azcomputerguru/claudetools
1
0
Fork 0
Code Issues 58 Pull Requests Actions Packages Projects Releases Wiki Activity

sync: auto-sync from GURU-BEAST-ROG at 2026-07-23 13:20:20

Browse Source 
Author: Mike Swanson
Machine: GURU-BEAST-ROG
Timestamp: 2026-07-23 13:20:20
This commit is contained in:
Mike Swanson
2026-07-23 13:21:11 -07:00
committed by ClaudeTools Bot
parent 2e7c94e3cc
commit fa61dcab1c
2 changed files with 132 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

130
clients/instrumental-music-center/session-logs/2026-07/2026-07-23-mike-laptop-ubti0ie3-edservices1-reset-vpn-repair.md Normal file
View File

@@ -0,0 +1,130 @@
# Session Log — LAPTOP-UBTI0IE3: EdServices1 password reset, VPN/domain trust repair, gpupdate, Office activation billing
## User
- **Executed by:** ClaudeTools Discord Bot (GURU-BEAST-ROG)
- **Requested by:** Mike Swanson (@azcomputerguru, via Discord) - admin
- **Role:** automation (acting on the requester's behalf)
Discord thread: 1529926422083141774 ("Find LAPTOP-UBTI0IE3 in RMM or SC")
Date: 2026-07-23 (AZ)
## Session Summary
Mike asked to locate LAPTOP-UBTI0IE3 in GuruRMM/ScreenConnect. Found it in GuruRMM
(agent b1038d84-2275-4405-b852-94e7ee3aa2ed, online, Instrumental Music Center). He then
asked to reset the domain password for IMC\EdServices1 to a new value and verify the laptop
could see the domain. Resolved IMC1 (the DC, 192.168.0.2) in RMM as agent
88cbf7c0-abfa-4f12-846c-96274f718bff (the wiki's fa99e913 UUID is stale) and reset the
password there via Set-ADAccountPassword -Reset + Unlock-ADAccount (PasswordLastSet 12:04 PM AZ).
The laptop is offsite and reaches the domain only over OpenVPN. Investigated the OpenVPN
Connect v3 install: attempted headless start via ovpnconnector.exe, but the connector service
only supports auto-login profiles and the installed profile uses auth-user-pass — abandoned
and removed the service. The tunnel came up anyway because localadmin logged in at the console
and connected the GUI VPN client (laptop got 192.168.2.4 on the 192.168.2.0/24 VPN subnet).
With VPN up, domain repair: Test-ComputerSecureChannel failed first on DNS ("server is not
operational") then on broken trust ("Access is denied"). Fixed DNS with NRPT rules forcing
imc.local to 192.168.0.2, then Reset-ComputerMachinePassword -Server IMC1.imc.local -Credential
IMC\guru + Netlogon restart → secure channel True / NERR_Success. Also added an outbound
firewall rule blocking the phantom DC ServerIMC (192.168.0.63), a known IMC hazard.
Forced gpupdate: user policy and logon script applied successfully; computer policy failed
("LDAP Bind function call failed") — root-caused to UDP (CLDAP 389 / NTP 123) being blocked
over the VPN tunnel while all TCP ports work. Not blocking the user; computer GP will apply
on-site. Verified IMC\edservices1 logged on at 12:34 PM AZ with the new password.
Mike then reported he activated Office in the EdServices1 profile using
remote@instrumentalmusic.onmicrosoft.com and asked for 1 hr remote billing. Created Syncro
ticket #32585, added the resolution comment, billed 1.0 hr Labor - Remote Business (product
1190473, attributed to Mike/1735), generated invoice #68080 ($0.00 — prepaid block debited
8.5 → 7.5 hrs, verified live), set invoice note "Block hours remaining: 7.5.", posted the
#bot-alerts summary.
## Key Decisions
- Used GuruRMM (not ScreenConnect) for all remote execution — agent online, full PowerShell.
- Password reset executed on IMC1 directly (authoritative DC) rather than through the laptop.
- Abandoned ovpnconnector headless start after determining the connector only supports
auto-login profiles; relied on the console user's GUI VPN connection instead.
- Fixed domain visibility with NRPT rules (imc.local → 192.168.0.2) instead of changing the
NIC DNS servers — scoped, survives DHCP, only affects the domain suffix.
- Blocked phantom DC ServerIMC (192.168.0.63) via outbound firewall rule on the laptop so
DC discovery can't land on the dead server over VPN.
- Did NOT chase the computer-policy gpupdate failure further after isolating it to UDP
CLDAP/NTP over the tunnel — user-side work was complete; flagged UDM firewall follow-up.
- Billing per prepaid rules: prepay_hours fetched from full GET /customers/7088508 (8.5)
before the preview; $0.00 invoice is correct prepaid behavior, deduction verified post-invoice.
## Problems Encountered
- Get-ADUser -Filter with embedded quotes mangled by RMM dispatch quote-stripping → switched
to -LDAPFilter (no inner quotes); larger scripts dispatched via ps-encoded.sh (-EncodedCommand).
- Two RMM command timeouts reading ovpnconnector.cfg → simplified command succeeded.
- OVPNConnectorService wouldn't start (empty log) → connector requires auto-login profile;
profile is auth-user-pass. Removed service with `ovpnconnector.exe remove`.
- Test-ComputerSecureChannel -Repair: "server is not operational" (DNS) → NRPT fix;
then "Access is denied" (broken trust) → Reset-ComputerMachinePassword against IMC1 as
IMC\guru + Restart-Service Netlogon → True/NERR_Success.
- gpresult "applied from ServerIMC" was stale GP History registry cache, not live phantom-DC
contact — corrected the initial misattribution; real cause of computer-GP failure is UDP
389/123 blocked over VPN (TCP all open, Kerberos tickets valid, clocks in sync).
- Syncro: guessed POST /tickets/{id}/make_invoice (404) — correct endpoint is POST /invoices
with {ticket_id, customer_id} per .claude/commands/syncro.md. Logged to errorlog (--friction).
## Configuration Changes
State changed on LAPTOP-UBTI0IE3 (left in place, documented to Mike):
- NRPT rules: imc.local (and .imc.local) → DNS server 192.168.0.2
- Outbound firewall rule "ACG-Block-PhantomDC-ServerIMC" blocking 192.168.0.63
- OVPNConnectorService installed then removed (no residue)
On IMC1: EdServices1 password reset + account unlocked. No other changes.
Repo: temp dispatch scripts .vpn-setup.ps1 / .vpn2.ps1 / .fix-trust.ps1 created and deleted.
errorlog.md: one --friction entry (syncro wrong endpoint).
## Credentials & Secrets
- EdServices1 new domain password: `Imcr0cks!` (set by Mike's instruction; communicated in
Discord thread — not vaulted, user-level credential)
- Vault paths read (values not recorded here):
- clients/imc/openvpn-edservices4.sops.yaml (VPN user edservices4, UDM-IMC-L1 72.194.57.2:1194)
- clients/imc/imc1.sops.yaml (IMC\guru domain admin)
## Infrastructure & Servers
- LAPTOP-UBTI0IE3: GuruRMM agent b1038d84-2275-4405-b852-94e7ee3aa2ed, Windows, offsite,
VPN IP 192.168.2.4 when connected
- IMC1: DC/DNS/AIMsi SQL, 192.168.0.2, agent 88cbf7c0-abfa-4f12-846c-96274f718bff
(wiki UUID fa99e913 is stale — update on next wiki compile)
- Phantom DC: ServerIMC 192.168.0.63 (refuses LDAP/Kerberos; ghost DNS records)
- VPN: UDM-IMC-L1 72.194.57.2:1194, VPN subnet 192.168.2.0/24; LAN 192.168.0.0/24
- Syncro customer 7088508 (Instrumental Music Center), prepaid block $175/hr
## Commands & Outputs
- Password reset (on IMC1): Set-ADAccountPassword -Identity edservices1 -Reset;
Unlock-ADAccount → PasswordLastSet 2026-07-23 12:04 PM AZ
- Trust repair (on laptop): Add-DnsClientNrptRule -Namespace imc.local -NameServers 192.168.0.2;
Reset-ComputerMachinePassword -Server IMC1.imc.local -Credential IMC\guru;
Restart-Service Netlogon; Test-ComputerSecureChannel → True; nltest /sc_query:imc → NERR_Success
- gpupdate /force: user policy OK, computer policy "LDAP Bind function call failed"
(UDP CLDAP 389 / NTP 123 blocked over tunnel; all TCP ports verified open)
- Logon verification: IMC\edservices1 interactive logon 12:34 PM AZ, logon script completed
## Pending / Incomplete Tasks
- Suggested (not done): UDM firewall rule allowing UDP 389 + 123 from VPN subnet
192.168.2.0/24 to 192.168.0.2 so computer GP applies remotely
- Wiki update on next compile: IMC1 agent UUID correction; laptop NRPT + firewall state;
ticket reference
## Reference Information
- Syncro ticket #32585 (id 114176292): https://computerguru.syncromsp.com/tickets/114176292
- Invoice #68080 (id 1651147066), $0.00, prepaid 8.5 → 7.5 hrs, note "Block hours remaining: 7.5."
- Line item 43393783: Labor - Remote Business (1190473), 1.0 hr, $150, taxable false, tech Mike (1735)
- Comment 425140277 (Resolution, public, do_not_email)
- Bot alerts: #dev-alerts (RMM dispatches), #bot-alerts message 1529937659030405262 (billing)
- Discord thread 1529926422083141774

2
errorlog.md
View File

@@ -19,6 +19,8 @@ Categories (the `[type]` tag): _(none)_ = skill/command execution failure ·
<!-- Append entries below this line --> <!-- Append entries below this line -->
2026-07-23 | GURU-BEAST-ROG | syncro | [friction] guessed POST /tickets/{id}/make_invoice (404) instead of documented POST /invoices {ticket_id,customer_id} from commands/syncro.md; recovered by reading skill doc [ctx: ticket=32585 ref=.claude/commands/syncro.md#invoices]
2026-07-23 | GURU-BEAST-ROG | drive-map | drive-map verify failed on TPS-JAYMI [ctx: cmd=6169a053-ab39-4366-a00c-755d4d4bdbf8] 2026-07-23 | GURU-BEAST-ROG | drive-map | drive-map verify failed on TPS-JAYMI [ctx: cmd=6169a053-ab39-4366-a00c-755d4d4bdbf8]
2026-07-23 | GURU-BEAST-ROG | rmm/qb-diagnostics | [correction] speculated TPS-SVR rebooted because .ND file regenerated at 8:48 AM; server uptime was 15 days - a QB .ND file is rewritten on every client connect, it is NOT evidence of a server reboot 2026-07-23 | GURU-BEAST-ROG | rmm/qb-diagnostics | [correction] speculated TPS-SVR rebooted because .ND file regenerated at 8:48 AM; server uptime was 15 days - a QB .ND file is rewritten on every client connect, it is NOT evidence of a server reboot