sync: auto-sync from GURU-BEAST-ROG at 2026-07-23 13:20:20
Author: Mike Swanson Machine: GURU-BEAST-ROG Timestamp: 2026-07-23 13:20:20
This commit is contained in:
ClaudeTools Bot
@@ -0,0 +1,130 @@
|
||||
# Session Log — LAPTOP-UBTI0IE3: EdServices1 password reset, VPN/domain trust repair, gpupdate, Office activation billing
|
||||
|
||||
## User
|
||||
- **Executed by:** ClaudeTools Discord Bot (GURU-BEAST-ROG)
|
||||
- **Requested by:** Mike Swanson (@azcomputerguru, via Discord) - admin
|
||||
- **Role:** automation (acting on the requester's behalf)
|
||||
|
||||
Discord thread: 1529926422083141774 ("Find LAPTOP-UBTI0IE3 in RMM or SC")
|
||||
Date: 2026-07-23 (AZ)
|
||||
|
||||
## Session Summary
|
||||
|
||||
Mike asked to locate LAPTOP-UBTI0IE3 in GuruRMM/ScreenConnect. Found it in GuruRMM
|
||||
(agent b1038d84-2275-4405-b852-94e7ee3aa2ed, online, Instrumental Music Center). He then
|
||||
asked to reset the domain password for IMC\EdServices1 to a new value and verify the laptop
|
||||
could see the domain. Resolved IMC1 (the DC, 192.168.0.2) in RMM as agent
|
||||
88cbf7c0-abfa-4f12-846c-96274f718bff (the wiki's fa99e913 UUID is stale) and reset the
|
||||
password there via Set-ADAccountPassword -Reset + Unlock-ADAccount (PasswordLastSet 12:04 PM AZ).
|
||||
|
||||
The laptop is offsite and reaches the domain only over OpenVPN. Investigated the OpenVPN
|
||||
Connect v3 install: attempted headless start via ovpnconnector.exe, but the connector service
|
||||
only supports auto-login profiles and the installed profile uses auth-user-pass — abandoned
|
||||
and removed the service. The tunnel came up anyway because localadmin logged in at the console
|
||||
and connected the GUI VPN client (laptop got 192.168.2.4 on the 192.168.2.0/24 VPN subnet).
|
||||
|
||||
With VPN up, domain repair: Test-ComputerSecureChannel failed first on DNS ("server is not
|
||||
operational") then on broken trust ("Access is denied"). Fixed DNS with NRPT rules forcing
|
||||
imc.local to 192.168.0.2, then Reset-ComputerMachinePassword -Server IMC1.imc.local -Credential
|
||||
IMC\guru + Netlogon restart → secure channel True / NERR_Success. Also added an outbound
|
||||
firewall rule blocking the phantom DC ServerIMC (192.168.0.63), a known IMC hazard.
|
||||
|
||||
Forced gpupdate: user policy and logon script applied successfully; computer policy failed
|
||||
("LDAP Bind function call failed") — root-caused to UDP (CLDAP 389 / NTP 123) being blocked
|
||||
over the VPN tunnel while all TCP ports work. Not blocking the user; computer GP will apply
|
||||
on-site. Verified IMC\edservices1 logged on at 12:34 PM AZ with the new password.
|
||||
|
||||
Mike then reported he activated Office in the EdServices1 profile using
|
||||
remote@instrumentalmusic.onmicrosoft.com and asked for 1 hr remote billing. Created Syncro
|
||||
ticket #32585, added the resolution comment, billed 1.0 hr Labor - Remote Business (product
|
||||
1190473, attributed to Mike/1735), generated invoice #68080 ($0.00 — prepaid block debited
|
||||
8.5 → 7.5 hrs, verified live), set invoice note "Block hours remaining: 7.5.", posted the
|
||||
#bot-alerts summary.
|
||||
|
||||
## Key Decisions
|
||||
|
||||
- Used GuruRMM (not ScreenConnect) for all remote execution — agent online, full PowerShell.
|
||||
- Password reset executed on IMC1 directly (authoritative DC) rather than through the laptop.
|
||||
- Abandoned ovpnconnector headless start after determining the connector only supports
|
||||
auto-login profiles; relied on the console user's GUI VPN connection instead.
|
||||
- Fixed domain visibility with NRPT rules (imc.local → 192.168.0.2) instead of changing the
|
||||
NIC DNS servers — scoped, survives DHCP, only affects the domain suffix.
|
||||
- Blocked phantom DC ServerIMC (192.168.0.63) via outbound firewall rule on the laptop so
|
||||
DC discovery can't land on the dead server over VPN.
|
||||
- Did NOT chase the computer-policy gpupdate failure further after isolating it to UDP
|
||||
CLDAP/NTP over the tunnel — user-side work was complete; flagged UDM firewall follow-up.
|
||||
- Billing per prepaid rules: prepay_hours fetched from full GET /customers/7088508 (8.5)
|
||||
before the preview; $0.00 invoice is correct prepaid behavior, deduction verified post-invoice.
|
||||
|
||||
## Problems Encountered
|
||||
|
||||
- Get-ADUser -Filter with embedded quotes mangled by RMM dispatch quote-stripping → switched
|
||||
to -LDAPFilter (no inner quotes); larger scripts dispatched via ps-encoded.sh (-EncodedCommand).
|
||||
- Two RMM command timeouts reading ovpnconnector.cfg → simplified command succeeded.
|
||||
- OVPNConnectorService wouldn't start (empty log) → connector requires auto-login profile;
|
||||
profile is auth-user-pass. Removed service with `ovpnconnector.exe remove`.
|
||||
- Test-ComputerSecureChannel -Repair: "server is not operational" (DNS) → NRPT fix;
|
||||
then "Access is denied" (broken trust) → Reset-ComputerMachinePassword against IMC1 as
|
||||
IMC\guru + Restart-Service Netlogon → True/NERR_Success.
|
||||
- gpresult "applied from ServerIMC" was stale GP History registry cache, not live phantom-DC
|
||||
contact — corrected the initial misattribution; real cause of computer-GP failure is UDP
|
||||
389/123 blocked over VPN (TCP all open, Kerberos tickets valid, clocks in sync).
|
||||
- Syncro: guessed POST /tickets/{id}/make_invoice (404) — correct endpoint is POST /invoices
|
||||
with {ticket_id, customer_id} per .claude/commands/syncro.md. Logged to errorlog (--friction).
|
||||
|
||||
## Configuration Changes
|
||||
|
||||
State changed on LAPTOP-UBTI0IE3 (left in place, documented to Mike):
|
||||
- NRPT rules: imc.local (and .imc.local) → DNS server 192.168.0.2
|
||||
- Outbound firewall rule "ACG-Block-PhantomDC-ServerIMC" blocking 192.168.0.63
|
||||
- OVPNConnectorService installed then removed (no residue)
|
||||
|
||||
On IMC1: EdServices1 password reset + account unlocked. No other changes.
|
||||
|
||||
Repo: temp dispatch scripts .vpn-setup.ps1 / .vpn2.ps1 / .fix-trust.ps1 created and deleted.
|
||||
errorlog.md: one --friction entry (syncro wrong endpoint).
|
||||
|
||||
## Credentials & Secrets
|
||||
|
||||
- EdServices1 new domain password: `Imcr0cks!` (set by Mike's instruction; communicated in
|
||||
Discord thread — not vaulted, user-level credential)
|
||||
- Vault paths read (values not recorded here):
|
||||
- clients/imc/openvpn-edservices4.sops.yaml (VPN user edservices4, UDM-IMC-L1 72.194.57.2:1194)
|
||||
- clients/imc/imc1.sops.yaml (IMC\guru domain admin)
|
||||
|
||||
## Infrastructure & Servers
|
||||
|
||||
- LAPTOP-UBTI0IE3: GuruRMM agent b1038d84-2275-4405-b852-94e7ee3aa2ed, Windows, offsite,
|
||||
VPN IP 192.168.2.4 when connected
|
||||
- IMC1: DC/DNS/AIMsi SQL, 192.168.0.2, agent 88cbf7c0-abfa-4f12-846c-96274f718bff
|
||||
(wiki UUID fa99e913 is stale — update on next wiki compile)
|
||||
- Phantom DC: ServerIMC 192.168.0.63 (refuses LDAP/Kerberos; ghost DNS records)
|
||||
- VPN: UDM-IMC-L1 72.194.57.2:1194, VPN subnet 192.168.2.0/24; LAN 192.168.0.0/24
|
||||
- Syncro customer 7088508 (Instrumental Music Center), prepaid block $175/hr
|
||||
|
||||
## Commands & Outputs
|
||||
|
||||
- Password reset (on IMC1): Set-ADAccountPassword -Identity edservices1 -Reset;
|
||||
Unlock-ADAccount → PasswordLastSet 2026-07-23 12:04 PM AZ
|
||||
- Trust repair (on laptop): Add-DnsClientNrptRule -Namespace imc.local -NameServers 192.168.0.2;
|
||||
Reset-ComputerMachinePassword -Server IMC1.imc.local -Credential IMC\guru;
|
||||
Restart-Service Netlogon; Test-ComputerSecureChannel → True; nltest /sc_query:imc → NERR_Success
|
||||
- gpupdate /force: user policy OK, computer policy "LDAP Bind function call failed"
|
||||
(UDP CLDAP 389 / NTP 123 blocked over tunnel; all TCP ports verified open)
|
||||
- Logon verification: IMC\edservices1 interactive logon 12:34 PM AZ, logon script completed
|
||||
|
||||
## Pending / Incomplete Tasks
|
||||
|
||||
- Suggested (not done): UDM firewall rule allowing UDP 389 + 123 from VPN subnet
|
||||
192.168.2.0/24 to 192.168.0.2 so computer GP applies remotely
|
||||
- Wiki update on next compile: IMC1 agent UUID correction; laptop NRPT + firewall state;
|
||||
ticket reference
|
||||
|
||||
## Reference Information
|
||||
|
||||
- Syncro ticket #32585 (id 114176292): https://computerguru.syncromsp.com/tickets/114176292
|
||||
- Invoice #68080 (id 1651147066), $0.00, prepaid 8.5 → 7.5 hrs, note "Block hours remaining: 7.5."
|
||||
- Line item 43393783: Labor - Remote Business (1190473), 1.0 hr, $150, taxable false, tech Mike (1735)
|
||||
- Comment 425140277 (Resolution, public, do_not_email)
|
||||
- Bot alerts: #dev-alerts (RMM dispatches), #bot-alerts message 1529937659030405262 (billing)
|
||||
- Discord thread 1529926422083141774
|
||||
@@ -19,6 +19,8 @@ Categories (the `[type]` tag): _(none)_ = skill/command execution failure ·
|
||||
|
||||
<!-- Append entries below this line -->
|
||||
|
||||
2026-07-23 | GURU-BEAST-ROG | syncro | [friction] guessed POST /tickets/{id}/make_invoice (404) instead of documented POST /invoices {ticket_id,customer_id} from commands/syncro.md; recovered by reading skill doc [ctx: ticket=32585 ref=.claude/commands/syncro.md#invoices]
|
||||
|
||||
2026-07-23 | GURU-BEAST-ROG | drive-map | drive-map verify failed on TPS-JAYMI [ctx: cmd=6169a053-ab39-4366-a00c-755d4d4bdbf8]
|
||||
|
||||
2026-07-23 | GURU-BEAST-ROG | rmm/qb-diagnostics | [correction] speculated TPS-SVR rebooted because .ND file regenerated at 8:48 AM; server uptime was 15 days - a QB .ND file is rewritten on every client connect, it is NOT evidence of a server reboot
|
||||
|
||||
Reference in New Issue
Block a user