claudetools/clients/cascades-tucson/session-logs/2026-06/2026-06-26-howard-home-to-pro-upgrades-continued.md

## User
- **User:** Howard Enos (howard)
- **Machine:** Howard-Home
- **Role:** tech

## Session Summary

Continued the Cascades of Tucson Windows Home -> Pro upgrade workstream from 2026-06-25. Started
with a fleet-aware audit: pulled the GuruRMM agent inventory and identified non-Pro (Windows Home)
machines. Confirmed RMM's `os_name` field is trustworthy for edition (yesterday's three upgrades now
report Pro/Pro for Workstations correctly, so it reads true edition, not the stale "Home" ProductName
string). The remaining Cascades Home boxes were NurseAssist, SALES4-PC, DESKTOP-MD6UQI3, and
CascadesProxess; NURSESTATION-PC (Business), ANN-PC (Enterprise), and CS-SERVER (Server 2019) are
domain-join-capable and were not flagged.

Per Howard's direction, upgraded NurseAssist and DESKTOP-MD6UQI3 (excluding CascadesProxess as an
appliance and SALES4-PC pending a who-pays decision). New requirement this session: send the
logged-on user a reboot warning 2 minutes before the restart. Implemented as `msg * /time:120 "..."`
plus `shutdown /r /t 120 /f /c "..."` (the shutdown countdown also shows a save-your-work message).
Both machines followed the proven flow: silent `changepk.exe /productkey <generic Pro key>` edition
flip (Core -> Professional, no auto-reboot as SYSTEM) -> warned reboot to reconcile registry+licensing
-> `slmgr /ipk <MAK>` + `/ato` -> `/dli` verify. Both activated as Pro for Workstations (VOLUME_MAK,
Licensed). NurseAssist had no active user; DESKTOP-MD6UQI3 had user "Dining Manager" active, so the
2-minute warning mattered there. NurseAssist needed an `/ato` retry; DESKTOP-MD6UQI3 activated first try
(the 0xC004E028 on first /ato is benign "activation already in progress").

Confirmed NurseAssist is a distinct physical machine from Assistnurse-pc (one is Home, the other Pro for
Workstations -- a single box cannot be both), resolving the earlier duplicate concern.

Ran a fleet-wide Home-edition audit at Howard's request: 26 Home installs across many clients, most
likely intentional (non-domain small clients). Flagged AMT-PC (Arizona Medical Transit) on Windows 7
Home Premium as an EOL security risk separate from any Pro/Home upgrade. Howard scoped the rest of the
work back to Cascades only.

Howard reported SALES4-PC was upgraded by the machine's supplier (an outside party that supplied it to
Cascades), so it needs no action and no charge from us. He then asked to upgrade CascadesProxess; the
pre-check confirmed it is the Proxess access-control server (ProxessIQ Server service running, console
user "Unwired", EditionID=Core). Before dispatching changepk, Howard interrupted: CascadesProxess must
be done late at night because it is still actively in use for the access-control hardware install. No
disruptive action was taken on it -- only the read-only pre-check. CascadesProxess upgrade deferred.

## Key Decisions

- Send a 2-minute reboot warning (msg + shutdown /t 120) to the logged-on user before each reboot
  (Howard's new requirement; mid-morning upgrades mean users are active).
- changepk runs silently as SYSTEM and does not disrupt the user, so it is dispatched first; the
  user-facing warning + reboot is the second step.
- Excluded CascadesProxess (appliance) and SALES4-PC (supplier-owned, who-pays pending) per Howard.
- Deferred CascadesProxess to a late-night window because it is in active use for the access-control
  hardware install; will verify ProxessIQ Server restarts after the reboot.
- Treated NurseAssist as a real distinct machine (different edition than Assistnurse-pc proves they are
  separate boxes) -> safe to upgrade.
- For non-Cascades Home machines: informational only; do not upgrade without a reason (domain join).

## Problems Encountered

- Repeated the doubled-single-quote PowerShell registry-path bug AGAIN (day after logging it; cited
  feedback_windows_quote_stripping). Inside a single-quoted bash $SCRIPT, ''HKLM:\...\Windows NT\...''
  collapses and the space in "Windows NT" breaks the read. Logged a second --friction entry noting the
  rule is not sticking; the durable fix is to always use double-quotes for paths inside the bash script
  (or build PS via heredoc), never doubled single-quotes.
- DESKTOP-MD6UQI3 was unresponsive to even trivial commands at session start (just came online, likely
  thrashing) -- commands sat "running" for 80+ seconds. Deferred it, proceeded with NurseAssist, then it
  recovered on its own a few minutes later and upgraded cleanly.
- Both NurseAssist and DESKTOP-MD6UQI3 briefly dropped offline right after changepk completed, so the
  warning+reboot command queued as "pending" and fired automatically on reconnect -- still correct, just
  required waiting for the reconnect before verifying.
- NurseAssist /ato first attempt left License Status: Notification; retry activated successfully (same
  transient pattern as MEMRECEPT yesterday).

## Configuration Changes

- Appended: `errorlog.md` -- second bash/PowerShell quoting --friction entry (repeat).
- No repo doc edits this session (REMAINING-WORK-PLAN.md / billing memory updates from 2026-06-25 still
  current; SALES4-PC supplier-upgrade and CascadesProxess deferral noted here -- update the plan/memory
  next session when CascadesProxess is done).

## Credentials & Secrets

- ACG Windows Pro (for Workstations) MAK: vault `infrastructure/windows-pro-mak.sops.yaml`, field
  `credentials.product_key`. Consumed 2 more counts this session (NurseAssist, DESKTOP-MD6UQI3). No new
  secrets. Generic public Pro key (not secret): VK7JG-NPHTM-C97JM-9MPGT-3V66T.

## Infrastructure & Servers

- GuruRMM: http://172.16.3.30:3001. Cascades agent IDs used -- NurseAssist
  fc88f14b-06eb-47ac-b9e6-971c44d700ba, DESKTOP-MD6UQI3 99d7c8a7-8efb-4416-b9df-da22e0797aa0,
  CascadesProxess f41f02a8-6e80-4f8c-a427-0436decc3147 (deferred).
- CascadesProxess: Proxess access-control server; service "ProxessIQ Server"; console user "Unwired";
  reboot briefly interrupts door-access management -- do late at night.

## Commands & Outputs

- Edition flip (as SYSTEM, no auto-reboot): `changepk.exe /productkey VK7JG-NPHTM-C97JM-9MPGT-3V66T`
  -> Core -> Professional, exit 0.
- 2-min warning + reboot: `msg * /time:120 "..."` then `shutdown /r /t 120 /f /c "..."`.
- Activate: `slmgr /ipk <MAK>` -> `/ato` (retry if License Status stays Notification / 0x8004FE92) -> `/dli`.
- Result both boxes: "Windows(R), ProfessionalWorkstation edition ... VOLUME_MAK ... License Status: Licensed".
- Trust `EditionID` (and RMM os_name) over `ProductName` for edition.

## Pending / Incomplete Tasks

- CascadesProxess Home -> Pro upgrade: deferred to a late-night window (in use for access-control install).
  Flow ready; verify ProxessIQ Server restarts post-reboot. Will be +1 MAK count / $99 unless it
  self-activates via digital entitlement.
- Billing: NurseAssist + DESKTOP-MD6UQI3 = 2 x $99 = $198 to Cascades (not yet invoiced this session).
  Reuse Syncro product "Windows Pro Upgrade" (id 23571919); machine-named lines; optional labor.
- SALES4-PC: upgraded by supplier -- no ACG action, no charge.
- Then domain-join the now-Pro Cascades boxes per REMAINING-WORK-PLAN.md.

## Reference Information

- Prior session log: clients/cascades-tucson/session-logs/2026-06/2026-06-25-howard-home-to-pro-upgrades.md
- Yesterday's billing: Syncro ticket #32466, invoice #1650806091; product "Windows Pro Upgrade" id 23571919.
- Generic Pro key: VK7JG-NPHTM-C97JM-9MPGT-3V66T (edition flip only, does not activate).
- Cascades non-Pro remaining: CascadesProxess (deferred). SALES4-PC done by supplier.

## Update: 18:58 PT (2026-06-27) — scratch-file cleanup

Two empty scratch files (`.hours_calc.sh`, `.lab.txt`) had been swept into a repo-root commit
(ab0f0e0) by the catch-all `git add -A` during an earlier sync. They were removed in commit
8633d59 (2026-06-26 17:20) and are confirmed absent from the HEAD tree. No functional impact;
noted as a reminder to keep scratch in the scratchpad dir, not the repo root.