From ffee8888a71dc2765c4b0bfd783a5152f2bde3e7 Mon Sep 17 00:00:00 2001 From: Winter Williams Date: Tue, 21 Jul 2026 09:59:26 -0700 Subject: [PATCH] sync: auto-sync from GURU-BEAST-ROG at 2026-07-21 09:58:35 Author: Mike Swanson Machine: GURU-BEAST-ROG Timestamp: 2026-07-21 09:58:35 --- .mvan-users.json | 1 + .tps_cmd_id | 1 + ...nter-tps-tina-dns-outage-mcafee-removal.md | 121 ++++++++++++++++++ .../bot/2026-07/2026-07-21-bot-activity.md | 2 + 4 files changed, 125 insertions(+) create mode 100644 .mvan-users.json create mode 100644 .tps_cmd_id create mode 100644 clients/prairie-schooner/session-logs/2026-07/2026-07-21-winter-tps-tina-dns-outage-mcafee-removal.md create mode 100644 session-logs/bot/2026-07/2026-07-21-bot-activity.md diff --git a/.mvan-users.json b/.mvan-users.json new file mode 100644 index 00000000..763dad38 --- /dev/null +++ b/.mvan-users.json @@ -0,0 +1 @@ +{"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#users(id,displayName,userPrincipalName,accountEnabled)","value":[{"id":"9c49a2c1-28aa-4116-aed0-53704ad55208","displayName":"admin","userPrincipalName":"admin@mvan.onmicrosoft.com","accountEnabled":true},{"id":"b82cf38a-7cc7-434e-ba12-f4ad745ac19a","displayName":"Info@modernstile.com","userPrincipalName":"info@mvan.onmicrosoft.com","accountEnabled":true},{"id":"c26c43ab-b3c4-4543-836d-f6d736eaa394","displayName":"MVAN Invoicing","userPrincipalName":"invoicing@mvaninc.com","accountEnabled":true},{"id":"d664c34c-3867-42d7-b33e-aa23775c18f5","displayName":"June MS","userPrincipalName":"j.bradford@modernstile.com","accountEnabled":false},{"id":"17d0969e-ca5b-4b31-8919-6f7d20b07f28","displayName":"Jason Real","userPrincipalName":"jason.r@mvaninc.com","accountEnabled":true},{"id":"44d3538f-4bdb-444c-9f84-2d9f49c34c75","displayName":"June Bradford","userPrincipalName":"june.b@mvaninc.com","accountEnabled":true},{"id":"47d7d4b9-e4fc-4fa7-9f65-da724c2e049f","displayName":"June_Admin","userPrincipalName":"june@mvan.onmicrosoft.com","accountEnabled":true},{"id":"7d6ecbef-d787-4453-aab2-23e8d2806f8d","displayName":"Kyeri Brooks","userPrincipalName":"kyeri.b@mvaninc.com","accountEnabled":true},{"id":"a38fa3e7-9e77-4864-8213-62bb47cce07b","displayName":"Mitch MS","userPrincipalName":"m.vandeveer@modernstile.com","accountEnabled":false},{"id":"149e8f5a-e412-4a33-8f2a-25cdd6a38ad9","displayName":"Mitch VanDeveer","userPrincipalName":"mitch.v@mvaninc.com","accountEnabled":true},{"id":"208c20b1-b57a-4967-b9b7-2bd8f397ec95","displayName":"Mitch_Admin","userPrincipalName":"mitch@mvan.onmicrosoft.com","accountEnabled":true},{"id":"46407841-55aa-45d1-8959-205e22077238","displayName":"Ryan Clark","userPrincipalName":"ryan@mvan.onmicrosoft.com","accountEnabled":true},{"id":"f7ae5b00-4379-4a9d-943b-1337be041b6a","displayName":"Sienna VanDeveer","userPrincipalName":"sienna.v@mvaninc.com","accountEnabled":true},{"id":"547852a1-4ced-4e36-abe5-52779a53b4b1","displayName":"Computer Guru","userPrincipalName":"sysadmin@mvaninc.com","accountEnabled":true},{"id":"6b475028-fcba-4899-a619-be687f6eb2f6","displayName":"tocurtis","userPrincipalName":"tocurtis_cox.net#EXT#@mvan.onmicrosoft.com","accountEnabled":true}]} \ No newline at end of file diff --git a/.tps_cmd_id b/.tps_cmd_id new file mode 100644 index 00000000..3d6a0745 --- /dev/null +++ b/.tps_cmd_id @@ -0,0 +1 @@ +3e89294b-c519-4e07-968d-88619ccd60fe diff --git a/clients/prairie-schooner/session-logs/2026-07/2026-07-21-winter-tps-tina-dns-outage-mcafee-removal.md b/clients/prairie-schooner/session-logs/2026-07/2026-07-21-winter-tps-tina-dns-outage-mcafee-removal.md new file mode 100644 index 00000000..0e5b94ea --- /dev/null +++ b/clients/prairie-schooner/session-logs/2026-07/2026-07-21-winter-tps-tina-dns-outage-mcafee-removal.md @@ -0,0 +1,121 @@ +# TPS-Tina no-internet fix + McAfee Safe Connect removal — 2026-07-21 + +## User +- **Executed by:** ClaudeTools Discord Bot (GURU-BEAST-ROG) +- **Requested by:** Winter Williams (@winterguru, via Discord) - tech +- **Role:** automation (acting on the requester's behalf) + +## Session Summary + +Winter reported TPS-Tina at The Prairie Schooner could not reach outside websites while +appearing to be online — same symptom as Syncro ticket 32509 (7/7: dead Norton ConnectSafe +DNS servers from DHCP; fix at the time pinned NIC DNS to 192.168.1.125, the old DC). + +Investigation found TPS-Tina's GuruRMM agent offline since Sat 7/19 ~5:19 PM AZ, so direct +remote-exec was impossible. TPS-SVR (new DC, 192.168.1.135) was online and used as a jump +box. Diagnostics from TPS-SVR showed: Tina up on LAN at 192.168.1.139 (pingable), WinRM +closed, WMI blocked (RPC dynamic ports — firewall likely on Public profile since the +machine could not reach the DC via DNS). Root cause: **TPS-SERVER (old DC, 192.168.1.125) +went down Sat 7/19 ~3:03 PM AZ** and Tina's resolver list included the dead .125; Windows +stuck on it, killing name resolution (ping by IP worked, no websites — classic DNS-dead +symptom, confirmed by Howard's report). + +Access path: PsExec (downloaded PSTools to TPS-SVR C:\Windows\Temp) over SMB 445. Direct +`psexec -u TPS\guru` failed with logon-type error 1385 (logon-rights policy); workaround +was pre-authenticating the SMB session via `net use \\192.168.1.139\ADMIN$ /user:TPS\guru` +then `psexec -s` (SYSTEM) without -u. Fix applied: reset NIC DNS to DHCP +(Set-DnsClientServerAddress -ResetServerAddresses; UniFi DHCP now hands .135 + .125), +Clear-DnsClientCache, restarted GuruRMMAgent/GuruRMMWatchdog. Howard was working the issue +in parallel and also corrected her DNS. Agent reconnected 9:42 AM AZ; verified in Tina's +user session: google.com/msn.com HTTP 200, DNS resolving. + +Second task (Winter): removed McAfee Safe Connect 2.13 (junk VPN flagged on ticket 32509). +Quiet uninstall via bundle cache exe, exit 0; verified services (mccspsvc, +SafeConnectService), uninstall registry entries, and the TAP-Windows V9 adapter all gone. +No reboot required. + +Howard closed the loop: he is updating the Syncro ticket himself; no billing action taken +by the bot. + +## Key Decisions + +- Used TPS-SVR as LAN jump box since Tina's agent was offline (DNS-dead machines cannot + reach the RMM server). +- Chose PsExec over SMB 445 after WMI/WinRM were blocked; `net use` pre-auth + `-s` + bypassed the 1385 interactive-logon restriction without policy changes. +- Reset Tina's DNS to DHCP rather than re-pinning static — UniFi (new DHCP at .1) hands + out correct DNS now; removes the stale-pin failure mode that caused this recurrence. +- Did not touch UniFi DHCP DNS list (.125 secondary) — flagged to Howard, his migration. +- No Syncro writes — Howard is updating the ticket himself. + +## Problems Encountered + +- WMI as SYSTEM from TPS-SVR → E_ACCESSDENIED (machine account not admin on Tina); with + TPS\guru creds → RPC unavailable (dynamic ports firewalled). Resolved via PsExec/SMB. +- PsExec with `-u TPS\guru` → error 1385 "not granted the requested logon type"; + resolved with net-use pre-auth + `-s`. +- ps-encoded.sh refused nested EncodedCommand payload (>6KB); slimmed inner script to fit + (~5.9KB encoded, near the agent's ~7KB body limit). +- Building the outer .ps1 via bash heredoc collapsed `\\` UNC backslashes (known gotcha — + documented in the /rmm skill); rebuilt with the Write tool + sed placeholder substitution. + +## Configuration Changes + +- TPS-Tina (192.168.1.139): NIC "Ethernet 2" DNS reset to DHCP-provided (.135, .125); + DNS cache flushed; GuruRMMAgent + GuruRMMWatchdog restarted. +- TPS-Tina: McAfee Safe Connect 2.13 uninstalled (bundle {2973b354-fb68-4cf9-a20a-5bf99895504b}, + MSI {FA376988-2613-43B7-8BFC-91D8DC165F14}); TAP-Windows Adapter V9 removed with it. +- TPS-SVR: PSTools.zip + PsExec.exe left at C:\Windows\Temp (harmless; reusable). +- Repo: scratch scripts under .claude/tmp/ (tps-tina-*.ps1, tps-psexec-*.ps1) — contain + base64 of the vaulted TPS domain admin password; gitignored scratch, safe to delete. + +## Credentials & Secrets + +- Used (read-only from vault): `clients/prairie-schooner/tps-domain-admin.sops.yaml` + (TPS\guru domain admin). No new credentials created. + +## Infrastructure & Servers + +- TPS-SERVER (old DC/QB host/file server, 192.168.1.125): **DOWN since Sat 7/19 ~3:03 PM AZ** + (RMM last_seen 2026-07-19T22:03Z; not pingable from TPS-SVR). Planned-vs-crash unconfirmed + — Howard asked, no answer yet in thread. +- TPS-SVR (new DC, 192.168.1.135): online, DNS working, forwarders OK. +- Gateway/DHCP: UniFi at 192.168.1.1 (SonicWall replaced ~7/8); DHCP hands DNS = .135, .125. + Risk: .125 dead secondary can stall any machine (Tina's exact failure) until removed or + the old server returns. +- TPS-Tina: 192.168.1.139, Windows 11 Pro, Intel I219-LM "Ethernet 2", agent + c8d76770-dc9e-45b7-94c7-fdcab3e105a2. Firewall blocks WMI/WinRM but allows SMB 445 + ICMP. +- Mel-PC: 192.168.1.149, DNS .135/.125, healthy. + +## Commands & Outputs + +- Jump-box pattern for a DNS-dead Windows endpoint (agent offline, WMI/WinRM blocked): + `net use \\\ADMIN$ /user:DOMAIN\admin ` then + `PsExec.exe \\ -accepteula -nobanner -s powershell -NoProfile -EncodedCommand ` + (UTF-16LE base64 inner script; avoids all quote-stripping). +- Fix: `Get-NetAdapter -Physical | ? Status -eq Up | % { Set-DnsClientServerAddress + -InterfaceIndex $_.ifIndex -ResetServerAddresses }; Clear-DnsClientCache` +- Verification (user_session context via agent): google.com HTTP 200, msn.com HTTP 200, + Resolve-DnsName OK. +- McAfee removal: `"C:\ProgramData\Package Cache\{2973b354-...}\McAfeeSafeConnect.exe" + /uninstall /quiet` → exit 0; services/registry/TAP verified gone. + +## Pending / Incomplete Tasks + +- **TPS-SERVER down**: Howard to confirm planned vs crashed. If staying down, wiki + migration checklist items (FSMO transfer, CA migration, QB cutover, backup) need status. +- **UniFi DHCP still hands dead .125 as secondary DNS** — recommend removal while old + server is down (Howard's call). +- Syncro ticket 32509: Howard updating it manually; verify he captured the McAfee removal. +- Wiki article `wiki/clients/the-prairie-schooner.md` is now stale (TPS-SERVER status, + SonicWall→UniFi swap done, McAfee removed) — run /wiki-compile when convenient. + +## Reference Information + +- Syncro ticket: #32509 (id 113581381) — Resolved status, Howard updating. +- Discord thread: 1529163694192201800 (#tech-department). +- Bot alerts: #dev-alerts message_ids 1529167104585236722 (DNS fix), 1529168257460732066 + (McAfee removal). +- RMM agents: TPS-Tina c8d76770-dc9e-45b7-94c7-fdcab3e105a2, TPS-SVR + 799675cf-5c94-465a-b653-63e08d016526, TPS-SERVER 4f8dff0c-b033-4f66-9101-9350e32e0a81. +- Prior context: wiki/clients/the-prairie-schooner.md (server migration, paused). diff --git a/session-logs/bot/2026-07/2026-07-21-bot-activity.md b/session-logs/bot/2026-07/2026-07-21-bot-activity.md new file mode 100644 index 00000000..d8a0ef4b --- /dev/null +++ b/session-logs/bot/2026-07/2026-07-21-bot-activity.md @@ -0,0 +1,2 @@ +16:52 AZ - Howard (@howard9645) - Forward Anthropic email from mike@ mailbox to howard@ - [OK] forwarded Claude.ai secure-link email (received 9:33 AM AZ) via /mailbox Graph forward; noted link likely expired +16:56 AZ - Howard (@howard9645) - Forward 2nd Anthropic sign-in email (issued 9:49 AM AZ) from mike@ to howard@ - [OK] forwarded via /mailbox Graph forward