azcomputerguru/claudetools
1
0
Fork 0
Code Issues 58 Pull Requests Actions Packages Projects Releases Wiki Activity
Files
384f5967e93cdbeebb6c1409aecf50e83e243ec6
claudetools/projects/gps-rmm-audit/session-logs/2026-07/2026-07-07-howard-gps-onboard-endpoint-backup-verify.md
Howard Enos 8efc351e25 sync: auto-sync from HOWARD-HOME at 2026-07-07 08:22:41 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-07 08:22:41
2026-07-07 08:23:08 -07:00

8.1 KiB
Raw Blame History

GPS Audit — Held-Client Endpoint Backup Verification + Janet/Marty Ryan Onboarding

User

  • User: Howard Enos (howard)
  • Machine: Howard-Home
  • Role: tech

Session Summary

Continuation of the GPS -> GuruRMM backup verification (prior log 2026-07-05-howard-gps-backup-map-msp360.md). Deleted a wrong weekend findings DM to Winter, then resolved the 4 "held / Datto-candidate" billed-backup clients from the map (Reliant, The Prairie Schooner, Janet Altschuler, Design & Brand Envoys) by putting eyes directly on the machines.

For the 3 clients that already had online GuruRMM agents (Reliant, Prairie, Envoys), ran a Datto-product inventory then a full backup-software scan. Result: their machines run Datto EDR + Datto RMM (security/management) but no Datto backup client and no backup software of any kind — confirming "Datto backup" per Mike was EDR/RMM, not a backup. The one apparent exception, Prairie's TPS-SERVER showing wbadmin=yes, turned out to be a Windows Server Backup to a USB disk whose last successful run was 3/7/2018 (~8 years dead). So all verified NOT backing up.

Janet Altschuler had zero footprint (no RMM agent). Located her 2 machines in ScreenConnect (ALTSCHULER-FRON, ALTSCHULER-JANE, Company "Altschuler", both online), onboarded a GuruRMM client + site, pushed the agent via SC send-command, and both enrolled. Both already had Datto EDR (confirmed in the EDR console) so per Howard left EDR alone; tied the accounts together (SC Company/Site normalized to "Janet Altschuler"/"Main", created her wiki). A full backup-software scan of both machines confirmed no backup running (only Dropbox, stopped).

Updated the Winter + Mike Discord messages in place (PATCH) with the endpoint-verified results rather than sending new ones. Then ran the GPS-RMM autoenroll plan for machines that came back online: WillcoxDOTAdmin enrolled and auto-reassigned to Reliant (verified a real Reliant Syncro asset); DESKTOP-OC2PH4I (Marty Ryan) enrolled to Staging. Per Howard, onboarded a new "Marty Ryan" RMM client and reassigned that machine into it; left the disabled GPS-RMM-AutoEnroll scheduled task disabled. Updated customer wikis for the added machines (created marty-ryan.md and reliant-well-drilling.md; janet-altschuler.md already existed).

Key Decisions

  • Verified the held clients by direct endpoint inspection instead of waiting on the Datto Workplace super-admin key — RMM agents were already present on 3 of 4, giving ground truth.
  • Trusted the Datto EDR console over an endpoint registry scan when the two disagreed on Janet's EDR status (the first quick scan missed the EDR agent; console showed both online).
  • Left EDR untouched on Janet's machines (both already covered) per Howard's rule; only tied accounts together (SC + wiki).
  • Edited the existing Winter/Mike DMs in place rather than sending new messages — keeps one authoritative thread and avoids another retraction (the weekend Winter DM had to be deleted).
  • Onboarded Marty Ryan as a real RMM client so the Staging machine could be reassigned; left the autoenroll scheduled task disabled per Howard (manual sweeps only).

Problems Encountered

  • First quick Datto scan on Janet's machines reported only "Datto RMM" (no EDR); a thorough re-scan + the EDR console both showed Datto EDR Agent present. Transient miss — resolved by treating the console as authoritative.
  • Broad backup-detection regex matched Windows built-ins (MareBackup, RegIdleBackup, Recovery-*, Sync Host) and unrelated apps (Dropbox, Nero, NETGEAR Genie) — filtered those out; the only real signal was Prairie TPS-SERVER's ancient wbadmin history.
  • ScreenConnect extension does not expose full-fleet listing (GetSessions absent) — can only query GetSessionsByName, so finding Janet's machines required her hostnames (Howard supplied them: ALTSCHULER-FRON / ALTSCHULER-JANE).
  • git rebase conflict in errorlog.md during a /sync (two machines appended entries) — resolved by keeping both sides (append-only log), git add + rebase --continue.
  • ownCloud usage/users too slow (occ load) to confirm Mineralogical earlier — used direct SSH + filecache MySQL query instead (separate finding, prior in-session).

Configuration Changes

Created:

  • wiki/clients/janet-altschuler.md (earlier in session)
  • wiki/clients/marty-ryan.md, wiki/clients/reliant-well-drilling.md
  • Vault: clients/altschuler/gururmm-site-main.sops.yaml, clients/marty-ryan/gururmm-site-main.sops.yaml Modified:
  • projects/gps-rmm-audit/backup-map.md (4 held clients -> endpoint-verified NOT BACKING UP; rollup now 7 of 16 not backing up)
  • projects/gps-rmm-audit/gps-clients.json (40-client cid list, earlier)
  • projects/gps-rmm-audit/autoenroll.log (manual sweep run 2026-07-07 07:18)

Credentials & Secrets

  • GuruRMM enrollment key — Janet Altschuler: vault clients/altschuler/gururmm-site-main.sops.yaml. client_id d041b8db-1f68-4b30-9ef9-c7b38f44c079, site GOLD-LION-1382.
  • GuruRMM enrollment key — Marty Ryan: vault clients/marty-ryan/gururmm-site-main.sops.yaml. client_id b223e7eb-8220-495b-9dcf-4cfd6d974e20, site WARM-WOLF-1324.
  • Datto EDR reg key — Janet Altschuler: altschul01 (org "Altschuler, Janet" c430e9ac-5d5f-43a7-af8b-f241f6a7dfb1), already vaulted msp-tools/datto-edr-regkeys.sops.yaml.
  • Datto Workplace super-admin API key: still NOT received from Mike (existing key 6d1dbfa4 = 0 projects).

Infrastructure & Servers

  • GuruRMM API http://172.16.3.30:3001 (RMM base via rmm-auth.sh).
  • ScreenConnect https://computerguru.screenconnect.com (RESTful API Manager, GetSessionsByName only).
  • Janet Altschuler SC sessions: ALTSCHULER-FRON 73e2b210-a794-4c82-8903-8b9d55842eab, ALTSCHULER-JANE 00aab70e-dcce-4278-83ea-7c6107ce6b73 (Company set to "Janet Altschuler", Site "Main").
  • Datto EDR instance azcomp4587 (infocyte.com). Both Altschuler machines online, agent v3.17.1.5552.
  • RMM machine placements 2026-07-07: Reliant = BookKeeper, RWD-CHRIS, WillcoxDOTAdmin; Marty Ryan = DESKTOP-OC2PH4I; Janet Altschuler = Altschuler-Front, Altschuler-Janet.

Commands & Outputs

# autoenroll plan (push Staging installer to online-not-in-RMM, wait, reassign)
bash .claude/scripts/gps-rmm-autoenroll.sh          # 2026-07-07 07:18: pushed 2, reassigned 1
python projects/gps-rmm-audit/tools/rebuild-and-push.py --dry   # ONLINE now:2 active<=14d:10 stale:4 dead:58
python projects/gps-rmm-audit/tools/reassign-staging.py         # DESKTOP-OC2PH4I -> Marty Ryan
# onboard (client + site + vault key): POST /api/clients {name}; POST /api/sites {client_id,name:Main}
# Datto EDR install one-liner: edr.py deploy-cmd --regkey altschul01
# Discord message edit (PATCH): /channels/{ch}/messages/{id} {content}

Endpoint backup scan result (held clients, 2026-07-06/07): Reliant BookKeeper/RWD-CHRIS = none; Prairie Mel-PC/TPS-Tina = none, TPS-SERVER = WSB last 3/7/2018 (dead), TPS-SVR unscannable; Envoys DESKTOP-BCLOLSI/-I51630E = none (OSGOOD-PAUL offline); Janet FRON/JANE = none (Dropbox stopped).

Pending / Incomplete Tasks

  • Mike/Winter reply to the backup question (4 clients) + the Datto Workplace super-admin API request — both still unanswered as of 2026-07-07.
  • 10 machines "active <=14d" not currently online — will only enroll on a manual autoenroll sweep (gps-rmm-autoenroll.sh); the scheduled task is left DISABLED per Howard.
  • Prairie TPS-SVR failed to scan (offline/timeout) — re-check backup on it when online.
  • Envoys OSGOOD-PAUL offline — scan when it surfaces.
  • Backup billing decisions for Mike/Winter still open (7 of 16 billed clients not backing up; revenue leaks; $0 backup lines) — see backup-map.md.

Reference Information

  • Backup map: projects/gps-rmm-audit/backup-map.md
  • Client wikis: wiki/clients/janet-altschuler.md, marty-ryan.md, reliant-well-drilling.md
  • Autoenroll tooling: .claude/scripts/gps-rmm-autoenroll.sh, projects/gps-rmm-audit/tools/{rebuild-and-push,reassign-staging}.py
  • Memory: reference_msp360_backup_monitoring, feedback_backup_targets_never_guessed
  • Discord msg IDs (edited in place): winter 1523814142128033922, mike 1523814169705578550
Reference in New Issue View Git Blame Copy Permalink