claudetools/clients/cascades-tucson/session-logs/2026-06/2026-06-10-howard-meredith-locked-word-doc.md

Cascades — Meredith locked Word doc (stale Office lock files) + 0.5h remote billing

User

• User: Howard Enos (howard)
• Machine: Howard-Home
• Role: tech

Session Summary

Meredith Kuhn at Cascades reported that "Employee General Training Signature Page.docx" on the \\cascadesds\Public\Company Web Docs\Staff Trainings share showed "locked for editing by her," with no one actually in the file. Confirmed cascadesds is the Synology NAS (192.168.0.120), not CS-SERVER.

Investigated via GuruRMM. CS-SERVER (running as SYSTEM/machine account) could not authenticate to the Synology Public share — expected, given the known NAS workgroup/Kerberos mismatch documented in the wiki. Switched the execution point to Meredith's own machine, ASSISTMAN-PC (agent cf86fa5e-96a2-494d-9cb1-8be22a518ad0), where she was actively logged in (meredithk, console session since 6/8). Ran a read-only listing in her user_session context, which reaches the share with her credentials.

Root cause: stale Word owner/lock files. The hidden ~$ployee General Training Signature Page.docx owner file (162 bytes, dated 7/12/2024) was orphaned in the folder — Word reads that ~$… file to display "locked for editing by [name]," so a ~2-year-old leftover produced a permanent false lock. The folder held five such orphaned 2024 owner files (General, Competency, Training, and two Disaster Drill docs). The real document was healthy (opened, not read-only). With the user's go-ahead (all 5), deleted all five ~$ owner files via Meredith's session and verified the folder clean.

Howard separately confirmed the Synology shows no one accessing the file after a reboot, corroborating the stale-lock diagnosis. Billed the work as 0.5h remote on a new Cascades ticket (#32403), bundling a second item Howard handled this morning — sending the admin password to John at 7:40 AM — under the same charge per his instruction. Cascades is a prepaid block customer; invoice netted $0.00 and the block decremented 56.75 → 56.25h. Saved this session log.

Key Decisions

• Used ASSISTMAN-PC (Meredith's PC) in user_session context rather than CS-SERVER as SYSTEM — the Synology Public share isn't reachable from the domain-joined server's machine account (workgroup/Kerberos), but Meredith's own token reaches it exactly as she does.
• Rebuilt the UNC path from [char]92 char codes inside PowerShell so no literal backslash had to survive the bash → jq → agent → powershell transport (an earlier probe lost a backslash, \\cascadesds → \cascadesds, and resolved against C:).
• Deleted all 5 orphaned 2024 owner files (not just the General one) — all clearly stale, and the other four would throw the same false lock on their docs.
• Billed remote labor product 1190473 at its live rate ($150); rate is cosmetic for a prepaid customer (invoice $0, block debits by quantity 0.5h).
• Left ticket contact blank (standing Cascades rule — Meredith is the recurring wrong default).

Problems Encountered

• CS-SERVER as SYSTEM returned Test-Path False on the share — not a real reachability conclusion at first because the UNC path had a backslash stripped in transport. Re-tested with char-code path construction; confirmed it's a genuine auth limitation (machine account can't reach the non-domain NAS), so pivoted to ASSISTMAN-PC user_session.

Configuration Changes

• Deleted 5 stale Word owner files on \\cascadesds\Public\Company Web Docs\Staff Trainings:
  • ~$ployee General Training Signature Page.docx
  • ~$ployee Competency Training Signature Page.docx
  • ~$ployee Training Signature Page.docx
  • ~$saster Drill Signature Page.docx
  • ~$saster Drill Template and Signature Page.docx
• No repo file changes beyond this session log.

Credentials & Secrets

• No credential was used or captured for the fix — the RMM agent ran in Meredith's session via SYSTEM/WTS impersonation.
• Meredith Kuhn has no vault entry; her login password is not on file and Howard does not have it. Not created (no password available). Options if needed later: AD reset on CS-SERVER via RMM, then vault.
• The admin password sent to John at 7:40 AM was handled by Howard outside this session; not recorded here.

Infrastructure & Servers

• cascadesds = Synology NAS, 192.168.0.120 (DSM :5000). Legacy file storage; hosts the Public share. Workgroup "CASCADES" → Kerberos auth failures from domain-joined machines (so SYSTEM on CS-SERVER cannot reach it).
• ASSISTMAN-PC (Meredith Kuhn) — GuruRMM agent cf86fa5e-96a2-494d-9cb1-8be22a518ad0, online, meredithk console session since 6/8/2026.
• CS-SERVER — GuruRMM agent c39f1de7-d5b6-45ae-b132-e06977ab1713, 192.168.2.254 (DC/file/Hyper-V).

Commands & Outputs

• RMM owner-file listing (user_session, ASSISTMAN-PC) found ~$ployee General Training Signature Page.docx (162 B, 7/12/2024) + 4 more 2024 owner files; target doc healthy (150073 B, LastWrite 7/12/2024, not read-only).
• Delete command (cmd:636e2541) → "DELETED" x5, verify "(none remain - clean)".
• Syncro: ticket #32403 (id 112502876), line item id 42810122 (0.5h @ $150), invoice id 1650638663 total $0.00, status Invoiced; prepay 56.75 → 56.25.

Pending / Incomplete Tasks

• Tell Meredith to fully close Word, then reopen the doc — should open editable with no lock prompt. If it still shows locked after a clean close/reopen, it would indicate a live SMB handle on the NAS (clear via Synology DSM → File Services / Resource Monitor). Howard's post-reboot check (no one accessing the file) indicates this is resolved.
• No Meredith vault entry; create only if a password becomes available.

Reference Information

• Share/file: \\cascadesds\Public\Company Web Docs\Staff Trainings\Employee General Training Signature Page.docx
• Syncro ticket: #32403 — https://computerguru.syncromsp.com/tickets/112502876
• Syncro invoice: 1650638663 ($0.00, 0.5 prepay applied)
• Cascades customer id: 20149445 (prepay 56.25h after this bill)
• RMM dispatch alerts: cmd:636e2541 (delete); Syncro alert posted to #bot-alerts

Update: 14:33 PT — re-save (no new work)

Second /save of the same session. No material changes since the initial save: the lock-file remediation (5 stale ~$ files deleted on ASSISTMAN-PC) and the 0.5h remote billing (Syncro #32403, invoice $0.00, prepay 56.75 → 56.25) were already complete and recorded above. Re-synced only.