# Cascades of Tucson — Session Log 2026-05-22 ## User - **User:** Howard Enos (howard) - **Machine:** Howard-Home - **Role:** tech - **Session span:** 2026-05-22, afternoon/evening --- ## Session Summary This session continued the Cascades of Tucson department-by-department domain migration (Syncro #110680053), picking up from the previous session where NURSESTATION-PC folder redirection had just been resolved. The session covered five main areas: cascadesDS authentication investigation, GPO ILT fixes for RECEPTIONIST-PC prep, Ashley Jensen's machine migration, RECEPTIONIST-PC domain join, and cascades migration plan documentation. The cascadesDS Synology NAS authentication failure for the Nurses account was investigated. Root cause was identified as a workgroup name collision — cascadesDS workgroup is "CASCADES" which matches the AD domain short name, causing domain-joined Windows machines to send domain (Kerberos/NTLM) credentials that the non-domain-joined Synology rejects. Three options were evaluated: domain-joining the Synology, creating a temporary local account, or moving ALDocs to CS-SERVER. Since cascadesDS has many legacy local accounts set up by prior IT and is slated to become a backup device, all options were deferred. Howard will move ALDocs to CS-SERVER when ready, at which point the Synology authentication problem becomes moot. Two GPO ILT fixes were applied to CS-SERVER ahead of RECEPTIONIST-PC's domain join. The FrontDesk printer (in CSC - Printer Deployment GPO) and R: drive mapping (in CSC - Drive Mappings GPO) both had Item-Level Targeting set to `OU=Resident Services` — which would have incorrectly pushed these to Courtesy Patrol and RS Director. Both were changed to `FilterGroup: CASCADES\SG-FrontDesk`. Both GPT.ini versions were bumped (65536 → 131072). Ashley Jensen (DESKTOP-U2DHAP0, OU=Administrative, accountant) was domain-joined using ProfWiz. Server-side prep was completed: D:\Homes\Ashley.Jensen with all five subfolders created on CS-SERVER, Ashley.Jensen added to SG-FolderRedirect. The domain join succeeded but folder redirection did not apply correctly — the Desktop partially redirected but Explorer did not reflect the new path even after logoff/logon. Howard moved folders manually. The exact cause of the redirection failure was not fully diagnosed; this remains an ongoing issue across multiple machines on this migration. RECEPTIONIST-PC was domain-joined successfully via ProfWiz, migrating the local `RECEPTIONIST-PC\Front Desk` profile to `CASCADES\frontdesk`. Post-join server-side steps were completed: RECEPTIONIST-PC$ moved from CN=Computers to OU=Staff PCs,OU=Workstations; added to SG-Reception-PCs; frontdesk added to SG-FrontDesk; CSC - Reception Workstation Policy GPO linked to OU=Staff PCs,OU=Workstations. The loopback Replace mode on this GPO means folder redirection is suppressed for RECEPTIONIST-PC by design — no folder redirect issues expected here. --- ## Key Decisions - **cascadesDS domain join deferred:** Joining the NAS to the domain would break migration from it to CS-SERVER — the NAS has many legacy local accounts and will be repurposed as a backup device. Decided to defer until ALDocs is moved to CS-SERVER. - **FrontDesk printer and R: drive ILTs changed to group-based filter:** Changed from OU=Resident Services to SG-FrontDesk before RECEPTIONIST-PC domain join to prevent GPO from incorrectly deploying these resources to other RS users when Phase 3 GPOs are broadly linked. - **RECEPTIONIST-PC uses loopback Replace — no folder redirection:** By design. The CSC - Reception Workstation Policy GPO suppresses per-user folder redirection so any domain user sitting at the receptionist desk gets the reception configuration (Q:, W:, FrontDesk printer) regardless of their home department. - **Ashley Jensen folder redirection not retried:** After failed attempt, Howard moved folders manually. The failure mode (Desktop partially redirected but not reflected in Explorer after logoff/logon) is not yet fully diagnosed. --- ## Problems Encountered - **cascadesDS auth failure root cause:** Workgroup "CASCADES" = AD domain short name. Domain-joined machines send domain credentials; Synology rejects them. Deferred — NAS being phased out. - **GPT.ini version collision (Drive Mappings / Printer Deployment):** Both GPOs had Version=65536 (only user version set). Bumped to 131072 after XML edits. jq --arg used to safely pass Windows paths through JSON encoding after multiple backslash escaping failures with other approaches. - **Printers.xml FrontDesk match failed with -eq:** `$_.name -eq "\\CS-SERVER\FrontDesk"` returned null despite the name appearing correct in diagnostics. Switched to `-like "*FrontDesk*"` with `-notlike "*NursesPrinter*"` guard. Exact cause (possible encoding difference) not determined. - **new-home-folder.ps1 not on CS-SERVER:** Script exists in claudetools repo but was not deployed to CS-SERVER. Ran the function inline in the GuruRMM command instead. Note: the script path `C:\scripts\new-home-folder.ps1` does not exist on CS-SERVER. - **Ashley Jensen folder redirection failure:** GPO fired (Desktop was partially redirected) but Explorer showed old path after logoff/logon. Howard moved folders manually. Cause not diagnosed. - **Ashley Jensen logged into local account after first ProfWiz attempt:** Logged into local account instead of domain account — profile migration did not complete. System restore performed, ProfWiz re-run. --- ## Configuration Changes - `C:\Windows\SYSVOL\sysvol\cascades.local\Policies\{82fcc33c-8ea2-43ca-8d9b-bfebd17a297f}\User\Preferences\Drives\Drives.xml` — R: drive ILT changed from OU=Resident Services to FilterGroup CASCADES\SG-FrontDesk - `C:\Windows\SYSVOL\sysvol\cascades.local\Policies\{82fcc33c-8ea2-43ca-8d9b-bfebd17a297f}\GPT.INI` — Version 65536 → 131072 - `C:\Windows\SYSVOL\sysvol\cascades.local\Policies\{9f5e71de-f2b0-421f-b3e4-0f07913fffd3}\User\Preferences\Printers\Printers.xml` — FrontDesk printer ILT changed from OU=Resident Services to FilterGroup CASCADES\SG-FrontDesk - `C:\Windows\SYSVOL\sysvol\cascades.local\Policies\{9f5e71de-f2b0-421f-b3e4-0f07913fffd3}\GPT.INI` — Version 65536 → 131072 - `D:\Homes\Ashley.Jensen\` — created on CS-SERVER with Desktop, Documents, Downloads, Music, Pictures subfolders and correct ACL - AD: Ashley.Jensen added to SG-FolderRedirect - AD: RECEPTIONIST-PC$ moved from CN=Computers to OU=Staff PCs,OU=Workstations,DC=cascades,DC=local - AD: RECEPTIONIST-PC$ added to SG-Reception-PCs - AD: frontdesk added to SG-FrontDesk - GPO: CSC - Reception Workstation Policy (GUID={A94116C2-078E-4343-8EA4-DFA6B377F0F8}) linked to OU=Staff PCs,OU=Workstations,DC=cascades,DC=local - `clients/cascades-tucson/session-logs/2026-05-22-session.md` — created (this file) - `C:\Users\Howard\.claude\plans\wise-discovering-panda.md` — updated save point, checklist, Known Issues section added for cascadesDS --- ## Credentials & Secrets - **Ashley Jensen domain account:** CASCADES\Ashley.Jensen / `Fall2025!` - **Ashley Jensen local (pre-join):** `ScarlettSky18*` - **Vault:** `clients/cascades-tucson/accountant-pc.sops.yaml` - **frontdesk domain account:** CASCADES\frontdesk / `sccssccs#3` (vault: `clients/cascades-tucson/frontdesk-user.sops.yaml`) - **cascadesDS admin:** `admin` / `r3tr0gradE99#` (vault: existing entry) --- ## Infrastructure & Servers | Host | Role | IP / Notes | |------|------|------------| | CS-SERVER | AD DC, file server, print server | 192.168.2.254 | | cascadesDS | Synology NAS | 192.168.0.120, port 5000 (DSM), workgroup=CASCADES | | RECEPTIONIST-PC | Receptionist workstation | 10.0.20.102, MAC 98:59:7A:B0:06:58, now domain-joined | | DESKTOP-U2DHAP0 | Ashley Jensen's workstation | Domain-joined, GuruRMM agent installed | | NURSESTATION-PC | Nurses station | Domain-joined, folder redirection complete | **GPO GUIDs:** - CSC - Drive Mappings: `{82fcc33c-8ea2-43ca-8d9b-bfebd17a297f}` - CSC - Printer Deployment: `{9f5e71de-f2b0-421f-b3e4-0f07913fffd3}` - CSC - Reception Workstation Policy: `{A94116C2-078E-4343-8EA4-DFA6B377F0F8}` **AD Groups updated:** - SG-FrontDesk: frontdesk - SG-Reception-PCs: RECEPTIONIST-PC$ - SG-FolderRedirect: Crystal.Rodriguez, Ashley.Jensen, Zachary.Nelson, Nurses --- ## Commands & Outputs ```powershell # GPO GUIDs (run on CS-SERVER) Import-Module GroupPolicy (Get-GPO -Name "CSC - Drive Mappings").Id.ToString() # 82fcc33c-8ea2-43ca-8d9b-bfebd17a297f (Get-GPO -Name "CSC - Printer Deployment").Id.ToString() # 9f5e71de-f2b0-421f-b3e4-0f07913fffd3 # Move RECEPTIONIST-PC to correct OU Move-ADObject -Identity "CN=RECEPTIONIST-PC,CN=Computers,DC=cascades,DC=local" -TargetPath "OU=Staff PCs,OU=Workstations,DC=cascades,DC=local" # Add computer to SG-Reception-PCs Add-ADGroupMember -Identity "SG-Reception-PCs" -Members (Get-ADComputer -Identity "RECEPTIONIST-PC") # Link Reception Workstation Policy GPO New-GPLink -Name "CSC - Reception Workstation Policy" -Target "OU=Staff PCs,OU=Workstations,DC=cascades,DC=local" -LinkEnabled Yes # Ashley Jensen home folder — inline (script not deployed to CS-SERVER) $Username = "Ashley.Jensen"; $path = "D:\Homes\$Username" New-Item -ItemType Directory -Path $path -Force | Out-Null # ... (full function in clients/cascades-tucson/scripts/new-home-folder.ps1) ``` --- ## Pending / Incomplete Tasks - **Ashley Jensen (DESKTOP-U2DHAP0):** Folder redirection incomplete. Howard moved folders manually. Verify Desktop/Documents/Downloads point to \\CS-SERVER\Homes\Ashley.Jensen. Home folder and SG-FolderRedirect are configured server-side. - **RECEPTIONIST-PC:** Verify gpupdate picks up CSC - Reception Workstation Policy — Q: and W: drives should map, FrontDesk printer should deploy on next login. - **cascadesDS → nurses:** Map \\cascadesDS\Server for nurses user (ALDocs) — deferred until data moved to CS-SERVER. - **NURSESTATION-PC:** Auto-lock GPO (HIPAA, ~10 min idle). - **Nurses credential vault:** `clients/cascades-tucson/nurses-shared.sops.yaml` (password: Nurse8863171!) — not yet created. - **Lauren Hasselman:** OneDrive data move + New-HomeFolder + SG-FolderRedirect + machine domain join. - **Entra Connect:** Add cascadestucson.com UPN suffix, change Administrative OU UPNs, add OU=Administrative to sync scope. - **Phase 3 machines:** DESKTOP-KQSL232, CHEF-PC, SALES4-PC, MDIRECTOR-PC domain joins. - **M365 licensing:** Relicense 31 users Business Standard → Business Premium (time-sensitive, 31 SPB seats free). - **new-home-folder.ps1 deployment:** Script should be deployed to CS-SERVER (e.g., C:\scripts\) so it can be dot-sourced rather than run inline via GuruRMM. --- ## Reference Information - **Syncro ticket:** https://computerguru.syncromsp.com/tickets/110680053 - **Migration plan:** `C:\Users\Howard\.claude\plans\wise-discovering-panda.md` - **GuruRMM CS-SERVER agent ID:** `6766e973-e703-47c1-be56-76950290f87c` - **GuruRMM DESKTOP-U2DHAP0 agent:** confirmed installed, ID not recorded - **Cascades vault entries:** `clients/cascades-tucson/` in vault repo - **fdeploy1.ini path:** `C:\Windows\SYSVOL\sysvol\cascades.local\Policies\{512B43A4-F049-4CE5-BFAC-860AD13E92BE}\User\Documents & Settings\fdeploy1.ini` (Flags now 187)