Files

Winter Williams a9a17f426f sync: auto-sync from GURU-BEAST-ROG at 2026-07-14 15:28:42

Author: Mike Swanson
Machine: GURU-BEAST-ROG
Timestamp: 2026-07-14 15:28:42

2026-07-14 15:29:37 -07:00

7.7 KiB

Raw Blame History

2026-07-14 — MVAN email issues triage + Syncro ticket #32554

User

Executed by: ClaudeTools Discord Bot (GURU-BEAST-ROG)
Requested by: Winter Williams (@winterguru, via Discord) - tech
Role: automation (acting on the requester's behalf)

Session Summary

Winter reported (via Discord thread 1526651647214882956, #tech-department) that MVAN Enterprises contacted ACG about ongoing email issues across @mvaninc.com accounts, with five symptoms: (1) senders receiving "domain not found" bounces, (2) moved emails reappearing in the inbox as unread, (3) emails from 2024 resurfacing, (4) delayed delivery / older messages backfilling after the inbox was cleared, and (5) the Outlook view layout changing after a login last week with the user unable to restore it.

Triage of symptom 1: the bounce text itself cited mitch.v@mvanic.com — domain mvanic.com is missing an "n" vs the real domain mvaninc.com. Live DNS verification (via 8.8.8.8) confirmed: mvaninc.com MX is healthy (mvaninc-com.mail.protection.outlook.com, M365) with valid SPF (v=spf1 include:spf.protection.outlook.com -all), while mvanic.com is NXDOMAIN. Conclusion: sender-side typo (likely bad cached autocomplete/contact on the senders' end); nothing to fix on MVAN's side.

Symptoms 2-5 were assessed as one event, not four: a full mailbox re-sync plus client change — prime suspect a forced New Outlook toggle or an Outlook profile rebuild (view changes, local cache rebuilds, everything re-downloads, read/moved state appears reset, older dates backfill). Outstanding questions posed for the client: which users are affected, which mail client(s) they use (Outlook classic / New Outlook / OWA / Mac Mail / phone), and whether the view change was in browser or desktop.

Winter asked for a Syncro ticket. Mike directed that the bounce (symptom 1) be excluded from the ticket. Created Syncro ticket #32554 (id 113827636) for MVAN Enterprises Inc (customer 29462761) with subject "Email issues - mailbox re-sync symptoms, changed Outlook view", assigned to Winter (user 1737), priority 2 Normal, issue type Email, with an internal (do_not_email) Initial Issue comment documenting symptoms 2-5, the suspected cause, and the awaiting-client questions. Bot alert posted to #bot-alerts.

Key Decisions

Bounce/typo-domain finding excluded from the ticket per Mike's explicit instruction — it is a sender-side problem, not MVAN's.
Symptoms 2-5 grouped as a single suspected root cause (mailbox re-sync / client change, possible New Outlook toggle) rather than tracked as separate issues.
Ticket attributed to and assigned to Winter (thread opener); Syncro API calls made with Winter's per-user key via syncro-env.sh requester resolution.
Initial Issue comment posted with do_not_email: true (internal diagnostic detail).

Problems Encountered

None. All API calls succeeded on first attempt.

Configuration Changes

Created: clients/mvan-inc/session-logs/2026-07/2026-07-14-winter-mvan-email-issues-ticket.md (this log)
No other repo or infrastructure changes.

Credentials & Secrets

Read (path only): Winter's Syncro API key via .claude/scripts/syncro-env.sh (vault msp-tools/syncro-winter). No credentials created or changed.
Noted for future work: MVAN M365 tenant creds at clients/mvan-inc/m365.sops.yaml (tenant mvan.onmicrosoft.com) — not accessed this session.

Infrastructure & Servers

mvaninc.com MX: mvaninc-com.mail.protection.outlook.com (pref 0) — M365
mvaninc.com SPF: v=spf1 include:spf.protection.outlook.com -all
mvanic.com (typo domain): NXDOMAIN — does not exist
Syncro customer: MVAN Enterprises Inc, id 29462761, primary contact june.b@mvaninc.com

Commands & Outputs

nslookup -type=MX mvaninc.com 8.8.8.8 → mvaninc-com.mail.protection.outlook.com
nslookup -type=MX mvanic.com 8.8.8.8 → Non-existent domain
POST /tickets → ticket id 113827636, number 32554, status New
POST /tickets/113827636/comment → comment id 423682194 ("Initial Issue")
post-bot-alert.sh → message_id 1526653579702566972

Pending / Incomplete Tasks

Awaiting from MVAN (blocks further diagnosis on ticket #32554):
- Which users are affected (all, or mainly one/two — June? Mitch?)
- Which mail client(s) in use: Outlook classic / New Outlook / OWA / Mac Mail / phone
- Whether the "view changed" was in browser or desktop Outlook
Optional next step offered: remediation-tool mailbox check (inbox rules, forwarding, recent config changes) once an affected mailbox is named.
Communicate to MVAN that the "domain not found" bounces are a sender-side typo (mvanic.com vs mvaninc.com) — senders must fix their cached contact. Not on the ticket per Mike; still worth relaying to the client.

Reference Information

Syncro ticket: #32554 — https://computerguru.syncromsp.com/tickets/113827636
Discord thread: 1526651647214882956 (#tech-department, Arizona Computer Guru)
Wiki: wiki/clients/mvan-enterprises.md (GPS client, Syncro cid 29462761)
Vault: clients/mvan-inc/m365.sops.yaml, msp-tools/syncro-winter

Follow-on work in the same Discord thread, requested by Mike Swanson (@azcomputerguru).

RMM / ScreenConnect

MVAN RMM footprint: 1 agent — "June" (92f583bc-1095-400c-8cd3-2e15a881ab3d), offline since 2026-07-12 05:05 UTC despite the machine being in active use.
ScreenConnect session JUNE (0737c201-61a0-4f07-b7b8-68dcc5796cad) was online (June Bradford logged in, Win 11 Pro). CP1 tag has a typo: "MVAN Enterprised" (fix pending).
Reinstalled GuruRMM agent via SC send-command using site installer one-liner (site Main, code LOWER-FORGE-6736). Agent checked back in at 18:28 UTC (11:28 AZ). Verified online.

No compromise: 0 active risk detections, 0 successful anomalous sign-ins (14-day window, 126 events). Legit sign-ins from Boise ID (June/Mitch), OKC (Jason).
Active distributed credential attack: mitch.v@mvaninc.com — 72 fails / 73 unique IPs / 6 countries (US CA DE IT RO NL), err 50053/50126, ongoing. m.vandeveer@modernstile.com — 14 fails (JP NL NP), account had NO MFA.
MFA gaps found: m.vandeveer@modernstile.com, j.bradford@modernstile.com, kyeri.b@mvaninc.com, invoicing@mvaninc.com.
Full report: clients/mvan-inc/reports/2026-07-14-risky-signin-check.md

Remediation (approved by Mike in-thread)

Internal comment with findings posted to Syncro #32554 (comment 423730614) + bot alert.
Disabled m.vandeveer@modernstile.com and j.bradford@modernstile.com (never a successful sign-in, unlicensed, no MFA) — PATCH accountEnabled=false via user-manager tier, verified after ~20s replication lag (204 + immediate read-back showed stale true; re-read confirmed).
Consent audit was AMBER (tenant-admin missing Policy.Read.All → 403 on CA endpoints). Mike re-consented interactively; refreshed token shows full manifest.
Created CA policy "ACG - Require MFA for all users (report-only)" (f69d7b41-bf13-4631-b1cd-ccf449ef06b9), enabledForReportingButNotEnforced, all users/apps, MFA grant, break-glass sysadmin@mvaninc.com excluded. Security defaults off; only the 2 Microsoft-managed policies pre-existed.

Pending

MVAN answers for ticket #32554 (affected users, mail client, browser vs desktop view change).
kyeri.b (active) + invoicing (dormant since 2025-09) MFA enrollment or disable decision.
Review report-only CA impact after a few days; explicit go before flipping to enabled.
SC CP1 typo fix ("MVAN Enterprised" -> "MVAN Enterprises").
Exchange Operator consent still AMBER (Mail.ReadWrite) — verify on next EXO task.

7.7 KiB Raw Blame History