azcomputerguru/claudetools
1
0
Fork 0
Code Issues 58 Pull Requests Actions Packages Projects Releases Wiki Activity
Files
main
claudetools/clients/instrumental-music-center/session-logs/2026-07/2026-07-08-howard-imc-edr-rollout-sql-caps.md
Howard Enos e765c9115d sync: auto-sync from HOWARD-HOME at 2026-07-08 18:04:09 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-08 18:04:09
2026-07-08 18:04:40 -07:00

11 KiB
Raw Permalink Blame History

IMC — fleet reconciliation, Datto EDR rollout, Bitdefender removal, SQL memory caps applied

User

  • User: Howard Enos (howard)
  • Machine: Howard-Home
  • Role: tech

Session Summary

Reconciled the Instrumental Music Center (IMC) fleet across GuruRMM, ScreenConnect, Datto EDR, MSP360, and Syncro, then acted on the gaps. Started from a request to find IMC machines in GuruRMM and retire (in Syncro) any machine not in RMM. Direction evolved: deploy GuruRMM to the IMC ScreenConnect session group (default site Main, MOO only when clearly MOO by public IP), and retire only Syncro assets offline > 40 days.

Enrolled DESKTOP-NFU17AJ into GuruRMM/Main via the server's site-preconfigured installer one-liner pushed through ScreenConnect send-command (verified: RMM agents 17 -> 18). Queued the same install to four offline SC machines (Manda's DESKTOP-KRHQ5TS, Sara Sherer's SNAPPERLANDHOME, LAPTOP-PNVA9G51, LESLIE2019LAPTO) — they run on reconnect. Determined Syncro "retire" = "Archive" which is UI-only (no REST API); handed the user the 12-asset archive list rather than deleting.

Established that IMC's AV is Datto AV/EDR (16 agents), not Bitdefender (1 stray, REPAIRADMIN). Billing check: recurring schedule #365662 ($1,590.02/mo) bills 20 AV seats but no backup line, while MSP360 shows IMC1 actively backing up (Files + SQL daily; Images plan stale since 2024-10) — a backup revenue gap (user handling backups in a separate plan). Deployed Datto EDR to the unprotected live machines: BigMom + DESKTOP-NFU17AJ via /rmm (installed, verified, Datto org 16 -> 18), queued IMC-LUIS, IMC-M-EdServices1, and REPAIRADMIN via SC. Began the REPAIRADMIN Bitdefender -> EDR swap (EDR queued; BD removal pending EDR verify, since BD has no uninstall API and REPAIRADMIN is offline).

Verified the outstanding "max server memory" caps (Mike-approved 2026-05-07) were never applied — all three IMC1 instances were at the uncapped default (2147483647 MB). Applied them: WID 512 MB as SYSTEM; SQLEXPRESS 12288 MB + AIMSQL 256 MB required IMC\guru (SQL sysadmin) via in- process LogonUser + RunImpersonated, because the RMM agent's NT AUTHORITY\SYSTEM is not sysadmin on those two instances. All three verified. Fixed ps-encoded.sh (added a Python fallback for the UTF-16LE encode since this box lacks iconv.exe). Updated the IMC wiki throughout and committed/pushed each change.

Key Decisions

  • Site placement by public IP, not guesswork: Main = 72.194.57.2, MOO = 68.107.177.170, everything else -> Main (per user rule). MOO machines were already enrolled, so all new enrollments went to Main.
  • Retire = Archive = UI-only: confirmed against Syncro docs; refused to use DELETE /customer_assets (destructive, loses history/ticket links). Handed the user the list.
  • Retirement threshold = offline > 40 days (user), measured by ScreenConnect GuestInfoUpdateTime because Syncro updated_at is a bulk-touch (unreliable).
  • AV-swap ordering: install + verify Datto EDR BEFORE removing Bitdefender — never leave an unprotected window.
  • SQL caps via IMC\guru impersonation over RMM (user-approved credential path): fastest, but the DA password transits one RMM command (base64) — flagged for optional rotation.
  • In-process token impersonation for the SQL apply (not sqlcmd/Start-Process) — captures output cleanly, no external tool dependency.
  • ps-encoded.sh Python fallback rather than sourcing an iconv.exe binary — portable, fixes the whole fleet, uses the already-present Python.

Problems Encountered

  • SC --company filter returned empty — CP1 is the full tagged value IMC - Instrumental Music Center, not Instrumental Music Center; and CP values live under .CustomProperties.CustomPropertyN. Resolved by enumerating via raw CustomProperty1 = '...'.
  • jq parse errors on rmm-search.sh --json — caused by my 2>&1 merging the stderr [OK] Authenticated banner into stdout. Fix: 2>/dev/null when piping --json to jq.
  • ps-encoded.sh failed: iconv: command not found — Git-for-Windows ships the iconv DLL (msys-iconv-2.dll) but not iconv.exe, and has no pacman. Patched the script with a Python fallback; verified byte-exact round-trip.
  • SQL RECONFIGURE permission denied on SQLEXPRESS + AIMSQL — RMM agent runs as NT AUTHORITY\SYSTEM, which is not sysadmin there (reduced to IMC\guru + AIM service acct on 2026-04-12). Resolved by impersonating IMC\guru in-process.
  • Bitdefender has no uninstall API (GravityZone console/local-tool only), and REPAIRADMIN has anti-tampering ON — so removal will be BD's local uninstall tool via /rmm (blank uninstall password per policy), pending the box coming online.

Configuration Changes

  • IMC1 SQL max server memory (MB): SQLEXPRESS 2147483647 -> 12288; AIMSQL 2147483647 -> 256; MSSQL$MICROSOFT##WID 2147483647 -> 512. Reversible; no service restart.
  • GuruRMM: DESKTOP-NFU17AJ enrolled (Instrumental Music Center / Main). 4 more queued via SC.
  • Datto EDR: BigMom + DESKTOP-NFU17AJ agents installed (org Instrumental Music Center). IMC-LUIS, IMC-M-EdServices1, REPAIRADMIN queued via SC.
  • .claude/scripts/ps-encoded.sh — added Python fallback in encode_b64() (commit pushed).
  • .claude/commands/syncro.md — added "Customer Assets (retire/archive = UI-only)" section.
  • .claude/skills/screenconnect/SKILL.md — added verified GuruRMM/EDR deploy-via-send-command recipe + gotchas.
  • .claude/skills/datto-edr/SKILL.md — added SC-queue deploy for offline endpoints + AV-swap ordering note.
  • wiki/clients/instrumental-music-center.md — new Security/AV, Billing, fleet-recon sections; SQL caps marked APPLIED with a WATCH/probable-cause flag through ~2026-07-11; Backups + Active Work + History updated.
  • errorlog.md — logged the retire=archive-not-delete correction and the iconv friction.

Credentials & Secrets

  • IMC\guru (Domain Admin + SQL sysadmin on SQLEXPRESS/AIMSQL): password in vault clients/imc/imc1.sops.yaml field credentials.domain.password. Used this session via token impersonation to apply the SQL caps. It transited one GuruRMM command (base64 in command_text, cmd 378fffe7-a46b-4617-ae6c-38c8d34229b1) — recoverable in the RMM DB; rotate if zero residual exposure is required. Fallback password field also present: credentials.password-fallback.
  • Datto EDR enrollment RegKey instrume01 — IMC scan-target group "IMC - Speedway (Loc1)". Not currently vaulted (retrievable anytime via edr.py deploy-cmd --group <id>); vault it if we want it captured.
  • No new credentials created this session.

Infrastructure & Servers

  • IMC1 — 192.168.0.2, Windows Server 2016, 32 GB RAM (32560 MB reported). GuruRMM agent id 88cbf7c0-abfa-4f12-846c-96274f718bff. SQL instances: SQLEXPRESS (PROD, Standard, TCP 61151), AIMSQL (orphan, Express, 63116), MICROSOFT##WID.
  • Public IPs: Main/Speedway = 72.194.57.2; MOO = 68.107.177.170.
  • GuruRMM: server http://172.16.3.30:3001; install page base https://rmm.azcomputerguru.com; Main site code INNER-BRIDGE-8354 (site id 2c5b65ad-2d5e-47b3-b12b-632e35e08ff6); MOO SILVER-BRIDGE-5118 (f9e4a897-708b-43c5-ab7d-a8b05decdc3e). Client Instrumental Music Center 213b62a8-30f4-41dd-9bb3-549341104416.
  • Datto EDR: tenant azcomp4587.infocyte.com; org Instrumental Music Center 00b6b6e9-35ea-47cd-9413-088776434514; scan-target group IMC - Speedway (Loc1) c56026f0-b174-4f84-9dc4-cf8cffa49b74; RegKey instrume01.
  • Bitdefender: IMC company 5e77afc47357486d522f1a44 (only endpoint REPAIRADMIN 6a4d1bbe0a5a3122524a67ec, policy GPS Default 5c42940b6e16d61a0c8b4568, blank uninstall pw).
  • Syncro: customer 7088508; recurring schedule 365662 ($1,590.02/mo).
  • MSP360: company "Instrumental Music"; IMC1 plans — Files (daily, OK), SQL (daily, warnings), Images (stale 2024-10-24).

Commands & Outputs

  • SQL verify (before): all three instances max_server_memory_MB=2147483647 (uncapped default).
  • SQL apply (after): SQLEXPRESS: 12288 (verify=12288) as IMC\Guru, AIMSQL: 256 (verify=256) as IMC\Guru, WID: 512 (verify=512).
  • First SQL apply attempt (as SYSTEM) failed on SQLEXPRESS/AIMSQL: "User does not have permission to run the RECONFIGURE statement." -> switched to IMC\guru impersonation.
  • Datto EDR install (BigMom, NFU17AJ): exit 0, "Installed RTS agent to C:\Program Files\infocyte\agent\agent.exe"; Datto org agents 16 -> 18.
  • ps-encoded.sh fixed: encode/decode round-trip byte-exact (Python fallback).

Pending / Incomplete Tasks

  • REPAIRADMIN Bitdefender -> Datto EDR swap — EDR queued via SC; when online: verify EDR live, push BD local uninstall tool via /rmm (confirm uninstallTool.exe path on the box), delete BD console entry 6a4d1bbe0a5a3122524a67ec.
  • EDR on the 4 SC-queued RMM enrollments (DESKTOP-KRHQ5TS, SNAPPERLANDHOME, LAPTOP-PNVA9G51, LESLIE2019LAPTO) — after they land in GuruRMM, push Datto EDR to each.
  • Verify the 4 queued GuruRMM installs + 2 queued EDR installs (IMC-LUIS, IMC-M-EdServices1) complete on reconnect.
  • User: archive the 12 offline>40d Syncro assets (UI, Bulk Actions -> Archive), then clear the 3 matching dead Datto agents (desktop-urv3ugr, office1, purchasingcomp).
  • WATCH through ~2026-07-11: if IMC reports AIM/SQL/perf issues, treat the memory caps as the first probable cause (rollback = uncap to 2147483647).
  • Backups — live-but-unbilled on IMC1; SQL diff-chain churn vs the local 22:00 job; Images plan stale. User handling in a separate plan.
  • Optional: rotate IMC\guru (password transited RMM cmd 378fffe7); vault the Datto RegKey.

Reference Information

  • Wiki: wiki/clients/instrumental-music-center.md.
  • GuruRMM install one-liner (Main): iex (irm 'https://rmm.azcomputerguru.com/install/INNER-BRIDGE-8354/windows').
  • Datto EDR install: Install-EDR -URL "https://azcomp4587.infocyte.com" -RegKey instrume01.
  • RMM cmd ids: SQL apply (SYSTEM, partial) — check-memory d2d918c2; SQL apply (IMC\guru) 378fffe7-a46b-4617-ae6c-38c8d34229b1; EDR BigMom f6653ac5, NFU17AJ 07873cbe.
  • Syncro archive list (asset ids): 5345521, 5033192, 10333758, 2486998, 2967905, 3100580, 2451117, 3151232, 3151234, 3151242, 3151229, 3150899.
  • Commits pushed: wiki fleet-recon 840b0ce; ps-encoded fix; wiki SQL-caps update (this session).

Update: 18:03 PT — re-save (no intervening work)

Re-save requested; no new actions taken since the prior save/sync (HEAD fcf4304). All open threads unchanged and still pending: REPAIRADMIN Bitdefender -> Datto EDR swap (awaiting the box online); Datto EDR on the four SC-queued RMM enrollments once they land; verification of the queued GuruRMM + EDR installs on reconnect; user to archive the 12 offline>40d Syncro assets; memory-cap WATCH window through ~2026-07-11. No config, credential, or infrastructure changes this interval.

Reference in New Issue View Git Blame Copy Permalink