Howard Enos
af4ad0aea3
CS-SERVER post-reboot verification: time sync, TLS 1.2 enforcement, and Windows Server Backup feature all persisted cleanly. dcdiag clean. Ready for Entra Connect install. Synology cascadesDS permission inventory captured via DSM API (SSH disabled by default on Synology). 35 users, 4 groups, 10 shares. Analysis identifies 7 shared-account role logins (HIPAA violation), 8 departed-employee accounts to clean up, and 4 shares needing Meredith-side confirmation before migration (pacs most sensitive). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
133 lines
8.3 KiB
Markdown
133 lines
8.3 KiB
Markdown
# Synology cascadesDS — Analysis + Migration Mapping (2026-04-22)
|
|
|
|
**Inventory source:** `synology-permission-inventory.md` (derived from `synology-permission-inventory-raw.md`)
|
|
**Purpose:** Feed the Phase 4 (`phase4-synology.md` §6.0) permission migration — CS-SERVER NTFS/SMB applied via `scripts/phase2-file-shares.ps1`.
|
|
|
|
---
|
|
|
|
## Headline observations
|
|
|
|
### 1. Shared-account / role-based logins exist on Synology
|
|
The following Synology user accounts are **role names, not individuals**. Each is a HIPAA §164.312(a)(2)(i) Unique User Identification problem on the Synology — multiple humans sharing one credential when accessing PHI-bearing shares:
|
|
|
|
- `Accounting`
|
|
- `Dining Manager`
|
|
- `Front Desk`
|
|
- `mcnurse` (Memory Care nurse)
|
|
- `Memcare Receptionist`
|
|
- `memcarenurse`
|
|
- `Nurse Tower`
|
|
|
|
These should **not** be carried forward to CS-SERVER. The CS-SERVER model is per-person named accounts (already Howard's 2026-04-22 rollout plan), so at cutover these shared logins disappear and their previously-assigned permissions migrate to the appropriate AD security group.
|
|
|
|
### 2. Departed employees still present on Synology
|
|
Per our AD state and the 2026-04-22 working list:
|
|
|
|
| Synology user | Status |
|
|
|---|---|
|
|
| `Amber M Lee` | Not in AD or current roster — treat as departed |
|
|
| `Ann Dery` | Former employee (deleted from AD 2026-04-13) |
|
|
| `Anna Pitzlin` | Former employee (confirmed by HR, slated for deletion) |
|
|
| `Britney Thompson` | Departed 2026-04-22 per John's reply |
|
|
| `Haris Durut` | Former employee (deleted from AD 2026-04-13) |
|
|
| `Monica RamirezRossette` | Former employee (removed from Domain Admins 2026-03-09) |
|
|
| `Nela Durut-Azizi` | Former employee (already expired=yes on Synology) |
|
|
| `Tamra Johnson` | Renamed to `Tamra Matthews`; the Synology account is the old name |
|
|
|
|
None of these carry forward. Delete after cutover.
|
|
|
|
### 3. Service/admin accounts to keep or retire
|
|
|
|
| Account | Keep or retire |
|
|
|---|---|
|
|
| `admin` | Keep (DSM default; locked to administrators). Used only during maintenance. |
|
|
| `guest` | Already expired=yes. Leave disabled. HIPAA audit says remove; keep as-is for now. |
|
|
| `guru` | Keep (MSP / Computer Guru service account). Rotate password post-cutover. |
|
|
| `CasAdmin201` | **Investigate** — looks like a prior-MSP admin account. Has Admin rights on every share. Recommend disable + confirm with Meredith before deletion. |
|
|
| `VPNClient` | Synology VPN service account; narrow purpose. Keep as-is unless VPN feature is retired. |
|
|
|
|
### 4. Four Synology groups, but only one is load-bearing for staff
|
|
- `administrators` — DSM admin group. Full control everywhere.
|
|
- `http` — Web-service group, not staff-facing.
|
|
- `MainOffice` — Appears to be a custom group for office staff. **This is the one we need to translate into AD groups** when migrating share access.
|
|
- `users` — Default membership (every local user is a member). Most share permissions grant modest rights to this group.
|
|
|
|
Group-member enumeration via the DSM API returned error 3201; full membership will need to be captured via DSM web UI (Control Panel → User & Group → Group → double-click → Members tab) or via CLI when SSH is enabled.
|
|
|
|
### 5. Sandra Fish share
|
|
There's a share named `Sandra Fish` — former director's personal folder. Has the same deny pattern as other shares. **Decision needed:** archive contents to `Archive\Former-Director-Sandra-Fish\` on CS-SERVER and delete the share, or keep accessible only to Meredith as custodian until retention expires (state/HIPAA).
|
|
|
|
### 6. pacs share
|
|
`pacs` likely refers to a Picture Archiving and Communication System — medical imaging. Heavy deny pattern (most users denied by default). This is a **HIPAA-clinical share**. Worth confirming with Meredith what's actually in it before moving — if it's live imaging of residents, EncryptData is mandatory and access should narrow to Clinical-PHI group.
|
|
|
|
### 7. `web`, `Activities`, `chat` shares
|
|
- `web` — likely the DSM Web Station share. Mostly denied for users. Retire with Synology.
|
|
- `Activities` — Life Enrichment activity docs? Unclear. Meredith-confirm.
|
|
- `chat` — likely for DSM Chat. If unused (Teams is the planned chat per HIPAA doc), retire.
|
|
|
|
---
|
|
|
|
## Synology → AD identity mapping
|
|
|
|
For the 2026-04-22 active roster, here is the proposed mapping. Use this to feed `SG-*` group memberships before `phase2-file-shares.ps1` runs.
|
|
|
|
| Synology user | AD identity (SamAccountName) | AD department |
|
|
|---|---|---|
|
|
| `Ashley Jensen` | `Ashley.Jensen` | Administrative |
|
|
| `ChristinaDupras` | `Christina.DuPras` | Resident Services |
|
|
| `Crystal Rodriguez` | `Crystal.Rodriguez` | Marketing |
|
|
| `Crystal Suszek` | *(alias of Crystal Rodriguez — consolidate; no second AD account)* | — |
|
|
| `JD Martin` | `JD.Martin` | Culinary |
|
|
| `John Trozzi` | `John.Trozzi` | Maintenance |
|
|
| `Karen Rossini` | `karen.rossini` | Care, Assisted Living |
|
|
| `Lois Lane` | `Lois.Lane` | Care, Assisted Living |
|
|
| `Lupe Sanchez` | `Lupe.Sanchez` | Housekeeping |
|
|
| `Megan Hiatt` | `Megan.Hiatt` | Marketing |
|
|
| `meredith kuhn` | `Meredith.Kuhn` | Administrative |
|
|
| `Shelby Trozzi` | `Shelby.Trozzi` | Memory Care |
|
|
| `Susan Hicks` | `Susan.Hicks` | Life Enrichment |
|
|
| `Veronica` | `Veronica.Feller` | Care, Assisted Living |
|
|
| `Stephanie Devin` | *(not in AD — blocked in M365, former employee)* | — |
|
|
|
|
Not migrated: Amber M Lee, Ann Dery, Anna Pitzlin, Britney Thompson, Haris Durut, Monica RamirezRossette, Nela Durut-Azizi, Tamra Johnson. Plus all role accounts in observation #1.
|
|
|
|
---
|
|
|
|
## Proposed AD security group → CS-SERVER share mapping
|
|
|
|
Mirror of the Synology pattern, collapsed onto the AD security groups we're creating in the rollout (see `docs/cloud/user-account-rollout-plan.md` §4). Individual user ACEs from Synology merge into the matching group.
|
|
|
|
| Share | Who gets RW on CS-SERVER | Who gets RO | Notes |
|
|
|---|---|---|---|
|
|
| `Management` | `SG-Management-RW` = Administrative + Sales Director + Clinical Directors + Life Enrichment Director | Authenticated Users (RO) | Current Synology: deny-by-default, individual grants; clean slate on CS-SERVER with group-based |
|
|
| `SalesDept` | `SG-Sales-RW` = Megan, Crystal, Tamra, Lauren, Allison, Ashley | — | PHI concern (resident intake forms) — audit SACL required |
|
|
| `Server` | `SG-Server-RW` = Administrative + IT | — | IT / sysadmin scratch space |
|
|
| `homes` | Per-user only (`CREATOR OWNER` for new subfolders, `Domain Users` read on root) | — | Already the CS-SERVER pattern per `phase2-server-prep.md` |
|
|
| `Public` | `Authenticated Users` RW | — | Non-sensitive shared area |
|
|
| `Culinary` | `SG-Culinary-RW` = JD Martin, Ramon, Alyssa | — | Already created on CS-SERVER (per `cs-server.md` §SMB shares) — verify ACL |
|
|
| `pacs` | **INVESTIGATE FIRST** — clinical imaging; scope to `SG-Clinical-PHI` if confirmed + enable SMB3 encryption + SACL auditing | — | Critical PHI share; do not migrate until confirmed |
|
|
| `Activities` | TBD — ask Meredith | TBD | Life Enrichment? |
|
|
| `chat`, `web` | Do not migrate | — | Retire with Synology |
|
|
| `Sandra Fish` | Archive-only access for Meredith + IT | — | Former-director data; retention decision needed |
|
|
|
|
---
|
|
|
|
## Questions for Meredith / Howard before cutover
|
|
|
|
1. What is in `pacs` today? If it's medical imaging, we treat it as the highest-sensitivity share — strict ACL, SMB3 encryption, full Object Access audit SACL, dedicated `SG-Clinical-PHI` group.
|
|
2. What is in `Activities`? Life Enrichment docs? HIPAA-relevant (resident participation records)?
|
|
3. `CasAdmin201` — who is/was this? Used today or legacy?
|
|
4. Is Meredith's `Sandra Fish` share something to archive long-term or purge?
|
|
5. `chat` — currently used? If not, confirm for retirement.
|
|
|
|
---
|
|
|
|
## Next action items
|
|
|
|
- [ ] Walk through DSM Control Panel with Howard to capture the `MainOffice` group membership (API error 3201 blocked automated pull)
|
|
- [ ] Confirm with Meredith the content/use of `pacs`, `Activities`, `chat`, `Sandra Fish`
|
|
- [ ] Update `docs/migration/scripts/phase2-file-shares.ps1` inputs with the mapping table above
|
|
- [ ] After CS-SERVER is migrated: disable Synology shared-account logins (`Accounting`, `Front Desk`, `mcnurse`, `memcarenurse`, `Memcare Receptionist`, `Nurse Tower`, `Dining Manager`) — HIPAA compliance cleanup
|
|
- [ ] After CS-SERVER is migrated: disable former-employee Synology accounts (Amber, Ann, Anna, Britney, Haris, Monica, Nela, Tamra)
|
|
- [ ] Reconfigure Synology as backup target per `phase4-synology.md` §6.4, retire it as a NAS
|