# Step 4: Server Preparation — AD & Shares (~4-6 hours, remote via ScreenConnect)

**No user impact — server-side work only.**

---

## 4a — DNS cleanup

Run `scripts/phase2-dns-cleanup.ps1` on CS-SERVER.

Actions:
- Remove stale A records pointing to old IPs (192.168.0.5, 192.168.2.59, etc.)
- Fix DomainDnsZones/ForestDnsZones records to point to 192.168.2.254
- Enable DNS scavenging (7-day interval)
- Enable aging on cascades.local zone
- Create reverse lookup zones for 192.168.0.0/22 and 10.0.20.0/24

**Verify after:** `nslookup cs-server.cascades.local` should return only 192.168.2.254.

---

## 4b — AD cleanup

Run `scripts/phase2-ad-setup.ps1` on CS-SERVER.

### Security fixes (immediate)
- Remove disabled Monica.Ramirez from **Domain Admins** group
- Disable Haris.Durut (still enabled, no longer employed)
- Rename "Quickboosk acccess" group → "QuickBooks Access"
- Add lauren.hasselman to QuickBooks Access (replaced Jeff Bristol)

### OU cleanup
- Fix misspelled OU: "Managment" → "Management"
- Create OU structure: `Workstations\Staff PCs`

### Security groups (created and populated with members)

| Group | Members |
|-------|---------|
| SG-Management-RW | Meredith.Kuhn, Ashley.Jensen, Megan.Hiatt, Crystal.Rodriguez, Tamra.Matthews, britney.thompson, Veronica.Feller, strozzi, Alyssa.Brooks, lauren.hasselman |
| SG-Sales-RW | Megan.Hiatt, Crystal.Rodriguez, Tamra.Matthews |
| SG-Server-RW | Ashley.Jensen, britney.thompson, Christina.DuPras, Veronica.Feller, Meredith.Kuhn |
| SG-Chat-RW | Ashley.Jensen, britney.thompson, Veronica.Feller |
| SG-Culinary-RW | JD.Martin, Ramon.Castaneda, Alyssa.Brooks |
| SG-IT-RW | howard, sysadmin |
| SG-Receptionist-RW | Cathy.Kingston, Shontiel.Nunn, Ray.Rai, Sebastian.Leon, Michelle.Shestko |
| SG-Directory-RW | Cathy.Kingston, Shontiel.Nunn, Christina.DuPras |
| SG-AllShares-RO | (populated as needed) |

### Account removals (client confirmed)

**Already disabled — delete:**
- Anna.Pitzlin, Nela.Durut-Azizi, Jodi.Ramstack, Monica.Ramirez, jeff.bristol

**Still enabled — disable + delete (not in HR list, former employees):**
- Haris.Durut, Nuria.Diaz, Cathy.Reece, Kelly.Wallace, alyssa.brooks, Isabella.Islas, ann.dery

**Keep:** lauren.hasselman (took over Bristol's role as Business Office Director)

### Move computers to Workstations OU
- CRYSTAL-PC, ACCT2-PC, DESKTOP-H6QHRR7, DESKTOP-1ISF081

---

## 4c — Sync data from Synology NAS — DONE 2026-03-07

~~Run `scripts/phase2-sync-synology.ps1` on CS-SERVER.~~

**Synology Drive Client** reinstalled on CS-SERVER and configured for live sync to `D:\Shares\Main`. All Synology shares sync continuously to this location.

**Sync method:** Synology Drive Client (live, ongoing sync)
**Sync destination:** `D:\Shares\Main` on CS-SERVER
**Direction:** Synology → CS-SERVER (one-way)

### Synology shares visible via SMB (2026-03-07 audit)

| Synology Share | Size | Syncing to `D:\Shares\Main` |
|---|---|---|
| `homes` | 228.14 GB | Yes |
| `Public` | 50.15 GB | Yes |
| `SalesDept` | 12.61 GB | Yes |
| `Server` | 1.84 GB | Yes |
| `Management` | 1.4 GB | Yes |
| `chat` | 0 GB (empty) | Yes |
| `home` | 0 GB (empty) | Yes |

**Total:** ~294 GB syncing. D: had 635 GB free — sufficient.

### Shares NOT visible via SMB

| Synology Share | Notes |
|---|---|
| `Activities` | Not shared via SMB — may be internal Synology folder or removed |
| `pacs` | Not shared via SMB — verify on Synology DSM |
| `Sandra Fish` | Not shared via SMB — verify on Synology DSM |
| `web` | Not shared via SMB — verify on Synology DSM |

**Note:** Synology uses local accounts (not AD-joined). Authenticated from CS-SERVER via `net use \\192.168.0.120 /user:admin`.

Already on CS-SERVER (no sync needed): Culinary, IT, Receptionist, directoryshare

`SaleShare` is the old/duplicate folder — ignore it. `SalesDept` is the real one.

---

## 4d — Set up file share permissions (HIPAA: access control + audit)

Run `scripts/phase2-file-shares.ps1` on CS-SERVER (AFTER sync completes).

Creates SMB shares for synced folders and sets NTFS permissions matching Synology access. **HIPAA §164.312(b):** After shares are created, enable Advanced Audit Logging on all PHI-containing shares (Management, Server, homes) to track read/write/delete operations.

**Prerequisite (added 2026-04-22 per `docs/security/hipaa-review-2026-04-22.md` + user-rollout dependency):** Before this script runs, the Synology permission inventory must be captured and translated to AD security group memberships. See `docs/migration/phase4-synology.md` §6.0.1–6.0.2 for the discovery commands and `docs/migration/synology-permission-inventory.md` (to be created) for the mapping output.

**HIPAA-review additions (must be applied as part of this phase, not deferred):**
- `Set-SmbShare -EncryptData $true` on every share in the table — satisfies Addressable specs §164.312(a)(2)(iv) at-rest and §164.312(e)(2)(ii) in-transit encryption
- NTFS SACL (audit rule) set to audit Success + Failure for ReadData / WriteData / Delete / ChangePermissions on all PHI shares — satisfies Required spec §164.312(b) Audit Controls
- See `phase4-synology.md` §6.0.3 for the exact PowerShell

| Share | NTFS Access | SMB Share |
|---|---|---|
| Management | SG-Management-RW = Modify | `\\CS-SERVER\Management` |
| SalesDept | SG-Sales-RW = Modify | `\\CS-SERVER\SalesDept` |
| Server | SG-Server-RW = Modify | `\\CS-SERVER\Server` |
| chat | SG-Chat-RW = Modify | `\\CS-SERVER\chat` |
| Public | Authenticated Users = Modify | `\\CS-SERVER\Public` |
| Culinary | SG-Culinary-RW = Modify | `\\CS-SERVER\Culinary` (exists) |
| IT | SG-IT-RW = Modify | `\\CS-SERVER\IT` (exists) |
| Receptionist | SG-Receptionist-RW = Modify | `\\CS-SERVER\Receptionist` (exists) |
| directoryshare | SG-Directory-RW = Modify | `\\CS-SERVER\directoryshare` (exists) |
| homes | CREATOR OWNER = Full (subfolder) | `\\CS-SERVER\homes` (ABE enabled) |

All shares also get: Domain Admins = Full Control, SYSTEM = Full Control.

---

## 4e — Set up print server

Run `scripts/phase2-print-server.ps1` on CS-SERVER.

Creates TCP/IP printer ports for each printer. Drivers must be downloaded separately from manufacturer websites and installed manually, then the script can create the shared printers.

| Printer | IP | Driver Source |
|---------|-----|---------------|
| Front Desk - Epson ET-5800 | 192.168.2.147 | epson.com |
| Business Office - Canon MF455DW | 192.168.3.227 | canon.com |
| Marketing - Brother MFC-L8900CDW | 192.168.2.21 | brother.com |
| 206 Health - Brother MFC-L8900CDW | 192.168.1.138 | brother.com |
| MemCare MedTech - Brother MFC-L8900CDW | 192.168.2.53 | brother.com |
| MemCare Director - Canon MF451CDW | 192.168.3.52 | canon.com |
| Kitchen Printer | 192.168.0.121 | _TBD_ |

**Test:** Print a test page from CS-SERVER to each shared printer before deploying via GPO.

---

## 4f — Create GPOs (DO NOT link yet)

### GPO 1: "CSC - Drive Mappings"
User Configuration → Preferences → Drive Maps

| Drive | Path | Targeting |
|-------|------|-----------|
| S: | `\\CS-SERVER\Shares` | All domain users |
| M: | `\\CS-SERVER\Management` | SG-Management-RW members |
| T: | `\\CS-SERVER\SalesDept` | SG-Sales-RW members |
| K: | `\\CS-SERVER\Culinary` | SG-Culinary-RW members |
| I: | `\\CS-SERVER\IT` | SG-IT-RW members |
| R: | `\\CS-SERVER\Receptionist` | SG-Receptionist-RW members |
| P: | `\\CS-SERVER\Public` | All domain users |

Use Item-Level Targeting → Security Group for department-specific drives.

### GPO 2: "CSC - Printer Deployment"
Computer Configuration → Preferences → Printers

Deploy shared printers with Item-Level Targeting by computer name or security group:
- `\\CS-SERVER\FrontDesk-Epson` → Front desk PCs
- `\\CS-SERVER\BizOffice-Canon` → Accounting PCs
- `\\CS-SERVER\Marketing-Brother` → Marketing group
- (etc.)

### GPO 3: "CSC - Security Baseline"
Computer Configuration → Security Settings

| Setting | Value |
|---------|-------|
| Min password length | 12 characters |
| Password complexity | Enabled |
| Max password age | 90 days |
| Password history | 10 |
| Account lockout threshold | 5 attempts |
| Account lockout duration | 30 minutes |
| Lockout counter reset | 30 minutes |
| Screen lock timeout | 15 minutes |
| Windows Firewall | All profiles ON |

### GPO 4: "CSC - Windows Update"
Computer Configuration → Admin Templates → Windows Update

- Auto download + scheduled install
- Schedule: Sundays at 3:00 AM
- No auto-restart with logged-on users

### GPO 6: "CSC - Shared Workstation"
Linked to: `OU=Shared PCs,OU=Workstations,DC=cascades,DC=local`

Applies only to machines in the Shared PCs OU. Uses Item-Level Targeting by computer name so different shared PCs get different printers/drives/mailboxes.

**User Configuration → Preferences → Drive Maps**

| Drive | Path | ILT |
|-------|------|-----|
| R: | `\\CS-SERVER\Receptionist` | Computer Name = [TBD — front desk PC] |

**User Configuration → Preferences → Printers**

| Printer | Set Default | ILT |
|---------|-------------|-----|
| `\\CS-SERVER\FrontDesk-Epson` | Yes | Computer Name = [TBD — front desk PC] |

**User Configuration → Admin Templates → Microsoft Outlook 2016 → Account Settings → Exchange**

| Setting | Value |
|---------|-------|
| Cached Exchange Mode | Disabled (forces Online Mode) |

Online mode prevents shared mailbox data from caching on every shared PC — important when multiple users rotate through the same machine.

**User Configuration → Preferences → Registry**

Auto-mount shared mailbox via registry (only on targeted shared PCs):

| Key Path | Value | Data | ILT |
|----------|-------|------|-----|
| `HKCU\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002` | `001f6610` | `reception@[tenant-domain]` | Computer Name = [TBD] |

> **Note:** The registry path above is a placeholder — the exact profile key varies per installation. The shared mailbox SMTP address depends on the M365 tenant domain (Step 3 blocker). Computer names will be filled in after the onsite visit identifies which PCs are shared.

**Onsite TODO (before this GPO is functional):**
- [ ] Identify shared workstation computer names and roles
- [ ] Move shared PCs into `OU=Shared PCs,OU=Workstations`
- [ ] Fill in ILT computer names above
- [ ] Create shared mailbox in M365 (see Step 4 in shared workstation plan)
- [ ] Document user-to-shared-PC rotation matrix
- [ ] Test: log into shared PC → verify R: drive, default printer, and shared mailbox appear
- [ ] Test: log into normal PC → verify reception drive/printer/mailbox do NOT appear

---

### GPO 5: "CSC - Folder Redirection"
User Configuration → Policies → Windows Settings → Folder Redirection

| Folder | Redirect to | Setting |
|--------|------------|---------|
| Desktop | `\\CS-SERVER\homes\%username%\Desktop` | Basic, create folder |
| Documents | `\\CS-SERVER\homes\%username%\Documents` | Basic, create folder |
| Downloads | `\\CS-SERVER\homes\%username%\Downloads` | Basic, create folder |

Settings:
- Grant user exclusive rights: **Yes**
- Move contents to new location: **Yes** (first time only)
- Policy removal: Leave contents
- Also applies to Windows 10/11

This replaces roaming profiles — user data lives on the server but profiles stay local (fast logon, no corruption issues).

---

## Rollback

- Unlink any GPO from GPMC — takes effect at next `gpupdate`
- DNS records were exported in Step 1
- AD changes can be reverted from Step 1 exports