Mike Swanson
32f64a9561
Notable findings per article: - internal-infrastructure: Neptune cert expires 2026-05-31, DkimSigner disabled (unsigned outbound mail), Cloudflare tunnel on Jupiter - peaceful-spirit: L2TP/IPsec RRAS VPN; billing/Syncro ID undocumented - cryoweave: website redesign pending client assets - glaztech: phishing bypassed MailProtector via secondary MX (fixed); no MFA enforcement yet; do not enable Security Defaults yet - pavon: OwnCloud cron stacking fixed; Nextcloud migration deferred - grabb-durando: plaintext DB password in README needs vaulting; AI demand review app scoped - stamback-septic: WS2012 EOL server on network - sombra-residential: Server2013 is actually WS2012 EOL unpatched - birth-biologic: Datto→SharePoint migration unconfirmed complete Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
108 lines
6.2 KiB
Markdown
108 lines
6.2 KiB
Markdown
---
|
|
type: client
|
|
name: stamback-septic
|
|
display_name: Stamback Septic
|
|
last_compiled: 2026-05-24
|
|
compiled_by: DESKTOP-0O8A1RL/claude-main
|
|
sources:
|
|
- clients/stamback-septic/CONTEXT.md
|
|
- clients/stamback-septic/session-logs/2026-05-05-howard-onboarding-and-joe-laptop-onedrive-fix.md
|
|
backlinks:
|
|
- projects/gururmm
|
|
---
|
|
|
|
# Stamback Septic
|
|
|
|
## Profile
|
|
|
|
- **Company type:** Septic services company (Tucson, AZ)
|
|
- **Contract type:** Prepaid block (hours-based)
|
|
- **Key contacts:**
|
|
- Joe Schmuker — accountspayable@fusionsiteservices.com | (520) 384-4803 office | (520) 484-5235 mobile
|
|
- Joe alternate email: js.stambackseptic@gmail.com (linked to possible duplicate Syncro record)
|
|
- **Address:** 8939 South Eisenhower Road, Tucson AZ 85756
|
|
- **Billing rate:** $150/hr (Labor - Remote Business, product `1190473`)
|
|
- **Hours remaining (prepaid):** ~3.5 hrs as of 2026-05-05 (was 5.5 hrs; 2.0 hrs debited via Syncro ticket #32234)
|
|
- **Customer since:** 2018-01-09
|
|
- **Syncro customer ID:** 11513046
|
|
- **Possible duplicate Syncro record:** 34021422 (Joseph Schmuker, email js.stambackseptic@gmail.com, no business linked) — NOT merged; flag if it appears in billing or ticket flows
|
|
|
|
## Infrastructure
|
|
|
|
### Servers & Services
|
|
|
|
Not yet documented. No servers or network infrastructure captured in available session logs.
|
|
|
|
### Email & Identity
|
|
|
|
- **M365 / email:** Joe uses `joe.schmuker@fusionsite.com` (FusionSite tenant `3dd7fc1e-7d46-4e83-931a-8abe57a8bc73`) — this appears to be Stamback's parent or affiliated company domain. Also associated with `joe@stambackservices.com`, `info@stambackservices.com`, `JSchmuker@fusionsiteservices.com` — multi-domain identity history.
|
|
- **M365 tenant details:** [unverified — no ACG-managed tenant confirmed for Stamback directly]
|
|
- **MFA status:** [unverified]
|
|
|
|
### Network
|
|
|
|
- **ISP / WAN:** [unverified]
|
|
- **Firewall:** [unverified]
|
|
- **VPN:** [unverified]
|
|
|
|
## GuruRMM
|
|
|
|
- **Client name:** Stamback Septic
|
|
- **Client code:** `STAM`
|
|
- **Client ID:** `b3ba0e60-6132-4403-888b-601054ed4a9a`
|
|
- **Site name:** StambackSeptic
|
|
- **Site code:** `SOUTH-PHOENIX-4306`
|
|
- **Site ID:** `0f3abe88-834f-4943-b28f-e97c236a0fea`
|
|
- **Agent enrollment key:** Encrypted at `clients/stamback-septic/gururmm-site-main.sops.yaml` (generated once at site creation 2026-05-05; do not regenerate unless compromised)
|
|
|
|
### Enrolled Agents
|
|
|
|
| Agent | Host | OS | Version | Agent ID | Notes |
|
|
|---|---|---|---|---|---|
|
|
| DESKTOP-BTR2AM3 | [unverified] | Windows | [unverified] | [unverified] | Seen in GuruRMM fleet table (wiki/projects/gururmm.md) — confirmed enrolled |
|
|
| StambackLaptopNew | Joe Schmuker's laptop | Windows 11 26200 | [unverified] | `4b6e9b9e-b7bb-4a91-836d-c3ce11fbb9c3` | Cloned laptop; single local profile `Owner`; not domain/Azure AD joined; OneDrive identity cleanup performed 2026-05-05 |
|
|
|
|
[WARNING] Neither agent was confirmed enrolled at time of CONTEXT.md creation (2026-05-05 — "None yet"). Both appear in the GuruRMM fleet table as of 2026-05-24 fleet snapshot, implying enrollment occurred after initial setup. Agent IDs for DESKTOP-BTR2AM3 not captured in any available file.
|
|
|
|
### Agent Deployment Command (ScreenConnect / SYSTEM context)
|
|
|
|
```powershell
|
|
$u='https://rmm-api.azcomputerguru.com/downloads/gururmm-agent-windows-amd64-latest.exe';
|
|
$d='C:\Windows\Temp\gururmm-agent.exe';
|
|
Invoke-WebRequest $u -UseBasicParsing -OutFile $d;
|
|
& $d install --server-url 'wss://rmm-api.azcomputerguru.com/ws' --api-key 'grmm_vC91v9Rv5FYsVfW4RBWa4UduDsUcW5uc'
|
|
```
|
|
|
|
## Licenses & Assets
|
|
|
|
- **Emsisoft License:** `PAK-MIV-BAN-843`
|
|
|
|
## Access
|
|
|
|
- **Remote access:** ScreenConnect (ACG-managed instance) — used for OneDrive fix session 2026-05-05
|
|
- **Vault path:** `clients/stamback-septic/gururmm-site-main.sops.yaml` (enrollment key only; other credentials not yet vaulted)
|
|
- **Syncro:** https://computerguru.syncromsp.com/customers/11513046
|
|
|
|
## Patterns & Known Issues
|
|
|
|
- **Clone + multi-tenant identity mess:** Joe's laptop was cloned from an existing machine. The source machine had M365/OneDrive identity caches across at least three tenants (FusionSite, StambackServices, consumer MSA). Post-clone, DPAPI-bound refresh tokens from the source machine were undecryptable, causing OneDrive silent sign-in failure. A full identity wipe (HKCU OneDrive accounts, Office Identity, OneAuth cache, TokenBroker cache) followed by clean sign-in was required. This should be treated as a standard post-clone step for any user with an M365 history.
|
|
- **"Allow my organization to manage my device" trap:** After identity wipe, Joe checked the device-management checkbox at OneDrive sign-in, which triggered an Azure AD device-join attempt that FusionSite's Conditional Access rejected. Fix: sign out from the failed join (Settings → Access work or school), re-sign in without the checkbox. Document this in new-PC checklist.
|
|
- **GuruRMM agent task queue wedge:** If a remote command spawns a child process that does not exit cleanly (e.g., `OneDrive.exe /reset`), the agent command queue can wedge — agent stays online but new commands sit pending indefinitely. Resolved by endpoint reboot. Track as a known agent behavior; worth a check-and-clear hook in a future agent version.
|
|
- **Prepay visibility in Syncro:** Prepay balance was not visible in the Syncro GUI during the session (Mike thought there were no prepay hours). Always verify via `GET /customers/{id}` → `.customer.prepay_hours` API call rather than relying on GUI display.
|
|
- **Syncro auto-applies prepay at invoice creation:** Even when billing at standard rate ($150/hr, product `1190473`), Syncro deducts from prepay block automatically at invoice time. To bill at full rate without touching prepay, use a non-applicable product or zero out prepay first.
|
|
|
|
## Active Work
|
|
|
|
None documented as of 2026-05-05. Onboarding complete; agents enrolled.
|
|
|
|
## History Highlights
|
|
|
|
| Date | Event |
|
|
|---|---|
|
|
| 2018-01-09 | Customer since in Syncro |
|
|
| 2026-05-05 | Howard: Initial GuruRMM onboarding — client + site created, in-repo scaffold created, enrollment key vaulted. Joe Schmuker's cloned laptop OneDrive identity cleanup (multi-tenant cache wipe). Billed 2 hrs via Syncro ticket #32234 (invoice #67562, $0 — prepay auto-applied). Stamback prepay balance: 5.5 → 3.5 hrs. |
|
|
|
|
## Backlinks
|
|
|
|
- [[projects/gururmm]] — DESKTOP-BTR2AM3 and StambackLaptopNew enrolled (site: StambackSeptic)
|