---
slug: cascades-tucson
display_name: Cascades of Tucson
type: client
last_compiled: 2026-07-17
compiled_by: HOWARD-HOME/claude-main
sources:
  - clients/cascades-tucson/session-logs/2026-07/2026-07-17-howard-nurse-station-kiosk-build.md
  - clients/cascades-tucson/session-logs/2026-07/2026-07-17-howard-roadmap-finish-line-refresh.md
  - clients/cascades-tucson/session-logs/2026-07/2026-07-15-howard-technology-plan-final.md
  - clients/cascades-tucson/session-logs/2026-07/2026-07-15-howard-phish-investigation-amu54618.md
  - clients/cascades-tucson/session-logs/2026-07/2026-07-14-recovered-wiki-plan-review-hipaa-gaps.md
  - clients/cascades-tucson/session-logs/2026-07/2026-07-09-howard-charity-menle-caregiver-rename.md
  - clients/cascades-tucson/session-logs/2026-07/2026-07-09-howard-chris-knight-accounting-mailbox.md
  - clients/cascades-tucson/session-logs/2026-07/2026-07-02-howard-caretaker-phone-login-pso-roster-cleanup.md
  - clients/cascades-tucson/session-logs/2026-07/2026-07-02-howard-shelby-webdocs-share.md
  - clients/cascades-tucson/session-logs/2026-07/2026-07-01-howard-caretaker-roster-update-phone-login-cutover.md
  - clients/cascades-tucson/session-logs/2026-07/2026-07-01-howard-vlan20-migration-live-reconcile.md
  - clients/cascades-tucson/docs/REMAINING-WORK-PLAN.md
  - clients/cascades-tucson/docs/security/hipaa-caregiver-controls.md
  - clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.md
  - wiki/clients/cascades-tucson.md (prior compiled 2026-07-15)
backlinks:
  - projects/gururmm
  - wiki/systems/uos-server
---

# Cascades of Tucson

Senior living / assisted living facility in Tucson, AZ (201 N Jessica Ave, 85710). Single 6-floor building with a MemCare (Memory Care) wing on floors 5-6. ~236 rooms. ACG took over from a previous MSP in March 2026. Primary compliance driver is HIPAA. Active multi-phase migration project ongoing: domain join (~12 machines done, ~10 remaining), VLAN 20 staff migration largely complete, caregiver phone SSO live as of 2026-07-01, CARF Technology and System Plan finalized and delivered 2026-07-15, nurse-station kiosk GPO built on NURSESTATION-PC 2026-07-17.

---

## Profile

- **Contract type:** Prepaid hour block
- **Billing rate:** $175/hr all labor
- **Hours remaining:** **21.5 hrs as of 2026-07-15 (live Syncro).** Always live-check via `GET /customers/20149445` before billing.
- **Syncro customer ID:** 20149445
- **Managed devices (Syncro assets):** 29 (live 2026-07-15)
- **Active tickets:** **0 open Syncro tickets as of 2026-07-15.** See REMAINING-WORK-PLAN.md and session logs for all active project work.
- **Key contacts (Syncro authoritative):**
  - Ashley Jensen — Administrator (ashley.jensen@cascadestucson.com)
  - John Trozzi — Maintenance (John.trozzi@cascadestucson.com, 520-365-8200); facility liaison for Helpany
  - Meredith Kuhn — Assistant Manager (meredith.kuhn@cascadestucson.com, 520-886-3171). **NEVER set as ticket contact in Syncro** — recurring wrong default.
  - JD Martin — Chef (jd.martin@cascadestucson.com, 520-822-4269)
  - Jeff Bristol — Accounting (accounting@cascadestucson.com)
  - Crystal Rodriguez (crystal.rodriguez@cascadestucson.com)
  - Meredith Kuhn (meredith.kuhn@cascadestucson.com)
  - Shelby Trozzi — MemCare Director (MDIRECTOR-PC). Domain account `CASCADES\Shelby.Trozzi` (OU=Care-Memorycare, not Entra-synced). Password vaulted 2026-07-02.
  - Chris Knight — Accounting / Business Office (chris.knight@cascadestucson.com). Workstation: DESKTOP-N5G1ROO. FullAccess+SendAs on accounting@ granted 2026-07-09.
  - Lauren Hasselman — Accounting. Lupe Sanchez — staff (DESKTOP-TRCIEJA, EOL, pending replacement).

---

## Infrastructure

### Servers & Services

| Host | IP | Role | OS | Notes |
|---|---|---|---|---|
| CS-SERVER | 192.168.2.254 (Hyper-V vEthernet); SMB at **192.168.2.248** | DC, DNS, DHCP (no scopes), File Server, Hyper-V host, Print Server | Windows Server 2019 Standard | Dell PowerEdge R610 (~2009, 16+ years old). **Single DC — CRITICAL risk.** GuruRMM agent: `c39f1de7-d5b6-45ae-b132-e06977ab1713`. **RAID HEALTHY** (live OMSA 2026-06-24). **Datto EDR + AV ACTIVE** (agent `b41befcf-e418-4d0d-8552-bc7662364d07`, installed 2026-07-13). Service Tag **9MQFTK1**. |
| CS-SERVER iDRAC | 192.168.2.65 | Out-of-band management | — | Dell OOB. Service Tag 9MQFTK1. |
| CS-QB (Hyper-V VM) | 192.168.2.228 | SMB/445 only — NOT a live SIP PBX (2026-06-16 recon). Label "VoIP server" is stale. | — | Revisit/retire. QuickBooks also runs on CS-SERVER directly (should NOT be on a DC). |
| cascadesDS (Synology NAS) | 192.168.0.120 | NAS / onsite backup (planned repurpose 60-90 days) | DSM 7.2.1-69057 Update 11 | DS718+, ext4, 6 GB RAM, serial 1920PEN537202, 2x WD10EZEX 1 TB. Port 5000 HTTP, Drive Server 6690 SSL. Workgroup "CASCADES" causes Kerberos auth failures from domain-joined machines. **Synology shared-folder syncs to CS-SERVER ARE SET UP AND WORKING** (confirmed Howard 2026-07-15). Drive Client v7.5.0.16085 syncs folders to `D:\Shares\Main` on CS-SERVER. |
| pfSense Firewall | 192.168.0.1 | Perimeter firewall, inter-VLAN routing, DHCP/DNS | pfSense Plus 25.07-RELEASE | Netgate device. Dual-WAN. All DHCP served by pfSense (CS-SERVER DHCP role has no scopes). SSH/22 blocked from OpenVPN subnet — use GUI (443) remotely. Logs PLAIN TEXT on 25.07. Netgate AutoConfigBackup NOT yet enabled. Config vaulted point-in-time 2026-06-17. |

**CS-SERVER RAID detail (live OMSA 2026-06-24, healthy):**

| ID | Size/Type | Make/Serial | Role |
|---|---|---|---|
| 0:0:0 | 1.2 TB SAS | Seagate / Z400WHK8 | VD0 (D:) mirror member |
| 0:0:1 | 1.2 TB SAS | Seagate / S400RL2N | VD0 (D:) mirror member |
| 0:0:2 | 320 GB SATA | Hitachi / 1DR | VD2 (C:) mirror member |
| 0:0:3 | 320 GB SATA | WDC WD3200BEVT / WXEX08URD116 | VD2 (C:) mirror member (was flaky 6/15, self-recovered) |
| 1:0:4 | 1.2 TB SAS | Seagate / Z400WHML | **GLOBAL HOT SPARE — do NOT remove** |

- VD0 = D: (1,117 GB RAID-1) Ok; VD2 = C: (297.5 GB RAID-1) Ok.
- **[WARN] PSU redundancy lost** — one PSU not delivering; likely just not connected (Howard 2026-07-15). Not an active emergency.
- **Planned reliability upgrade:** replace the two consumer 320 GB drives (0:0:2, 0:0:3) with 2x enterprise SATA SSD already purchased. Gate: confirm image/system-state backup is current first (image plan was ~10 days stale at 2026-07-15 check).

**Backup:**
- **MSP360/CloudBerry cloud backup on CS-SERVER:** file-level backup last success 2026-07-15 07:00 (daily, verified live). Image/system-state plan last success 2026-07-05 (~10 days stale at 7/15 — confirm/repair before SSD swap). Installed 2026-06-15.
- **Planned:** Synology NAS repurposed as onsite backup target for CS-SERVER (60-90 days, per CARF tech plan). Synology -> CS-SERVER syncs continue as interim file mirror.

**Endpoint security:**
- **Datto EDR/AV (Infocyte/azcomp4587) is the ACG-managed endpoint stack.** Org `2d5ea96e-3228-461b-9c60-13ae464b61d8`, target group `1dbd2b02-f7df-45d0-a7f2-18667f48447f`, reg key `6qw68y2rwl`. 35 agents enrolled, all AV-enabled, 28 online (2026-07-15). Install: `Install-EDR -URL "https://azcomp4587.infocyte.com" -RegKey 6qw68y2rwl`.
- **CS-SERVER:** Datto EDR/AV active (agent `b41befcf`, heartbeat current, defs current). Legacy prior-MSP Datto stack removed 2026-06-26; ACG-managed EDR reinstalled 2026-07-13.
- **Bitdefender decommission substantially complete.** DESKTOP-TRCIEJA still BD_ACTIVE (GravityZone console-only uninstall; retires with hardware replacement). Stale: confirm Cascades removed from Syncro BD deployment; GravityZone portal cleanup stale RECEPTIONIST-PC records (company `66b0448e`); reconcile laptop3/laptop1/cascades-laptop EDR agents.

---

### Email & Identity

- **M365 tenant:** cascadestucson.com | Tenant ID: `207fa277-e9d8-4eb7-ada1-1064d2221498`
- **M365 licenses (live Graph 2026-07-17):**
  - **Business Premium (SPB):** `cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46` — 45 owned / 40 consumed / 5 free. Includes Intune, MDE, Entra P1, MFA Premium, AIP, Purview, Windows Business.
  - **O365_BUSINESS_PREMIUM (legacy):** `f245ecc8-75af-4f8e-b61f-27d8114de5f3` — **SUSPENDED.** 23 consumed post-2026-07-17 shared mailbox conversions (was 29 post-jodi decommission, dropped to 23 after 6 licenses reclaimed on 7/17). Does NOT include Intune, MDE, Entra P1, MFA Premium. These 23 users need to be moved to SPB (5 free seats today, 18 more needed from Pax8).
  - **Exchange Essentials:** `e8f81a67-bd96-4074-b108-cf193eb9433b` — **SUSPENDED.** 1 consumed (Shelby Trozzi — needs both suspended SKUs removed + SPB assigned).
- **Shared mailbox conversions (2026-07-17):** 10 functional/role-based accounts converted to shared mailboxes (accounting@, accountingassistant@, boadmin@, hr@, security@, Training@, medtech@, nurse@, transportation@, fax@). Freed 6x O365_BUSINESS_PREMIUM + 4x EXCHANGE_S_ESSENTIALS licenses. frontdesk@ and memcarereceptionist@ left as licensed user mailboxes (active daily sign-ins).
- **On-prem AD domain:** cascades.local | UPN suffix: cascadestucson.com
- **MX / mail flow:** Exchange Online (EOP direct MX). SPF: `-all`. DKIM: both M365 selectors published. DMARC: `p=quarantine; pct=100` (verified live 2026-07-15). Reports to `info@cascadestucson.com` (unmonitored). No third-party gateway.
- **MFA:** CA policy "Require MFA for all users" (`7e87a1c7`) enabled. Caregivers excluded from MFA (protected by on-network block + 8h reauth + device restriction). Voice-call MFA disabled tenant-wide; exception: `SG-MFA-Voice-Call-Scoped-sysadmin` (`304f941e`, single member `sysadmin@`).
- **Entra Connect:** Installed on CS-SERVER 2026-04-25; exited staging 2026-05-14; actively syncing. Sync scope: ONLY `OU=Caregivers`, `OU=Groups`, `OU=Caregiver Devices`. `OU=Administrative` not yet in scope. **Cloud/Graph group adds to `SG-Caregivers` fail (HTTP 400) — all membership writes on CS-SERVER via RMM.**
- **Break-glass accounts:** `breakglass1-csc@cascadestucson.com`, `breakglass2-csc@cascadestucson.com`. **Not yet created as of 2026-07-17.** Must exist + FIDO2 keys enrolled before the final CA allow-list flip (WS3). This is the top prerequisite blocking the caregiver lockdown go-live.
- **Admin accounts:**
  - `admin@cascadestucson.com` — Mike's working admin (cloud-only, Connect-excluded)
  - `sysadmin@cascadestucson.com` — Howard's working admin (cloud-only, Connect-excluded). Object id: `471b13dc-3cf8-416b-a132-f5f3bc8d1cc8`. Vault: `clients/cascades-tucson/m365-sysadmin.sops.yaml`.
- **ALIS (clinical SaaS):** https://cascadestucson.alisonline.com. communityId 622. Vault: `clients/cascades-tucson/alis-sso-app-registration.sops.yaml`; API user: `clients/cascades-tucson/alis-api-howard-user.sops.yaml` (username must be `howard.enos@cascadestucson`). ALIS app id `d5108493-cba8-4f08-90b6-1bb0bc09eb2a`, client secret expires **2028-05-06** (rotation reminder — expiry breaks ALIS SSO tenant-wide). Staff endpoints read-only via API; writes via `alis` skill `build-import` -> upload .xls in ALIS UI.
- **jodi.ramstack DECOMMISSIONED 2026-07-15:** account disabled, sessions revoked, Business Standard license removed. No mailbox existed (deprovisioned by suspended subscription; last sign-in 2025-03-28). Account object retained disabled/unlicensed.
- **Audit retention:** Approved 2026-04-29. Azure Log Analytics (90d) + Storage Account (6yr) in RG `rg-audit-cascadestucson`. **Not yet built** (HIPAA 164.312(b) gap).
- **[SECURITY — OPEN] `ComputerGuru - Tenant Admin` SP holds a standing Privileged Authentication Administrator role** (stranded from Alma Montt offboarding 2026-06-25; Graph blocked teardown). Needs Global Admin to remove in Entra. Leave its Conditional Access Administrator role. Pending Mike.
- **Shared mailboxes (current state):**
  - `grievances@`, `Surveys@` — created 2026-06-12; Meredith Kuhn + Ashley Jensen FullAccess+SendAs.
  - `accounting@` ("Accounting Dept.") — delegates: Lauren Hasselman, Ashley Jensen, Zachary Nelson, Chris Knight (added 2026-07-09) each FullAccess (auto-mapping) + SendAs.
  - `accountingassistant@`, `boadmin@`, `hr@`, `security@`, `Training@`, `medtech@`, `nurse@`, `transportation@`, `fax@` — converted to shared mailboxes 2026-07-17; unlicensed.
  - Alma Montt's mailbox — converted to SharedMailbox 2026-06-25 (Shelby Trozzi FullAccess+AutoMap).
  - Tamra Matthews' mailbox — converted to SharedMailbox 2026-06-30 (Crystal Rodriguez, Megan Hiatt, Meredith Kuhn, Ashley Jensen FullAccess+AutoMap).
- **HIPAA BAA:** Covered by Microsoft Customer Agreement for Business plan subscribers (confirmed 2026-05-14). Medtelligent (ALIS) BAA not yet verified.
- **Remediation tool:** Full tiered app suite consented 2026-04-21. All six apps active: Security Investigator (`bfbc12a4`), Exchange Operator (`b43e7342`), User Manager (`64fac46b`), Tenant Admin (`709e6eed`), Defender Add-on, Intune Manager.
- **Phishing incident (2026-07-14/15):** BEC/vendor-fraud phish from info@syufway.com to accounting@, posing as AMYSH Solutions with fake W-9. Quarantined copy auto-blocked; delivered copy moved to Deleted Items; syufway.com + steqm.com added to Tenant Allow/Block List (Sender block, no expiration). No compromise; no outbound reply.

---

## Entra Access Architecture

**Summary:** HIPAA-driven identity-based access control splitting staff into two security postures enforced via Microsoft Entra Conditional Access on top of hybrid identity (Entra Connect), with ALIS wired for SSO.

### Foundation — hybrid identity

On-prem AD `cascades.local` synced to Entra/M365 via Entra Connect (PHS + Seamless SSO). UPN suffix `cascadestucson.com` — Windows login = email = M365/ALIS identity (one credential everywhere).

### Two user buckets

1. **Restricted — caregivers + medtechs** (group `SG-Caregivers`, `8b8d9222`): sign in **only on the Cascades network** and **only on approved devices** (shared Galaxy phones + tagged caregiver laptops/desktops). **No MFA** (no personal devices) — protected by location + device controls + 8h sign-in frequency. See `docs/security/hipaa-caregiver-controls.md` for full compensating-controls architecture.
2. **Privileged — admins / directors / managers / nurses** (NOT in `SG-Caregivers`): email + ALIS from anywhere, seamless onsite / 2FA offsite (Authenticator/PIN).

### Conditional Access — caregiver enforcement

| Policy | ID | State |
|---|---|---|
| CSC - Block caregivers off Cascades network | `e35614e1` | **Enabled** (live since 2026-04-29; trusted IPs `72.211.21.217/32` + `184.191.143.62/32`) |
| CSC - Block caregivers on non-compliant device | `ede985e2` | **DISABLED 2026-07-01** — superseded by allow-list at final lockdown. Do NOT re-enable. |
| CSC - Caregivers: allow-listed devices only | `1b7fd025` | **Report-only / test-scoped** — device filter `(device.displayName -startsWith "CSC-") or (device.extensionAttribute1 -eq "CSCCaregiverDevice")`. Flip to enforced + live group when break-glass accounts exist. |
| CSC - Caregiver sign-in frequency 8h | `7d491c7a` | **Enabled** |
| Require MFA for all users | `7e87a1c7` | Enabled — SG-Caregivers + SG-Caregivers-Pilot both excluded |

- **Caregiver Named Location:** `061c6b06-b980-40de-bff9-6a50a4071f6f`, trusted IPs `72.211.21.217/32`, `184.191.143.62/32`.
- **GDAP exclusion:** CA blocking policies must exclude "Service provider users" (GDAP foreign principals) + `SG-External-Signin-Allowed` + `SG-Break-Glass`.
- **[ROOT CAUSE 2026-07-01] `pilot.test` login success masked two separate CA blockers.** A pilot passing on a device-test group does NOT prove the production group will pass the same gauntlet.

### Caregiver roster & FGPP

- **`SG-Caregivers` = frontline caregivers ONLY.** Roster: 35 as of 2026-07-01 (8 offboarded, 4 new hires added, Zeke Huerta moved to front desk). Admin-adjacent staff, `pilot.test`, disabled accounts excluded. All writes via CS-SERVER/RMM (Cloud/Graph writes fail HTTP 400).
- **`PSO-Caregivers` (Fine-Grained Password Policy, created 2026-07-02):** Precedence 10, `MaxPasswordAge=00:00:00` (never expires). Applies to `SG-Caregivers`; removal reverts cohort to 42-day domain default.
- **Juan Andrade (`j.andrade`):** offboard pending as of 7/17 (was due 2026-07-16 PM per coord todo `80716a98`). Verify status — if not done, disable + remove from `SG-Caregivers` + reclaim Business Premium.

### ALIS SSO

- Entra app registration -> OIDC SSO into ALIS; tenant-wide admin consent granted 2026-06-03 (`AllPrincipals` `User.Read` on SP `e1cae4ad`). Per-caregiver: ALIS staff `Email` must equal Entra UPN exactly. ALIS application: `d5108493-cba8-4f08-90b6-1bb0bc09eb2a`, daily sign-ins verified 2026-07-15.
- **How to enable ALIS SSO for one user:** set Email = exact Entra UPN in ALIS admin -> Staff -> record; user signs in via "Sign in with Microsoft"; turn off ALIS-native 2FA (native 2FA conflicts and locked out Karen Rossini).
- **Remaining caregiver ALIS work (Howard handling):** Email=UPN for existing caregivers; ALIS records built for Munezero/Cota/Robinson (via `alis` skill `build-import`); Vallejo Email=a.vallejo@; 7 discharged-record decisions; turn off ALIS-native 2FA per user; lower ALIS session timeout 20 -> 15 min.

### Caregiver devices

- **Phones:** Samsung A15s in Intune Shared Device Mode (Android Enterprise, corporate-owned dedicated). Enrollment profile: `CSC - Android Shared Phones (Entra SDM)` (`9a0fcc6d`). Dynamic group: `Cascades - Shared Phones` (`ea96f4b7`). **NEVER create a new enrollment profile** — reuse the existing profile's QR. Android enrollment token: vault `clients/cascades-tucson/intune-android-enrollment-token.sops.yaml` (Replace, not Revoke, when stale).
- **Caregiver desktops/laptops:** Hybrid Entra Join + on-prem GPO. CA allow-list targets group `Cascades - Caregiver Devices` (`02c6f698`). Relevant GPOs:
  - `CSC - Caregiver Workstation` (`3B5CD9A6-A278-4676-A9FD-9396D21A8261`): linked to `OU=Caregivers,OU=Departments`, filter `SG-Caregivers-Test` (to be flipped to `SG-Caregivers` at go-live).
  - `CSC - Caregiver Device Lockdown` (`E6174988-2721-4D96-ADF5-F5BB44E92769`): deployed to `OU=Caregiver Devices`, loopback merge (UserPolicyMode=1). Contains AppLocker Packaged App Deny rules for `SG-Caregivers`, `DontDisplayLastUserName=1`, AppIDSvc=Automatic, auto-lock/sign-out (lock @3min, 90s warn, sign-out @15min).
  - `CSC - Nurse Station Kiosk` (`32d76052-4d92-446c-95fb-614653f84742`): linked to `OU=Caregiver Devices`, filter `SG-Caregivers`. 15 Edge HKCU policies (BrowserSignin=2, EdgeDefaultProfileEnabled=1, ClearBrowsingDataOnExit=1, PasswordManagerEnabled=0, SyncDisabled=1, etc.), GPP Shortcuts (ALIS, PharmCare, Helpany to `%DesktopDir%`), UI restrictions (NoRun, NoControlPanel, DisableCMD, DisableRegistryTools, DisableTaskMgr, NoSetFolders, RemoveWindowsStore, etc.). Built 2026-07-17.
- **Managed Google Play binding:** owned by `MDMS@cascadestucson.com` — if this account is deleted/disabled/unlicensed, every Android phone loses management. Vault: `clients/cascades-tucson/mdm-service-account.sops.yaml`.
- **Intune (Windows MDM):** `INTUNE_A=PendingInput` — MS case open, does NOT block caregiver access (hybrid+GPO path replaces Intune dependency).

### Nurse-station kiosk (built 2026-07-17)

NURSESTATION-PC configured as a shared caregiver desktop (WS3 step 3b):
- Hybrid-joined: AzureAdJoined=YES, DomainJoined=YES. DN: `CN=NURSESTATION-PC,OU=Caregiver Devices,OU=Staff PCs,OU=Workstations,DC=cascades,DC=local`. RMM agent `f5a89784-834f-47b1-82e2-7e3e9dd337ff`, DeviceId `d3bf931f-f128-4261-8398-b46c34a4b342`.
- Edge SSO via PRT (`BrowserSignin=2` + `EdgeDefaultProfileEnabled=1`). Any caregiver signs in with `cascades\` username and gets ALIS via SSO automatically.
- GPP Shortcuts: ALIS, PharmCare, Helpany deployed to per-user desktop via kiosk GPO.
- AppLocker Packaged App Deny rules for `SG-Caregivers` (SID `S-1-5-21-388235164-2207693853-3666415804-1183`): Edge GameAssist, Paint, Photos, Store, Wallet, Cortana, Intel Graphics, Intel Experience, Intel Optane, Realtek Audio blocked. AppLocker policy XML: `\\cascades.local\SYSVOL\cascades.local\scripts\applocker-caregiver.xml`.
- Machine-level printers: `\\CS-SERVER\Nurses - Brother MFC-L8900CDW` (TCP_192.168.2.75) + `\\CS-SERVER\Health Services - Konica Minolta C368` (TCP_192.168.1.138).
- WAM token broker cache cleared 2026-07-17 to fix stale PRT issue (`AADSTS50126` for sysadmin@ credential).
- **ASSISTNURSE-PC: still pending.** Move from CN=Computers to OU=Caregiver Devices + machine-level printers + gpupdate. GPO settings apply automatically once in the OU.
- **Remaining:** PRT/SSO verification (confirm `AzureAdPrt: YES` after reboot), test non-caregiver login unrestricted, CSC - Reception Workstation Policy still applies to NURSESTATION-PC (pre-existing, unresolved).

### Caregiver name change procedure

Established 2026-07-09 (Bariffa Sika -> Charity Menle). **Rename, never re-create:** `Set-ADUser` (Surname/DisplayName/UPN/EmailAddress) -> `Rename-ADObject` (CN) -> `Set-ADUser -SamAccountName` -> `Start-ADSyncSyncCycle -PolicyType Delta`. Set `proxyAddresses` explicitly (primary SMTP new + alias old). Password and group membership do not change. Vault: temp password stays under the OLD sAMAccountName key.

---

### Network

- **ISP / WAN:** Dual-WAN Cox. WAN1 igc0 `184.191.143.62/30` (Cox Fiber, primary, gw `184.191.143.61`) + WAN2 igc3 `72.211.21.217/27` (Cox Coax, secondary, static). `WAN_Group` gateway group.
- **Firewall:** pfSense Plus 25.07-RELEASE at `192.168.0.1`. Admin vault: `clients/cascades-tucson/pfsense-firewall.sops.yaml`. Split-tunnel OpenVPN (Howard): `clients/cascades-tucson/pfsense-openvpn-howard.sops.yaml` (route `192.168.0.0/22`; use OpenVPN GUI or OpenVPN Connect with DCO disabled). Config backup vaulted point-in-time 2026-06-17.
- **[ROUTING GOTCHA 2026-06-30]** LAN "Default allow LAN to any" rule Gateway=WAN_Group policy-routes LAN->internal-VLAN traffic out the WAN. Fixed with a top LAN pass rule (src CS-SERVER `192.168.2.248`, dst `10.0.20.0/24`, gw=default). pfSense OpenVPN `--inactive` idle timeout ~300s (not yet fixed).
- **LAN / VLAN layout:** Primary staff/AP network `192.168.0.0/22`. **Staff/Internal VLAN 20** ("CSCNET", `10.0.20.0/24`, gw `10.0.20.1`). **Voice VLAN 30** (`10.0.30.0/24`, gw `10.0.30.1`). **Guest VLAN 50** (`10.0.50.0/24`, RFC1918 blocked). **CSC Internal VLAN 10** (mgmt). Per-unit /28 VLANs: ~240 networks (VLANs 101-631 for per-room resident isolation, `10.[floor].[room].0/28`). DHCP backend: ISC (Kea config present, dormant). Unbound DNS.
- **[STATUS 2026-07-01] VLAN 20 migration — machines essentially done, printers lagging.** 22 online hosts on VLAN 20 (10.0.20.x); only CS-SERVER (by design) + ~6 stragglers remain on 192.168.x. Printer shares: only 4/15 repointed (FrontDesk .221, BusinessOffice .220, LifeEnrichment .94, MCReception .78); 11 still point at old-LAN IPs. GPO `CSC - Point and Print (CS-SERVER)` pilot-scoped to DESKTOP-H6QHRR7 only. Map: `docs/printer-gpo-map.md`.
- **Switching (live 2026-07-15):** 11 switch objects in UniFi (8 online, 2 offline USL24PB — Switch 2nd Floor #2 and Switch 4th Floor #2 — **offline by design, not an issue**, Howard confirmed 2026-07-15; 1 USPM16P pending). 34 active 100Mb switch ports + 5 AP uplinks at 100Mb (APs 122, 145, 204, 236, 240 — highest-impact). p38 (1st Floor USW) 4.0% tx-drop rate.
- **UniFi controller:** 172.16.3.29:11443 (UOS). Cascades site `va6iba3v`, site_id `685f39068e65331c46ef6dd2`.
- **WiFi — 77 U7-Pro APs (75 online, 2026-07-15).** CSCNet (shared PPSK, ~230-242 per-key->network mappings, wlanconf `685f39078e65331c46ef7ee5`, vault `clients/cascades-tucson/wifi-cscnet.sops.yaml`). CSC ENT (legacy, planned repurpose as 5 GHz-only WPA2 PPSK device island for Poly voice + Helpany). Guest (isolated, VLAN 50). Mesh: 2nd Floor Atrium is wireless-mesh parent for CC Bridge + salon (5 GHz backhaul ch36).
- **Wireless RF (applied 2026-06-19, validated):** 2.4 GHz -> MEDIUM power on 47 radios. 5 GHz -> clean DFS 40 MHz plan on 72 non-mesh APs (ch 52/60/100/108/116/124/132/140, 0 co-channel) — retry HALVED (8.7->3.8 avg). CSCNet BSS-transition (802.11v) ON. 6 GHz blocked on CSCNet (WPA3 mandate; Howard's supervised decision required to enable).
- **Voice VLAN 30 (COMPLETE 2026-06-19):** HIPAA-isolated. 37 devices: 28 Poly phones + 8 AudioCodes (`.224-.231`) + Vertical desktop (`10.0.30.201`, wired). Voice PPSK vault: `clients/cascades-tucson/wifi-voice-ppsk.sops.yaml`. Bistro phone pulled 2026-06-19 (bad Kitchen phone replaced with Bistro phone — Bistro now has no phone). QoS design ready (`docs/network/phase1-voice-qos-design.md`) but NOT built; blocker: WAN2 coax upload measurement.
- **VoIP vendor: Vertical (Richard Turner rturner@vertical.com).** Two fleets: 8 AudioCodes (wired, external power, PoE OFF) + 28 Poly (WiFi via CSCNet PPSK). Dropped-calls root cause is RF band selection; CSC ENT device-island plan is the fix.

### External Vendors

- **Helpany (resident safety sensors):** "Paul" ceiling-mounted radar sensors (Sedimentum backend, no camera/mic). WiFi WPA2-only, 5 GHz-capable. Currently on CSC ENT (key: vault `clients/cascades-tucson/wifi-cscnet.sops.yaml`), migrating to 5 GHz device island. Facility liaison: John Trozzi.
- **bill.com (BILL):** Sends from `inform.bill.com`, `hq.bill.com`, `hello.bill.com`, `mc.bill.com`. Safe sender: `account-services@inform.bill.com`.
- **BOK Financial:** DMARC p=reject; zero historical emails to cascadestucson.com (wrong recipient address on BOK's side, resolved externally).

### Business Applications

| System | Function | Notes |
|---|---|---|
| ALIS (Medtelligent) | Clinical EHR | SSO live. HIPAA — BAA required before PHI leaves. communityId 622. Medtelligent BAA not yet verified. |
| QuickBooks | Accounting | Running on CS-SERVER (should NOT be on a DC). |
| Bill.com | AP/AR | REST API automatable. |
| Relias | Training / LMS | Export / API. |
| You've Got Leads | Senior-living CRM | Export / API varies. |
| TELS (Direct Supply) | Facilities | Export; API uncertain. |
| Focus HR | HR / payroll | Export or vendor API. |
| Helpany (app.safe-living.com) | Caregiver app / resident sensors | Export-only likely. |
| POS | Point of sale | TBD. |

**[PROPOSED] KPI dashboard (Ashley Jensen request, 2026-06-17):** Phase 1 scheduled CSV/Excel exports -> SharePoint -> Power BI Pro; Phase 2 API-capable systems (Bill.com, QuickBooks Online) via Power Automate. Parked pending Ashley's day-one KPIs + data-freshness need + POS/Focus-HR specifics. Scoping: `clients/cascades-tucson/docs/proposals/kpi-dashboard.md`.

---

## Access

- **CS-SERVER:** Via ScreenConnect or GuruRMM (agent `c39f1de7-d5b6-45ae-b132-e06977ab1713`; re-enrolls — resolve live by hostname). Credentials: vault `clients/cascades-tucson/cs-server.sops.yaml` (username `sysadmin`). SMB clients reach it at **192.168.2.248**, NOT .254 (Hyper-V vEthernet).
- **CS-SERVER iDRAC:** 192.168.2.65
- **pfSense admin (HTTPS):** https://192.168.0.1 — vault: `clients/cascades-tucson/pfsense-firewall.sops.yaml`
- **pfSense SSH:** `ssh admin@192.168.0.1` (system OpenSSH) — **tcp/22 blocked from OpenVPN subnet; use GUI remotely**
- **pfSense OpenVPN (Howard):** vault: `clients/cascades-tucson/pfsense-openvpn-howard.sops.yaml` (split-tunnel, route `192.168.0.0/22`)
- **pfSense config backup (2026-06-17):** vault: `clients/cascades-tucson/pfsense-config-backup-2026-06-17.sops.yaml`
- **Synology DSM:** http://192.168.0.120:5000 — vault: `clients/cascades-tucson/synology-cascadesds.sops.yaml`. **[SECURITY]** Cloud Signin Portal credential was committed plaintext at vault commit 1fbc0e1 — encrypted go-forward but **must be rotated.**
- **M365 admin:** admin@cascadestucson.com — vault: `clients/cascades-tucson/m365-admin.sops.yaml`
- **M365 sysadmin:** sysadmin@cascadestucson.com — vault: `clients/cascades-tucson/m365-sysadmin.sops.yaml`
- **WiFi CSCNet:** vault: `clients/cascades-tucson/wifi-cscnet.sops.yaml`
- **WiFi Voice PPSK (VLAN 30):** vault: `clients/cascades-tucson/wifi-voice-ppsk.sops.yaml`
- **Android enrollment token:** vault: `clients/cascades-tucson/intune-android-enrollment-token.sops.yaml`
- **MDM service account:** vault: `clients/cascades-tucson/mdm-service-account.sops.yaml`
- **svc-scan (scan-to-folder):** vault: `clients/cascades-tucson/svc-scan.sops.yaml`
- **ALIS SSO app registration:** vault: `clients/cascades-tucson/alis-sso-app-registration.sops.yaml`
- **ALIS API user:** vault: `clients/cascades-tucson/alis-api-howard-user.sops.yaml`
- **Caregiver temp passwords (2026-06-30):** vault: `clients/cascades-tucson/caregiver-temp-passwords-2026-06-30.sops.yaml`. Retrieve with `vault get` (NOT `get-field`). Do NOT inline values.
- **Caregiver temp passwords (2026-07-01, 4 new hires):** vault: `clients/cascades-tucson/caregiver-temp-passwords-2026-07-01.sops.yaml`. Same retrieval rules.
- **Shelby Trozzi (domain account):** vault: `clients/cascades-tucson/shelby-trozzi.sops.yaml`. Not Entra-synced (safe to reset on-prem without M365 impact).
- **pilot.test AD account (test identity for kiosk work):** vault: `clients/cascades-tucson/pilot-test-ad.sops.yaml`. Added to SG-Caregivers 2026-07-17 for kiosk testing. Reclaim when WS3 pilot complete.
- **UOS controller SSH (root):** vault: `infrastructure/uos-server-ssh-key`
- **UOS controller RW admin (Network API):** vault: `infrastructure/uos-server-network-api-rw`
- **UniFi AP device auth (Cascades):** vault: `clients/cascades-tucson/unifi-ap-ssh`
- **Vault root:** `clients/cascades-tucson/`

---

## Patterns & Known Issues

### Syncro / Billing

- **Never set a contact on any Syncro ticket unless explicitly requested.** Meredith Kuhn is the recurring wrong default Syncro pre-selects — she is not the correct contact. Leave `contact_id` blank.
- **Billing product for prepaid block draw:** Use a real labor type (Remote, Onsite, etc.) — NOT "Prepaid project labor" (exempt, won't decrement the block).
- **Always live-check hours before billing:** `GET /customers/20149445`.
- **Windows Home->Pro upgrade billing:** Syncro product "Windows Pro Upgrade" id 23571919 ($99/machine). MAK: vault `infrastructure/windows-pro-mak.sops.yaml`. 4 MAK counts consumed to date (MDIRECTOR-PC activated free via digital entitlement; MEMRECEPT-PC + LAPTOP-8P7HDSEI via MAK; NurseAssist + DESKTOP-MD6UQI3 upgraded 2026-06-26 — 2x$99 still to invoice as of 7/13).

### Exchange Online / Message Tracing

- **Get-MessageTrace is hard-deprecated (Sept 2025).** Use `Get-MessageTraceV2` instead (`ResultSize` not `PageSize`). V2 max window 10 days — loop 9 consecutive windows for 90-day coverage.
- **Sender-side suppression (SendGrid ESP):** If a user never receives mail from a specific sender and message trace shows zero records, consider a SendGrid suppression list (fix = contact sender's support, no M365 action). Confirmed with bill.com.
- **AutoMapping rolls back on rapid sequential grants.** Grant one user at a time, spaced ~6-8s; poll until removed before the next grant. (Tamra Matthews offboarding root cause, 2026-06-30.)
- **Get-RecipientPermission replication lag:** an immediate read-back after a SendAs grant can miss the new trustee (EXO replica lag); re-read before concluding the write failed. (Chris Knight accounting mailbox, 2026-07-09.)

### Active Directory / User Management

- **Security group assignment is always explicit.** When creating any Cascades user, ask which security group(s). OU -> group auto-mirror was explicitly declined 2026-05-14.
- **`SG-Caregivers` = frontline caregivers ONLY.** Admin-adjacent staff (Feller, Nyanzunda), `pilot.test`, disabled accounts excluded. Cloud/Graph adds fail (HTTP 400); all writes on CS-SERVER via RMM.
- **Entra Connect sync scope is narrow — do not OU-move a synced caregiver.** Scope covers ONLY `OU=Caregivers`, `OU=Groups`, `OU=Caregiver Devices`. Moving a caregiver to any other OU deletes its cloud object (Zeke Huerta, front desk role change, 2026-07-01 — OU move deferred).
- **New user mandatory order (folder redirection):** (1) Create AD user; (2) Run `New-HomeFolder -Username "<sam>"` on CS-SERVER; (3) Add to SG-FolderRedirect; (4) THEN first domain logon. Skipping step 2 causes fdeploy to cache a failure silently and never retry.
- **Folder redirect recovery:** `clients/cascades-tucson/scripts/fix-shell-redirect.ps1` via GuruRMM while user is logged in. Must set both GUID-based and legacy-name registry keys. `fdeploy1.ini flags=187` (changed from 1211 which caused WRITE_DAC failures on new subfolders).
- **[ROOT CAUSE 2026-06-08] Native Folder Redirection was DOA fleet-wide** — GPO targets were in `fdeploy1.ini` but the Windows FR CSE only reads `fdeploy.ini`. Fixed by writing correct `fdeploy.ini` + version bump.
- **Login-screen hide (`SpecialAccounts\UserList`):** An enabled local admin not visible in the sign-in picker has a `SpecialAccounts\UserList` suppression (DWORD `<username>=0`). Fix: delete the DWORD.
- **Caregiver name change — rename, never re-create.** Procedure: `Set-ADUser` -> `Rename-ADObject` -> `Set-ADUser -SamAccountName` -> delta `Start-ADSyncSyncCycle`. Set `proxyAddresses` explicitly. Vault: temp password stays under OLD sAMAccountName key.
- **Never set `ChangePasswordAtLogon $true` for a caregiver who will sign in on a shared phone** — always fails as Entra `err=50126` (Microsoft Authentication Broker cannot render forced-change screen).
- **RECEPTIONIST-PC is two physical boxes sharing a hostname** (frontdesk MJ0KQHNP, MemCare MJ0KQH4R -> staged rename MEMCARE-STATION, pending reboot). Reconcile fleets by SERIAL, not hostname.

### GPO / Kiosk Configuration

- **GPP Shortcuts CSE GUID:** `{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}` (verified from client `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions`). Correct GUID is critical — wrong CSE (Printers `{BC75B1ED-...}` or Scripts `{42B5FAAE-...}`) silently prevents shortcut delivery.
- **GPP shortcuts use `%DesktopDir%`** (per-user desktop, loopback at logon), NOT `%CommonDesktopDir%` (Public Desktop) — chicken-and-egg problem on first login means per-user is required.
- **Printers added as machine-level connections (`/ga` flag)** via `rundll32 printui.dll,PrintUIEntry /ga /n \\CS-SERVER\<share>` so every user gets them automatically.
- **PRT acquisition on hybrid-joined machines:** Stale WAM token broker cache for a service account causes `AzureAdPrt: NO`. Fix: clear `Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AC\TokenBroker` for all users + reboot. Also clear stale Edge profile data if browser SSO is broken.
- **Edge SSO on kiosk PCs requires `BrowserSignin=2` + `EdgeDefaultProfileEnabled=1`.** `BrowserSignin=0` blocks PRT passthrough entirely.
- **AppLocker Packaged App Deny rules for one group:** `Allow Everyone: *` + `Deny SG-Caregivers: [app list]` is the only GPO-native approach that restricts one group while leaving all others unrestricted. Deny rules override Allow rules. Requires AppIdentity service (`AppIDSvc`) set to Automatic.

### File Shares & Scan-to-Folder

- **Accounting folder:** `D:\Shares\Accounting` on CS-SERVER, shared as `\\CS-SERVER\AcctDept`. **Share is named `AcctDept`, NOT `Accounting`** (a printer share named `Accounting` already exists). REUSE `svc-scan` for every future scanner->network-folder setup — do NOT create per-printer accounts. Vault: `clients/cascades-tucson/svc-scan.sops.yaml`.
- **Brother MFC-L8900CDW "Business Office" (10.0.20.220):** Scan-to-Network path `\\192.168.2.254\AcctDept\Scans`, Auth Method **NTLMv2** (not Auto/Kerberos — printer can't KDC across VLAN), username `cascades\svc-scan`.
- **`\\CS-SERVER\Company Web Docs`:** `D:\Shares\Public\Company Web Docs`, Shelby.Trozzi = Change. RMM cannot push drive map directly (user_session double-hop -> SMB error 67); use `cmdkey` + persistent `HKCU:\Network\W` workaround.
- **`\\CS-SERVER\Executive`:** `D:\Shares\Executive`, inheritance broken; Ashley.Jensen + Meredith.Kuhn = Modify. E: on DESKTOP-U2DHAP0 (Ashley) + ASSISTMAN-PC (Meredith).
- **RMM dispatch gotcha:** build UNC from `[char]92` in PowerShell payloads — literal `\\` collapses to `\` through jq/agent.

### Printers / VLAN 20 Migration

- **Server-share model is preferred** for domain-joined machines. Workgroup machines get direct-IP local printer; switch to server share on domain join.
- **Point-and-Print policy prerequisite** for standard users: `HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers`: `RestrictDriverInstallationToAdministrators=0` + subkey `PointAndPrint` (`Restricted=1, TrustedServers=1, ServerList=CS-SERVER, NoWarningNoElevationOnInstall=1, UpdatePromptSettings=2`). Symptom without it: elevation prompt `0x800702e4` / PrintService event 513.
- **Canon MF741CDW / MF743CDW are UFR II ONLY — NOT PCL.** PCL6 driver produces Error #822. Pull `Canon Generic Plus UFR II V250` (INF `cnlb0ma64.inf`) from client DriverStore.
- **Static VLAN 20 printer IPs:** Front Desk Epson ET-5800 = `10.0.20.221`; Life Enrichment Canon MF741CDW = `10.0.20.94` (UFR II); Business Office Brother L8900CDW = `10.0.20.220`; Dining Room Canon MF743CDW = `10.0.20.228`; Chef Office Brother MFC-9330CDW = `10.0.20.236`; MedTech Brother MFC-L8900CDW = `10.0.20.74`; MC Reception Epson ET-5800 = `10.0.20.78`. Full map: `docs/printer-gpo-map.md`.

### Synology NAS

- **`synopkg status SynologyDrive` falsely returns "stopped" (status 263) even when active.** Verify via `systemctl is-active pkgctl-SynologyDrive` and `netstat -tlnp | grep 6690`.
- **Accessing cascadesDS from RMM — always use a user session, not CS-SERVER SYSTEM.** Domain machine account fails Kerberos against the Synology (workgroup "CASCADES" same short name as AD domain).
- **Stale Word owner lock files on cascadesDS:** Word creates hidden `~$<filename>` files on abrupt session end. Fix: delete the `~$` file(s).

### CS-SERVER SMB

- **RMM-dispatched SMB client commands false-negative.** `net use`/`net view`/`Test-Path`/`Get-SmbConnection` in `user_session` return error 67/RPC 1702/"none" even for known-good targets. CS-SERVER SMB is healthy. Validate server-side via `Get-SmbSession`/`Get-SmbOpenFile`. A drive-map `verify` failure is NOT proof of a problem.

### Conditional Access / CA Policies

- **Phased rollout — never tenant-wide.** All caregiver CA policies target `SG-Caregivers` (`8b8d9222-5d71-419a-936d-56d895c6c332`).
- **`pilot.test` login success masked two separate CA blockers.** `pilot.test` is in `SG-Caregivers-DeviceTest` / `SG-Caregivers-Test` — excluded from compliance-block and targeted by allow-list. Live `SG-Caregivers` members hit BOTH problems simultaneously. A pilot passing on a device-test group does NOT prove production will pass.
- **Caregiver device allow-list CA policy `1b7fd025` is still report-only / test-group scoped.** Do NOT flip to enforced until break-glass accounts exist + `SG-Break-Glass` exclusion is in place.

### Wireless / UniFi RF

- **[APPLIED 2026-06-19] Production RF optimization:** 2.4 GHz power -> MEDIUM on 47 radios; 5 GHz -> clean DFS 40 MHz channels on 72 non-mesh APs; retry HALVED; BSS-transition (802.11v) ON.
- **Primary pain band is 2.4 GHz.** Avg TX-retry ~10%; cu_total 69-94% live; catastrophic external neighbor density.
- **DFS channels here are 4-5x cleaner than non-DFS** (survey-proven; never apply a non-DFS-only policy without measuring first).
- **Offline switches (Switch 4th Floor #2, USW Pro Max 16) are offline BY DESIGN — not an issue** (Howard confirmed 2026-07-15).
- **AP-hang recovery:** `device-control.sh cascades poe-cycle "<AP name>" --apply`. Do NOT use `force-provision` (took AP 445 offline during the Floor-4 pilot).
- **Tooling (`unifi-wifi` skill):** `audit-site.sh`, `live-stats.sh`, `survey-report.py`, `channel-plan.sh`, `apply-radio.sh`, `apply-wlan.sh`, `dfs-check.sh`, `switch-audit.sh`, `device-control.sh`.

### VoIP / Network Device Migration

- **Re-VLANing a wired switch port requires a link bounce to force re-DHCP.** UniFi block/unblock is a MAC filter only — does NOT bounce the link.
- **Externally-powered AudioCodes desk phones need a PHYSICAL power-cycle** (8 units on ports 1-8 of USW-16-PoE with external bricks; PoE OFF on those ports — controller PoE-cycle is a no-op).
- **Verify VLAN membership via the client `vlan` field, not the controller's displayed IP** (IP field caches/lags).

### pfSense Operations

- **pfSense 25.07 logs are PLAIN TEXT.** Read with `tail`/`grep`. `clog` returns empty output.
- **LAN "allow LAN to any" rule policy-routes internal-VLAN traffic out the WAN** (Gateway=WAN_Group). Fix: top LAN pass rule, Gateway=default, scoped source.
- **pfSense dirty-boot / duplicate dhcpd:** After unclean shutdown, dhcpd may start twice. Fix: `killall dhcpd && echo "services_dhcpd_configure();" | /usr/local/sbin/pfSsh.php`.

### Security Incidents (historical)

- **Megan Hiatt (2026-04-16):** Active credential stuffing — 126 failed sign-ins from Belfast GB, Hamburg DE. Password reset + SMTP AUTH disable actioned. **Re-verify April remediation held** (flagged 2026-06-30).
- **John Trozzi (2026-04-16, 2026-04-20):** Investigated twice — both times NO BREACH.
- **Crystal Rodriguez (2026-04-19):** Phishing investigation. Report: `clients/cascades-tucson/reports/2026-04-19-crystal-rodriguez-phish-investigation.md`.
- **Canva email delivery (2026-05-20):** Resolved by adding canva.com domains to AllowedSenderDomains in EOP.
- **ALIS AADSTS65001 (2026-06-03):** Resolved by granting tenant-wide admin consent on ALIS SP (`e1cae4ad`).
- **Chris Knight bill.com / BOK email delivery (2026-06-04):** Root cause sender-side (SendGrid suppression; BOK wrong recipient email). Resolved externally. Ticket #32383.
- **BEC / vendor-fraud phish (2026-07-14):** info@syufway.com to accounting@ — fake W-9 for "AMYSH Solutions" EIN 92-4058031. Remediated 2026-07-15; syufway.com + steqm.com blocked in TABL. No compromise.
- **dunedolly21@gmail.com:** External guest invited 2026-04-14 by Lauren Hasselman. Status unknown — confirm with Lauren. [unverified]

### HIPAA Compliance

- **Primary objective.** CS-SERVER and ALIS store PHI.
- **Critical open gaps:** No audit logging on D:\Homes (SS164.312(b)); Object Access auditing disabled on CS-SERVER; no SMB encryption on homes share; audit retention infra approved but not built; BAA inventory incomplete; break-glass accounts not created.
- **Closed gaps:** Backup (MSP360 cloud backup 2026-06-15); MFA / CA for all users; caregiver access restricted to building network (2026-07-01); auto-lock + auto-sign-out on shared caregiver devices (GPO deployed 2026-06-05); Voice VLAN 30 isolates PHI from phone traffic (2026-06-19); HIPAA BAA covered by MCA (confirmed 2026-05-14); 7 deleted mailboxes restored 2026-04-25 for 7-year retention.
- **Termination policy established:** convert to shared mailbox, hide from GAL, retain 7 years. Litigation Hold waived for 2026-06 offboardings (Alma, Tamra) — no PHI per Howard.

---

## Active Work

> Canonical remaining-work plan: `clients/cascades-tucson/docs/REMAINING-WORK-PLAN.md` (built 2026-06-24; refreshed 2026-07-13/14/15/17). 9 sequenced workstreams. Work from it.

*0 open Syncro tickets as of 2026-07-15. All active work is project-level.*

### Finish sequence (re-cut 2026-07-15, updated 2026-07-17)

1. **Juan Andrade offboard (WAS 2026-07-16 PM) — VERIFY STATUS.** Disable + remove from `SG-Caregivers` + reclaim Business Premium. Coord todo `80716a98`. If not yet done, do immediately.
2. **Break-glass accounts (`breakglass1-csc@`, `breakglass2-csc@`) + FIDO2 YubiKeys + strip stranded PAA role from Tenant Admin SP** — prerequisite for WS3 allow-list enforcement flip. Tenant runs live block policies with no break-glass today. Pending Mike for PAA removal.
3. **Caregiver lockdown go-live (WS3 steps 1-8 incl. 3b):** flip GPO `CSC - Caregiver Workstation` filter to `SG-Caregivers`; flip CA `1b7fd025` to enforced + live group; OU-move caregiver machines to `OU=Caregiver Devices`; ALIS email-match; disable ALIS-native 2FA; reboot NURSESTATION-PC to activate lockdown; complete ASSISTNURSE-PC (OU move + printers + gpupdate); pilot cleanup (delete `pilot.test` + groups).
4. **M365 relicense 23 remaining suspended-Standard users (WS4).** 5 SPB free today; 18 more needed from Pax8. Howard checking Pax8 for current billing. Seat-mix decision (full vs lighter licenses) required first (~$375-575/mo net-new). Shelby Trozzi needs both suspended SKUs removed + SPB assigned.
5. **Repair/confirm image/system-state backup -> SSD swap (WS5).** Image side was ~10 days stale on 7/15. Gate: confirm current before any drive work.
6. **Domain-join tail + dept drives (WS1+2).** ~10 machines remaining. Onsite batch: reboots, KFM unlinks, LAPTOP-DRQ5L558 on-LAN. Point-and-Print GPO fleet-wide; MCMedTech + other stale printer shares repointed.
7. **Network tail (WS6) + audit-retention build (WS4):** CSC ENT device-island consolidation (~79-client evacuation first) + 34-port/5-AP-uplink gig sweep. Audit retention LAW 90d + Storage 6yr (HIPAA 164.312(b) gap, approved 2026-04-29).
8. **M365 collaboration migration — SharePoint/Teams (WS8).** Scoping after WS1/2 tail; permission model rides dept OU/SG structure. Synology backup-only flip follows (WS5).
9. **ALIS online payments (WS9).** Scoping questions drafted (`docs/proposals/alis-online-payments-scoping-2026-07-15.md`, 18 questions) — NOT yet sent. Loop in Jeff Bristol (accounting@). BAA chase item (Medtelligent BAA unverified).
10. **Ticket-verify pass with Howard.** Tickets #32194/#32230/#32254/#32319/#32342/#32370 closed in Syncro — verify work was actually completed.

### Workstation replacement list (per CARF tech plan 2026-07-15)

5 machines confirmed for replacement + 1 spare: DESKTOP-TRCIEJA (Lupe Sanchez, EOL), ASSISTMAN-PC (Meredith Kuhn, i5-6200U cannot run Win11), MDIRECTOR-PC (Shelby Trozzi, 3.9 GB RAM), MEMRECEPT-PC (Pentium E5500, oldest in fleet), CHEF-PC (Culinary), plus spare deployed to new hire. Lupe Sanchez replacement decision made 2026-06-18. Chef-PC elevated from rebuild to full replace per tech plan 2026-07-15.

### Domain join readiness (as of 2026-06-26 pass)

- **READY:** DESKTOP-LPOPV30 (Karen), MAINTENANCE-PC, LAPTOP-E0STJJE8; after reboots: ASSISTMAN-PC, ANN-PC, Laptop2, NurseAssist, DESKTOP-MD6UQI3 (all now Pro/PfW).
- **Deferred:** LAPTOP-DRQ5L558 (off-network, must be on-LAN first); CHEF-PC (after reinstall/replace ticket); SALES4-PC (Tamra offboarded, machine repurpose TBD).
- **EOL/Replace:** DESKTOP-TRCIEJA, ASSISTMAN-PC, MDIRECTOR-PC, MEMRECEPT-PC, CHEF-PC.
- **Script note:** `phase3-pre-join-verify.ps1` hardcodes DC at `192.168.2.254`; correct SMB target is `192.168.2.248` — update before reuse.

### Open pending items

- **[URGENT] Verify Juan Andrade offboard status** (was due 2026-07-16 PM).
- **[SECURITY] Break-glass accounts** not created. Required before CA go-live.
- **[SECURITY] Remove standing PAA role from Tenant Admin SP.** Needs Global Admin. Pending Mike.
- **[SECURITY] Rotate exposed Synology Cloud Signin Portal credential** (vault commit 1fbc0e1).
- **[PENDING] Zeke Huerta MFA (Authenticator) registration.** No registered method since front-desk move (2026-07-01).
- **[PENDING] ASSISTNURSE-PC nurse station kiosk config** (OU move + printers + gpupdate).
- **[PENDING] NURSESTATION-PC PRT/SSO verification** (confirm AzureAdPrt: YES + ALIS SSO silent after reboot).
- **[PENDING] MEMCARE-STATION rename not applied** (pending reboot on MemCare RECEPTIONIST-PC box, S/N MJ0KQH4R).
- **[PENDING] pfSense AutoConfigBackup** enable + **OpenVPN `--inactive` timeout** fix.
- **[PENDING] DESKTOP-TRCIEJA GravityZone BD uninstall** (console-only). Box slated for hardware replacement.
- **[PENDING] 6 GHz on CSCNet** — WPA3 conversion required; Howard's supervised decision.
- **[PENDING] Bistro phone replacement** — Bistro has no phone since 2026-06-19.
- **[PENDING] WAN2 (coax) upload measurement** — needed to size pfSense HFSC voice QoS.
- **[PENDING] Audit retention infra** (LAW 90d + Storage 6yr) approved 2026-04-29, not yet built.
- **[PENDING] MemCare min-RSSI (floors 5/6)** — deferred until new APs added.
- **[WARN] 34 switch ports + 5 AP uplinks at 100 Mbps** — cabling/NIC sweep needed.
- **[PENDING] ALIS app session timeout** lower from 20 to 15 min (Howard, ALIS admin).
- **[PENDING] File server audit logging** (SS164.312(b) gap — no NTFS/object-access audit trail on D:\Homes).
- **[PLANNED — 60-90 days] Repurpose Synology NAS as onsite backup for CS-SERVER** (per tech plan).
- **[PLANNED] CSC ENT device-island consolidation** (Poly voice + Helpany sensors -> 5 GHz-only WPA2 PPSK). Design: `docs/network/csc-ent-device-island-plan.md`. ~79-client evacuation is the prerequisite.
- **[PLANNED] CS-SERVER SSD upgrade** (2x enterprise SATA SSD purchased; window requires confirmed image backup).
- **[PLANNED] Voice QoS for VLAN 30** — design done (`docs/network/phase1-voice-qos-design.md`), not built; blocker: WAN2 coax upload.
- **[PLANNED] SharePoint/Teams migration (WS8)** — after WS1/2 tail.
- **[PLANNED] KPI dashboard (Ashley Jensen)** — parked pending her day-one KPIs.
- **[PLANNED] DC migration** off 16-yr-old R610 — scope and quote included in CARF tech plan.

---

## History Highlights

| Date | Event |
|---|---|
| 2026-03-06 | ACG onboarding begins. Initial audit: CS-SERVER Dell R610, pfSense, UniFi, Synology. 19 machines. No backup, no HIPAA compliance. |
| 2026-03-09 | AD security hardening: Monica Ramirez removed from Domain Admins, lockout policy fixed, AD Recycle Bin enabled, MachineAccountQuota set to 0. |
| 2026-03-31 | Cascades onboarded to remediation tool. Tenant ID documented. 50 users, Secure Score 34%. |
| 2026-04-13 | Major onsite: 13 stale AD accounts deleted, OU structure cleaned, UPNs migrated to cascadestucson.com, Homes share created, Folder Redirection GPO deployed, first domain joins. |
| 2026-04-14 | Sandra Fish global admin revoked. ALIS SSO confirmed. Business Premium proposal created. |
| 2026-04-16 | Breach checks: Megan Hiatt (credential stuffing, not breached; password reset). John Trozzi (clean). Crystal Rodriguez phish. |
| 2026-04-25 | Entra Connect installed on CS-SERVER (staging mode). 7 deleted mailboxes restored for HIPAA. Dual-WAN discovered. |
| 2026-04-28-29 | CA policy reconciliation. Audit retention architecture designed. Break-glass design (2 accounts, YubiKeys). Three caregiver CA policies created in Report-only mode. |
| 2026-05-01 | Howard billed 33.5 hrs on Entra project ticket #32214 against prepaid block. |
| 2026-05-07-08 | SDM phone provisioning. SDM token success. ALIS SSO app registration values captured to vault. |
| 2026-05-11 | CA policy `CSC - Block caregivers on non-compliant device` flipped from Report-only to Enabled. Caregiver fleet re-enrolled (~17 unique SDM phones). ALIS SSO end-to-end validated. Registration Campaign + SSPR exclusion configured for caregivers. |
| 2026-05-14-16 | Caregiver AD accounts created. Entra Connect exited staging — actively syncing. Wireless diagnostic (2.4 GHz saturation hypothesis identified). |
| 2026-05-20 | Canva email delivery resolved. |
| 2026-05-22 | Ashley Jensen domain-joined. RECEPTIONIST-PC domain-joined. GPO ILT fixes. |
| 2026-06-03 | ALIS AADSTS65001 resolved: tenant-wide admin consent on ALIS SP. Caregiver device allow-list CA policy `1b7fd025` created (report-only). |
| 2026-06-05 | NURSESTATION-PC login issue resolved. Hybrid Entra Join + GPOs deployed: `CSC - Caregiver Workstation` validated; `CSC - Caregiver Device Lockdown` deployed to OU=Caregiver Devices. Ticket #32303, 7.0h. |
| 2026-06-08 | Chris Knight workstation (DESKTOP-N5G1ROO) domain-joined + GuruRMM-enrolled. Root-caused native Folder Redirection failure (`fdeploy.ini` misname) and fixed fleet-wide. ASSISTNURSE-PC reinstalled Win10->Win11. |
| 2026-06-09 | Accounting scan-to-folder built. D:\Shares\Accounting on CS-SERVER; shared as \\CS-SERVER\AcctDept; svc-scan service account vaulted; Brother MFC-L8900CDW Scan-to-Network configured. |
| 2026-06-12 | Shared mailboxes grievances@ + Surveys@ created and delegated to Meredith + Ashley. Ticket #32417, 0.5h. |
| 2026-06-15 | Wireless RF full audit. 77 U7-Pro APs confirmed. 2.4 GHz saturation as primary pain point confirmed. CS-SERVER backup started (MSP360). pfSense OpenVPN password reset. |
| 2026-06-16 | Voice VLAN plan designed. pfSense confirmed pfSense Plus 25.07-RELEASE. unifi-wifi skill feature-complete. |
| 2026-06-17 | Voice VLAN 30 built + verified. Vertical desktop + initial Poly phones migrated. Power outage and full recovery (pfSense on UPS surge-only -> dhcpd duplicate + L2 issue; moved pfSense to battery side). Plaintext Synology signin credential discovered in vault commit 1fbc0e1. |
| 2026-06-18 | Voice VLAN 30 cutover (8 AudioCodes + 22 Poly). Dropped-calls root-caused to RF band selection, not VLAN. 6 GHz root-caused dark. RF optimization master plan built. DESKTOP-TRCIEJA (Lupe Sanchez) EOL decision. |
| 2026-06-19 | PRODUCTION RF OPTIMIZATION APPLIED (2 AM window): 2.4 GHz MEDIUM on 47 radios; clean DFS 40 MHz on 72 non-mesh APs; retry HALVED. Voice VLAN migration COMPLETE (29/29 Poly re-keyed). Billed ticket #32444, 7h. |
| 2026-06-23 | Planned power outage (05:30-09:00 MST) — clean shutdown executed. |
| 2026-06-24 | CS-SERVER RAID live-verified HEALTHY (1:0:4 = global hot spare). PSU redundancy lost noted. Executive share built (\\CS-SERVER\Executive). Live AD+RMM domain-join diff; REMAINING-WORK-PLAN.md built (7 workstreams). CARF Technology Plan deliverable started. CSC ENT device-island consolidation plan drafted. |
| 2026-06-25 | Alma Montt OFFBOARDED (MC Life Enrichment, no PHI). Endpoint security migration started: Datto EDR/AV rollout + Bitdefender decommission. RECEPTIONIST-PC identified as two physical boxes. |
| 2026-06-25 | Home->Pro upgrades: MDIRECTOR-PC (free digital entitlement), MEMRECEPT-PC + LAPTOP-8P7HDSEI (2 MAK counts, $198 to bill). |
| 2026-06-26 | CS-SERVER: full legacy prior-MSP Datto stack removed. SMB "outage" debunked (test-method artifact). NurseAssist + DESKTOP-MD6UQI3 upgraded to Pro for Workstations (2x$99, to invoice). |
| 2026-06-29 | ALIS caregiver phone-only + caretaker crosscheck: phone-only caregivers = NONE; 7 caregivers exist in ALIS only as Discharged records. |
| 2026-06-30 | Caregiver phone SSO — license + group + temp-password onboarding complete for 40 frontline caregivers. Tamra Matthews OFFBOARDED. VLAN 20 printer migration + pfSense policy-routing fix. MEMCARE-STATION rename staged. |
| 2026-07-01 | VLAN 20 migration live-reconciled — 22 machines on VLAN 20, printer shares 4/15. Caretaker roster update: 8 disabled + license reclaimed, 4 new hires (Vallejo, Munezero, Cota, Robinson), Zeke Huerta front desk. SG-Caregivers now 35. CA phone/desktop login verified end-to-end; two CA blockers fixed. Interim caretaker CA posture (desktops + phones, on-network only) — Howard's go. |
| 2026-07-02 | Caregiver phone login: forced-change gotcha resolved (cleared ChangePasswordAtLogon for all 35). PSO-Caregivers (never-expire FGPP) created on CS-SERVER. Shelby Trozzi "Company Web Docs" share built; domain account password vaulted. |
| 2026-07-09 | Charity Menle caregiver rename (procedure established — rename, never re-create). Chris Knight granted FullAccess+SendAs on accounting@ SharedMailbox. Android enrollment token replaced (Replace, not Revoke). |
| 2026-07-13 | Datto EDR installed on CS-SERVER (closed DC coverage gap since 2026-06-26). REMAINING-WORK-PLAN.md + wiki refreshed. Juan Andrade offboard coord todo `80716a98` created for 2026-07-16 PM. |
| 2026-07-14 | Wiki + remaining-work-plan reviewed end-to-end (recovered session). HIPAA gaps identified: Juan Andrade access overdue, no break-glass accounts, Named Location too loose, no object-access audit logging, BAA inventory incomplete. |
| 2026-07-15 | CARF Technology and System Plan finalized (4-page branded PDF, 8 CARF areas + supplementary). Live verification sweep: EDR/AV active 35 agents incl. CS-SERVER; M365 SPB 45/41/4; DMARC/DKIM/SPF live; VLAN 30 voice 37 clients; MSP360 file backup current. jodi.ramstack DECOMMISSIONED. Synology shared-folder syncs to CS-SERVER confirmed working. WS8 (SharePoint/Teams) + WS9 (ALIS online payments) workstreams added. |
| 2026-07-15 | BEC/vendor-fraud phish (info@syufway.com, fake W-9 "AMYSH Solutions") investigated and remediated. syufway.com + steqm.com blocked in Tenant Allow/Block List. |
| 2026-07-17 | 10 functional/role-based mailboxes converted to shared mailboxes; 6x O365_BUSINESS_PREMIUM + 4x EXCHANGE_S_ESSENTIALS licenses reclaimed. SPB 40 consumed (5 free); O365BP suspended now 23 consumed. |
| 2026-07-17 | NURSESTATION-PC nurse-station kiosk GPO built (WS3 step 3b): Edge SSO via PRT, GPP shortcuts (ALIS/PharmCare/Helpany), AppLocker Packaged App Deny rules for SG-Caregivers, UI restrictions, machine-level printers. ASSISTNURSE-PC pending. |

---

## Backlinks

- [[projects/gururmm]] — RECEPTIONIST-PC + CS-SERVER enrolled (site CascadesTucson); fleet EDR/BD + Home->Pro + printer work driven via GuruRMM
- [[wiki/systems/uos-server]] — UniFi controller hosts Cascades site va6iba3v