# Session Log: 2026-03-23

## Session Summary

Multi-client session covering email routing fixes, Intune deployments, MDM investigation, infrastructure changes, and workstation maintenance.

### Key Accomplishments
1. **Sorensen/RieussetCorp email routing fixed** — identified MailProtector IP authorization as root cause, added Neptune IPs
2. **Neptune Exchange infrastructure fully documented** — SBR agent chain, config file locations, send connectors, transport agents
3. **MVAN Enterprises ScreenConnect deployed** — pushed via Intune PowerShell scripts to JUNE (confirmed) and MODERN_STILE_20 (pending)
4. **Lonestar Electrical MDM issue investigated** — identified ManageEngine MDM self-enrollment as cause of joser's personal phone MDM prompt
5. **Dataforth Galactic Advisors security report reviewed** — AD1 disk at 90%, C:\Engineering consuming 787 GB
6. **Tailscale routing fixed** — moved 172.16.0.0/22 route from ACG pfSense to D2TESTNAS to reach Neptune
7. **CachyOS workstation** — SSH key generated, brightness hotkey fix (acpi_backlight=native), memory system moved to repo
8. **Claude Code memory system moved in-repo** — now syncs via Gitea across all machines

---

## Client Work: Sorensen / RieussetCorp.com

### Problem
Outbound email not routing properly from Neptune Exchange server, same issue as devcon.

### Investigation
- MX: `10 rieussetcorp-com.inbound.emailservice.io` (MailProtector) -- correct
- SPF: `v=spf1 include:spf.us.emailservice.io -all` -- correct
- mail.rieussetcorp.com: CNAME to mail.acghosting.com -> 67.206.163.124 -- correct
- Neptune SBR agent config files at `C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\agents\Custom\`:
  - `Microsoft.Exchange.SBR.InternalDomains.config` — rieussetcorp.com listed
  - `Microsoft.Exchange.SBR.OverrideSettings.config` — `rieussetcorp.com;rieussetcorp.sbr` listed
- Send connector `Outbound.Sorensen` exists, smarthost `rieussetcorp-com.outbound.emailservice.io`
- Message tracking from 3/16 showed SETROUTE (Sender Based Routing) and SENDEXTERNAL via Outbound.Sorensen with 250 OK

### Root Cause
MailProtector did not have Neptune's new IPs (67.206.163.124 and .122) authorized as sending servers for rieussetcorp.com.

### Fix
Added 67.206.163.124 and 67.206.163.122 to MailProtector's authorized sender IPs for rieussetcorp.com.

### Neptune SBR Routing Chain (documented for future reference)
1. User sends mail from Exchange mailbox on Neptune (172.16.3.11)
2. Microsoft.Exchange.SBR transport agent (Priority 12) fires on OnResolved
3. SBR reads `OverrideSettings.config` — maps domain to `.sbr` routing domain
4. Exchange matches `.sbr` address space to send connector
5. Send connector smarthosts through MailProtector: `domain-com.outbound.emailservice.io`
6. Also: messageconcept ExSBR agent at Priority 11 (`C:\Program Files\messageconcept\ExSBR\`)

### Neptune Access
- WinRM: 172.16.3.11, ACG\administrator / Gptf*77ttb##, NTLM transport
- Exchange PS: `New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri http://neptune.acg.local/PowerShell/ -Authentication Kerberos`
- Requires Tailscale route through D2TESTNAS for 172.16.0.0/22

---

## Client Work: MVAN Enterprises

### Intune ScreenConnect Deployment
- **Tenant:** mvan.onmicrosoft.com
- **Admin:** sysadmin@mvaninc.com / r3tr0gradE99#
- **Claude-MSP-Access App:** fabb3421-8b34-484b-bc17-e46de9703418 (multi-tenant Graph API)
- **Client Secret:** ~QJ8Q~NyQSs4OcGqHZyPrA2CVnq9KBfKiimntbMO

### Licenses
- Microsoft Intune Plan 2 (2/2)
- Microsoft 365 Business Premium SPB (4/6)
- Entra ID P2 (1/1)

### Managed Devices
| Device | User | OS | Last Sync | Status |
|--------|------|-----|-----------|--------|
| MODERN_STILE_20 | alisha.p@mvaninc.com | Win 10.0.26100 | Today | Active |
| JUNE | june.b@mvaninc.com | Win 10.0.26200 | Today | Active |
| MITCH-LAPTOP | | Win 10.0.22631 | Feb 15 | Stale |
| MITCH_WORK2 | | Win 10.0.26200 | Nov 2025 | Very stale |

### ScreenConnect Deployment
- **Installer URL:** `https://computerguru.screenconnect.com/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest&c=MVAN%20Enterprised&c=&c=&c=&c=&c=&c=&c=`
- **Method:** Intune PowerShell script (beta API: deviceManagementScripts)
- **Script v1 ID:** 55661d90-2c13-42fe-a3f1-156e410a74d2 (deleted after JUNE confirmed)
- **Script v2 ID:** 25383326-5d27-4fa2-862d-1550fca3e65b (re-push for MODERN_STILE_20)
- **Dynamic Group (both devices):** 3c804c2e-d2ab-4bc5-8720-16224e138a3c "ScreenConnect Deploy - MVAN Active Devices"
- **Dynamic Group (MS20 only):** 58673ed2-6075-47be-9f26-bb46b3fbb098 "MODERN_STILE_20 - SC Reinstall"
- **Results:** JUNE appeared in ScreenConnect. MODERN_STILE_20 had old version, uninstalled, re-pushed (pending).

### MVAN Device IDs
- MODERN_STILE_20: Intune `6211568f-1c5c-491f-89a7-1aac82127653`, Entra `8b1d5aa6-8acf-4ce3-ab4f-81e37980dc45`
- JUNE: Intune `f478fd56-bccb-4f7e-856f-4a27a172ae4b`

---

## Client Work: Lonestar Electrical

### Problem
joser@lonestarelectrical.net getting MDM enrollment prompt on personal phone.

### Investigation
- Google Workspace admin console: Mobile management = **Basic** (no MDM push)
- ManageEngine MDM (mdm.manageengine.com) is the actual MDM provider
- Admin: mike@azcomputerguru.com (Zoho account, Super Admin)
- Two enrolled devices: Zach and JOSE (both via QR Code, Dec 4 2025, Fully managed — company tablets)
- **Self Enrollment Settings:** Enabled for ALL directory groups, unlimited devices per user, no platform restrictions
- When joser installs ME MDM app on personal phone, self-enrollment prompts

### Fix (pending — page was broken)
- Disable Self Enrollment entirely in ManageEngine MDM (Enrollment > Self Enrollment > Disable)
- Tell joser to uninstall ME MDM app from personal phone
- Path: `https://mdm.manageengine.com/webclient#/uems/mdm/enrollment/self-enrollment/details`

---

## Dataforth: Galactic Advisors Security Report

### Report
- **Source:** "Detail Report - Dataforth Corporation [BETA]" from Galactic Advisors, analyzed March 23 2026
- **PDF:** ~/Downloads/Detail Report - Dataforth Corporation [BETA].pdf
- **Session log:** clients/dataforth/session-logs/2026-03-23-galactic-advisors-report.md

### 3 Computers Evaluated
| Computer | User | Role |
|----------|------|------|
| AD1 (192.168.0.27) | sysadmin | Domain controller |
| DESKTOP-AH0SLT7 | jantar | Workstation |
| D1-CUST-003 | tdean | Workstation |

### [CRITICAL] AD1 Disk at 90%
- C:\ 926 GB / 1023 GB (97 GB free)
- **C:\Engineering: 787.66 GB** (85% of used space) — single subfolder "ENGR"
- C:\Engineering is shared as `\\AD1\Engineering`
- C:\Shares: 81.77 GB, C:\Users: 80.38 GB, C:\ProgramData: 40.23 GB
- Plan: Add new virtual disk on ESXi, move Engineering data to new volume
- ESXi host: 192.168.0.122 (root / Gptf*77ttb!@#!@#) — SSH failed, needs web UI

### AD1 Access
- WinRM: 192.168.0.27, INTRANET\sysadmin / Paper123!@#, NTLM
- Via Tailscale D2TESTNAS route (192.168.0.0/24)

---

## Infrastructure Changes

### Tailscale Routing
- **Changed:** 172.16.0.0/22 route moved from ACG pfSense to D2TESTNAS
- **Reason:** Neptune (172.16.3.11) is at Dataforth, same IP range as ACG office
- **D2TESTNAS advertised routes:** 192.168.0.0/24, 192.168.100.0/24, 172.16.0.0/22
- **ACG pfSense:** 172.16.0.0/22 route disabled
- **[WARNING]:** ACG office can't reach its own 172.16.x.x via Tailscale until restored

### D2TESTNAS SSH Key
- Generated ed25519 key on acg-guru-5070: `ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE59Jz7w2PBYMUZySIT7WtUHv/ek5hCwYQefUqsPY/QN guru@acg-guru-5070`
- Authorized on D2TESTNAS for root
- D2TESTNAS SSH: root@192.168.0.9 (key auth works, password Paper123!@#)

### CachyOS Workstation
- **SSH key generated:** ~/.ssh/id_ed25519 (guru@acg-guru-5070)
- **Brightness fix:** Added `acpi_backlight=native` to kernel cmdline in /boot/limine.conf — takes effect on reboot
- **Root cause:** KDE powerdevil using nvidia_0 (max=100) scale but writing to intel_backlight (max=496)

### Claude Code Memory System
- Moved from ~/.claude/projects/-home-guru-ClaudeTools/memory/ to repo at .claude/memory/
- Symlinked system path to repo path
- CLAUDE.md updated with instructions for other machines
- Synced to Gitea

---

## Neptune Outstanding Issues (for next session)

1. **SNAT rule** — outbound mail going as 67.206.163.122 not .124. Check UDM (192.168.0.254) `/data/on_boot.d/10-neptune-snat.sh`. UDM SSH password (Paper123!@#-unifi) was rejected.
2. **No PTR record for 67.206.163.122** — Gmail rejecting
3. **67.206.163.122 blacklisted** — at least by bassanonet.it/Aruba
4. **MAIL ghost server** — decommissioned but still in Exchange transport config
5. **Spam queues** — ~25 retry queues to junk domains
6. **Tailscale route** — needs permanent solution (currently D2TESTNAS, ACG office may need it back)

---

## Pending Tasks

1. **MODERN_STILE_20** — ScreenConnect reinstall via Intune script v2 (pending execution)
2. **Lonestar MDM** — Disable self-enrollment in ManageEngine when Zoho portal works
3. **AD1 disk** — Add new ESXi virtual disk, move C:\Engineering to new volume
4. **Neptune issues** — SNAT, PTR, blacklist, MAIL server cleanup, spam queues
5. **Tailscale routing** — permanent solution for 172.16.0.0/22 conflict

---

## Credentials Referenced This Session

### Neptune Exchange
- Host: 172.16.3.11 (via Tailscale through D2TESTNAS)
- WinRM: ACG\administrator / Gptf*77ttb##
- Exchange PS: http://neptune.acg.local/PowerShell/ (Kerberos)

### MVAN Enterprises M365
- Tenant: mvan.onmicrosoft.com
- Admin: sysadmin@mvaninc.com / r3tr0gradE99#
- Claude-MSP-Access App: fabb3421-8b34-484b-bc17-e46de9703418
- Client Secret: ~QJ8Q~NyQSs4OcGqHZyPrA2CVnq9KBfKiimntbMO

### Dataforth AD1
- Host: 192.168.0.27
- User: INTRANET\sysadmin / Paper123!@#
- ESXi: 192.168.0.122, root / Gptf*77ttb!@#!@#

### D2TESTNAS
- Host: 192.168.0.9
- User: root / Paper123!@# (also key auth from acg-guru-5070)

### Lonestar Electrical Google Workspace
- Admin: sysadmin@lonestarelectrical.net
- ManageEngine MDM: mike@azcomputerguru.com (Zoho account)
- MDM URL: https://mdm.manageengine.com/webclient

### ScreenConnect
- Instance: https://computerguru.screenconnect.com