azcomputerguru/claudetools
1
0
Fork 0
Code Issues 58 Pull Requests Actions Packages Projects Releases Wiki Activity
Files
2d1d85f58bb830f1fb69487c745e62d1535ac5ea
claudetools/clients/cascades-tucson/session-logs/2026-06/2026-06-09-howard-cascades-accounting-scan-folder.md
Howard Enos 4adf2c586c sync: auto-sync from HOWARD-HOME at 2026-06-09 17:08:26 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-06-09 17:08:26
2026-06-09 17:08:39 -07:00

9.4 KiB
Raw Blame History

Cascades of Tucson — Session Log 2026-06-09 — Accounting scan-to-folder build

User

  • User: Howard Enos (howard)
  • Machine: Howard-Home
  • Role: tech

Session Summary

Set up a scan-to-folder destination for the Cascades accounting team so the Business Office Brother MFC-L8900CDW (10.0.20.220) can scan documents to a network folder that Lauren Hasselman and Chris Knight (and, added mid-session, Zachary Nelson) can access. (Continuation of the same session that earlier reconciled crashed-session billing — see 2026-06-09-howard-cascades-billing-recovery-wiki.md.)

Started with read-only discovery on CS-SERVER via GuruRMM. The 2026-03-20 audit was stale; the live share set is much larger. Found there is no plain "Accounting" file share — the only accounting file folder is Company Web Docs\Accounting buried under the Synology-Drive-synced D:\Shares\Main tree, with a wide-open Everyone:FullControl ACL. Confirmed 10.0.20.220 is the Business Office Brother and that lauren.hasselman + chris.knight are real AD users. Per Howard's choices (dedicated clean share, lock to the named users, dedicated scan service account), built a fresh structure rather than reusing the Synology-synced folder.

Created the service account svc-scan (CN=Users, PasswordNeverExpires, CannotChangePassword), vaulted its password, then created D:\Shares\Accounting with inheritance broken and locked to Lauren/Chris (Modify), and D:\Shares\Accounting\Scans adding svc-scan (Modify, writer only). Hit a name collision: a pre-existing printer share named Accounting (Canon MF455DW) meant the file share didn't create and my grants/Everyone-revoke landed on the printer share. Restored the printer share (re-added Everyone:Read) and created the file share under the non-colliding name AcctDept. Added Zachary Nelson to NTFS + share when Howard asked. Verified svc-scan can SMB-write to \\192.168.2.254\AcctDept\Scans from ACCT2-PC (a VLAN-20 host, proxy for the printer).

Key network finding: CS-SERVER (192.168.2.254, main LAN) cannot reach the VLAN-20 printers — pfSense blocks main→VLAN20 (80/443/445 all fail to 10.0.20.220). So the Brother WBM must be configured from a VLAN-20 PC or onsite; the reverse path (printer→CS-SERVER:445) is open, which is all scanning needs. Gave Howard the exact Brother Scan-to-Network profile values (NTLMv2, cascades\svc-scan, path \\192.168.2.254\AcctDept\Scans); Howard configured it and a test scan succeeded. Finally mapped the \\cs-server\AcctDept share as persistent per-user drives via RMM user_session: Lauren got X: (Y: was in use on her box), Zachary got Y: (matching Chris's manual Y:). Howard set the standing rule that all future Cascades scanner→folder setups reuse svc-scan.

Key Decisions

  • Dedicated clean share over the existing accounting folder. The real accounting folder (Main\Company Web Docs\Accounting) is Everyone:Full and sits in the Synology-Drive-synced tree (scans would replicate to the NAS). Built D:\Shares\Accounting fresh with a scoped ACL instead.
  • Dedicated svc-scan service account (not a reused user credential) for the printer's stored SMB auth — least-privilege, vaulted, low blast radius. Howard then made it the standard for ALL future Cascades scan-to-folder setups (memory: feedback_cascades_scan_account.md).
  • File share named AcctDept, not Accounting — a printer share already owns "Accounting".
  • svc-scan granted on the Scans subfolder only (not the parent Accounting), relying on default bypass-traverse so it can reach/write the dropbox without being able to read accounting documents.
  • NTLMv2 (not Auto/Kerberos) in the Brother profile — the printer can't reach a KDC cleanly across the VLAN with explicit credentials.
  • Persistent drive maps via RMM user_session (per logged-in user) rather than GPP — only two users, both logged in; X:/Y: per free-letter availability.

Problems Encountered

  • Share name collision with a printer share. New-SmbShare -Name Accounting / Grant-SmbShareAccess silently operated on the existing Accounting Canon MF455DW printer share — the file share never got created and I added stray grants + revoked Everyone on the printer share. Resolved by removing my grants, re-adding Everyone:Read to the printer share, and creating the file share as AcctDept.
  • CS-SERVER cannot reach VLAN-20 printers (pfSense main→VLAN20 block) — can't configure the Brother WBM from the server. Resolved by validating from / directing config to a VLAN-20 host (ACCT2-PC); confirmed the needed direction (printer→server:445) is open.
  • UNC backslash mangling in dispatched scripts (\\ collapsed to \, paths like C:\192.168...). Resolved by building all UNC/path/identity strings from [char]92 on the server side (per the known transport quirk) and using mapped drive letters for write tests.
  • PSDrive UNC root tripled the path on a write test — switched to net use + drive letter.

Configuration Changes

  • CS-SERVER (cascades.local), via GuruRMM agent c39f1de7-d5b6-45ae-b132-e06977ab1713:
    • New AD user svc-scan (CN=Users; PasswordNeverExpires, CannotChangePassword; Description points to vault).
    • New folders D:\Shares\Accounting and D:\Shares\Accounting\Scans.
    • NTFS D:\Shares\Accounting: inheritance disabled; SYSTEM + BUILTIN\Administrators = FullControl; CASCADES\lauren.hasselman, CASCADES\chris.knight, CASCADES\zachary.nelson = Modify. No Everyone.
    • NTFS D:\Shares\Accounting\Scans: inherits the above + explicit CASCADES\svc-scan = Modify.
    • New SMB share AcctDept → D:\Shares\Accounting (Change: lauren/chris/zachary/svc-scan; Full: Admins).
    • Removed the earlier interim share+folder AcctScans (replaced by the AcctDept structure).
    • Restored the Accounting (Canon MF455DW) printer share — removed my stray grants, re-added Everyone:Read.
  • DESKTOP-H6QHRR7 (Lauren): persistent map X: → \\cs-server\AcctDept (user_session). Earlier also a Public Desktop shortcut "Accounting Scans" → \\CS-SERVER\AcctDept\Scans.
  • ACCT2-PC (Zachary): persistent map Y: → \\cs-server\AcctDept (user_session).
  • DESKTOP-N5G1ROO (Chris): Y: mapped by Howard manually (not by this session). Public Desktop shortcut pushed earlier.
  • Brother MFC-L8900CDW @ 10.0.20.220: Scan-to-Network profile created by Howard (see below). Test scan confirmed.
  • Repo: wiki updated (wiki/clients/cascades-tucson.md — Access vault pointer, new "File Shares & Scan-to-Folder" Patterns subsection incl. the svc-scan reuse rule, 2026-06-09 history row). Memory: feedback_cascades_scan_account.md + MEMORY.md index line. This session log.

Credentials & Secrets

  • svc-scan / aPqzfE3Sknm2ZbMwccPHAa9# — AD service account, cascades.local, on CS-SERVER. Vault: clients/cascades-tucson/svc-scan.sops.yaml (credentials.password). Brother SMB auth username cascades\svc-scan. PasswordNeverExpires, CannotChangePassword.

Infrastructure & Servers

  • CS-SERVER: 192.168.2.254 (main LAN). Live RMM agent c39f1de7-d5b6-45ae-b132-e06977ab1713. Share root D:\Shares. New: D:\Shares\Accounting{,\Scans}, share \\CS-SERVER\AcctDept.
  • Brother MFC-L8900CDW (Business Office): 10.0.20.220 (VLAN 20). WBM http://10.0.20.220. Profile → Network Folder Path \\192.168.2.254\AcctDept\Scans, Auth NTLMv2, user cascades\svc-scan, PDF Multi-Page.
  • ACCT2-PC: 10.0.20.209 (VLAN 20, Zachary). RMM agent da48bfbb-6b00-4bc5-bf03-0a3753362968. Reaches printer WBM + CS-SERVER:445.
  • Network: pfSense blocks main-LAN (192.168.2.x) → VLAN 20 (10.0.20.x); CS-SERVER→10.0.20.220:80/443/445 all fail. Printer→CS-SERVER:445 open.
  • Pre-existing collision: SMB printer share Accounting = "Accounting - Canon MF455DW" (LocalsplOnly).

Commands & Outputs

  • svc-scan write test (from ACCT2-PC): mapped \\192.168.2.254\AcctDept\Scans, wrote+removed a file, owner returned CASCADES\svc-scan → OK.
  • Drive maps (user_session, /persistent:yes): Lauren net use X: \\cs-server\AcctDept; Zachary net use Y: \\cs-server\AcctDept — both "command completed successfully."
  • Free-letter logic: (@("Y","X","W"...) | Where-Object { $inUse -notcontains $_ })[0] from Win32_LogicalDisk DeviceIDs.
  • RMM/SMB transport: build UNC + domain\user from [char]92 to survive the JSON/PowerShell backslash collapse.

Pending / Incomplete Tasks

  • ASSISTNURSE-PC 1.0h onsite billing on #32303 — still paused at preview from earlier today (awaiting Howard's go).
  • Optional: force all three accounting drive maps to a single consistent letter (currently Chris Y:, Zachary Y:, Lauren X:).
  • Optional: lock down the legacy Main\Company Web Docs\Accounting Everyone:Full folder (HIPAA) — separate cleanup, not done.
  • The AcctScans Public Desktop shortcut on Lauren/Chris points at \Scans; the mapped drive points at the AcctDept root — both valid, just noting the dual entry points.

Reference Information

  • Share: \\CS-SERVER\AcctDept → D:\Shares\Accounting; scan dropbox subfolder \Scans.
  • Printer scan target: \\192.168.2.254\AcctDept\Scans (use IP, not hostname — VLAN-20 DNS).
  • Vault: clients/cascades-tucson/svc-scan.sops.yaml.
  • Standing rule: reuse svc-scan for all future Cascades scanner→folder setups (feedback_cascades_scan_account.md).
  • Agents: CS-SERVER c39f1de7..., ACCT2-PC da48bfbb..., DESKTOP-H6QHRR7 633458f6..., DESKTOP-N5G1ROO 205025ee....
Reference in New Issue View Git Blame Copy Permalink