azcomputerguru/claudetools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sync: auto-sync from HOWARD-HOME at 2026-07-09 20:14:58

Browse Source 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-09 20:14:58
This commit is contained in:
Howard Enos
2026-07-09 20:15:28 -07:00
parent ab987bf9e1
commit eb04287396
3 changed files with 174 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

167
clients/sif-oidak/session-logs/2026-07/2026-07-09-howard-dortega-ad-account-printer-740.md Normal file
View File

@@ -0,0 +1,167 @@
# 2026-07-09 — Sif-oidak: dortega AD account, printer error 740, UPN decision
## User
- **User:** Howard Enos (howard)
- **Machine:** Howard-Home
- **Role:** tech
## Session Summary
Howard reported that Dwayne Ortega could not log in to his machine at Sif-oidak District. Investigation via GuruRMM against the domain controller found no on-prem AD account matching `ortega` or `dwayne` among the 71 domain users. Ortega existed only as an M365 cloud user, created 2026-06-03. `dsregcmd` on Sif-Laptop554 showed the workstations are `DomainJoined: YES` / `AzureAdJoined: NO`, so an M365 credential can never authenticate a Windows sign-in at this client. His cloud password had already been reset earlier the same day (`lastPasswordChangeDateTime: 2026-07-09T20:33:05Z`), which could not have fixed a machine login.
The wiki described Sif-oidak as a hybrid AD/M365 environment. That was verified false: neither SIF-SERVER nor SIF-SERVER2 has an `ADSync` service or an Azure AD Connect uninstall entry, no AD object carries an `msDS-ConsistencyGuid`, and every M365 user has `onPremisesSyncEnabled: null`. The two directories are fully disjoint. jalbert's AD UPN is `jalbert@SifOidak.local` while his M365 UPN is `jalbert.sod@sifoidak.onmicrosoft.com` — unrelated accounts belonging to the same person.
On Howard's instruction, AD user `dortega` was created on SIF-SERVER via GuruRMM `-EncodedCommand` dispatch, matching the client's existing conventions. The account was verified enabled with `pwdLastSet=0` (must change password at next logon) and confirmed replicated to both DCs. In the course of that verification SIF-SERVER2 was confirmed as a **backup domain controller** (`DomainRole: 4`), closing an open question outstanding since May. The temp credential was vaulted and pushed.
A second issue was then raised: jalbert getting an error adding the "#740 sharp ud3" printer. The `#740` turned out to be the error code, not part of the printer name. Error 740 is `ERROR_ELEVATION_REQUIRED`, matching `Error code= 800702e4` (`0x2E4` = 740) in three PrintService/Admin event-600 entries. Root cause is the post-KB5005652 default `RestrictDriverInstallationToAdministrators=1`, which blocks non-admin print-driver installs via Point and Print; jalbert is not a local admin. Howard confirmed the UAC prompt for the driver install never surfaced, so it presented as a bare error. Howard installed the printer himself; no remote change was dispatched.
Finally, Mike's standing instruction was captured: new Sif-oidak users must get both an AD account and an M365 account. The related request to drop `onmicrosoft.com` from usernames was investigated and closed as not actionable — the tenant's only verified domain is `sifoidak.onmicrosoft.com`, and using `@sifoidak.com` would require a DNS TXT verification record at GoDaddy, where ACG has no registrar access (Mike confirmed).
## Key Decisions
- **Created the AD account rather than resetting the cloud password again.** The cloud password had already been reset that day to no effect. Machine sign-in at this client is AD-only; no M365 change could ever fix it.
- **Placed dortega in `Domain Users` only.** jalbert is also in `AssistancePrograms Group`, but that is a departmental group and membership was not assumed. Flagged for confirmation.
- **Declined to set `RestrictDriverInstallationToAdministrators=0`** as a printer fix. That re-opens the PrintNightmare (CVE-2021-34527) RCE class for every user on the machine. The safe non-interactive alternative (per-machine connection added as SYSTEM via `printui /ga`) was prepared but not dispatched — Howard fixed it manually first.
- **Recorded the UPN rename as DECIDED, not BLOCKED.** Framing it as blocked would invite a future session to re-propose it. It is closed pending registrar access that we are not pursuing.
- **Corrected the wiki's "hybrid" description.** That single wrong word is what makes the two-account trap easy to fall into, and it directly caused this ticket.
## Problems Encountered
- **`get-token.sh` resolved `identity.json` from `$HOME`** instead of the repo, dying with `vault_path not set`. Worked around with `export VAULT_ROOT_ENV=D:/vault`. Logged to errorlog as friction.
- **UNC path `\\SIF-SERVER\print$` collapsed to a single backslash** inside a `jq --arg` PowerShell payload, producing a bogus "path not found" that nearly read as a real diagnostic finding. Re-dispatched byte-exact via `ps-encoded.sh`. Logged to errorlog as friction (ref `feedback_windows_quote_stripping`).
- **A rejected `git push` reported `[OK]`.** The chain `git push -q 2>&1 | tail -5 && echo "[OK]"` tested `tail`'s exit status, not git's. The vault push had actually been rejected (remote ahead). Fixed with `git pull --rebase` then a bare `git push`. Logged to errorlog as friction.
- **`signInActivity` query returned 403** — `AuditLog.Read.All` is still missing on the Security Investigator SP for this tenant, so sign-in history could not be read. This is the known open item from 2026-06-03, re-confirmed still outstanding.
- **Laptop agent UUIDs in the wiki were stale** — both laptops had re-enrolled since May. Corrected, with a warning to always resolve hostname → UUID live.
## Configuration Changes
| File | Change |
|---|---|
| `wiki/clients/sif-oidak.md` | Rewrote identity model (not hybrid); added Identity model, Printing, and User Onboarding Runbook sections; corrected agent UUIDs; confirmed SIF-SERVER2 as backup DC; closed UPN item; two history entries |
| `D:/vault/clients/sif-oidak/ad-users.sops.yaml` | **Created** — dortega AD credential (SOPS-encrypted, pushed) |
| `errorlog.md` | 3 `--friction` entries (get-token identity resolution, UNC backslash mangling, piped-exit-code false OK) |
**AD change (SIF-SERVER):** created user `dortega`.
## Credentials & Secrets
- **`dortega` on-prem AD account** — vaulted at `clients/sif-oidak/ad-users.sops.yaml`. Temp password is single-use: `pwdLastSet=0` forces a change at first logon, invalidating it. Read with:
```bash
bash .claude/scripts/vault.sh get-field clients/sif-oidak/ad-users.sops.yaml credentials.dortega_temp_password
```
- Password was never pasted into chat, a ticket, or a commit message.
- **ACG has no GoDaddy/registrar credentials for `sifoidak.com`.** Confirmed absent from vault; Mike confirmed we cannot obtain them.
- Existing: `clients/sif-oidak/laptops.sops.yaml` holds `Localadmin` / `Sif` local creds for the laptops.
## Infrastructure & Servers
| Host | Role | GuruRMM agent ID | Notes |
|---|---|---|---|
| SIF-SERVER | **PDC** (`DomainRole: 5`) | `def9fdbb-020b-498d-9d3b-edf5912ba298` | Shares SHARP UD3 PCL6 + MX-6070V PCL6 |
| SIF-SERVER2 | **Backup DC** (`DomainRole: 4`, confirmed this session) | `944b0c4b-048d-44b8-85e5-40da135f58d6` | Shares SHARP MX-6240N PCL6 |
| Sif-Laptop554 | jalbert's laptop | `9e5016f0-e330-4d24-ab01-67cf4e55d46b` | Online; UUID changed since May |
| Sif-Laptop555 | likely Ortega's (unconfirmed) | `1be314d5-0395-4b1c-aa26-3b4a96bd2e22` | Offline; UUID changed since May |
- **AD domain:** `SifOidak.local` — 71 users. Only UPN suffix in the forest.
- **AD password policy:** `MinPasswordLength: 6`, `ComplexityEnabled: False`, `MaxPasswordAge: ~42d`.
- **M365 tenant:** `sifoidak.onmicrosoft.com`, tenant ID `568eb763-3b95-4271-8443-530c74b1c6bb`.
- Only verified domain: `sifoidak.onmicrosoft.com` (`isInitial`, `isDefault`).
- SKU `O365_BUSINESS`, 11/11 consumed. Service plans include `EXCHANGE_S_FOUNDATION` (no-mailbox stub), `OFFICE_BUSINESS`, `ONEDRIVESTANDARD`.
- **No Exchange mailboxes exist.** All 12 users: `mail: null`, zero `proxyAddresses`.
- **Email:** `sifoidak.com` at **GoDaddy** — `NS ns19/ns20.domaincontrol.com`, `MX 0 smtp.secureserver.net`, `MX 10 mailstore1.secureserver.net`. Outside M365 entirely.
- **Printers:** all three queues use `PortName 192.168.0.99`.
- Parent org `tonation-nsn.gov` has `MX -> tonationnsn-gov02b.mail.protection.outlook.com` (separate tenant, not ours).
## Commands & Outputs
Find the client's agents:
```bash
bash .claude/scripts/rmm-search.sh -c "sif-oidak"
```
Confirm no AD account existed (returned zero matches across 71 users):
```powershell
Get-ADUser -Filter { Name -like "*ortega*" -or SamAccountName -like "*ortega*" } -Properties Enabled,LockedOut
```
Confirm no directory sync (all three checks negative on both DCs):
```powershell
Get-Service -Name "ADSync","AzureADConnectHealthSync*" # none
Get-ItemProperty HKLM:\...\Uninstall\* | ? DisplayName -match "Azure AD Connect" # none
(Get-ADUser -Filter * -Properties "msDS-ConsistencyGuid" | ? {$_."msDS-ConsistencyGuid"}).Count # 0
```
Workstation join state (Sif-Laptop554):
```
AzureAdJoined : NO
DomainJoined : YES
```
Create the account (dispatched byte-exact via `ps-encoded.sh` because of the `!` and quotes):
```bash
bash .claude/scripts/ps-encoded.sh rmm def9fdbb-020b-498d-9d3b-edf5912ba298 create-dortega.ps1 --timeout 120
```
Result — `cmd:cb79dca7`, exit 0:
```
SamAccountName : dortega
UserPrincipalName : dortega@SifOidak.local
DistinguishedName : CN=Dwayne Ortega,OU=Domain Users,DC=SifOidak,DC=local
Enabled : True
pwdLastSet : 0 <- must change at next logon
MUSTCHANGE=True
```
Replication verified on both DCs (`Get-ADUser dortega -Server localhost` → visible, `pwdLastSet=0`).
Printer failure — `Microsoft-Windows-PrintService/Admin`, event 600, ×3 on 2026-07-09:
```
The print spooler failed to import the printer driver that was downloaded from
\\sif-server\print$\x64\PCC\sv0emenu.inf_amd64_d930f97fabc69575.cab into the driver
store for driver SHARP UD3 PCL6. Error code= 800702e4.
```
`0x800702e4` → Win32 error `0x2E4` = **740** = `ERROR_ELEVATION_REQUIRED`. The event text blames the digital signature — **red herring**, it is purely elevation.
```powershell
# absent -> Windows default = 1 = only admins may install printer drivers
(Get-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows NT\Printers" -Name RestrictDriverInstallationToAdministrators).RestrictDriverInstallationToAdministrators
# ABSENT
Get-LocalGroupMember Administrators
# SIF-LAPTOP554\Administrator, SIF-LAPTOP554\Localadmin, SIFOIDAK\Domain Admins (no jalbert)
```
Separate GPO defect — event 513 on Sif-Laptop554:
```
Group Policy was unable to add per computer connection \\SIF-SERVER\SHARP MX-6240N PCL6.
Error code 0x709.
```
The MX-6240N is shared on **SIF-SERVER2**, not SIF-SERVER. GPO path is wrong.
Graph reads (note the `VAULT_ROOT_ENV` workaround):
```bash
export VAULT_ROOT_ENV="D:/vault"
TOK=$(bash ~/.claude/skills/remediation-tool/scripts/get-token.sh sifoidak.onmicrosoft.com investigator | tail -1)
curl -s "https://graph.microsoft.com/v1.0/domains" -H "Authorization: Bearer $TOK"
curl -s "https://graph.microsoft.com/v1.0/subscribedSkus" -H "Authorization: Bearer $TOK"
```
## Pending / Incomplete Tasks
- [ ] **Confirm which laptop is Ortega's** (Sif-Laptop555 assumed; offline this session) and verify he can sign in and complete the forced password change. He must be on the domain network for the first logon.
- [ ] **Fix the GPO printer path** — `\\SIF-SERVER\SHARP MX-6240N PCL6` → `\\SIF-SERVER2\SHARP MX-6240N PCL6`. Failing on every boot today.
- [ ] **Backfill `AuditLog.Read.All` + `User.Read.All`** on the Security Investigator SP: `onboard-tenant.sh sifoidak.onmicrosoft.com`. Sign-in history unreadable until then. Open since 2026-06-03.
- [ ] Decide whether dortega needs `AssistancePrograms Group` membership.
- [ ] Consider hardening the AD password policy (min 6, complexity off).
- [ ] Determine if jalbert's `PasswordNeverExpires` should be restored (cleared 2026-05-28).
- [ ] Consider GDAP / Partner Center relationship to get the tenant into CIPP.
- [ ] **No Syncro ticket or time was logged for this session.** Billing rate is $150/hr remote.
- [x] ~~Remove `onmicrosoft.com` from M365 usernames~~ — **CLOSED.** No registrar access to `sifoidak.com`; Mike confirmed unobtainable. Do not re-open.
## Reference Information
- Wiki article: `wiki/clients/sif-oidak.md`
- Commits: `2b6e368` (identity model + printer + onboarding runbook), `e570629` (close UPN rename)
- Vault: `clients/sif-oidak/ad-users.sops.yaml`, `clients/sif-oidak/laptops.sops.yaml`
- GuruRMM command IDs: `cb79dca7` (create dortega), `d72cee82` (AD user search)
- Syncro customer ID `7694718`; prior tickets #32341, #32380
- Tenant admin consent URL: `https://login.microsoftonline.com/sifoidak.onmicrosoft.com/adminconsent?client_id=709e6eed-0711-4875-9c44-2d3518c47063&redirect_uri=https://azcomputerguru.com&prompt=consent`
- Error 740 background: KB5005652 / CVE-2021-34527 (PrintNightmare) Point-and-Print hardening

4
errorlog.md
View File

@@ -19,6 +19,10 @@ Categories (the `[type]` tag): _(none)_ = skill/command execution failure ·
<!-- Append entries below this line -->
2026-07-10 | Howard-Home | unifi-wifi/gw-sitemanager.sh | [friction] net <console> raw <path> truncates JSON at [:5000] chars, so /stat/sta output is unparseable for sites with >~10 clients; had to re-query api.ui.com directly with the vaulted key [ctx: script=gw-sitemanager.sh line=264 workaround=direct-curl]
2026-07-10 | Howard-Home | unifi-wifi/gw-sitemanager | Site Manager API call failed (HTTP 404) [ctx: path=/v1/connector/consoles/1C6A1B1BC2470000000008B8D1B50000000009302B160000000067A67E3A:1341833834/proxy/network/stat/sta]
2026-07-09 | GURU-BEAST-ROG | remediation-tool | reset-password.sh JIT cleanup failed: SP cannot remove its own PAA role assignment (Graph 400 self-removal block); required temp PRA grant to second SP to remove. Script should delegate cleanup to another SP or warn [ctx: tenant=sifoidak script=reset-password.sh]
2026-07-09 | GURU-BEAST-ROG | remediation-tool | reset-password: failed to remove JIT Privileged Auth Admin role - standing privilege left behind, REMOVE MANUALLY [ctx: tenant=568eb763-3b95-4271-8443-530c74b1c6bb assignment=ikzke6-tKk6E1qsmSeCKE7PwwTzAbMNNrIysDtlMU0E-1 http=400]

4
wiki/clients/cascades-tucson.md
View File

@@ -211,7 +211,7 @@ Because per-user **Intune** never provisioned tenant-wide (`INTUNE_A = PendingIn
- Sharon Edwards -- Life Enrichment Assistant (DESKTOP-DLTAGOI)
- Ashley Jensen -- Accountant (DESKTOP-U2DHAP0)
- Shelby Trozzi -- MemCare Director (MDIRECTOR-PC)
- Chris Knight -- Accounting / Business Office (same access tier as Lauren Hasselman); chris.knight@cascadestucson.com (alias: c.knight@cascadestucson.com). **Workstation setup 2026-06-08:** machine **DESKTOP-N5G1ROO** (Win 11 Pro for Workstations) domain-joined + GuruRMM-enrolled (agent `205025ee-2676-4498-8a27-e88562a6f69a`), Office installed. AD account `chris.knight` (OU=Administrative) finished to match Lauren. Mailbox remains cloud-only/unsynced (same split state as Lauren).
- Chris Knight -- Accounting / Business Office (same access tier as Lauren Hasselman); chris.knight@cascadestucson.com (alias: c.knight@cascadestucson.com). **Workstation setup 2026-06-08:** machine **DESKTOP-N5G1ROO** (Win 11 Pro for Workstations) domain-joined + GuruRMM-enrolled (agent `205025ee-2676-4498-8a27-e88562a6f69a`), Office installed. AD account `chris.knight` (OU=Administrative) finished to match Lauren. Mailbox remains cloud-only/unsynced (same split state as Lauren). **Accounting mailbox access 2026-07-09:** granted FullAccess (auto-mapping) + SendAs on `accounting@cascadestucson.com`, matching Lauren/Ashley/Zachary.
- JD Martin -- Syncro-confirmed contact (jd.martin@cascadestucson.com); Chef's Office user on CHEF-PC (his default printer = USB Chef Printer).
- Lupe Sanchez -- staff (DESKTOP-TRCIEJA). EOL workstation (Gateway ZX6971 AIO, i3-2120, 8 GB RAM, Win11 unsupported). **Decision 2026-06-18: replace machine** (dual-AV + EOL hardware causing slow Excel; no remediation on current box). GuruRMM agent `c9bf1a2d-bfdc-401e-9cc8-f9e90bb19587` (resolve live by hostname; UUIDs change on re-enroll).
- Tamra Matthews -- Move-In Coordinator (Marketing/Sales), SALES4-PC. **OFFBOARDED 2026-06-30** (left June 2026 -- see Access section).
@@ -288,6 +288,8 @@ Because per-user **Intune** never provisioned tenant-wide (`INTUNE_A = PendingIn
- **Inky:** No Inky deployment exists in this tenant. Confirmed 2026-06-04.
- **EXO MSP app auth note (2026-06-04):** When the MSP app cert is not in the Windows cert store, use client_credentials flow to obtain an EXO-scoped access token and connect via `Connect-ExchangeOnline -AccessToken`. App: ComputerGuru Exchange Operator (`b43e7342-5b4b-492f-890f-bb5a4f7f40e9`). Vault: `msp-tools/computerguru-exchange-operator.sops.yaml`.
- **Shared mailboxes (created 2026-06-12):** `grievances@cascadestucson.com` and `Surveys@cascadestucson.com` -- both SharedMailbox type, cloud-only, no license consumed. Delegated to Meredith Kuhn and Ashley Jensen with FullAccess (auto-mapping) + SendAs on each. All 8 permission grants verified. Ticket #32417.
- **`accounting@cascadestucson.com` ("Accounting Dept.")** -- SharedMailbox, cloud-only, account disabled (normal for shared). **Delegates (verified 2026-07-09): Lauren Hasselman, Ashley Jensen, Zachary Nelson, Chris Knight** -- each holds FullAccess (auto-mapping) + SendAs. Chris Knight added 2026-07-09 to match Lauren's tier. Note `accountingassistant@` is a separate **UserMailbox**, not a delegate of this one.
- **Grant pattern (EXO REST `InvokeCommand`, `exchange-op` tier):** `Add-MailboxPermission -Identity accounting@ -User <upn> -AccessRights FullAccess -InheritanceType All -AutoMapping $true`, then `Add-RecipientPermission -Identity accounting@ -Trustee <upn> -AccessRights SendAs`. AutoMapping is what makes the mailbox self-attach in the user's Outlook profile (AutoDiscover refresh; restart Outlook to force). **Verification gotcha:** an immediate `Get-RecipientPermission` read-back can miss the new SendAs trustee (replication lag across EXO replicas) -- re-read before concluding the write failed. SendAs itself can take ~60 min to replicate before sending stops bouncing.
### Network