diff --git a/clients/four-paws/session-logs/2026-07/2026-07-08-howard-avimark-localadmin-rmm-enrollment.md b/clients/four-paws/session-logs/2026-07/2026-07-08-howard-avimark-localadmin-rmm-enrollment.md
new file mode 100644
index 00000000..c273ce79
--- /dev/null
+++ b/clients/four-paws/session-logs/2026-07/2026-07-08-howard-avimark-localadmin-rmm-enrollment.md
@@ -0,0 +1,78 @@
+## User
+- **User:** Howard Enos (howard)
+- **Machine:** Howard-Home
+- **Role:** tech
+
+## Session Summary
+
+Started with a Syncro billing task: Four Paws (vet clinic, customer id 33050383) had a missing Avimark desktop shortcut. The Avimark install was located at `C:\avimark` and a new desktop shortcut was created. Created ticket #32508 and invoice #67993 (0.5h remote labor, $75.00) via the `/syncro` skill.
+
+The user then provided full inventory detail for the Four Paws "Server" machine, including the localadmin credential (`r3tr0gradE99#`, auto-login). A vault entry (`clients/four-paws/localadmin`) already existed with a matching password (set up by Mike 2026-06-23); it was enriched with host-identification details (model, serial, IPs, MAC, Syncro id) and the auto-login status.
+
+The user requested removing the localadmin password (blank) while keeping it as the default/auto-login account. Before changing, a read-only recon confirmed nothing depended on localadmin for shares — the AVImark share (`\\SERVER\AVImark`) is served to the `staff` and `avimark` local accounts via workgroup pass-through, and no workstation had mapped drives or stored cmdkey credentials referencing localadmin. The password was blanked (`net user Localadmin ""`), set to never-expire, and Winlogon auto-login re-armed with a blank DefaultPassword. `LimitBlankPasswordUse=1` was left at its secure default.
+
+A reboot to verify auto-login revealed the blank password BROKE auto-login — Windows 11 `AutoAdminLogon` does not proceed with an empty `DefaultPassword`; the server stalled at the logon screen (no console session after ~4 min uptime). Per the user's decision, the original password `r3tr0gradE99#` was restored and stored for auto-login, then reboot-tested: auto-login confirmed working (localadmin on console, explorer + WMI console owner = SERVER\Localadmin). All three RMM-enrolled machines (SERVER, STATION2, DESKTOP-3T5P291) were rebooted per the user request.
+
+Finally, the user asked why machines were missing from GuruRMM and to add them. A network sweep from SERVER identified 4PAWS-DOC (192.168.0.148, Dell Vostro 3910) as an unmanaged Windows workstation and FOVEADR-DR5258X (192.168.0.248) as a vet radiography imaging appliance. 4PAWS-DOC was in ScreenConnect, so the GuruRMM agent was deployed via SC send-command. The first attempt failed because the box was thread-exhausted (`0x800700a4 No more threads can be created`); a reboot cleared it and the re-run enrolled 4PAWS-DOC successfully (agent id 79d5243b). An onboarding diagnostic was run on 4PAWS-DOC (Grade AMBER, 0 critical / 3 warning).
+
+## Key Decisions
+
+- Blanked localadmin password only after read-only recon proved shares use the `staff`/`avimark` accounts, not localadmin — so blanking could not break file sharing (`LimitBlankPasswordUse=1` confines a blank-password account to console-only anyway).
+- Restored the localadmin password after empirically proving blank-password + AutoAdminLogon is impossible on this Windows 11 build. Chose the original `r3tr0gradE99#` (known-good, already documented) to return to a proven state. Auto-login = "no password needed to log in" in practice, which was the user's underlying goal.
+- Did NOT enroll FOVEADR-DR5258X (Fovea DR X-ray imaging appliance) — RMM agents should not be dropped on vet imaging equipment without vendor confirmation; also not in ScreenConnect.
+- Deployed the GuruRMM agent to 4PAWS-DOC via ScreenConnect send-command (site one-liner) rather than RMM push, because the box had no existing agent.
+- Rebooted 4PAWS-DOC to clear thread exhaustion rather than retrying the enroll command (command delivery was fine; the machine was degraded).
+
+## Problems Encountered
+
+- **Blank-password auto-login failure:** After blanking localadmin's password, the server stalled at the logon screen on reboot. Root cause: Win11 `AutoAdminLogon` will not proceed with an empty `DefaultPassword`. Resolved by restoring the password and re-storing it for auto-login; reboot-verified.
+- **4PAWS-DOC enroll failure (`0x800700a4`):** GuruRMM install one-liner died at `Get-CimInstance Win32_Processor` with "No more threads can be created in the system" (ERROR_MAX_THRDS_REACHED). The box was resource-exhausted from long uptime. Resolved by rebooting the machine (down ~6 min, applied pending updates) and re-running the enroll — succeeded. Logged to errorlog.md.
+- **iconv missing on Howard-Home:** `ps-encoded.sh rmm` failed (`iconv: command not found`). Worked around by encoding the PowerShell script to UTF-16LE base64 with `py` and dispatching `powershell.exe -EncodedCommand <b64>` directly.
+
+## Configuration Changes
+
+- **Four Paws SERVER (192.168.0.5):** localadmin password blanked then restored to `r3tr0gradE99#`; set PasswordNeverExpires; Winlogon auto-login re-armed (AutoAdminLogon=1, DefaultUserName=Localadmin, DefaultDomainName=SERVER, DefaultPassword=r3tr0gradE99#). Net state = unchanged from pre-session (password restored). Rebooted.
+- **STATION2, DESKTOP-3T5P291:** rebooted (no config change).
+- **4PAWS-DOC (192.168.0.148):** GuruRMM agent installed + enrolled (Four Paws / Main); rebooted once to clear thread exhaustion.
+- **Vault `clients/four-paws/localadmin.sops.yaml`:** enriched with host details; password field cycled blank -> restored to `r3tr0gradE99#`; auth_note documents the blank-password/autologon incompatibility.
+- **New file:** `clients/four-paws/onboarding-baselines/4PAWS-DOC-20260708T193830.{json,md}` (diagnostic baseline).
+
+## Credentials & Secrets
+
+- **Four Paws SERVER localadmin:** username `Localadmin`, password `r3tr0gradE99#` (restored; auto-login account). Vault: `clients/four-paws/localadmin`.
+- **Four Paws staff workgroup account:** username `staff`, password `avimark!` (intra-machine SMB/printer auth; also a local admin on 4PAWS-DOC). Vault: `clients/four-paws/staff-workgroup`.
+- No new credentials created this session.
+
+## Infrastructure & Servers
+
+- **Four Paws LAN (192.168.0.0/24), workgroup (no domain), gateway .1**
+- **SERVER** — 192.168.0.5, Dell OptiPlex 5060, serial 32XGBZ2, Win11 Pro 26200, MAC E4:54:E8:6A:98:04. Runs `AVImarkServer` service (Automatic, Session 0) + `\\SERVER\AVImark` share (C:\AVImark). Auto-logs in as Localadmin. RMM agent ccb55043-b310-47df-afe3-2671c8ff113c.
+- **STATION2** — 192.168.0.87, MAC E4-54-E8-6B-0A-11. RMM agent 75350628-bd5d-4d92-af35-51148fc98a62.
+- **DESKTOP-3T5P291** — 192.168.0.112 (+.250), MAC 20-88-10-96-1B-6C. RMM agent 97bccd08-b33d-4090-9318-53111c475891.
+- **4PAWS-DOC** — 192.168.0.148, Dell Vostro 3910, serial FDQ5Y04, i5-12400/16GB, Win11 Pro 25H2 (26200), MAC 20-88-10-8E-C7-FA. NEW RMM agent 79d5243b-1b7d-4097-82f6-17b7b701bee5. SC session 0bb9172c-1d8f-4a44-8b2a-58d89a211031.
+- **FOVEADR-DR5258X** — 192.168.0.248, Fovea DR radiography imaging appliance. NOT managed (by design).
+- **GuruRMM site:** Four Paws / Main, site_code COPPER-HAWK-2085, site_id b5993733-8c98-426e-9ea6-673517dff97f, client_id 02a5a011-c53f-4a55-879c-4957086b52c3.
+
+## Commands & Outputs
+
+- Blank password: `net user Localadmin ""` + `Set-LocalUser -PasswordNeverExpires $true` + Winlogon New-ItemProperty (DefaultPassword=""). Result: auto-login broke (logon screen).
+- Restore: `net user Localadmin 'r3tr0gradE99#'` + Winlogon DefaultPassword=pw. Reboot -> `query user` shows `localadmin console Active`; `Win32_ComputerSystem.UserName = SERVER\Localadmin`.
+- Network sweep (SERVER): async ping 1..254 + nbtstat. Found 4PAWS-DOC (.148), FOVEADR-DR5258X (.248), printers/router.
+- SC enroll: `send-command --session 0bb9172c... --command 'powershell ... iex (irm https://rmm.azcomputerguru.com/install/COPPER-HAWK-2085/windows)'`.
+  - First attempt error: `Get-CimInstance : No more threads can be created in the system. HRESULT 0x800700a4` at line 30 (Win32_Processor).
+  - Fix: `shutdown /r /t 5 /f` via SC; wait ~6 min; re-send enroll -> enrolled (79d5243b).
+- Diagnostic: `run-onboarding-diagnostic.sh 4PAWS-DOC four-paws` -> AMBER, 0 crit / 3 warn.
+
+## Pending / Incomplete Tasks
+
+- 4PAWS-DOC AMBER warnings (not remediated — user declined for now): BitLocker OFF on C:, 2 pending Windows updates, Intel Platform License Manager service stopped (benign). Also: `staff` is a local admin (shared cred), no backup agent detected, W32Time service stopped.
+- FOVEADR-DR5258X imaging appliance: confirm with vendor whether it should be managed/backed up.
+- Workstations (SERVER, STATION2, DESKTOP-3T5P291, 4PAWS-DOC) need AVImark relaunched by staff after the reboots.
+- SERVER clock read ~6h ahead of expected during the session — possible time-sync drift worth checking.
+
+## Reference Information
+
+- Syncro ticket #32508 (id 113578793), invoice #67993 (id 1650970715) — https://computerguru.syncromsp.com/tickets/113578793
+- GuruRMM install URL: https://rmm.azcomputerguru.com/install/COPPER-HAWK-2085/windows
+- Diagnostic baseline: clients/four-paws/onboarding-baselines/4PAWS-DOC-20260708T193830.md
+- errorlog.md entry: screenconnect/rmm-enroll — 0x800700a4 thread exhaustion on 4PAWS-DOC