azcomputerguru/claudetools
1
0
Fork 0
Code Issues 73 Pull Requests Actions Packages Projects Releases Wiki Activity
Files
742bc5f81b64463575b7b69b8e690f94c6733c22
claudetools/clients/cascades-tucson/docs/REMAINING-WORK-PLAN.md
Howard Enos 22c54f7307 sync: auto-sync from HOWARD-HOME at 2026-07-17 10:24:46 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-17 10:24:46
2026-07-17 10:25:54 -07:00

26 KiB
Raw Blame History

Cascades of Tucson — Remaining Work Plan (to completion)

Consolidated execution plan tying the open Syncro tickets to the broader migration workstreams (workstations -> domain, users/departments, HIPAA caregiver lockdown). Built 2026-06-24 (Howard) from a live AD+RMM diff. Companion to PROJECT_STATE.md and wiki/clients/cascades-tucson.md (current truth). Goal: finish the migration quickly by working it as one sequenced plan.

REFRESHED 2026-07-13 (reconcile pass vs wiki + live state): caregiver CA posture updated to the 7/1 interim cutover, roster 35, Home->Pro completions folded in, CS-SERVER EDR installed, ticket table reconciled against Syncro (0 open as of 7/10). The "Live snapshot" below is still the 6/24 AD-vs-RMM diff -- domain-join states are per-machine current in the wiki's "Migration phase status" table.

REFRESHED 2026-07-15 — FINISH-LINE PASS (full live verification sweep: Graph/M365, Datto EDR, UniFi, MSP360, DNS — all evidence in the 7/15 session log + wiki recompile):

  • CARF Technology Plan FINALIZED (docs/proposals/cascades-technology-plan-2026-07-15.md) — this roadmap is the execution engine behind it; plan targets (30/60/90 day) map to the workstreams below.
  • jodi.ramstack DECOMMISSIONED 7/15 (disabled + sessions revoked + suspended-Standard license reclaimed; mailbox was already deprovisioned by the suspended sub — no data in-tenant). Suspended Standard now 29 consumed.
  • EDR verified 35/35 incl. CS-SERVER; email auth (SPF/DKIM/DMARC) verified; ALIS SSO verified (secret good to 2028); 77 APs confirmed; voice VLAN exactly 37 devices.
  • Synology -> CS-SERVER share sync IS live and working (wiki was stale; corrected).
  • New workstreams added: WS8 (SharePoint/Teams HIPAA migration), WS9 (ALIS online payments), WS3 step 3b (nurse-station phone-parity shared login).
  • Prepaid block: 21.5 hrs (live 7/15).
  • Goal restated: close every workstream out — the sequence at the bottom is the finish order.

Live snapshot — domain-join inventory (2026-06-24, AD vs RMM diff)

Domain (cascades.local) — joined staff workstations (12): ACCT2-PC, CRYSTAL-PC, DESKTOP-DLTAGOI (Sharon/LE), DESKTOP-F94M8UT, DESKTOP-H6QHRR7, DESKTOP-N5G1ROO (Chris Knight), DESKTOP-ROK7VNM, DESKTOP-U2DHAP0 (Ashley), ASSISTNURSE-PC, NURSESTATION-PC, RECEPTIONIST-PC, MEGAN. (Plus infra: CS-SERVER = DC, CS-QB = QB VM. Stale AD objects to clean: DESKTOP-1ISF081 (last logon 2025-03), AZUREADSSOACC is the Seamless-SSO object — leave.)

In RMM but NOT domain-joined — still to migrate (~17):

Machine User / role Plan
ASSISTMAN-PC Meredith Kuhn (on LOCAL acct meredithk) Domain-join + migrate her to cascades\Meredith.Kuhn
ANN-PC (verify user) Join + OU + drives
DESKTOP-LPOPV30 (verify) Join + OU + drives
DESKTOP-MD6UQI3 (verify, offline) Join + OU + drives
MAINTENANCE-PC Maintenance Join -> OU=Maintenance
MDIRECTOR-PC Shelby Trozzi (MC Director) Join -> OU=Care-Memorycare
MEMRECEPT-PC MC reception (shared) Join -> OU=Shared PCs
NurseAssist (distinct from ASSISTNURSE-PC) Join or retire-as-dupe — verify
SALES4-PC Sales Join -> OU=Marketing
LAPTOP-8P7HDSEI (verify) Join or caregiver path
Health-Services-Director vs AD HEALTH-SERVICES Verify dup/rename before acting
CHEF-PC Culinary (Chef JD) Ticket #32254 — reinstall Windows, THEN join -> OU=Culinary
DESKTOP-TRCIEJA Lupe Sanchez EOL — replace machine (decision 2026-06-18), join the replacement
DESKTOP-KQSL232 Lois Lane DECOMMISSIONED 6/26 (her HEALTH-SERVICES box is already domain-joined)
CascadesProxess Proxess access-control appliance Likely leave un-joined — verify it's an appliance
Laptop2, LAPTOP-DRQ5L558, LAPTOP-E0STJJE8, Laptop4 Caregiver shared laptops Join via the Caregiver Devices path (Workstream 3), not the staff path

OU structure (built): OU=Departments -> Administrative, Marketing, Care-Assisted Living (+ Nurses), Care-Memorycare, Culinary, Housekeeping, Life Enrichment, Maintenance, Resident Services, Transportation, Caregivers. OU=Workstations -> Staff PCs, Shared PCs, OU=Caregiver Devices (under Staff PCs). Groups in OU=Groups.

Workstream 1 — Workstation domain migration

Goal: every staff PC on cascades.local + GuruRMM + correct dept OU + mapped dept drives; retire per-PC Synology Drive Client.

Per-machine runbook (scripts in docs/migration/scripts/):

  1. phase3-pre-join-verify.ps1 (OneDrive KFM unlinked, no poisoned shell folders, name OK)
  2. phase3-join-domain.ps1 -> join cascades.local
  3. phase3-post-join-verify.ps1
  4. Move computer object into the correct department OU
  5. Confirm GuruRMM agent still checks in; migrate the user profile/data
  6. Map department drives (Workstream 2); uninstall Synology Drive Client; delete local cache once clean
  7. Log the change

Tickets in this workstream: #32194 (deploy spare machine for new hire — join + enroll + AD acct), #32254 (Chef-PC reinstall then join).

Device readiness audit (2026-06-24, live probe of 15 un-joined online machines)

Machine User Edition Readiness
DESKTOP-LPOPV30 Karen Rossini Win11 Pro READY
MAINTENANCE-PC Bruce Miller Win11 Pro WS READY
LAPTOP-E0STJJE8 caregiver Win11 Pro WS READY (caregiver path)
ASSISTMAN-PC Meredith Kuhn Win11 Pro pending reboot
ANN-PC christina Win11 Enterprise pending reboot
Laptop2 caregiver Win11 Pro pending reboot
CHEF-PC Ramon Castaneda Win11 Pro do #32254 reinstall first
LAPTOP-8P7HDSEI User Win10 Home BLOCKED: Home->Pro + OneDrive KFM ON
MDIRECTOR-PC Shelby Trozzi Win11 Home BLOCKED: Home->Pro + reboot
MEMRECEPT-PC memfrtdesk Win10 Home BLOCKED: Home->Pro + reboot
NurseAssist Veronica Win11 Home Pro WS (upgraded 6/26) READY-ish: KFM ON (unlink) + reboot; confirmed distinct from ASSISTNURSE-PC
SALES4-PC Tamra (OFFBOARDED 6/30) Win11 Home Pro (supplier upgrade) Repurpose TBD; join when reassigned
LAPTOP-DRQ5L558 caregiver Win11 Pro WS BLOCKED: off-network (public DNS, no DC reach)
DESKTOP-TRCIEJA Lupe Sanchez Win11 Pro SKIP — EOL, being replaced
Health-Services-Director Lois Lane Win11 Pro WS already domain-joined (= AD HEALTH-SERVICES)

Prep blockers / decisions (2026-06-24):

  • 5 machines on Windows Home cannot domain-join until upgraded to Pro (need license keys): LAPTOP-8P7HDSEI, MDIRECTOR-PC, MEMRECEPT-PC, NurseAssist, SALES4-PC. Howard handling the Home->Pro upgrades himself, ONSITE (decision 2026-06-25).
    • 2026-06-25 live re-check: the 6PM cron ad0a56a9 never completed — all 5 still EditionID=Core (Home), Licensed on Home keys, none half-upgraded. ProductName reads "Windows 10 Home" even on the Win11 boxes (stale registry string) — trust EditionID, not ProductName.
    • DONE 2026-06-25 (~8:45 PM, remotely via RMM, no users logged in): the 3 online Home boxes upgraded Home->Pro. Process: changepk.exe /productkey <generic Pro key> flips Core->Professional (as SYSTEM it does NOT auto-reboot; registry vs licensing go out of sync — reboot once to finalize), then activate. Results:
      • MDIRECTOR-PC -> Professional, self-activated FREE via a built-in Pro digital entitlement (no MAK used, no charge). READY to domain-join.
      • MEMRECEPT-PC + LAPTOP-8P7HDSEI -> activated with the ACG MAK (infrastructure/windows-pro-mak). NOTE: the MAK is a Pro for Workstations MAK — /ipk retargets the edition to ProfessionalWorkstation (higher SKU, fine for domain join), /dli = Licensed, VOLUME_MAK channel. 2 MAK counts consumed -> bill 2x $99 = $198 to Cascades (line items name each machine). MEMRECEPT needed an /ato retry (first attempt hit transient 0x8004FE92).
      • [RESOLVED 6/26-6/30] NurseAssist + DESKTOP-MD6UQI3 upgraded to Pro for Workstations 6/26 (2 x $99 to bill — Syncro product 23571919, not yet invoiced as of 7/10); NurseAssist confirmed a distinct machine from ASSISTNURSE-PC. SALES4-PC upgraded to Pro by its supplier (no ACG charge); Tamra offboarded 6/30, machine repurpose TBD.
      • Next step for the 3 upgraded boxes = domain-join (they now read EditionID=Professional/PfW).
  • OneDrive KFM ON (unlink before folder-redirect GPO): LAPTOP-8P7HDSEI, NurseAssist.
  • Pending reboots + KFM unlinks: held for onsite (Howard) — disruptive to clear remotely.
  • LAPTOP-DRQ5L558 is off the Cascades network (8.8.8.8/1.1.1.1 DNS, no DC reachability) — must be on-site/on-LAN before any join.
  • Note: the legacy phase3-pre-join-verify.ps1 hardcodes the DC at 192.168.2.254; clients actually reach it at 192.168.2.248 (the .254 NIC is the Hyper-V vEthernet and does not cleanly serve domain SMB) — update the script's target before reuse.
  • Pro/Enterprise + internal machines are READY to join once reboots are cleared onsite: DESKTOP-LPOPV30, MAINTENANCE-PC, ASSISTMAN-PC, ANN-PC, LAPTOP-E0STJJE8, Laptop2 (+ CHEF-PC after #32254).

Workstream 2 — Users, departments & file-share access

Goal: every user in the right OU + SG-*-RW group; department drives mapped per the access matrix; Synology retired as primary.

  • Shares already created on CS-SERVER (D:\Shares\...): Management, Sales/SalesDept, Server, Accounting, Culinary, Activities, directoryshare, IT, Receptionist, Executive (NEW — Ashley+Meredith). Confirm ALdocs/WebDocs/LifeEnrichment exist + NTFS per the matrix.
  • Populate SG-*-RW groups per docs/migration/share-access-matrix-2026-04-23.md.
  • Map dept drives per user via GPP/logon script (Receptionist drive = machine+user scoped, Tower desk only).
  • Close out the matrix open questions (per-user interviews): Lois Lane, Karen Rossini, Susan Hicks, John Trozzi, Lupe Sanchez, Shelby Trozzi, Matt Brooks, Christine Nyanzunda; pacs/Clinical-PHI create-or-retire; web retire.

Tickets: #32193 (Executive restricted share — DONE 2026-06-24, E: mapped both machines), #32230 (Karen Rossini -> ALDOCS on Synology — recheck when she's in, she was out 2026-06-24).

Workstream 3 — HIPAA caregiver lockdown — GO-LIVE (highest value, mostly built)

[UPDATED 2026-07-15] The 7/1 cutover put caregivers in an interim posture: all 35 SG-Caregivers may sign in on desktops AND phones, on-network only (e35614e1 off-network block — policy itself enabled since 2026-04-29 per live CA read 7/15, trusted IPs 72.211.21.217/32 + 184.191.143.62/32 — + 7d491c7a 8h sign-in frequency enforced; SG-Caregivers excluded from MFA-for-all). The compliance-block policy ede985e2 was DISABLED 2026-07-01 — do not re-enable (superseded by the allow-list). Temp passwords are live for phone sign-in (must-change cleared fleet-wide 7/2; PSO-Caregivers never-expire FGPP in place). Roster = 35 after the 7/1 reconcile. Juan Andrade offboards 2026-07-16 afternoon (coord todo 80716a98).

Final lockdown = flip from test scope to real caregivers, one device at a time (detail: wiki "Entra Access Architecture"):

  1. Swap GPO CSC - Caregiver Workstation security filter SG-Caregivers-Test -> SG-Caregivers.
  2. CA allow-list policy 1b7fd025: two changes — retarget test group SG-Caregivers-DeviceTest -> SG-Caregivers AND flip from report-only (enabledForReportingButNotEnforced) to enforced. Prereqs: SG-Break-Glass + GDAP/service-provider exclusions in place (break-glass accounts still NOT created — do this first).
  3. Move each caregiver machine into OU=Caregiver Devices + SG-PC-MainTower/SG-PC-MemoryCare one at a time: Laptop2, LAPTOP-DRQ5L558, LAPTOP-E0STJJE8, ASSISTNURSE-PC (needs re-join + re-tag after Win11 reinstall), NURSESTATION-PC (+ verify NurseAssist/Laptop4). NOTE: the device-lockdown (auto-logoff) GPO only applies once machines are in OU=Caregiver Devices — until then desktops caregivers use under the interim posture have NO auto-logoff enforcement. 3b. [ADDED 2026-07-15, Howard] Nurse-station desktops = phone-parity shared login. The TWO nurse-station desktops — NURSESTATION-PC + ASSISTNURSE-PC (explicitly NOT the medtech laptops) — get the same model as the caregiver phones: ANY caregiver signs in with their own cascades\ username, lands on ALIS via SSO, and sees the SAME standardized desktop shortcuts to the SAME sites as the phones. Implementation: allow SG-Caregivers interactive logon on those two machines; deploy the shortcut set via the CSC - Caregiver Workstation GPO (per-machine, all-users desktop) so every profile is identical; no per-user profile customization; auto-lock/sign-out from the device-lockdown GPO applies (step 6). Define the canonical shortcut list from the phone home-screen set (ALIS + the same sites — capture the list from a phone before building).
  4. ALIS email-match the 35 caregivers + medtechs (ALIS staff Email = Entra UPN); ALIS records still to create for Munezero/Cota/Robinson; Vallejo email-match; 7 discharged-record decisions; turn off ALIS-native 2FA per user, then move to SSO-only (native login is a CA bypass path).
  5. Lower ALIS app session timeout 20 -> 15 min (Howard, ALIS admin).
  6. Reboot NURSESTATION-PC to activate + verify the device-lockdown GPO (lock @3min, 90s warn, sign-out @15min).
  7. Phones-only lockdown cohort: deferred to end of rollout — docs/cloud/caretaker-phones-only-list.md.
  8. Pilot cleanup: delete pilot.test, remove stale SG-Caregivers-Pilot exclude from the MFA policy, delete the pilot/test groups.

Workstream 4 — M365

  • Relicense remaining suspended Business Standard users -> Business Premium (Standard SKU is SUSPENDED — time-sensitive). Live 7/15: SPB 45 enabled / 41 consumed (4 free); suspended Standard 29 consumed after the jodi.ramstack reclaim — 29 users to move needs ~25 more SPB seats OR a per-user needs pass (lighter licenses where full Office isn't needed — the CARF plan Area 2 budgets ~$375–575/mo for the mix). Count seats + decide mix before touching licenses.
  • Decommission jodi.ramstack — DONE 2026-07-15 (disabled, sessions revoked, license reclaimed; mailbox already gone via the suspended sub — nothing recoverable in-tenant).
  • Create break-glass accounts (breakglass1/2-csc@) + enroll FIDO2 YubiKeys — still not created (confirmed 5/27); now a prerequisite for the WS3 allow-list enforcement flip.
  • Remove the standing Privileged Authentication Administrator role from the ComputerGuru - Tenant Admin SP (stranded by Alma's 6/25 offboarding; needs a Global Admin; keep its Conditional Access Administrator role). Pending Mike.
  • Build audit retention (Log Analytics 90d + Storage 6yr) in rg-audit-cascadestucson — approved 2026-04-29, still unbuilt (HIPAA SS164.312(b) gap, includes D:\Homes object-access auditing).
  • Zeke Huerta: register Authenticator MFA (under MFA-for-all with no method since 7/1).
  • Megan Hiatt: re-verify the April credential-stuffing remediation held (flagged 6/30).

Workstream 5 — Server / infrastructure

  • Cloud backup (MSP360 -> ACG-backup): re-verified 2026-07-15 — daily file-level backup running clean (incrementals current). [WARN] The image/system-state side was ~10 days stale at the 7/15 check — confirm/repair the image plan + set retention BEFORE the SSD swap. [GATE for any drive work]
  • CS-SERVER RAID -- CORRECTED 2026-06-24: HEALTHY, not degraded (live OMSA: both mirrors Ok, all 5 disks Online, all LEDs green; the 6/15 degraded self-recovered). NO emergency drive swap. 1:0:4 = global hot spare (do not remove). Planned reliability upgrade: replace the 2 consumer 320 GB drives (esp. flaky WD 0:0:3) with the 2x enterprise SSD already purchased, on a scheduled window w/ confirmed image/system-state backup. [WARN] PSU redundancy lost -- one PSU not delivering, check onsite. Service Tag 9MQFTK1. Real fix = DC migration off the 16-yr-old R610.
  • Clean up old-MSP agent sprawl (Datto RMM/CentraStage + Datto EDR/Infocyte) thrashing the spindle — DONE on CS-SERVER 2026-06-26 (full legacy Datto stack removed). Current Datto EDR installed on CS-SERVER 2026-07-13 (HUNTAgent=Running, cmd 0a60cac7) — the DC is back under managed endpoint protection. Fleet stragglers tracked in the wiki (DESKTOP-TRCIEJA BD_ACTIVE, laptop3/laptop1/ cascades-laptop reconcile, Syncro BD-deployment removal, GravityZone portal cleanup).
  • Synology -> backup-only: the share syncs Synology -> CS-SERVER ARE set up and working (confirmed by Howard 7/15; wiki corrected). Remaining: finish the role flip (server is primary, Synology becomes the onsite backup target per CARF plan Area 5) + close the workgroup/Kerberos quirk.
  • Rotate the Synology signin-portal credential (was committed plaintext historically).
  • pfSense: AutoConfigBackup not enabled (found 7/15) — enable it (config IS backed up via our repo copy, but ACB gives point-in-time restore).

Workstream 6 — Network (mostly complete)

  • CSC ENT device-island consolidation (phones + Helpany on 5 GHz) — repurpose CSC ENT as a 5 GHz-only WPA2 PPSK SSID and consolidate BOTH the Poly voice handsets (-> VLAN 30) and the Helpany "Paul" radar sensors (-> new VLAN 40) onto it, separated at the VLAN layer. Gets both off congested 2.4 GHz; keeps WPA2-only gear isolated so CSCNet can later move to WPA3/WiFi7/6GHz. Supersedes the standalone "Voice 5 GHz lock" item below and the earlier "delete CSC ENT" idea (deleting it would orphan the Pauls). Both vendors can move their devices remotely once we provide the network. Onsite gate: verify per-room 5 GHz coverage before the band flip (steel walls; weak-5GHz devices stay on 2.4). Full design + sequence: docs/network/csc-ent-device-island-plan.md.
    • Build VLAN 40 (Helpany, egress-only to *.sedimentum.com + snapcraft/ubuntu) on pfSense.
    • Enable PPSK on CSC ENT: key Ftfd85710# -> VLAN 40 (Pauls keep SSID+key, not reprogrammed); new voice key -> VLAN 30 (phones re-pointed by Howard/Richard).
    • Flip CSC ENT to 5 GHz-only (apply-wlan.sh ... bands 5g) in a coordinated window; pilot a few phones + Pauls, then full rollout.
    • Helpany = Sandro Cilurzo / Eugenie Nicoud; Poly = Richard Turner (Vertical).
    • PREREQUISITE (live 2026-06-24): CSC ENT has 149 clients, only 68 are Helpany. ~79 non-Helpany devices must be evacuated first — 14 staff PCs (domain mig), 11 printers, 11 DIRECTV + 11 resident IoT/TV + 15 personal phones + 17 unknown (resident-facing — need help reconnecting). ~51 are on 2.4 GHz and would drop on a 5 GHz-only flip. Per-device inventory + resident help-list: docs/network/csc-ent-client-inventory-2026-06-24.md. TODO: pull stat/alluser for offline resident TVs; identify the 17 unknowns + generic phones with John Trozzi.
  • #32319 WiFi Room 343 — relocate a floor-2/4 AP for coverage (unifi-wifi skill, site va6iba3v).
  • #32342 Copy Room switch — install + adopt into UniFi.
  • Sub-gigabit sweep (live 7/15): 34 switch ports at 100 Mbps + 5 AP uplinks below gig — cabling/NIC sweep, prioritize the AP uplinks. (Live UniFi count 7/15: 11 switches, 77 APs, voice VLAN exactly 37 devices.)
  • (Superseded) Voice 5 GHz lock — now folded into the CSC ENT consolidation above (single dedicated 5 GHz network for phones + sensors, not just a phone-side band lock).

Workstream 7 — Onsite peripheral

  • #32370 eFax setup (Karen & Christin) + portable scanner on both machines.

Workstream 8 — M365 collaboration migration (SharePoint / Teams) — HIPAA lockdown

Added 2026-07-15 (Howard): move Cascades onto SharePoint, Teams, and the wider Microsoft 365 platform to lock down data access and advance HIPAA compliance. Pairs with the network upgrade work (WS6) and the domain migration (WS1/2) — the dept OU/group structure built there becomes the SharePoint/Teams permission model.

  • Scope/plan the migration: department file shares (CS-SERVER D:\Shares + Synology) -> SharePoint document libraries with role-based permissions mapped from the existing AD dept groups; Teams for internal comms/collab (replaces ad-hoc channels); OneDrive for per-user files.
  • HIPAA guardrails first-class: role-scoped access (same SG model as caregiver lockdown), audit logging (ties into the WS4 audit-retention build), retention policies, DLP evaluation, sensitivity labels for PHI, external-sharing OFF by default.
  • Licensing already supports it — Business Premium (45 seats) includes SharePoint/Teams/ OneDrive/Intune/Purview basics; the WS4 relicensing moves the office staff onto it.
  • Sequencing: after (or alongside tail of) the domain migration — don't build SharePoint permissions on the pre-migration flat-share model. Candidate first movers: the newer role-based shares (Executive restricted, Company Web Docs, ALDOCS).
  • Synology then finishes its transition to backup-only (WS5) once shares live in SharePoint.
  • Also on the plan doc: Copilot evaluation under HIPAA guardrails + the KPI dashboard's SharePoint/Power BI Phase 1 (scheduled exports) land on this same platform.

Workstream 9 — ALIS online payment system

Added 2026-07-15 (Howard): get Cascades onto ALIS's online payment system (resident/family billing payments through the clinical-record platform, Medtelligent).

  • Scope with Medtelligent — scoping questions DRAFTED 2026-07-15 (docs/proposals/alis-online-payments-scoping-2026-07-15.md, 18 questions: availability/ pricing/processor/PCI/BAA/ledger-posting/API/rollout). Next action: send to the Medtelligent rep, loop in Jeff Bristol (accounting@) on replies. Q9 doubles as the BAA chase (Medtelligent BAA unverified — feeds the area-4 BAA inventory regardless).
  • Coordinate with the business office (Jeff Bristol / accounting@) on the AR workflow change and family communication.
  • IT-side items: SSO already live for ALIS (staff side); verify family-facing payment portal access needs nothing on our network/identity side; add Medtelligent's payment processing to the BAA/vendor tracker (plan area 4).
  • Ties into the KPI dashboard (ALIS billing data is a Phase 1 export source).

Finish sequence — re-cut 2026-07-15 (order of completion)

Everything below is scoped, built, or blocked on exactly one prerequisite — this is the close-out order, not a wish list.

  1. 2026-07-16 afternoon: offboard Juan Andrade (disable + SG-Caregivers removal + license reclaim) — coord todo 80716a98. Do NOT disable before then.
  2. Break-glass accounts (breakglass1/2-csc@) + FIDO2 keys + strip the stranded PAA role (WS4) — THE blocking prerequisite for the allow-list enforcement flip; the tenant runs live block policies with no break-glass today. Also the CARF plan's 30-day security item.
  3. Caregiver lockdown go-live (WS3 steps 1–8, incl. 3b nurse-station phone-parity build) — highest HIPAA value; the real control (1b7fd025 allow-list) is still report-only/test-scoped. Capture the phone shortcut list for 3b while onsite for the OU moves.
  4. M365 relicense the 29 suspended-Standard users (WS4) — time-sensitive; decide seat mix first (4 SPB free vs 29 to move).
  5. Repair/confirm the image/system-state backup -> scheduled SSD swap (WS5) — image side was ~10 days stale on 7/15; single-DC risk until done.
  6. Remaining staff domain joins + dept drives (WS1+2: ~10 machines left after readiness blockers cleared) + printer-share repoints / Point-and-Print GPO fleet-wide (wiki VLAN 20). Onsite batch: reboots, KFM unlinks, LAPTOP-DRQ5L558 on-LAN.
  7. Network tail (WS6: CSC ENT device island incl. the ~79-client evacuation, 34-port + 5-AP-uplink gig sweep) + audit-retention build (WS4 — HIPAA 164.312(b) gap, approved since 4/29).
  8. M365 collaboration migration (WS8) — SharePoint/Teams scoping once the domain-migration tail is done; permission model rides the dept OU/SG structure from WS1/2. Synology finishes its backup-only role flip (WS5) behind it.
  9. ALIS online payments (WS9) — vendor-driven, runs in parallel with everything above: scoping questions are DRAFTED (docs/proposals/alis-online-payments-scoping-2026-07-15.md) — send to Medtelligent when ready; business-office coordination (Jeff Bristol) is the long pole.
  10. Ticket-verify pass with Howard (table below) — confirm the 6 closed-in-Syncro tickets were actually completed; any that weren't fold back into WS1/2/6/7 and get done in step 6–7 onsite trips.

Open Syncro tickets -> workstream map

[RECONCILE 2026-07-13] Syncro showed 0 open tickets as of 7/10, but the 6 tickets below were "Open — onsite" in the 6/24 plan and no completion is recorded in the wiki/session logs. VERIFY with Howard: completed-and-closed, or closed-without-work? Any not actually done go back on the board as workstream items (the underlying work — Chef-PC reinstall+join, Room 343 AP, Copy Room switch, eFax/scanner, spare machine, Karen ALDOCS — is still required by WS1/2/6/7).

Ticket Workstream Status
#32193 Executive restricted share 2 DONE 2026-06-24 (E: both machines, billed 0.5h block)
#32194 spare machine for new hire 1 Closed in Syncro — verify work done
#32230 Karen -> ALDOCS 2 Closed in Syncro — Karen's ALDocs shortcut WAS set 6/26 (drive-map); likely done
#32254 Chef-PC reinstall 1 Closed in Syncro — verify reinstall + domain-join happened
#32319 WiFi Room 343 6 Closed in Syncro — verify AP relocation done
#32342 Copy Room switch 6 Closed in Syncro — verify switch installed/adopted
#32370 eFax + scanner 7 Closed in Syncro — verify eFax + scanner delivered
Reference in New Issue View Git Blame Copy Permalink