From fa61dcab1cf31adfec1077a5780a9191c45a51a4 Mon Sep 17 00:00:00 2001 From: Mike Swanson Date: Thu, 23 Jul 2026 13:21:11 -0700 Subject: [PATCH] sync: auto-sync from GURU-BEAST-ROG at 2026-07-23 13:20:20 Author: Mike Swanson Machine: GURU-BEAST-ROG Timestamp: 2026-07-23 13:20:20 --- ...p-ubti0ie3-edservices1-reset-vpn-repair.md | 130 ++++++++++++++++++ errorlog.md | 2 + 2 files changed, 132 insertions(+) create mode 100644 clients/instrumental-music-center/session-logs/2026-07/2026-07-23-mike-laptop-ubti0ie3-edservices1-reset-vpn-repair.md diff --git a/clients/instrumental-music-center/session-logs/2026-07/2026-07-23-mike-laptop-ubti0ie3-edservices1-reset-vpn-repair.md b/clients/instrumental-music-center/session-logs/2026-07/2026-07-23-mike-laptop-ubti0ie3-edservices1-reset-vpn-repair.md new file mode 100644 index 00000000..ac1e36ef --- /dev/null +++ b/clients/instrumental-music-center/session-logs/2026-07/2026-07-23-mike-laptop-ubti0ie3-edservices1-reset-vpn-repair.md @@ -0,0 +1,130 @@ +# Session Log — LAPTOP-UBTI0IE3: EdServices1 password reset, VPN/domain trust repair, gpupdate, Office activation billing + +## User +- **Executed by:** ClaudeTools Discord Bot (GURU-BEAST-ROG) +- **Requested by:** Mike Swanson (@azcomputerguru, via Discord) - admin +- **Role:** automation (acting on the requester's behalf) + +Discord thread: 1529926422083141774 ("Find LAPTOP-UBTI0IE3 in RMM or SC") +Date: 2026-07-23 (AZ) + +## Session Summary + +Mike asked to locate LAPTOP-UBTI0IE3 in GuruRMM/ScreenConnect. Found it in GuruRMM +(agent b1038d84-2275-4405-b852-94e7ee3aa2ed, online, Instrumental Music Center). He then +asked to reset the domain password for IMC\EdServices1 to a new value and verify the laptop +could see the domain. Resolved IMC1 (the DC, 192.168.0.2) in RMM as agent +88cbf7c0-abfa-4f12-846c-96274f718bff (the wiki's fa99e913 UUID is stale) and reset the +password there via Set-ADAccountPassword -Reset + Unlock-ADAccount (PasswordLastSet 12:04 PM AZ). + +The laptop is offsite and reaches the domain only over OpenVPN. Investigated the OpenVPN +Connect v3 install: attempted headless start via ovpnconnector.exe, but the connector service +only supports auto-login profiles and the installed profile uses auth-user-pass — abandoned +and removed the service. The tunnel came up anyway because localadmin logged in at the console +and connected the GUI VPN client (laptop got 192.168.2.4 on the 192.168.2.0/24 VPN subnet). + +With VPN up, domain repair: Test-ComputerSecureChannel failed first on DNS ("server is not +operational") then on broken trust ("Access is denied"). Fixed DNS with NRPT rules forcing +imc.local to 192.168.0.2, then Reset-ComputerMachinePassword -Server IMC1.imc.local -Credential +IMC\guru + Netlogon restart → secure channel True / NERR_Success. Also added an outbound +firewall rule blocking the phantom DC ServerIMC (192.168.0.63), a known IMC hazard. + +Forced gpupdate: user policy and logon script applied successfully; computer policy failed +("LDAP Bind function call failed") — root-caused to UDP (CLDAP 389 / NTP 123) being blocked +over the VPN tunnel while all TCP ports work. Not blocking the user; computer GP will apply +on-site. Verified IMC\edservices1 logged on at 12:34 PM AZ with the new password. + +Mike then reported he activated Office in the EdServices1 profile using +remote@instrumentalmusic.onmicrosoft.com and asked for 1 hr remote billing. Created Syncro +ticket #32585, added the resolution comment, billed 1.0 hr Labor - Remote Business (product +1190473, attributed to Mike/1735), generated invoice #68080 ($0.00 — prepaid block debited +8.5 → 7.5 hrs, verified live), set invoice note "Block hours remaining: 7.5.", posted the +#bot-alerts summary. + +## Key Decisions + +- Used GuruRMM (not ScreenConnect) for all remote execution — agent online, full PowerShell. +- Password reset executed on IMC1 directly (authoritative DC) rather than through the laptop. +- Abandoned ovpnconnector headless start after determining the connector only supports + auto-login profiles; relied on the console user's GUI VPN connection instead. +- Fixed domain visibility with NRPT rules (imc.local → 192.168.0.2) instead of changing the + NIC DNS servers — scoped, survives DHCP, only affects the domain suffix. +- Blocked phantom DC ServerIMC (192.168.0.63) via outbound firewall rule on the laptop so + DC discovery can't land on the dead server over VPN. +- Did NOT chase the computer-policy gpupdate failure further after isolating it to UDP + CLDAP/NTP over the tunnel — user-side work was complete; flagged UDM firewall follow-up. +- Billing per prepaid rules: prepay_hours fetched from full GET /customers/7088508 (8.5) + before the preview; $0.00 invoice is correct prepaid behavior, deduction verified post-invoice. + +## Problems Encountered + +- Get-ADUser -Filter with embedded quotes mangled by RMM dispatch quote-stripping → switched + to -LDAPFilter (no inner quotes); larger scripts dispatched via ps-encoded.sh (-EncodedCommand). +- Two RMM command timeouts reading ovpnconnector.cfg → simplified command succeeded. +- OVPNConnectorService wouldn't start (empty log) → connector requires auto-login profile; + profile is auth-user-pass. Removed service with `ovpnconnector.exe remove`. +- Test-ComputerSecureChannel -Repair: "server is not operational" (DNS) → NRPT fix; + then "Access is denied" (broken trust) → Reset-ComputerMachinePassword against IMC1 as + IMC\guru + Restart-Service Netlogon → True/NERR_Success. +- gpresult "applied from ServerIMC" was stale GP History registry cache, not live phantom-DC + contact — corrected the initial misattribution; real cause of computer-GP failure is UDP + 389/123 blocked over VPN (TCP all open, Kerberos tickets valid, clocks in sync). +- Syncro: guessed POST /tickets/{id}/make_invoice (404) — correct endpoint is POST /invoices + with {ticket_id, customer_id} per .claude/commands/syncro.md. Logged to errorlog (--friction). + +## Configuration Changes + +State changed on LAPTOP-UBTI0IE3 (left in place, documented to Mike): +- NRPT rules: imc.local (and .imc.local) → DNS server 192.168.0.2 +- Outbound firewall rule "ACG-Block-PhantomDC-ServerIMC" blocking 192.168.0.63 +- OVPNConnectorService installed then removed (no residue) + +On IMC1: EdServices1 password reset + account unlocked. No other changes. + +Repo: temp dispatch scripts .vpn-setup.ps1 / .vpn2.ps1 / .fix-trust.ps1 created and deleted. +errorlog.md: one --friction entry (syncro wrong endpoint). + +## Credentials & Secrets + +- EdServices1 new domain password: `Imcr0cks!` (set by Mike's instruction; communicated in + Discord thread — not vaulted, user-level credential) +- Vault paths read (values not recorded here): + - clients/imc/openvpn-edservices4.sops.yaml (VPN user edservices4, UDM-IMC-L1 72.194.57.2:1194) + - clients/imc/imc1.sops.yaml (IMC\guru domain admin) + +## Infrastructure & Servers + +- LAPTOP-UBTI0IE3: GuruRMM agent b1038d84-2275-4405-b852-94e7ee3aa2ed, Windows, offsite, + VPN IP 192.168.2.4 when connected +- IMC1: DC/DNS/AIMsi SQL, 192.168.0.2, agent 88cbf7c0-abfa-4f12-846c-96274f718bff + (wiki UUID fa99e913 is stale — update on next wiki compile) +- Phantom DC: ServerIMC 192.168.0.63 (refuses LDAP/Kerberos; ghost DNS records) +- VPN: UDM-IMC-L1 72.194.57.2:1194, VPN subnet 192.168.2.0/24; LAN 192.168.0.0/24 +- Syncro customer 7088508 (Instrumental Music Center), prepaid block $175/hr + +## Commands & Outputs + +- Password reset (on IMC1): Set-ADAccountPassword -Identity edservices1 -Reset; + Unlock-ADAccount → PasswordLastSet 2026-07-23 12:04 PM AZ +- Trust repair (on laptop): Add-DnsClientNrptRule -Namespace imc.local -NameServers 192.168.0.2; + Reset-ComputerMachinePassword -Server IMC1.imc.local -Credential IMC\guru; + Restart-Service Netlogon; Test-ComputerSecureChannel → True; nltest /sc_query:imc → NERR_Success +- gpupdate /force: user policy OK, computer policy "LDAP Bind function call failed" + (UDP CLDAP 389 / NTP 123 blocked over tunnel; all TCP ports verified open) +- Logon verification: IMC\edservices1 interactive logon 12:34 PM AZ, logon script completed + +## Pending / Incomplete Tasks + +- Suggested (not done): UDM firewall rule allowing UDP 389 + 123 from VPN subnet + 192.168.2.0/24 to 192.168.0.2 so computer GP applies remotely +- Wiki update on next compile: IMC1 agent UUID correction; laptop NRPT + firewall state; + ticket reference + +## Reference Information + +- Syncro ticket #32585 (id 114176292): https://computerguru.syncromsp.com/tickets/114176292 +- Invoice #68080 (id 1651147066), $0.00, prepaid 8.5 → 7.5 hrs, note "Block hours remaining: 7.5." +- Line item 43393783: Labor - Remote Business (1190473), 1.0 hr, $150, taxable false, tech Mike (1735) +- Comment 425140277 (Resolution, public, do_not_email) +- Bot alerts: #dev-alerts (RMM dispatches), #bot-alerts message 1529937659030405262 (billing) +- Discord thread 1529926422083141774 diff --git a/errorlog.md b/errorlog.md index 43683d80..5420c5af 100644 --- a/errorlog.md +++ b/errorlog.md @@ -19,6 +19,8 @@ Categories (the `[type]` tag): _(none)_ = skill/command execution failure · +2026-07-23 | GURU-BEAST-ROG | syncro | [friction] guessed POST /tickets/{id}/make_invoice (404) instead of documented POST /invoices {ticket_id,customer_id} from commands/syncro.md; recovered by reading skill doc [ctx: ticket=32585 ref=.claude/commands/syncro.md#invoices] + 2026-07-23 | GURU-BEAST-ROG | drive-map | drive-map verify failed on TPS-JAYMI [ctx: cmd=6169a053-ab39-4366-a00c-755d4d4bdbf8] 2026-07-23 | GURU-BEAST-ROG | rmm/qb-diagnostics | [correction] speculated TPS-SVR rebooted because .ND file regenerated at 8:48 AM; server uptime was 15 days - a QB .ND file is rewritten on every client connect, it is NOT evidence of a server reboot