# Cascades of Tucson — Phase 2.6 Session Log

**Date:** 2026-05-20
**Duration:** Multi-session (continued from context-limit session)

## User
- **User:** Howard Enos (howard)
- **Machine:** HOWARD-HOME
- **Role:** tech

## Summary

Completed Phase 2.6: print server build-out, GPO creation, and AD account cleanup. All 13 printers are now installed and shared on CS-SERVER. Four CSC GPOs are created and staged (unlinked until Phase 3 domain join cutover).

---

## Work Completed

### 1. Front Desk Epson ET-5800 — Printer Installation

**Problem:** EPWizard.exe fails on Windows Server 2019 — `wlanapi.dll` stub is present but the WLAN stack is absent.

**Fix:**
1. Ran EPWizard.exe on CS-SERVER, let it extract drivers to `AppData\Local\Temp\ET-5800\` before dismissing the error
2. Copied extracted INFs to `C:\Users\sysadmin\Documents\ComputerGuru Connect v2\Files\epsonetdrivers\`
3. `pnputil /add-driver <INF> /install` staged the driver in Windows Driver Store
4. `Add-PrinterDriver -Name "EPSON ET-5800 Series"` registered it with the Print Spooler
5. `Add-Printer` / `Add-PrinterPort` created the printer at 192.168.2.147, shared as `FrontDesk`

**Driver name (from INF):** `EPSON ET-5800 Series`
**INF location:** E_WF1XCE.INF (UTF-16 LE with BOM FF FE — `Select-String` fails on it; must use `[System.IO.File]::ReadAllBytes()`)

### 2. Memory Care Director + MedTech Printers

Added to CS-SERVER (via GuruRMM remote PowerShell):

| Printer | Share | IP | Driver |
|---------|-------|----|--------|
| Memory Care Director - Canon MF751CDW | MCDirector | 192.168.3.52 | Canon Generic Plus PCL6 |
| Memory Care MedTech - Brother | MCMedTech | 192.168.2.53 | Brother Generic Jpeg Type2 Class Driver |

Both reachable and shared. Total shared printers on CS-SERVER: **13**.

### 3. Script: phase2-print-server.ps1

Updated `clients/cascades-tucson/docs/migration/scripts/phase2-print-server.ps1`:
- Status header updated to **COMPLETE 2026-05-20** (all 13 printers)
- Added FrontDesk, MCDirector, MCMedTech to `$printers` array
- Documented Epson ET-5800 workaround in header comments
- KM driver archived to `D:\Shares\Server\Drivers\KM_Universal_PCL6\`

### 4. AD Account Cleanup (5 accounts)

Executed via GuruRMM remote PowerShell on CS-SERVER. All `Disable-ADAccount` calls succeeded.

| Account | OU | Reason |
|---------|----|--------|
| britney.thompson | Care-Assisted Living | Departed 2026-04-22 |
| Richard.Adams | Transportation | Drivers no longer get IT access |
| Julian.Crim | Transportation | Drivers no longer get IT access |
| Christopher.Holick | Transportation | Drivers no longer get IT access |
| Shontiel.Nunn | Resident Services | Old-format account — s.nunn (Caregivers) is correct |

**Note:** britney.thompson's M365 license is still active and not yet harvested. Action needed before next billing cycle.

### 5. CSC - Security Baseline GPO

Created via `New-GPO` + `Set-GPRegistryValue` + direct SYSVOL writes.

**Screen saver (HKCU via GPP):**
- ScreenSaveTimeOut = 900 (15 min)
- ScreenSaveActive = 1
- ScreenSaverIsSecure = 1
- SCRNSAVE.EXE = scrnsave.scr

**GptTmpl.inf (Machine security — written as Unicode UTF-16):**
```
MinimumPasswordLength = 12
PasswordComplexity = 1
PasswordHistorySize = 24
MaximumPasswordAge = 90
MinimumPasswordAge = 1
LockoutBadCount = 5
ResetLockoutCount = 30
LockoutDuration = 30
```

**GPT.INI:** machine version bumped, security extension GUID `{827D319E-6EAC-11D2-A4EA-00C04F79F83A}{803E14A0-B4FB-11D0-A0D0-00A0C90F574B}` added.

**Status: UNLINKED.** Link to domain root at Phase 3 cutover.

### 6. CSC - Windows Update GPO

Created via `New-GPO` + `Set-GPRegistryValue` (HKLM AU key).

| Setting | Value |
|---------|-------|
| NoAutoUpdate | 0 |
| AUOptions | 4 (auto download + install) |
| ScheduledInstallDay | 1 (Sunday) |
| ScheduledInstallTime | 3 (3:00 AM) |
| NoAutoRebootWithLoggedOnUsers | 1 |
| EnableFeaturedSoftware | 0 |

**Status: UNLINKED.** Link to domain root at Phase 3 cutover.

### 7. CSC - Printer Deployment GPO

Created `Printers.xml` in SYSVOL at `{GPO-GUID}\User\Preferences\Printers\`.

13 printers with OU-based item-level targeting (`FilterOrgUnit`):

| Share | ILT |
|-------|-----|
| CopyRoom | No filter — all staff |
| BusinessOffice | OU=Administrative |
| Accounting | OU=Administrative |
| AdminOffice | OU=Administrative OR OU=Resident Services |
| ExecDirector | OU=Administrative |
| SalesMarketing | OU=Marketing |
| Kitchen | OU=Culinary |
| CulinaryChef | OU=Culinary |
| FrontDesk | OU=Resident Services |
| HealthServices | OU=Care-Assisted Living OR OU=Care-Memorycare |
| LifeEnrichment | OU=Life Enrichment |
| MCDirector | OU=Care-Memorycare |
| MCMedTech | OU=Caregivers OR OU=Care-Memorycare |

**CSE GUID:** `{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}{D02B1F72-3407-48AE-BA88-E8213C6761F1}`

**Status: UNLINKED.** Link to OU=Workstations at Phase 3 cutover.

### 8. CSC - Drive Mappings GPO

Created `Drives.xml` in SYSVOL at `{GPO-GUID}\User\Preferences\Drives\`.

| Drive | Share | ILT |
|-------|-------|-----|
| M: | \\CS-SERVER\Management | FilterGroup: CASCADES\SG-Mgmt-RW |
| S: | \\CS-SERVER\Sales | FilterGroup: CASCADES\SG-Sales-RW |
| T: | \\CS-SERVER\Activities | FilterGroup: CASCADES\SG-Activities-RW |
| K: | \\CS-SERVER\Culinary | FilterOrgUnit: OU=Culinary,OU=Departments |
| R: | \\CS-SERVER\Receptionist | FilterOrgUnit: OU=Resident Services,OU=Departments |

**CSE GUID:** `{5794DAFD-BE60-433f-88A2-1A31939AC01F}{D02B1F72-3407-48AE-BA88-E8213C6761F1}`

**Status: UNLINKED.** Link to OU=Departments at Phase 3 cutover.

---

## Final CSC GPO Inventory (8 GPOs, all AllSettingsEnabled)

```
CSC - Always Wait For Network    (pre-existing)
CSC - Drive Mappings             UNLINKED — link to OU=Departments at Phase 3
CSC - Folder Redirection         UNLINKED — blocked on Phase 3 domain joins
CSC - Folder Redirection (LE)    LIVE — linked to OU=Life Enrichment
CSC - Life Enrichment Printers   LIVE — linked to OU=Life Enrichment
CSC - Printer Deployment         UNLINKED — link to OU=Workstations at Phase 3
CSC - Security Baseline          UNLINKED — link to domain root at Phase 3
CSC - Windows Update             UNLINKED — link to domain root at Phase 3
```

---

## Docs Updated

- `clients/cascades-tucson/docs/migration/scripts/phase2-print-server.ps1` — Complete status + all 13 printers
- `clients/cascades-tucson/docs/servers/active-directory.md` — Accounts disabled, GPO table updated, pending issues updated, printer shares table updated

---

## Phase 3 Prerequisites (next major work)

Domain join order (per `migration/phase3-domain-join.md`):
1. DESKTOP-KQSL232 (10.0.20.227)
2. CHEF-PC (10.0.20.232)
3. SALES4-PC (10.0.20.203)
4. MDIRECTOR-PC (192.168.3.20) — **needs Windows 10 Pro upgrade first** (currently Home)

After first successful join — link GPOs per phase3-domain-join.md step 5c.

---

## Open Items

| Item | Priority | Notes |
|------|----------|-------|
| ~~britney.thompson M365 offboarding~~ | ~~Done~~ | Sign-in blocked, license removed, litigation hold applied (sysadmin@ via admin center 2026-05-20) |

---

## Update: 14:53 PT — britney.thompson M365 offboarding + next session scope

### britney.thompson M365 Offboarding (Complete)

Attempted Graph API via device code flow. The well-known PowerShell client ID (`1950a258-227b-4e31-a9cf-717495945fc2`) is blocked in the tenant (AADSTS65002 — preauthorization required). No Graph-capable modules installed on HOWARD-HOME (Microsoft.Graph, MSOnline, AzureAD all absent). No Azure CLI.

Howard logged into admin.microsoft.com as `sysadmin@cascadestucson.com` and completed offboarding manually:
- Sign-in blocked in M365
- License removed (returned to pool)
- Litigation hold applied on mailbox

AD account was disabled earlier in this session (see main log above). Offboarding is fully complete.

### Next Session — Accounting Office Folder Redirection

Planned work for next session:
- Machines in the accounting office (Room 103 area): ACCT2-PC (already domain-joined), plus any others in that area
- Folder redirection for accounting staff: Documents, Downloads, Desktop → `\\CS-SERVER\homes\%USERNAME%\`
- **Key difference from LE GPO:** GrantExclusive=true — removes inherited permissions, grants the user exclusive access (plus Domain Admins). No other domain users can browse sibling folders.
- Linked to OU=Administrative (or a sub-scope if only accounting staff targeted)
- Sales department folder redirection possibly follows same session if accounting goes cleanly
- Pre-check required: OneDrive KFM status on each accounting PC before applying GPO (see 2026-04-17 session log for procedure)
| Phase 3 domain joins | High | Block on MDIRECTOR-PC needing Win10 Pro upgrade |
| krbtgt password rotation | Medium | 569+ days old — deferred |
| Remove Meredith.Kuhn + John.Trozzi from Domain Admins | Low | Deferred |
| SG-Mgmt-RW + SG-Sales-RW membership | Medium | Populate before Phase 3 GPO linking |
| CSC - Folder Redirection (full) | Medium | Blocked on Phase 3 — check OneDrive KFM on each PC first |

---

## Update: 17:06 PT — Admin folder redirection setup + department migration master plan

### Session scope
Continued from context-limit session. Completed the accounting/admin folder redirection GPO setup for Zachary Nelson, resolved architecture questions about OneDrive/HIPAA/AppData, and built the full department migration master plan.

---

### 1. Folder Redirection Architecture Decisions

**GPO approach — native FRD, not GPP Registry:**
- Inspected `CSC - Folder Redirection` GPO SYSVOL: had `User\Preferences\Registry\Registry.xml` (GPP Registry approach, 550 bytes) plus empty `Documents & Settings` folder.
- Decision: use native Group Policy Folder Redirection (GPMC UI → User Configuration → Windows Settings → Folder Redirection), not the GPP Registry hack. Howard configured this directly in GPMC on CS-SERVER.

**One GPO for all non-LE departments (not per-dept):**
- `%USERNAME%` in the redirect path makes it universal — `\\CS-SERVER\homes\zachary.nelson\Documents`, `\\CS-SERVER\homes\lauren.hasselman\Documents`, etc. all handled by one policy.
- Keep `CSC - Folder Redirection (LE)` for Life Enrichment. `CSC - Folder Redirection` becomes the universal GPO for all other departments.

**Security group filter instead of OU scope:**
- All 6 users in OU=Administrative (Zachary.Nelson, lauren.hasselman, Alma.Montt, Meredith.Kuhn, Ashley.Jensen, Allison.Reibschied) — cannot use OU scope without hitting users not ready for redirection.
- Solution: `SG-FolderRedirect` security group. Only members get the GPO applied.
- Future: when all departments migrated, remove SG filter, add Authenticated Users — existing redirected users see zero disruption.

**AppData — do not redirect:**
- Confirmed: redirect only Documents, Desktop, Downloads. AppData causes login slowdowns, application breakage, and network overhead with no meaningful benefit for assigned-machine users.

---

### 2. GPO Configuration (Howard in GPMC on CS-SERVER)

Howard opened GPMC, edited `CSC - Folder Redirection`, configured:
- Documents → `\\CS-SERVER\homes` (Basic redirection, grant exclusive rights, move contents)
- Desktop → `\\CS-SERVER\homes` (same settings)
- Downloads → `\\CS-SERVER\homes` (same settings)
- Policy removal: leave folder in new location

Howard also removed `Authenticated Users` from Security Filtering directly in GPMC (scripted removal failed — `Set-GPPermission -PermissionLevel None` triggers interactive confirmation prompt even with `-Confirm:$false` in NonInteractive PS sessions; GPMC COM `CreateSecurityInfo` method also unavailable).

---

### 3. SG-FolderRedirect Created and Wired

Dispatched via GuruRMM to CS-SERVER:
- Created `SG-FolderRedirect` (Global Security group, created in CN=Users fallback since OU=Security Groups,OU=Groups path failed)
- Added `Zachary.Nelson` as sole member
- Added `SG-FolderRedirect` with GpoApply permission on `CSC - Folder Redirection`
- Linked `CSC - Folder Redirection` to `OU=Administrative,OU=Departments,DC=cascades,DC=local` (Enabled, Order 1)

**Final GPO state:**
```
CSC - Folder Redirection
  Linked: OU=Administrative — Enabled: True
  Security filter: SG-FolderRedirect [GpoApply]
  Members of SG-FolderRedirect: Zachary.Nelson
```

---

### 4. GuruRMM API Auth Change

GuruRMM API (port 3001) now requires JWT auth header. Previous sessions worked without it — behavior changed. Resolved:
```bash
TOKEN=$(curl -s -X POST "http://172.16.3.30:3001/api/auth/login" \
  -H "Content-Type: application/json" \
  -d '{"email":"claude-api@azcomputerguru.com","password":"ClaudeAPI2026!@#"}' \
  | grep -o '"token":"[^"]*"' | cut -d'"' -f4)
```
Command dispatch also now requires `command_type` field: `{"command_type":"powershell","command":"..."}`.
Result polling endpoint is `/api/commands/{id}` (not `/api/agents/{id}/command/{id}`).

---

### 5. HIPAA / OneDrive Discussion

Concluded: server folder redirection is the correct posture for PHI-adjacent roles (accounting/admin). OneDrive requires a signed Microsoft HIPAA BAA, conditional access to block personal device sync, and Business Premium or E3 for full compliance tooling. Until BAA status is confirmed for cascadestucson.com tenant, PHI should stay on-prem.

---

### 6. Entra Connect — Expansion Plan

Entra Connect is live on CS-SERVER, production mode. Currently syncing OU=Caregivers + OU=Groups only. Not yet syncing Administrative or other department OUs.

Key facts for expansion:
- On-prem UPN suffix is `@cascades.local` (non-routable). Must add `cascadestucson.com` as alternate UPN suffix in AD before syncing any new dept OU.
- Change user UPNs to `@cascadestucson.com` → soft-match links to existing M365 cloud accounts.
- PHS makes on-prem password win — M365 password changes to Windows domain password on first sync. Notify users or align passwords first.
- Local Windows login behavior is unchanged. GPOs, group memberships, folder paths — all unchanged.

---

### 7. Department Migration Master Plan

Created comprehensive multi-day migration plan. Covers:
- Per-department template: pre-checks → machine prep → domain join → ProfWiz → prep-profile script → SG-FolderRedirect → Entra sync
- Department sequence (Admin → LE → Culinary → RS → Marketing → Care → Caregivers)
- Final switchover: SG-FolderRedirect removed, Authenticated Users restored — zero disruption to already-redirected users
- Clean machine end state: fresh domain join → all GPOs apply automatically, no manual steps
- Key guardrails from 2026-04-17 LE session (ProfWiz NTUSER.DAT poisoning, KFM conflict procedure)
- Prerequisites before Phase 3 GPO linking (SG membership, krbtgt rotation, Domain Admins cleanup)

**Plan file:** `C:\Users\Howard\.claude\plans\wise-discovering-panda.md`  
**Resume command:** "resume the Cascades migration plan" at session start  
**Syncro ticket:** https://computerguru.syncromsp.com/tickets/110680053

---

### Configuration Changes

| File | Action | Notes |
|------|--------|-------|
| `clients/cascades-tucson/session-logs/2026-05-20-howard-phase2.6-printers-gpos-account-cleanup.md` | Appended | This update |
| `C:\Users\Howard\.claude\plans\wise-discovering-panda.md` | Created | Master migration plan with save-point tracking |
| `.claude/memory/project-cascades-migration-plan.md` | Created | Memory entry for plan file + Syncro ticket |
| `.claude/memory/MEMORY.md` | Updated | Added Cascades migration plan pointer |
| `C:\claudetools\.claude\temp\check-frd-gpo.ps1` | Created | GPO inspection script |
| `C:\claudetools\.claude\temp\frd-prep.ps1` | Created | SG create + GPO filter setup |
| `C:\claudetools\.claude\temp\frd-link.ps1` | Created | GPO link to OU=Administrative |
| `C:\claudetools\.claude\temp\find-zachary.ps1` | Created | AD user lookup + OU=Administrative inventory |

**AD changes (via GuruRMM on CS-SERVER):**
- Created security group `SG-FolderRedirect` (CN=Users,DC=cascades,DC=local)
- Added Zachary.Nelson to SG-FolderRedirect
- Removed Authenticated Users from CSC - Folder Redirection security filter (done by Howard in GPMC)
- Linked CSC - Folder Redirection to OU=Administrative (Enabled, Order 1)

**GPMC changes (Howard on CS-SERVER directly):**
- Configured native folder redirection in CSC - Folder Redirection:
  - Documents, Desktop, Downloads → `\\CS-SERVER\homes` (Basic, GrantExclusive, MoveContents)
  - Policy removal: leave folder in new location

---

### Infrastructure & Servers

| Resource | Value |
|----------|-------|
| CS-SERVER agent ID | `6766e973-e703-47c1-be56-76950290f87c` |
| GuruRMM API | `http://172.16.3.30:3001` (now requires JWT auth) |
| GuruRMM API admin | `claude-api@azcomputerguru.com` / `ClaudeAPI2026!@#` |
| cascades.local GPO GUID | CSC - Folder Redirection = `{512B43A4-F049-4CE5-BFAC-860AD13E92BE}` |
| ACCT2-PC | Zachary.Nelson's machine — test folder redirection tonight |
| DESKTOP-H6QHRR7 | lauren.hasselman — OneDrive KFM active, Howard moves data manually first |

---

### Pending / Next Steps

| Item | Priority | Notes |
|------|----------|-------|
| Zachary folder redirection live test | High | Tonight on ACCT2-PC — gpupdate /force as zachary.nelson, verify \\CS-SERVER\homes\zachary.nelson\ populated |
| Lauren Hasselman | High | Howard moves OneDrive data manually first, then add to SG-FolderRedirect |
| Entra Connect: add OU=Administrative to sync | Medium | Set cascadestucson.com UPN suffix first, align passwords, then delta sync |
| Phase 3 domain joins | High | DESKTOP-KQSL232 first; MDIRECTOR-PC blocked on Win10 Pro upgrade |
| Phase 3 GPO linking | High | After first successful domain join: Security Baseline, Drive Mappings, Printer Deployment, Windows Update |
| SG-Mgmt-RW / SG-Sales-RW / SG-Activities-RW | Medium | Populate before Drive Mappings GPO linked |
| krbtgt password rotation | Medium | 569+ days old |
| Remove Meredith.Kuhn + John.Trozzi from Domain Admins | Low | Deferred |
| Update Syncro ticket #110680053 | Medium | Log today's work |

---

## Update: 22:34 PT — NTFS fix, GPO debugging, Zachary folder redirection confirmed working

### Session Summary

Continued from the earlier session where CS-SERVER had been rebooted to clear hung icacls processes. This session completed the NTFS permissions fix on D:\Homes, debugged and resolved the folder redirection GPO failure, and confirmed Zachary Nelson folder redirection working on ACCT2-PC. Also billed two Syncro tickets and closed the browser cleanup ticket.

The NTFS fix proceeded in two rounds. The first icacls pass (run by Howard before this context window) partially worked: it removed the explicit BUILTIN\Users entry from D:\Homes root but left inherited entries flowing in from the D:\ parent, and left explicit BUILTIN\Users ACEs on the subfolders. Guided Howard through the GUI (Advanced Security Settings) to break inheritance on the root and remove BUILTIN\Users from root and all four subfolders (Crystal.Rodriguez, lauren.hasselman, sharon.edwards, Susan.Hicks). Final icacls verification via GuruRMM confirmed clean state across all five paths.

Folder redirection was not applying to Zachary despite three login attempts and gpupdate runs. gpresult showed "Applied Group Policy Objects: N/A" for user settings — zero user-side GPOs reaching him. Root cause: when Howard removed Authenticated Users from the GPO security filter in the earlier session (per Claude instructions), he removed ALL access including Read. Domain computers require Authenticated Users GpoRead to enumerate user-side GPOs; without it the computer cannot include CSC - Folder Redirection in any user RSoP. Also investigated fdeploy1.ini — discovered that fdeploy1.ini (not fdeploy.ini) is the active file on Windows Vista+ clients. All earlier "empty file" reports were false negatives caused by PowerShell mishandling the ampersand in the "Documents & Settings" path. The fdeploy1.ini had 1698 bytes of correct content written by GPMC. The sole blocker was the missing GpoRead. Added Authenticated Users GpoRead back via Set-GPPermission; Zachary logged in and folder redirection applied on the next login.

Billed Syncro ticket #32303 (Domain setup-entra sync) for 2 hours remote labor (product 1190473) and ticket #32306 (Room 343 virus, browser cleanup) for 1 hour onsite (product 26118). Cascades is prepaid; both invoices landed at $0 with prepay block decremented 38.5 to 35.5 hours. Ticket #32306 closed as Resolved. Migration master plan save point updated.

### Key Decisions

- Used GUI walk-through for NTFS fix instead of commands — Howard requested GUI approach after icacls left partial state. Advanced Security Settings is more reliable for multi-step inheritance break and ACE removal operations.
- Authenticated Users GpoRead is mandatory even with security group filtering — removing it entirely breaks computer-side enumeration of user GPOs. Correct pattern: Authenticated Users gets GpoRead only; target security group gets GpoApply. Claude gave incorrect guidance in the earlier session by not clarifying this distinction.
- fdeploy1.ini is the active file on Windows 10/11, not fdeploy.ini — fdeploy.ini is the legacy XP format, always empty on modern domains. Confirmed by comparing working LE GPO structure against the new GPO.
- Remote labor product (1190473 at $150/hr) used for Phase 2.6 migration work; Onsite product (26118 at $175/hr) used for the browser cleanup ticket. Correct per delivery channel.

### Problems Encountered

- icacls /inheritance:d /remove left BUILTIN\Users on subfolders — the combined flags converted inherited ACEs to explicit but did not then remove them in the same pass. Resolved via GUI.
- D:\Homes root inherited BUILTIN\Users from D:\ parent — removing the explicit ACE was not enough; root needed inheritance broken to stop the parent volume from propagating. Resolved via GUI disable inheritance.
- GuruRMM agent hung on UNC path commands — commands using UNC paths to SYSVOL caused the agent to run indefinitely. Resolved by waiting for agent recovery and switching to local C:\Windows\SYSVOL paths with System.IO.Path::Combine() to handle the ampersand character.
- fdeploy.ini vs fdeploy1.ini confusion — all attempts to read the legacy fdeploy.ini returned empty, leading to incorrect conclusion that GPMC had not written settings. Resolved by enumerating the "Documents & Settings" folder with GetFiles() and discovering fdeploy1.ini with 1698 bytes of correct content.
- GPO Authenticated Users GpoRead missing — root cause of "Applied GPOs: N/A". Resolved via Set-GPPermission adding GpoRead back. Root cause was incorrect guidance from Claude in the earlier session.

### Configuration Changes

- D:\Homes NTFS: inheritance from D:\ parent broken on root; BUILTIN\Users removed from root and all 4 subfolders via GUI
- D:\Homes root ACL final state: Authenticated Users (RX,AD) This Folder Only; Administrators (OI)(CI)(F); SYSTEM (OI)(CI)(F); CREATOR OWNER (OI)(CI)(IO)(F)
- CSC - Folder Redirection GPO: Authenticated Users GpoRead added back
- C:\Users\Howard\.claude\plans\wise-discovering-panda.md: CURRENT SAVE POINT updated

### Credentials & Secrets

- GuruRMM API: http://172.16.3.30:3001 — claude-api@azcomputerguru.com / ClaudeAPI2026!@# (JWT required)
- Syncro API key (Howard): Tde5174a6e9e312d14-02fd5bfe0f0ee40c87d027507c680e18

### Infrastructure & Servers

- CS-SERVER: DC + file server, cascades.local, GuruRMM agent 6766e973-e703-47c1-be56-76950290f87c
- ACCT2-PC: Zachary Nelson workstation, GuruRMM agent 9b51e554-45d8-4737-96f5-116c1b1a7589, OU=Staff PCs\Workstations
- D:\Homes share: clean NTFS, no BUILTIN\Users anywhere
- CSC - Folder Redirection GPO GUID: {512B43A4-F049-4CE5-BFAC-860AD13E92BE}
- CSC - Folder Redirection (LE) GPO GUID: {889BE7BE-202E-4153-89AD-B5DB62A52D25}

### Commands & Outputs

```
# Add Authenticated Users GpoRead back
Set-GPPermission -Name 'CSC - Folder Redirection' -TargetName 'Authenticated Users' -TargetType Group -PermissionLevel GpoRead

# Final GPO permission state:
# SG-FolderRedirect        | GpoApply
# Authenticated Users       | GpoRead
# Domain Admins             | GpoEditDeleteModifySecurity
# Enterprise Admins         | GpoEditDeleteModifySecurity
# ENTERPRISE DOMAIN CONTROLLERS | GpoRead
# SYSTEM                    | GpoEditDeleteModifySecurity

# fdeploy1.ini confirmed 1698 bytes with correct content
# Paths: \\CS-SERVER\Homes\%USERNAME%\Desktop, Documents, Downloads, Pictures, Music

# Syncro billing:
# #32303 — timer 39347344, 2.0h remote, invoice 1650366749, $0.00 prepaid
# #32306 — timer 39347378, 1.0h onsite, invoice 1650366766, $0.00 prepaid
# Prepay: 38.5 -> 35.5 hours remaining
# #32306 closed Resolved
```

### Pending / Incomplete Tasks

1. Lauren Hasselman — Howard moves OneDrive data to local folders first, then Add-ADGroupMember SG-FolderRedirect lauren.hasselman, log off/on, verify \\CS-SERVER\homes\lauren.hasselman\ populated
2. Entra Connect — cascadestucson.com UPN suffix, set UPN on Administrative users, add OU=Administrative to sync scope, delta sync, verify soft-match
3. Phase 3 domain joins — DESKTOP-KQSL232, CHEF-PC, SALES4-PC, MDIRECTOR-PC (MDIRECTOR-PC needs Win10 Home to Pro first)
4. Pre-Phase 3 prerequisites — SG-Mgmt-RW / SG-Sales-RW / SG-Activities-RW membership, krbtgt rotation (569+ days), remove Meredith.Kuhn + John.Trozzi from Domain Admins

### Reference Information

- Migration master plan: C:\Users\Howard\.claude\plans\wise-discovering-panda.md
- Resume command: "resume the Cascades migration plan"
- Syncro migration ticket: https://computerguru.syncromsp.com/tickets/110680053 (#32303)
- Syncro browser cleanup ticket (closed): https://computerguru.syncromsp.com/tickets/110684398 (#32306)
- Cascades customer ID: 20149445, prepay remaining: 35.5 hours