azcomputerguru/claudetools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sync: auto-sync from HOWARD-HOME at 2026-07-08 09:00:22

Browse Source 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-08 09:00:22
This commit is contained in:
Howard Enos
2026-07-08 09:00:48 -07:00
parent 2a1ea6c9f7
commit fcf43044d4
1 changed files with 162 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

162
clients/instrumental-music-center/session-logs/2026-07/2026-07-08-howard-imc-edr-rollout-sql-caps.md Normal file
View File

@@ -0,0 +1,162 @@
# IMC — fleet reconciliation, Datto EDR rollout, Bitdefender removal, SQL memory caps applied
## User
- **User:** Howard Enos (howard)
- **Machine:** Howard-Home
- **Role:** tech
## Session Summary
Reconciled the Instrumental Music Center (IMC) fleet across GuruRMM, ScreenConnect, Datto
EDR, MSP360, and Syncro, then acted on the gaps. Started from a request to find IMC machines
in GuruRMM and retire (in Syncro) any machine not in RMM. Direction evolved: deploy GuruRMM to
the IMC ScreenConnect session group (default site Main, MOO only when clearly MOO by public
IP), and retire only Syncro assets offline > 40 days.
Enrolled `DESKTOP-NFU17AJ` into GuruRMM/Main via the server's site-preconfigured installer
one-liner pushed through ScreenConnect `send-command` (verified: RMM agents 17 -> 18). Queued
the same install to four offline SC machines (Manda's `DESKTOP-KRHQ5TS`, Sara Sherer's
`SNAPPERLANDHOME`, `LAPTOP-PNVA9G51`, `LESLIE2019LAPTO`) — they run on reconnect. Determined
Syncro "retire" = "Archive" which is UI-only (no REST API); handed the user the 12-asset
archive list rather than deleting.
Established that IMC's AV is Datto AV/EDR (16 agents), not Bitdefender (1 stray, `REPAIRADMIN`).
Billing check: recurring schedule #365662 ($1,590.02/mo) bills 20 AV seats but no backup line,
while MSP360 shows IMC1 actively backing up (Files + SQL daily; Images plan stale since
2024-10) — a backup revenue gap (user handling backups in a separate plan). Deployed Datto EDR
to the unprotected live machines: `BigMom` + `DESKTOP-NFU17AJ` via /rmm (installed, verified,
Datto org 16 -> 18), queued `IMC-LUIS`, `IMC-M-EdServices1`, and `REPAIRADMIN` via SC. Began the
`REPAIRADMIN` Bitdefender -> EDR swap (EDR queued; BD removal pending EDR verify, since BD has no
uninstall API and REPAIRADMIN is offline).
Verified the outstanding "max server memory" caps (Mike-approved 2026-05-07) were never applied
— all three IMC1 instances were at the uncapped default (2147483647 MB). Applied them: WID 512
MB as SYSTEM; SQLEXPRESS 12288 MB + AIMSQL 256 MB required `IMC\guru` (SQL sysadmin) via in-
process `LogonUser` + `RunImpersonated`, because the RMM agent's `NT AUTHORITY\SYSTEM` is not
sysadmin on those two instances. All three verified. Fixed `ps-encoded.sh` (added a Python
fallback for the UTF-16LE encode since this box lacks `iconv.exe`). Updated the IMC wiki
throughout and committed/pushed each change.
## Key Decisions
- **Site placement by public IP**, not guesswork: Main = 72.194.57.2, MOO = 68.107.177.170,
everything else -> Main (per user rule). MOO machines were already enrolled, so all new
enrollments went to Main.
- **Retire = Archive = UI-only**: confirmed against Syncro docs; refused to use
`DELETE /customer_assets` (destructive, loses history/ticket links). Handed the user the list.
- **Retirement threshold = offline > 40 days** (user), measured by ScreenConnect
`GuestInfoUpdateTime` because Syncro `updated_at` is a bulk-touch (unreliable).
- **AV-swap ordering**: install + verify Datto EDR BEFORE removing Bitdefender — never leave an
unprotected window.
- **SQL caps via IMC\guru impersonation over RMM** (user-approved credential path): fastest, but
the DA password transits one RMM command (base64) — flagged for optional rotation.
- **In-process token impersonation** for the SQL apply (not sqlcmd/Start-Process) — captures
output cleanly, no external tool dependency.
- **`ps-encoded.sh` Python fallback** rather than sourcing an `iconv.exe` binary — portable,
fixes the whole fleet, uses the already-present Python.
## Problems Encountered
- **SC `--company` filter returned empty** — CP1 is the full tagged value `IMC - Instrumental
Music Center`, not `Instrumental Music Center`; and CP values live under
`.CustomProperties.CustomPropertyN`. Resolved by enumerating via raw `CustomProperty1 = '...'`.
- **`jq` parse errors** on `rmm-search.sh --json` — caused by my `2>&1` merging the stderr
`[OK] Authenticated` banner into stdout. Fix: `2>/dev/null` when piping `--json` to jq.
- **`ps-encoded.sh` failed: `iconv: command not found`** — Git-for-Windows ships the iconv DLL
(`msys-iconv-2.dll`) but not `iconv.exe`, and has no pacman. Patched the script with a Python
fallback; verified byte-exact round-trip.
- **SQL RECONFIGURE permission denied on SQLEXPRESS + AIMSQL** — RMM agent runs as
`NT AUTHORITY\SYSTEM`, which is not sysadmin there (reduced to `IMC\guru` + AIM service acct on
2026-04-12). Resolved by impersonating `IMC\guru` in-process.
- **Bitdefender has no uninstall API** (GravityZone console/local-tool only), and REPAIRADMIN has
anti-tampering ON — so removal will be BD's local uninstall tool via /rmm (blank uninstall
password per policy), pending the box coming online.
## Configuration Changes
- **IMC1 SQL** `max server memory (MB)`: SQLEXPRESS 2147483647 -> **12288**; AIMSQL 2147483647 ->
**256**; MSSQL$MICROSOFT##WID 2147483647 -> **512**. Reversible; no service restart.
- **GuruRMM**: `DESKTOP-NFU17AJ` enrolled (Instrumental Music Center / Main). 4 more queued via SC.
- **Datto EDR**: `BigMom` + `DESKTOP-NFU17AJ` agents installed (org Instrumental Music Center).
`IMC-LUIS`, `IMC-M-EdServices1`, `REPAIRADMIN` queued via SC.
- **`.claude/scripts/ps-encoded.sh`** — added Python fallback in `encode_b64()` (commit pushed).
- **`.claude/commands/syncro.md`** — added "Customer Assets (retire/archive = UI-only)" section.
- **`.claude/skills/screenconnect/SKILL.md`** — added verified GuruRMM/EDR deploy-via-send-command
recipe + gotchas.
- **`.claude/skills/datto-edr/SKILL.md`** — added SC-queue deploy for offline endpoints + AV-swap
ordering note.
- **`wiki/clients/instrumental-music-center.md`** — new Security/AV, Billing, fleet-recon sections;
SQL caps marked APPLIED with a WATCH/probable-cause flag through ~2026-07-11; Backups + Active
Work + History updated.
- **`errorlog.md`** — logged the retire=archive-not-delete correction and the iconv friction.
## Credentials & Secrets
- **`IMC\guru`** (Domain Admin + SQL sysadmin on SQLEXPRESS/AIMSQL): password in vault
`clients/imc/imc1.sops.yaml` field `credentials.domain.password`. Used this session via token
impersonation to apply the SQL caps. **It transited one GuruRMM command** (base64 in
`command_text`, cmd `378fffe7-a46b-4617-ae6c-38c8d34229b1`) — recoverable in the RMM DB; rotate
if zero residual exposure is required. Fallback password field also present:
`credentials.password-fallback`.
- **Datto EDR enrollment RegKey `instrume01`** — IMC scan-target group "IMC - Speedway (Loc1)".
Not currently vaulted (retrievable anytime via `edr.py deploy-cmd --group <id>`); vault it if we
want it captured.
- No new credentials created this session.
## Infrastructure & Servers
- **IMC1** — 192.168.0.2, Windows Server 2016, 32 GB RAM (32560 MB reported). GuruRMM agent id
`88cbf7c0-abfa-4f12-846c-96274f718bff`. SQL instances: `SQLEXPRESS` (PROD, Standard, TCP 61151),
`AIMSQL` (orphan, Express, 63116), `MICROSOFT##WID`.
- **Public IPs:** Main/Speedway = 72.194.57.2; MOO = 68.107.177.170.
- **GuruRMM:** server `http://172.16.3.30:3001`; install page base `https://rmm.azcomputerguru.com`;
Main site code `INNER-BRIDGE-8354` (site id `2c5b65ad-2d5e-47b3-b12b-632e35e08ff6`); MOO
`SILVER-BRIDGE-5118` (`f9e4a897-708b-43c5-ab7d-a8b05decdc3e`). Client `Instrumental Music Center`
`213b62a8-30f4-41dd-9bb3-549341104416`.
- **Datto EDR:** tenant `azcomp4587.infocyte.com`; org `Instrumental Music Center`
`00b6b6e9-35ea-47cd-9413-088776434514`; scan-target group `IMC - Speedway (Loc1)`
`c56026f0-b174-4f84-9dc4-cf8cffa49b74`; RegKey `instrume01`.
- **Bitdefender:** IMC company `5e77afc47357486d522f1a44` (only endpoint `REPAIRADMIN`
`6a4d1bbe0a5a3122524a67ec`, policy `GPS Default` `5c42940b6e16d61a0c8b4568`, blank uninstall pw).
- **Syncro:** customer 7088508; recurring schedule 365662 ($1,590.02/mo).
- **MSP360:** company "Instrumental Music"; IMC1 plans — Files (daily, OK), SQL (daily, warnings),
Images (stale 2024-10-24).
## Commands & Outputs
- SQL verify (before): all three instances `max_server_memory_MB=2147483647` (uncapped default).
- SQL apply (after): `SQLEXPRESS: 12288 (verify=12288) as IMC\Guru`, `AIMSQL: 256 (verify=256) as
IMC\Guru`, `WID: 512 (verify=512)`.
- First SQL apply attempt (as SYSTEM) failed on SQLEXPRESS/AIMSQL: "User does not have permission
to run the RECONFIGURE statement." -> switched to IMC\guru impersonation.
- Datto EDR install (BigMom, NFU17AJ): exit 0, "Installed RTS agent to
C:\Program Files\infocyte\agent\agent.exe"; Datto org agents 16 -> 18.
- `ps-encoded.sh` fixed: encode/decode round-trip byte-exact (Python fallback).
## Pending / Incomplete Tasks
- **REPAIRADMIN Bitdefender -> Datto EDR swap** — EDR queued via SC; when online: verify EDR live,
push BD local uninstall tool via /rmm (confirm `uninstallTool.exe` path on the box), delete BD
console entry `6a4d1bbe0a5a3122524a67ec`.
- **EDR on the 4 SC-queued RMM enrollments** (`DESKTOP-KRHQ5TS`, `SNAPPERLANDHOME`, `LAPTOP-PNVA9G51`,
`LESLIE2019LAPTO`) — after they land in GuruRMM, push Datto EDR to each.
- **Verify the 4 queued GuruRMM installs + 2 queued EDR installs** (`IMC-LUIS`, `IMC-M-EdServices1`)
complete on reconnect.
- **User: archive the 12 offline>40d Syncro assets** (UI, Bulk Actions -> Archive), then clear the
3 matching dead Datto agents (`desktop-urv3ugr`, `office1`, `purchasingcomp`).
- **WATCH through ~2026-07-11:** if IMC reports AIM/SQL/perf issues, treat the memory caps as the
first probable cause (rollback = uncap to 2147483647).
- **Backups** — live-but-unbilled on IMC1; SQL diff-chain churn vs the local 22:00 job; Images plan
stale. User handling in a separate plan.
- Optional: rotate `IMC\guru` (password transited RMM cmd 378fffe7); vault the Datto RegKey.
## Reference Information
- Wiki: `wiki/clients/instrumental-music-center.md`.
- GuruRMM install one-liner (Main): `iex (irm 'https://rmm.azcomputerguru.com/install/INNER-BRIDGE-8354/windows')`.
- Datto EDR install: `Install-EDR -URL "https://azcomp4587.infocyte.com" -RegKey instrume01`.
- RMM cmd ids: SQL apply (SYSTEM, partial) — check-memory `d2d918c2`; SQL apply (IMC\guru)
`378fffe7-a46b-4617-ae6c-38c8d34229b1`; EDR BigMom `f6653ac5`, NFU17AJ `07873cbe`.
- Syncro archive list (asset ids): 5345521, 5033192, 10333758, 2486998, 2967905, 3100580, 2451117,
3151232, 3151234, 3151242, 3151229, 3150899.
- Commits pushed: wiki fleet-recon `840b0ce`; ps-encoded fix; wiki SQL-caps update (this session).