# Kittle — Joshua Sutherland AD onboarding + GuruRMM site setup **Date:** 2026-05-08 **Client:** Kittle Design & Construction LLC (Syncro 32460233, Tenant `kittle.lan`) ## User - **User:** Howard Enos (howard) - **Machine:** Howard-Home + onsite at Kittle 11:30 AM PT - **Role:** tech ## Session Summary Created Active Directory user `joshua.sutherland` at Kittle Design & Construction's domain (`kittle.lan`) for new employee Joshua Sutherland, who is taking over Wrex's existing workstation. Coordinated the onsite via Syncro ticket #32263 with an 11:30 AM PT scheduled appointment. Vaulted the Kittle GuruRMM site enrollment key (the Kittle GuruRMM client + site were created today) to enable agent deployment to Kittle endpoints going forward. Documented the working ScreenConnect command pattern (`#!ps` prefix required for PowerShell context) after Howard hit cmd-vs-PowerShell parsing errors. ## Key Decisions - Joshua's email field uses the existing M365 domain (`joshua@kittlearizona.com`) — Kittle's M365 cloud identity layer is on `kittlearizona.com` while their on-prem AD is `kittle.lan`. Email field on the AD user reflects M365, not the on-prem domain. - Initial AD password set to `Sutherland2026!`, then reset onsite to `Kota2020!` per Howard's direction. Force-change-at-logon enabled. - Local admin rights on Wrex's PC handled separately — `Add-LocalGroupMember` must run on Wrex's actual workstation, not on the DC (which doesn't have a local Administrators group; that command targets the local SAM, not the domain). - Kittle is now a GuruRMM client. Howard installing agents on SERVER2021 + Wrex's PC during the onsite to begin RMM coverage. - Saved feedback memory: Syncro appointment owner must be explicitly confirmed when creating tickets — don't auto-default to ticket's assigned tech, don't add additional attendees without explicit user direction. ## Problems Encountered - ScreenConnect command runner defaulted to `cmd` context, causing PowerShell syntax to fail. Resolved by prefixing scripts with `#!ps` to force PowerShell execution. - Initial AD user creation had `-AccountPassword $Kota2020!` which PowerShell parsed as variable `$Kota2020` (empty) followed by `!` — `!` cannot be part of a variable name. Resolved by setting `$Password = ConvertTo-SecureString "Kota2020!" -AsPlainText -Force` first, then referencing `$Password`. - `Add-LocalGroupMember` on the DC failed with "Group Administrators was not found." — DCs use Builtin\Administrators (domain-wide), not a local SAM group. Resolved by deferring the local-admin step to when Howard is at Wrex's actual workstation. ## Configuration Changes ### Active Directory user created (kittle.lan domain) ``` Name: Joshua Sutherland SamAccountName: joshua.sutherland UserPrincipalName: joshua.sutherland@kittle.lan EmailAddress: joshua@kittlearizona.com Enabled: true ChangePasswordAtLogon: true DistinguishedName: CN=Joshua Sutherland,CN=Users,DC=kittle,DC=lan Description: Created 2026-05-08 by Howard for use on Wrex's machine ``` Password initially set to `Sutherland2026!`, then reset to `Kota2020!` per Howard's onsite preference (`Set-ADAccountPassword -Identity joshua.sutherland -NewPassword $Pwd -Reset`). ### Kittle GuruRMM site (created today, agents pending) ``` Client: Kittle Design & Construction LLC (id d8b08837-78e0-441e-b824-e0abbf0254ed, code KITTLE) Site: Main Office (id 851376d1-33be-46ee-9e48-be44767e4a0a, code SILVER-HAWK-7639) Address: 2539 N Balboa Ave #125, Tucson AZ 85705 API key: grmm_JA9bA45d7IGOf0bEifZnH9JjIBPOMZxq ``` Vaulted at `clients/kittle/gururmm-site-main.sops.yaml` (vault commit `6eb3414`). ### Syncro ticket created - **#32263** — "Joshua - set up account on Wrex's computer" — Onsite, Scheduled, Howard Enos - **Appointment** id `5585387825` — 2026-05-08 11:30 AM - 1:00 PM PT - Customer: Kittle Design & Construction LLC, contact_id null per global rule ### Memory updated - New: `.claude/memory/feedback_syncro_appointment_owner.md` — confirm appointment owner explicitly when creating tickets, don't add attendees silently. ## Credentials & Secrets ### Joshua Sutherland AD account (kittle.lan) - Username: `joshua.sutherland` - UPN: `joshua.sutherland@kittle.lan` - Email: `joshua@kittlearizona.com` - **Password (current, after onsite reset): `Kota2020!`** - Force change at next logon: yes ### Kittle GuruRMM Main Office site enrollment key (NEW today) - API key: `grmm_JA9bA45d7IGOf0bEifZnH9JjIBPOMZxq` - Vault: `clients/kittle/gururmm-site-main.sops.yaml` ### Kittle SERVER2021 admin (FROM Syncro customer notes — needs vault migration) - Username: `administrator` - Password: `AXman2Z` - **Source: Syncro customer notes (plaintext exposure)** — flag for vault migration. Same pattern as Horseshoe Management. ### Kittle M365 Outlook accounts (FROM Syncro customer notes — also flagged) - `kittletucson@outlook.com` / `tick8800` - `kittletucson2@outlook.com` / `Tick8800` ## Infrastructure & Servers - **Kittle domain:** `kittle.lan` (NetBIOS: `KITTLE`) - **DC + file server:** `SERVER2021` (Syncro asset id `10584015`) - **M365 tenant:** `kittlearizona.com` - **Other Syncro asset:** `FRONTDESK` (id `11122225`) - **Wrex's workstation:** hostname unknown — not in Syncro asset inventory. Discovery pending onsite. - **Office:** 2539 N Balboa Ave #125, Tucson AZ 85705 - **Primary contact:** Kimberly Ross, `admin@kittlearizona.com` ## Commands & Outputs ### Working AD user creation script (run on DC via ScreenConnect with `#!ps` prefix) ```powershell #!ps $Domain = Get-ADDomain Write-Host "Domain: $($Domain.DNSRoot) ($($Domain.NetBIOSName))" $Password = ConvertTo-SecureString "Sutherland2026!" -AsPlainText -Force $UPN = "joshua.sutherland@$($Domain.DNSRoot)" $Path = "CN=Users,$($Domain.DistinguishedName)" New-ADUser ` -Name "Joshua Sutherland" ` -GivenName "Joshua" -Surname "Sutherland" ` -SamAccountName "joshua.sutherland" ` -UserPrincipalName $UPN ` -EmailAddress "joshua@kittlearizona.com" ` -AccountPassword $Password ` -Enabled $true ` -ChangePasswordAtLogon $true ` -Path $Path ` -Description "Created 2026-05-08 by Howard for use on Wrex's machine" Get-ADUser -Identity joshua.sutherland -Properties * | Select-Object SamAccountName, UserPrincipalName, EmailAddress, Enabled, DistinguishedName ``` ### Password reset (run on DC, ScreenConnect `#!ps`) ```powershell #!ps $NewPassword = ConvertTo-SecureString "Kota2020!" -AsPlainText -Force Set-ADAccountPassword -Identity "joshua.sutherland" -NewPassword $NewPassword -Reset Set-ADUser -Identity "joshua.sutherland" -ChangePasswordAtLogon $true Get-ADUser -Identity "joshua.sutherland" -Properties * | Select-Object SamAccountName, Enabled, PasswordLastSet, ChangePasswordAtLogon ``` ### Local admin add (run on Wrex's PC, NOT the DC) ```powershell #!ps $DomainNetBIOS = "KITTLE" $User = "$DomainNetBIOS\joshua.sutherland" Add-LocalGroupMember -Group "Administrators" -Member $User Get-LocalGroupMember -Group "Administrators" | Format-Table Name, ObjectClass, PrincipalSource ``` ### GuruRMM agent deployment (working command) ```powershell #!ps $u='https://rmm-api.azcomputerguru.com/downloads/gururmm-agent-windows-amd64-latest.exe'; $d='C:\Windows\Temp\gururmm-agent.exe'; Invoke-WebRequest $u -UseBasicParsing -OutFile $d; & $d install --server-url 'wss://rmm-api.azcomputerguru.com/ws' --api-key 'grmm_JA9bA45d7IGOf0bEifZnH9JjIBPOMZxq' ``` The `#!ps` prefix is required when running via ScreenConnect Commands tab — without it, ScreenConnect runs in cmd context and `Invoke-WebRequest` fails. URL itself returns HTTP 200 (verified, 3.95 MB exe). ## Pending / Incomplete Tasks ### Onsite (in progress 11:30 AM PT) - [ ] Add `KITTLE\joshua.sutherland` to local Administrators group on Wrex's workstation (script ready — run on Wrex's PC) - [ ] Install GuruRMM agent on SERVER2021 (PowerShell command ready) - [ ] Install GuruRMM agent on Wrex's workstation (same command) - [ ] Optionally: roll out GuruRMM agent to FRONTDESK and any other Kittle endpoints - [ ] Bill the Syncro ticket (#32263) at end of onsite ### Vault hygiene - [ ] Migrate Kittle SERVER2021 admin password (`administrator / AXman2Z`) from Syncro plaintext customer notes to SOPS vault (`clients/kittle/server2021.sops.yaml`) - [ ] Migrate the two Kittle Outlook accounts (`kittletucson@outlook.com` / `kittletucson2@outlook.com`) from Syncro notes to vault - [ ] Strip those plaintext credentials from Syncro after vaulting (same exposure pattern as Horseshoe Management — flagged on 2026-05-06) ### Joshua workstation tasks (onsite) - [ ] Confirm Joshua has signed in successfully on Wrex's PC and changed his password at first logon - [ ] Verify joshua.sutherland is a local admin on Wrex's PC (`whoami /priv`, or test elevated UAC prompt) - [ ] Email setup if needed (M365 mailbox provisioning is separate from AD creation — Joshua may need a Kittle M365 license assigned) ## Reference Information ### Vault paths - `clients/kittle/gururmm-site-main.sops.yaml` — GuruRMM site enrollment key (NEW today, vault commit `6eb3414`) - `clients/kittle/m365-michael-sanchez.sops.yaml` — existing M365 entry for Michael Sanchez ### Syncro - Customer ID: `32460233` - Customer name: Kittle Design & Construction LLC - Ticket: **#32263** (today's onsite) - Direct link: https://computerguru.syncromsp.com/tickets/110024484 ### GuruRMM - API: `https://rmm-api.azcomputerguru.com` - Dashboard: `https://rmm.azcomputerguru.com` - Kittle Main Office: site code `SILVER-HAWK-7639`, id `851376d1-33be-46ee-9e48-be44767e4a0a` ### Memory - `.claude/memory/feedback_syncro_appointment_owner.md` — new today ### Related work - Cascades-of-Tucson session log for the same day: `clients/cascades-tucson/session-logs/2026-05-08-howard-cascades-sdm-token-success-and-alis-sso.md` --- **Onsite scheduled:** 2026-05-08 11:30 AM - 1:00 PM PT (Syncro #32263, appointment id `5585387825`) **Resume:** Confirm onsite tasks (local admin, GuruRMM agents) completed; bill the ticket; vault migration follow-up.