# The Prairie Schooner — Cutover Runbook

## AS-BUILT 2026-07-15 — NETWORK SWAP DONE [OK]

Howard onsite 2026-07-15: SonicWall pulled, UDM Pro in as gateway (.1).
Everything verified working onsite: workstations renewed onto same IPs, internet up,
phones have dial tone/registration, QB opened against \\tps-server (old server) — the
network move broke nothing.

MYSTERY SOLVED onsite: the device previously inventoried as a "USG gateway" (.136,
role unconfirmed) is actually a **UniFi USW-Lite-16-PoE switch** — there was never a
separate USG. The switch was KEPT: adopted into the UDM Pro's console, uplinked to the
Pro's LAN port; it PoE-powers the 3x Yealink phones. Chain:
Cox modem -> UDM Pro (gw .1) -> USW-Lite-16-PoE -> endpoints/phones/NVR/servers.
Workstation fixed IPs set in UniFi; Ad Block / DNS Shield / IDS-IPS confirmed OFF.

Rollback window closed — SonicWall out of service.

---

REVISED 2026-07-14 evening (Howard's call): **decouple the two migrations.**
Tomorrow morning = NETWORK SWAP ONLY (SonicWall/USG out, UDM Pro in). Nothing else
changes — Q: keeps pointing at \\tps-server, QB keeps running off the OLD server.
If QB works after the cable move, the network is proven. The QB/file-server move to
TPS-SVR happens LATER as its own step with its own test.
Companion file: `udm-dhcp-plan.md` (LAN/DHCP/reservations detail).

## State as of tonight (all verified)

- QuickBooks CLOSED everywhere: MEL-PC killed clean; TINA + JAYMI had kernel-zombie
  QBW (unkillable, hung SMB handle) -> users logged off, both machines rebooted,
  QBCFMonitorService stopped on all 3. Zero open handles on the server's Quickbooks share.
- Data ALREADY STAGED on TPS-SVR (held in reserve for the later server move):
  robocopy delta completed 18:40 with FAILED=0 — Quickbooks 144.2 GB / Deployment 22.4 GB
  in C:\Share\*. Company file: schoonerQB2025.QBW (2.9 GB) + consistent ND/DSN/TLG set.
- Q: -> \\tps-server\quickbooks via GPP in Default Domain Policy — **NOT touched** (stays
  on the old server for tomorrow's test).
- Client-visible network today: gateway .1, DHCP from SonicWall, DNS handed = .125.

## TONIGHT — UDM Pro config only (UniFi app, Pro LAN ISOLATED)

Values in `udm-dhcp-plan.md`. Summary:
- LAN 192.168.1.1/24 (Pro takes the SonicWall's IP), domain tps.local
- DHCP pool 192.168.1.100–199
- DNS handed to clients: **.125, .135** — SAME primary as today. Zero observable change.
  (Flip to .135-first later, after the network is proven — that control is the point
  of this swap.)
- 7 fixed-IP reservations: 3 PCs, 3 Yealink phones, Dahua NVR (MACs in the plan file)
- Content filtering / DNS Shield / ad-block OFF
- WAN already live on the Cox modem (public DHCP)

## TOMORROW MORNING — cables + test

1. Pull SonicWall (.1) and USG; patch the office switch into the Pro's LAN port.
2. On one workstation: `ipconfig /renew` -> expect SAME IP, gw .1, DNS .125/.135,
   internet up.
3. Log on as a user (Howard has passwords): Q: maps to \\tps-server\Quickbooks
   (unchanged), open the company file — QB works exactly as yesterday.
   -> proves the network move broke nothing.
4. Phones: dial tone / registration on all 3 Yealinks. NVR: local UI + remote view.
5. Run `bash clients/prairie-schooner/verify-cutover.sh` from ClaudeTools for the
   scripted pass/fail readout.

**Rollback:** plug the SonicWall back in — nothing else was changed.

## LATER (separate visit) — QB/file-server move to TPS-SVR

Data is already staged; refresh + cut when ready:
1. QB closed everywhere -> re-run the robocopy delta (seconds).
2. On TPS-SVR: create shares
   `New-SmbShare -Name Quickbooks -Path C:\Share\Quickbooks -FullAccess Everyone`
   `New-SmbShare -Name Deployment -Path C:\Share\Deployment -FullAccess "NT AUTHORITY\Authenticated Users" -ReadAccess Everyone`
3. Install QB Database Server Manager (match their QB Desktop year) -> scan C:\Share\Quickbooks.
4. GPMC: Default Domain Policy -> User Prefs -> Drive Maps -> Q: -> \\tps-svr\Quickbooks.
5. Relogon test on one PC, open company file multi-user.
6. Flip Pro DHCP DNS order to .135, .125.

## Then the AD retirement (unchanged)

FSMO transfer, CA migration (test Backup-CARoleService key export first), QB checks,
demote TPS-SERVER + power off, real backup. Old server stays ON until this completes —
it is still a DC, DNS (.125), CA, and (for now) the QB host.