azcomputerguru/claudetools
1
0
Fork 0
Code Issues 58 Pull Requests Actions Packages Projects Releases Wiki Activity
Files
main
claudetools/clients/cascades-tucson/session-logs/2026-07/2026-07-20-howard-domain-join-batch-and-offboard.md
Howard Enos 03e17829c6 sync: auto-sync from HOWARD-HOME at 2026-07-20 20:42:54 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-20 20:42:54
2026-07-20 20:43:27 -07:00

7.5 KiB
Raw Permalink Blame History

2026-07-20 — Cascades Domain Join Batch + Juan Andrade Offboard Verification

User

  • User: Howard Enos (howard)
  • Machine: Howard-Home
  • Role: tech

Session Summary

Closed out the Juan Andrade offboard (tracker issue #28) by verifying all three offboard steps via Graph API against the correct Cascades tenant (cascadestucson.com, tenant ID 207fa277-e9d8-4eb7-ada1-1064d2221498). Account disabled, all licenses reclaimed, all group memberships removed. Issue closed with verification comment.

Began working through the domain-join machine list from issue #24 (REMAINING-WORK-PLAN.md WS1+2). Howard joined DESKTOP-TRCIEJA (Lupe Sanchez, room 426), ANN-PC (Christina), and NurseAssist (Veronica Feller) to the domain onsite. Also added printer ECOSYS MA2100CWfx to CSCNet in room 426. DESKTOP-TRCIEJA was previously marked EOL/replace in the work plan; Howard joined it instead.

For NurseAssist (Veronica Feller): identified her AD account (Veronica.Feller, enabled) and M365 account (veronica.feller@cascadestucson.com). Reset her AD password to 1369Cascades!! on CS-SERVER via RMM. Set her M365 password to match. OneDrive was blocking local login on NurseAssist, so we unlinked OneDrive remotely via RMM (removed Business1 + Personal account keys and auto-start from registry). Howard is downloading her OneDrive data from the cloud to the machine before proceeding with ProfWiz.

The hive-cleanup-shellfolders.ps1 script was staged on NurseAssist at C:\ProfileBackups\ but could not run because Veronica's profile was still loaded (user logged in). The established Cascades runbook order is: hive-cleanup (before ProfWiz) -> ProfWiz -> prep-profile-for-redirection.ps1 (after ProfWiz, before first domain login). This must wait until Veronica is logged off.

Veronica is not in SG-Caregivers but is subject to the MFA-for-all CA policy. Generated a TAP (WF3P9%*+, 60 min, multi-use) to bypass MFA for the OneDrive login. Howard raised the question of location-based MFA bypass (on-network = no MFA) — Cascades already has Named Locations configured (72.211.21.217/32 + 184.191.143.62/32) and this can be added as a CA condition on the MFA-for-all policy. Deferred for now.

Key Decisions

  • DESKTOP-TRCIEJA was previously marked EOL/replace; Howard domain-joined it instead (plan change).
  • Veronica Feller's OneDrive unlinked remotely via RMM registry edits rather than fighting the local login/MFA loop.
  • Password set to 1369Cascades!! for both AD and M365 (manual sync since Entra Connect is still in staging).
  • Location-based MFA bypass (on-network skip MFA) identified as a future CA policy change — deferred to a separate session.
  • Confirmed the correct Cascades tenant domain is cascadestucson.com (not cascadesoftucson.onmicrosoft.com) — the latter is a different tenant that has no app consent.

Problems Encountered

  • Initial M365 password reset targeted the wrong user ID (508d7b35 = Juan Andrade instead of a2188357 = Veronica Feller). Root cause: reused the user ID from the earlier Juan Andrade offboard verification without re-resolving. Fixed by looking up Veronica's actual Graph user ID and re-issuing the PATCH.
  • The remediation-tool get-token.sh cert-based auth broke mid-session (exit 3, cert_private_key_pem_b64 did not decode to a valid PEM). Worked around by using client_secret auth directly via curl against the correct vault path (D:/vault/msp-tools/computerguru-security-investigator.sops.yaml). The vault files for the app suite are in msp-tools/, not services/.
  • AD PowerShell query (Get-ADUser) on CS-SERVER timed out at 30s. Switched to dsquery/dsget which completed in seconds.
  • hive-cleanup script too large for RMM inline dispatch (12KB encoded > 6KB limit). Staged via base64 file write instead.
  • hive-cleanup could not run because Veronica's NTUSER.DAT was locked (user still logged in).

Configuration Changes

  • NurseAssist registry: removed HKCU\Software\Microsoft\OneDrive\Accounts\Business1, Personal, and OneDrive Run key (via RMM, SID S-1-5-21-1777292141-3886650548-1988923861-1002)
  • Staged hive-cleanup-shellfolders.ps1 at C:\ProfileBackups\hive-cleanup-shellfolders.ps1 on NurseAssist
  • AD password reset for Veronica.Feller on CS-SERVER
  • M365 password reset for veronica.feller@cascadestucson.com
  • TAP created for Veronica Feller (60 min, multi-use)

Credentials & Secrets

  • Veronica Feller AD password: 1369Cascades!! (set via Set-ADAccountPassword on CS-SERVER)
  • Veronica Feller M365 password: 1369Cascades!! (set via Graph PATCH, user ID a2188357-3519-4399-b5ad-62b9f1ae924d)
  • Veronica Feller TAP: WF3P9%*+ (created 2026-07-20T18:45:38Z, 60 min lifetime, multi-use) — likely expired by session end

Infrastructure & Servers

  • Cascades tenant: cascadestucson.com, tenant ID 207fa277-e9d8-4eb7-ada1-1064d2221498
  • CS-SERVER agent ID: resolved live each time (do not cache)
  • NurseAssist agent ID: fc88f14b-06eb-47ac-b9e6-971c44d700ba (verify before reuse — UUIDs change on re-enroll)
  • Veronica Feller AD SID: S-1-5-21-1777292141-3886650548-1988923861-1002 (local profile on NurseAssist)
  • Veronica Feller Graph user ID: a2188357-3519-4399-b5ad-62b9f1ae924d
  • Juan Andrade Graph user ID: 508d7b35-f3ed-467e-880e-7b0960260299 (disabled, offboarded)
  • Printer added: ECOSYS MA2100CWfx on CSCNet, room 426

Commands & Outputs

  • dsquery user -name "Veronica*" | dsget user -samid -display -disabled on CS-SERVER -> confirmed Veronica.Feller, enabled
  • Get-ChildItem C:\Users -Directory on NurseAssist -> Localadmin, Public, Veronica
  • Graph GET /users filter for Veronica -> veronica.feller@cascadestucson.com, accountEnabled: true
  • Graph GET /users/a2188357.../memberOf -> only SG-SSPR-Eligible (not in SG-Caregivers, subject to MFA-for-all)
  • Graph POST .../temporaryAccessPassMethods -> TAP WF3P9%*+ created successfully

Pending / Incomplete Tasks

  • NurseAssist (Veronica Feller): OneDrive data downloading from cloud. When done: log Veronica off, run hive-cleanup-shellfolders.ps1 -ProfilePath 'C:\Users\Veronica' (already staged at C:\ProfileBackups\), then ProfWiz to cascades\Veronica.Feller, then prep-profile-for-redirection.ps1 on the migrated profile, then first domain login.
  • Remaining domain-join machines (~7): DESKTOP-LPOPV30 (Karen, READY), MAINTENANCE-PC (Bruce, READY), ASSISTMAN-PC (Meredith, reboot), MDIRECTOR-PC (Shelby, reboot), MEMRECEPT-PC (memfrtdesk, reboot), LAPTOP-8P7HDSEI (KFM unlink), CHEF-PC (reinstall first).
  • DESKTOP-TRCIEJA + ANN-PC: joined but may need reboot + post-join verify + prep-profile scripts.
  • Location-based MFA bypass: CA policy change to skip MFA on-network using existing Named Locations. Deferred.
  • Entra Connect: still in staging. Moving to production would sync AD/M365 passwords automatically.
  • Tracker issue #24: open, updated with today's progress (3 machines joined).
  • Vault: store Veronica.Feller password in vault (not done this session).

Reference Information

  • Tracker issue #28 (Juan Andrade offboard): CLOSED 2026-07-20
  • Tracker issue #24 (domain-join remaining machines): OPEN, 2 comments added today
  • REMAINING-WORK-PLAN.md: clients/cascades-tucson/docs/REMAINING-WORK-PLAN.md
  • Migration scripts: clients/cascades-tucson/docs/migration/scripts/phase3-*.ps1
  • Hive cleanup: clients/cascades-tucson/scripts/hive-cleanup-shellfolders.ps1
  • Prep profile: clients/cascades-tucson/scripts/prep-profile-for-redirection.ps1
  • Cascades Named Locations (trusted IPs): 72.211.21.217/32, 184.191.143.62/32
Reference in New Issue View Git Blame Copy Permalink