepay deduction) after a fresh `GET /customers/152567` confirmed `prepay_hours = 0.0`.
## Problems Encountered
- `get-token.sh` (remediation-tool) read the wrong identity.json (`~/.claude/identity.json`, which lacks `vault_path`); the authoritative one is `C:/claudetools/.claude/identity.json` (`vault_path: D:/vault`). Worked around with `VAULT_ROOT_ENV="D:/vault"`.
- Vault push was rejected twice (remote ahead) during the RMM key and EDR key commits; resolved with `git -C "$VR" pull --rebase` then push.
- MJ-PARALEGAL onboarding surfaced two criticals (firewall off, E: 0% free) and an anomalous DNS (172.16.132.1 on a 192.168.1.x LAN) — captured as open items, not yet remediated.
- "commit this" had nothing to commit: the auto-sync process had already committed the wiki + baselines (main repo in sync, 0/0 vs origin). The only pending changes were 4 unrelated submodule pointer movements (two showing `doesn't contain commit` warnings) — left untouched rather than committing drift.
## Configuration Changes
- Created `wiki/clients/michaeljohnson.md` (committed via auto-sync).
- Edited `wiki/index.md` — added Michael Johnson client row; bumped "Last updated" to 2026-06-29.
- Created `clients/michaeljohnson/onboarding-baselines/DESKTOP-GG4LKSL-20260629T211835.{md,json}` and `MJ-PARALEGAL-20260629T211845.{md,json}`.
- Created vault `clients/michaeljohnson/gururmm-site-main.sops.yaml` (RMM enrollment key + syncro_customer_id).
- Created vault `clients/michaeljohnson/datto-edr.sops.yaml` (EDR reg key + org/group IDs).
- This session log.
## Credentials & Secrets
- **GuruRMM site "Main" enrollment** — site_code `BRIGHT-RIVER-8998`, api_key vaulted at `clients/michaeljohnson/gururmm-site-main.sops.yaml`.
- **Datto EDR registration key** — `wTgQ23T0Al` (org `fef82618-de1d-4b5c-b92e-7fd078e2b983`, group "Main" `3b844ef0-d792-4be9-bc0e-7d4848b99180`), vaulted at `clients/michaeljohnson/datto-edr.sops.yaml`. Auto-approves + enrolls agents into the Main group.
## Infrastructure & Servers
- **Client:** Michael Johnson — Syncro 152567 (since 2013), break-fix, no prepaid block. 177 N Church, Tucson AZ 85701. Contacts: Michael (michaeljohnson311@gmail.com / 520-622-0065), Crystal (paralegal, 520-906-4672). Mail on Google, not M365.
- **Network:** workgroup, peer-to-peer, 192.168.1.0/24. No server, no domain.
- **DESKTOP-GG4LKSL** (Michael) — HP Pavilion Gaming TG01, i7-11700F, 31.8 GB, Win11 Pro 25H2 (26200), 192.168.1.135 (Wi-Fi). RMM agent `09c08484-2b51-404b-a294-6e39f498867c`. EDR agent `798dadc9-dd72-40fe-bd06-e6b5506ebf73`. Onboarding AMBER.
- **MJ-PARALEGAL** (Crystal) — ASUS, i5-10400, 15.8 GB, Win11 Pro 25H2 (26200), 192.168.1.136 (wired). RMM agent `4537ac34-e548-484c-b4e9-fd91e7f97a23`. EDR agent `963178af-23b1-4bee-90e8-f9a6dbac7aec`. Onboarding RED.
- **GuruRMM:** client `99022a2e-6b8f-472b-9269-6a746ef0970b`, site `94b5cb21-3d8e-484a-8ef3-8388b66417d2` (Main, BRIGHT-RIVER-8998). Server `http://172.16.3.30:3001`.
- **Datto EDR:** tenant `azcomp4587.infocyte.com`, org "Michael Johnson" `fef82618-de1d-4b5c-b92e-7fd078e2b983`, group "Main" `3b844ef0-d792-4be9-bc0e-7d4848b99180`. Both agents online, AV on, v3.17.1.5552.
- **Rednour (incidental):** Nick Pafford `npafford@rednourlaw.com` (`fe859088-bcbc-49dc-aaea-4c6e68f7d5bb`), tenant `4a4ca18a-f516-478b-99da-2e0722c5dc18`. Was on Exchange Online Plan 1 (EXCHANGESTANDARD) — email only. Winter assigned the document license.
## Commands & Outputs
- RMM Bitdefender check (both hosts): `BITDEFENDER: none in uninstall hive` / `BD SERVICES: none` — confirmed absent.
- Datto EDR install (both): `Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe`, exit 0.
- `$EDR agents --org fef82618-...` final: desktop-gg4lksl AV on, mj-paralegal AV on, both v3.17.1.5552.
- Syncro billing: comment 421302761, line item 43066968 (0.5 @ 175), invoice 1650843860 total 87.50, ticket → Invoiced.
- Remediation token workaround: `VAULT_ROOT_ENV="D:/vault" bash get-token.sh <tenant> investigator`.
## Pending / Incomplete Tasks
- **MJ-PARALEGAL [P1]:** re-enable firewall (Private + Public); clear/expand E: (0% free).
- **Both [P1]:** establish/confirm backup coverage — no backup agent on either machine (law-office data).
- **MJ-PARALEGAL [P2]:** fix anomalous DNS 172.16.132.1 (should be local gateway/ISP).
- **DESKTOP-GG4LKSL [P3]:** free D: (14.6%); reset time source off Alibaba NTP; install 4 pending updates. MJ-PARALEGAL: 2 pending updates.
- Both: consider BitLocker with manual key escrow (workgroup, no AD escrow target).
- Open Syncro ticket #32477 was billed + Invoiced this session.
- ClaudeTools repo: 4 unrelated submodule pointer changes pending (discord-bot, guru-rmm, guru-scan, security-assessment) — not from this session; left untouched.
## Reference Information
- Syncro ticket: #32477 (id 113125174) — https://computerguru.syncromsp.com/tickets/113125174 — Invoiced.
- Syncro customer: Michael Johnson 152567 — https://computerguru.syncromsp.com/customers/152567
- Invoice #1650843860 — $87.50 (0.5h onsite @ $175).
- RMM install page: https://rmm.azcomputerguru.com/install/BRIGHT-RIVER-8998
- Datto EDR console: https://azcomp4587.infocyte.com
- Vault: `clients/michaeljohnson/gururmm-site-main.sops.yaml`, `clients/michaeljohnson/datto-edr.sops.yaml`.
- Baselines: `clients/michaeljohnson/onboarding-baselines/`.