azcomputerguru/claudetools
1
0
Fork 0
Code Issues 58 Pull Requests Actions Packages Projects Releases Wiki Activity
Files
2048d73a4a9668735406651ff161c52041ed72bb
claudetools/clients/cascades-tucson/session-logs/2026-05-20-howard-phase2.6-printers-gpos-account-cleanup.md
Howard Enos 0f3b8869fc sync: auto-sync from HOWARD-HOME at 2026-05-20 22:41:35 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-05-20 22:41:35
2026-05-20 22:41:38 -07:00

25 KiB
Raw Blame History

Cascades of Tucson — Phase 2.6 Session Log

Date: 2026-05-20 Duration: Multi-session (continued from context-limit session)

User

  • User: Howard Enos (howard)
  • Machine: HOWARD-HOME
  • Role: tech

Summary

Completed Phase 2.6: print server build-out, GPO creation, and AD account cleanup. All 13 printers are now installed and shared on CS-SERVER. Four CSC GPOs are created and staged (unlinked until Phase 3 domain join cutover).

Work Completed

1. Front Desk Epson ET-5800 — Printer Installation

Problem: EPWizard.exe fails on Windows Server 2019 — wlanapi.dll stub is present but the WLAN stack is absent.

Fix:

  1. Ran EPWizard.exe on CS-SERVER, let it extract drivers to AppData\Local\Temp\ET-5800\ before dismissing the error
  2. Copied extracted INFs to C:\Users\sysadmin\Documents\ComputerGuru Connect v2\Files\epsonetdrivers\
  3. pnputil /add-driver <INF> /install staged the driver in Windows Driver Store
  4. Add-PrinterDriver -Name "EPSON ET-5800 Series" registered it with the Print Spooler
  5. Add-Printer / Add-PrinterPort created the printer at 192.168.2.147, shared as FrontDesk

Driver name (from INF): EPSON ET-5800 Series INF location: E_WF1XCE.INF (UTF-16 LE with BOM FF FE — Select-String fails on it; must use [System.IO.File]::ReadAllBytes())

2. Memory Care Director + MedTech Printers

Added to CS-SERVER (via GuruRMM remote PowerShell):

Printer Share IP Driver
Memory Care Director - Canon MF751CDW MCDirector 192.168.3.52 Canon Generic Plus PCL6
Memory Care MedTech - Brother MCMedTech 192.168.2.53 Brother Generic Jpeg Type2 Class Driver

Both reachable and shared. Total shared printers on CS-SERVER: 13.

3. Script: phase2-print-server.ps1

Updated clients/cascades-tucson/docs/migration/scripts/phase2-print-server.ps1:

  • Status header updated to COMPLETE 2026-05-20 (all 13 printers)
  • Added FrontDesk, MCDirector, MCMedTech to $printers array
  • Documented Epson ET-5800 workaround in header comments
  • KM driver archived to D:\Shares\Server\Drivers\KM_Universal_PCL6\

4. AD Account Cleanup (5 accounts)

Executed via GuruRMM remote PowerShell on CS-SERVER. All Disable-ADAccount calls succeeded.

Account OU Reason
britney.thompson Care-Assisted Living Departed 2026-04-22
Richard.Adams Transportation Drivers no longer get IT access
Julian.Crim Transportation Drivers no longer get IT access
Christopher.Holick Transportation Drivers no longer get IT access
Shontiel.Nunn Resident Services Old-format account — s.nunn (Caregivers) is correct

Note: britney.thompson's M365 license is still active and not yet harvested. Action needed before next billing cycle.

5. CSC - Security Baseline GPO

Created via New-GPO + Set-GPRegistryValue + direct SYSVOL writes.

Screen saver (HKCU via GPP):

  • ScreenSaveTimeOut = 900 (15 min)
  • ScreenSaveActive = 1
  • ScreenSaverIsSecure = 1
  • SCRNSAVE.EXE = scrnsave.scr

GptTmpl.inf (Machine security — written as Unicode UTF-16):

MinimumPasswordLength = 12
PasswordComplexity = 1
PasswordHistorySize = 24
MaximumPasswordAge = 90
MinimumPasswordAge = 1
LockoutBadCount = 5
ResetLockoutCount = 30
LockoutDuration = 30

GPT.INI: machine version bumped, security extension GUID {827D319E-6EAC-11D2-A4EA-00C04F79F83A}{803E14A0-B4FB-11D0-A0D0-00A0C90F574B} added.

Status: UNLINKED. Link to domain root at Phase 3 cutover.

6. CSC - Windows Update GPO

Created via New-GPO + Set-GPRegistryValue (HKLM AU key).

Setting Value
NoAutoUpdate 0
AUOptions 4 (auto download + install)
ScheduledInstallDay 1 (Sunday)
ScheduledInstallTime 3 (3:00 AM)
NoAutoRebootWithLoggedOnUsers 1
EnableFeaturedSoftware 0

Status: UNLINKED. Link to domain root at Phase 3 cutover.

7. CSC - Printer Deployment GPO

Created Printers.xml in SYSVOL at {GPO-GUID}\User\Preferences\Printers\.

13 printers with OU-based item-level targeting (FilterOrgUnit):

Share ILT
CopyRoom No filter — all staff
BusinessOffice OU=Administrative
Accounting OU=Administrative
AdminOffice OU=Administrative OR OU=Resident Services
ExecDirector OU=Administrative
SalesMarketing OU=Marketing
Kitchen OU=Culinary
CulinaryChef OU=Culinary
FrontDesk OU=Resident Services
HealthServices OU=Care-Assisted Living OR OU=Care-Memorycare
LifeEnrichment OU=Life Enrichment
MCDirector OU=Care-Memorycare
MCMedTech OU=Caregivers OR OU=Care-Memorycare

CSE GUID: {BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}{D02B1F72-3407-48AE-BA88-E8213C6761F1}

Status: UNLINKED. Link to OU=Workstations at Phase 3 cutover.

8. CSC - Drive Mappings GPO

Created Drives.xml in SYSVOL at {GPO-GUID}\User\Preferences\Drives\.

Drive Share ILT
M: \CS-SERVER\Management FilterGroup: CASCADES\SG-Mgmt-RW
S: \CS-SERVER\Sales FilterGroup: CASCADES\SG-Sales-RW
T: \CS-SERVER\Activities FilterGroup: CASCADES\SG-Activities-RW
K: \CS-SERVER\Culinary FilterOrgUnit: OU=Culinary,OU=Departments
R: \CS-SERVER\Receptionist FilterOrgUnit: OU=Resident Services,OU=Departments

CSE GUID: {5794DAFD-BE60-433f-88A2-1A31939AC01F}{D02B1F72-3407-48AE-BA88-E8213C6761F1}

Status: UNLINKED. Link to OU=Departments at Phase 3 cutover.

Final CSC GPO Inventory (8 GPOs, all AllSettingsEnabled)

CSC - Always Wait For Network    (pre-existing)
CSC - Drive Mappings             UNLINKED — link to OU=Departments at Phase 3
CSC - Folder Redirection         UNLINKED — blocked on Phase 3 domain joins
CSC - Folder Redirection (LE)    LIVE — linked to OU=Life Enrichment
CSC - Life Enrichment Printers   LIVE — linked to OU=Life Enrichment
CSC - Printer Deployment         UNLINKED — link to OU=Workstations at Phase 3
CSC - Security Baseline          UNLINKED — link to domain root at Phase 3
CSC - Windows Update             UNLINKED — link to domain root at Phase 3

Docs Updated

  • clients/cascades-tucson/docs/migration/scripts/phase2-print-server.ps1 — Complete status + all 13 printers
  • clients/cascades-tucson/docs/servers/active-directory.md — Accounts disabled, GPO table updated, pending issues updated, printer shares table updated

Phase 3 Prerequisites (next major work)

Domain join order (per migration/phase3-domain-join.md):

  1. DESKTOP-KQSL232 (10.0.20.227)
  2. CHEF-PC (10.0.20.232)
  3. SALES4-PC (10.0.20.203)
  4. MDIRECTOR-PC (192.168.3.20) — needs Windows 10 Pro upgrade first (currently Home)

After first successful join — link GPOs per phase3-domain-join.md step 5c.

Open Items

Item Priority Notes
britney.thompson M365 offboarding Done Sign-in blocked, license removed, litigation hold applied (sysadmin@ via admin center 2026-05-20)

Update: 14:53 PT — britney.thompson M365 offboarding + next session scope

britney.thompson M365 Offboarding (Complete)

Attempted Graph API via device code flow. The well-known PowerShell client ID (1950a258-227b-4e31-a9cf-717495945fc2) is blocked in the tenant (AADSTS65002 — preauthorization required). No Graph-capable modules installed on HOWARD-HOME (Microsoft.Graph, MSOnline, AzureAD all absent). No Azure CLI.

Howard logged into admin.microsoft.com as sysadmin@cascadestucson.com and completed offboarding manually:

  • Sign-in blocked in M365
  • License removed (returned to pool)
  • Litigation hold applied on mailbox

AD account was disabled earlier in this session (see main log above). Offboarding is fully complete.

Next Session — Accounting Office Folder Redirection

Planned work for next session:

  • Machines in the accounting office (Room 103 area): ACCT2-PC (already domain-joined), plus any others in that area
  • Folder redirection for accounting staff: Documents, Downloads, Desktop → \\CS-SERVER\homes\%USERNAME%\
  • Key difference from LE GPO: GrantExclusive=true — removes inherited permissions, grants the user exclusive access (plus Domain Admins). No other domain users can browse sibling folders.
  • Linked to OU=Administrative (or a sub-scope if only accounting staff targeted)
  • Sales department folder redirection possibly follows same session if accounting goes cleanly
  • Pre-check required: OneDrive KFM status on each accounting PC before applying GPO (see 2026-04-17 session log for procedure) | Phase 3 domain joins | High | Block on MDIRECTOR-PC needing Win10 Pro upgrade | | krbtgt password rotation | Medium | 569+ days old — deferred | | Remove Meredith.Kuhn + John.Trozzi from Domain Admins | Low | Deferred | | SG-Mgmt-RW + SG-Sales-RW membership | Medium | Populate before Phase 3 GPO linking | | CSC - Folder Redirection (full) | Medium | Blocked on Phase 3 — check OneDrive KFM on each PC first |

Update: 17:06 PT — Admin folder redirection setup + department migration master plan

Session scope

Continued from context-limit session. Completed the accounting/admin folder redirection GPO setup for Zachary Nelson, resolved architecture questions about OneDrive/HIPAA/AppData, and built the full department migration master plan.

1. Folder Redirection Architecture Decisions

GPO approach — native FRD, not GPP Registry:

  • Inspected CSC - Folder Redirection GPO SYSVOL: had User\Preferences\Registry\Registry.xml (GPP Registry approach, 550 bytes) plus empty Documents & Settings folder.
  • Decision: use native Group Policy Folder Redirection (GPMC UI → User Configuration → Windows Settings → Folder Redirection), not the GPP Registry hack. Howard configured this directly in GPMC on CS-SERVER.

One GPO for all non-LE departments (not per-dept):

  • %USERNAME% in the redirect path makes it universal — \\CS-SERVER\homes\zachary.nelson\Documents, \\CS-SERVER\homes\lauren.hasselman\Documents, etc. all handled by one policy.
  • Keep CSC - Folder Redirection (LE) for Life Enrichment. CSC - Folder Redirection becomes the universal GPO for all other departments.

Security group filter instead of OU scope:

  • All 6 users in OU=Administrative (Zachary.Nelson, lauren.hasselman, Alma.Montt, Meredith.Kuhn, Ashley.Jensen, Allison.Reibschied) — cannot use OU scope without hitting users not ready for redirection.
  • Solution: SG-FolderRedirect security group. Only members get the GPO applied.
  • Future: when all departments migrated, remove SG filter, add Authenticated Users — existing redirected users see zero disruption.

AppData — do not redirect:

  • Confirmed: redirect only Documents, Desktop, Downloads. AppData causes login slowdowns, application breakage, and network overhead with no meaningful benefit for assigned-machine users.

2. GPO Configuration (Howard in GPMC on CS-SERVER)

Howard opened GPMC, edited CSC - Folder Redirection, configured:

  • Documents → \\CS-SERVER\homes (Basic redirection, grant exclusive rights, move contents)
  • Desktop → \\CS-SERVER\homes (same settings)
  • Downloads → \\CS-SERVER\homes (same settings)
  • Policy removal: leave folder in new location

Howard also removed Authenticated Users from Security Filtering directly in GPMC (scripted removal failed — Set-GPPermission -PermissionLevel None triggers interactive confirmation prompt even with -Confirm:$false in NonInteractive PS sessions; GPMC COM CreateSecurityInfo method also unavailable).

3. SG-FolderRedirect Created and Wired

Dispatched via GuruRMM to CS-SERVER:

  • Created SG-FolderRedirect (Global Security group, created in CN=Users fallback since OU=Security Groups,OU=Groups path failed)
  • Added Zachary.Nelson as sole member
  • Added SG-FolderRedirect with GpoApply permission on CSC - Folder Redirection
  • Linked CSC - Folder Redirection to OU=Administrative,OU=Departments,DC=cascades,DC=local (Enabled, Order 1)

Final GPO state:

CSC - Folder Redirection
  Linked: OU=Administrative — Enabled: True
  Security filter: SG-FolderRedirect [GpoApply]
  Members of SG-FolderRedirect: Zachary.Nelson

4. GuruRMM API Auth Change

GuruRMM API (port 3001) now requires JWT auth header. Previous sessions worked without it — behavior changed. Resolved:

TOKEN=$(curl -s -X POST "http://172.16.3.30:3001/api/auth/login" \
  -H "Content-Type: application/json" \
  -d '{"email":"claude-api@azcomputerguru.com","password":"ClaudeAPI2026!@#"}' \
  | grep -o '"token":"[^"]*"' | cut -d'"' -f4)

Command dispatch also now requires command_type field: {"command_type":"powershell","command":"..."}. Result polling endpoint is /api/commands/{id} (not /api/agents/{id}/command/{id}).

5. HIPAA / OneDrive Discussion

Concluded: server folder redirection is the correct posture for PHI-adjacent roles (accounting/admin). OneDrive requires a signed Microsoft HIPAA BAA, conditional access to block personal device sync, and Business Premium or E3 for full compliance tooling. Until BAA status is confirmed for cascadestucson.com tenant, PHI should stay on-prem.

6. Entra Connect — Expansion Plan

Entra Connect is live on CS-SERVER, production mode. Currently syncing OU=Caregivers + OU=Groups only. Not yet syncing Administrative or other department OUs.

Key facts for expansion:

  • On-prem UPN suffix is @cascades.local (non-routable). Must add cascadestucson.com as alternate UPN suffix in AD before syncing any new dept OU.
  • Change user UPNs to @cascadestucson.com → soft-match links to existing M365 cloud accounts.
  • PHS makes on-prem password win — M365 password changes to Windows domain password on first sync. Notify users or align passwords first.
  • Local Windows login behavior is unchanged. GPOs, group memberships, folder paths — all unchanged.

7. Department Migration Master Plan

Created comprehensive multi-day migration plan. Covers:

  • Per-department template: pre-checks → machine prep → domain join → ProfWiz → prep-profile script → SG-FolderRedirect → Entra sync
  • Department sequence (Admin → LE → Culinary → RS → Marketing → Care → Caregivers)
  • Final switchover: SG-FolderRedirect removed, Authenticated Users restored — zero disruption to already-redirected users
  • Clean machine end state: fresh domain join → all GPOs apply automatically, no manual steps
  • Key guardrails from 2026-04-17 LE session (ProfWiz NTUSER.DAT poisoning, KFM conflict procedure)
  • Prerequisites before Phase 3 GPO linking (SG membership, krbtgt rotation, Domain Admins cleanup)

Plan file: C:\Users\Howard\.claude\plans\wise-discovering-panda.md
Resume command: "resume the Cascades migration plan" at session start
Syncro ticket: https://computerguru.syncromsp.com/tickets/110680053

Configuration Changes

File Action Notes
clients/cascades-tucson/session-logs/2026-05-20-howard-phase2.6-printers-gpos-account-cleanup.md Appended This update
C:\Users\Howard\.claude\plans\wise-discovering-panda.md Created Master migration plan with save-point tracking
.claude/memory/project-cascades-migration-plan.md Created Memory entry for plan file + Syncro ticket
.claude/memory/MEMORY.md Updated Added Cascades migration plan pointer
C:\claudetools\.claude\temp\check-frd-gpo.ps1 Created GPO inspection script
C:\claudetools\.claude\temp\frd-prep.ps1 Created SG create + GPO filter setup
C:\claudetools\.claude\temp\frd-link.ps1 Created GPO link to OU=Administrative
C:\claudetools\.claude\temp\find-zachary.ps1 Created AD user lookup + OU=Administrative inventory

AD changes (via GuruRMM on CS-SERVER):

  • Created security group SG-FolderRedirect (CN=Users,DC=cascades,DC=local)
  • Added Zachary.Nelson to SG-FolderRedirect
  • Removed Authenticated Users from CSC - Folder Redirection security filter (done by Howard in GPMC)
  • Linked CSC - Folder Redirection to OU=Administrative (Enabled, Order 1)

GPMC changes (Howard on CS-SERVER directly):

  • Configured native folder redirection in CSC - Folder Redirection:
    • Documents, Desktop, Downloads → \\CS-SERVER\homes (Basic, GrantExclusive, MoveContents)
    • Policy removal: leave folder in new location

Infrastructure & Servers

Resource Value
CS-SERVER agent ID 6766e973-e703-47c1-be56-76950290f87c
GuruRMM API http://172.16.3.30:3001 (now requires JWT auth)
GuruRMM API admin claude-api@azcomputerguru.com / ClaudeAPI2026!@#
cascades.local GPO GUID CSC - Folder Redirection = {512B43A4-F049-4CE5-BFAC-860AD13E92BE}
ACCT2-PC Zachary.Nelson's machine — test folder redirection tonight
DESKTOP-H6QHRR7 lauren.hasselman — OneDrive KFM active, Howard moves data manually first

Pending / Next Steps

Item Priority Notes
Zachary folder redirection live test High Tonight on ACCT2-PC — gpupdate /force as zachary.nelson, verify \CS-SERVER\homes\zachary.nelson\ populated
Lauren Hasselman High Howard moves OneDrive data manually first, then add to SG-FolderRedirect
Entra Connect: add OU=Administrative to sync Medium Set cascadestucson.com UPN suffix first, align passwords, then delta sync
Phase 3 domain joins High DESKTOP-KQSL232 first; MDIRECTOR-PC blocked on Win10 Pro upgrade
Phase 3 GPO linking High After first successful domain join: Security Baseline, Drive Mappings, Printer Deployment, Windows Update
SG-Mgmt-RW / SG-Sales-RW / SG-Activities-RW Medium Populate before Drive Mappings GPO linked
krbtgt password rotation Medium 569+ days old
Remove Meredith.Kuhn + John.Trozzi from Domain Admins Low Deferred
Update Syncro ticket #110680053 Medium Log today's work

Update: 22:34 PT — NTFS fix, GPO debugging, Zachary folder redirection confirmed working

Session Summary

Continued from the earlier session where CS-SERVER had been rebooted to clear hung icacls processes. This session completed the NTFS permissions fix on D:\Homes, debugged and resolved the folder redirection GPO failure, and confirmed Zachary Nelson folder redirection working on ACCT2-PC. Also billed two Syncro tickets and closed the browser cleanup ticket.

The NTFS fix proceeded in two rounds. The first icacls pass (run by Howard before this context window) partially worked: it removed the explicit BUILTIN\Users entry from D:\Homes root but left inherited entries flowing in from the D:\ parent, and left explicit BUILTIN\Users ACEs on the subfolders. Guided Howard through the GUI (Advanced Security Settings) to break inheritance on the root and remove BUILTIN\Users from root and all four subfolders (Crystal.Rodriguez, lauren.hasselman, sharon.edwards, Susan.Hicks). Final icacls verification via GuruRMM confirmed clean state across all five paths.

Folder redirection was not applying to Zachary despite three login attempts and gpupdate runs. gpresult showed "Applied Group Policy Objects: N/A" for user settings — zero user-side GPOs reaching him. Root cause: when Howard removed Authenticated Users from the GPO security filter in the earlier session (per Claude instructions), he removed ALL access including Read. Domain computers require Authenticated Users GpoRead to enumerate user-side GPOs; without it the computer cannot include CSC - Folder Redirection in any user RSoP. Also investigated fdeploy1.ini — discovered that fdeploy1.ini (not fdeploy.ini) is the active file on Windows Vista+ clients. All earlier "empty file" reports were false negatives caused by PowerShell mishandling the ampersand in the "Documents & Settings" path. The fdeploy1.ini had 1698 bytes of correct content written by GPMC. The sole blocker was the missing GpoRead. Added Authenticated Users GpoRead back via Set-GPPermission; Zachary logged in and folder redirection applied on the next login.

Billed Syncro ticket #32303 (Domain setup-entra sync) for 2 hours remote labor (product 1190473) and ticket #32306 (Room 343 virus, browser cleanup) for 1 hour onsite (product 26118). Cascades is prepaid; both invoices landed at $0 with prepay block decremented 38.5 to 35.5 hours. Ticket #32306 closed as Resolved. Migration master plan save point updated.

Key Decisions

  • Used GUI walk-through for NTFS fix instead of commands — Howard requested GUI approach after icacls left partial state. Advanced Security Settings is more reliable for multi-step inheritance break and ACE removal operations.
  • Authenticated Users GpoRead is mandatory even with security group filtering — removing it entirely breaks computer-side enumeration of user GPOs. Correct pattern: Authenticated Users gets GpoRead only; target security group gets GpoApply. Claude gave incorrect guidance in the earlier session by not clarifying this distinction.
  • fdeploy1.ini is the active file on Windows 10/11, not fdeploy.ini — fdeploy.ini is the legacy XP format, always empty on modern domains. Confirmed by comparing working LE GPO structure against the new GPO.
  • Remote labor product (1190473 at $150/hr) used for Phase 2.6 migration work; Onsite product (26118 at $175/hr) used for the browser cleanup ticket. Correct per delivery channel.

Problems Encountered

  • icacls /inheritance:d /remove left BUILTIN\Users on subfolders — the combined flags converted inherited ACEs to explicit but did not then remove them in the same pass. Resolved via GUI.
  • D:\Homes root inherited BUILTIN\Users from D:\ parent — removing the explicit ACE was not enough; root needed inheritance broken to stop the parent volume from propagating. Resolved via GUI disable inheritance.
  • GuruRMM agent hung on UNC path commands — commands using UNC paths to SYSVOL caused the agent to run indefinitely. Resolved by waiting for agent recovery and switching to local C:\Windows\SYSVOL paths with System.IO.Path::Combine() to handle the ampersand character.
  • fdeploy.ini vs fdeploy1.ini confusion — all attempts to read the legacy fdeploy.ini returned empty, leading to incorrect conclusion that GPMC had not written settings. Resolved by enumerating the "Documents & Settings" folder with GetFiles() and discovering fdeploy1.ini with 1698 bytes of correct content.
  • GPO Authenticated Users GpoRead missing — root cause of "Applied GPOs: N/A". Resolved via Set-GPPermission adding GpoRead back. Root cause was incorrect guidance from Claude in the earlier session.

Configuration Changes

  • D:\Homes NTFS: inheritance from D:\ parent broken on root; BUILTIN\Users removed from root and all 4 subfolders via GUI
  • D:\Homes root ACL final state: Authenticated Users (RX,AD) This Folder Only; Administrators (OI)(CI)(F); SYSTEM (OI)(CI)(F); CREATOR OWNER (OI)(CI)(IO)(F)
  • CSC - Folder Redirection GPO: Authenticated Users GpoRead added back
  • C:\Users\Howard.claude\plans\wise-discovering-panda.md: CURRENT SAVE POINT updated

Credentials & Secrets

Infrastructure & Servers

  • CS-SERVER: DC + file server, cascades.local, GuruRMM agent 6766e973-e703-47c1-be56-76950290f87c
  • ACCT2-PC: Zachary Nelson workstation, GuruRMM agent 9b51e554-45d8-4737-96f5-116c1b1a7589, OU=Staff PCs\Workstations
  • D:\Homes share: clean NTFS, no BUILTIN\Users anywhere
  • CSC - Folder Redirection GPO GUID: {512B43A4-F049-4CE5-BFAC-860AD13E92BE}
  • CSC - Folder Redirection (LE) GPO GUID: {889BE7BE-202E-4153-89AD-B5DB62A52D25}

Commands & Outputs

# Add Authenticated Users GpoRead back
Set-GPPermission -Name 'CSC - Folder Redirection' -TargetName 'Authenticated Users' -TargetType Group -PermissionLevel GpoRead

# Final GPO permission state:
# SG-FolderRedirect        | GpoApply
# Authenticated Users       | GpoRead
# Domain Admins             | GpoEditDeleteModifySecurity
# Enterprise Admins         | GpoEditDeleteModifySecurity
# ENTERPRISE DOMAIN CONTROLLERS | GpoRead
# SYSTEM                    | GpoEditDeleteModifySecurity

# fdeploy1.ini confirmed 1698 bytes with correct content
# Paths: \\CS-SERVER\Homes\%USERNAME%\Desktop, Documents, Downloads, Pictures, Music

# Syncro billing:
# #32303 — timer 39347344, 2.0h remote, invoice 1650366749, $0.00 prepaid
# #32306 — timer 39347378, 1.0h onsite, invoice 1650366766, $0.00 prepaid
# Prepay: 38.5 -> 35.5 hours remaining
# #32306 closed Resolved

Pending / Incomplete Tasks

  1. Lauren Hasselman — Howard moves OneDrive data to local folders first, then Add-ADGroupMember SG-FolderRedirect lauren.hasselman, log off/on, verify \CS-SERVER\homes\lauren.hasselman\ populated
  2. Entra Connect — cascadestucson.com UPN suffix, set UPN on Administrative users, add OU=Administrative to sync scope, delta sync, verify soft-match
  3. Phase 3 domain joins — DESKTOP-KQSL232, CHEF-PC, SALES4-PC, MDIRECTOR-PC (MDIRECTOR-PC needs Win10 Home to Pro first)
  4. Pre-Phase 3 prerequisites — SG-Mgmt-RW / SG-Sales-RW / SG-Activities-RW membership, krbtgt rotation (569+ days), remove Meredith.Kuhn + John.Trozzi from Domain Admins

Reference Information

Reference in New Issue View Git Blame Copy Permalink