383 lines
26 KiB
Markdown
383 lines
26 KiB
Markdown
# Cascades of Tucson — Remaining Work Plan (to completion)
|
||
|
||
> Consolidated execution plan tying the open Syncro tickets to the broader migration
|
||
> workstreams (workstations -> domain, users/departments, HIPAA caregiver lockdown).
|
||
> Built 2026-06-24 (Howard) from a live AD+RMM diff. Companion to `PROJECT_STATE.md`
|
||
> and `wiki/clients/cascades-tucson.md` (current truth).
|
||
> Goal: finish the migration quickly by working it as one sequenced plan.
|
||
>
|
||
> **REFRESHED 2026-07-13** (reconcile pass vs wiki + live state): caregiver CA posture
|
||
> updated to the 7/1 interim cutover, roster 35, Home->Pro completions folded in,
|
||
> CS-SERVER EDR installed, ticket table reconciled against Syncro (0 open as of 7/10).
|
||
> The "Live snapshot" below is still the 6/24 AD-vs-RMM diff -- domain-join states are
|
||
> per-machine current in the wiki's "Migration phase status" table.
|
||
>
|
||
> **REFRESHED 2026-07-15 — FINISH-LINE PASS** (full live verification sweep: Graph/M365,
|
||
> Datto EDR, UniFi, MSP360, DNS — all evidence in the 7/15 session log + wiki recompile):
|
||
> - **CARF Technology Plan FINALIZED** (`docs/proposals/cascades-technology-plan-2026-07-15.md`)
|
||
> — this roadmap is the execution engine behind it; plan targets (30/60/90 day) map to the
|
||
> workstreams below.
|
||
> - **jodi.ramstack DECOMMISSIONED 7/15** (disabled + sessions revoked + suspended-Standard
|
||
> license reclaimed; mailbox was already deprovisioned by the suspended sub — no data in-tenant).
|
||
> Suspended Standard now 29 consumed.
|
||
> - **EDR verified 35/35** incl. CS-SERVER; email auth (SPF/DKIM/DMARC) verified; ALIS SSO
|
||
> verified (secret good to 2028); 77 APs confirmed; voice VLAN exactly 37 devices.
|
||
> - **Synology -> CS-SERVER share sync IS live and working** (wiki was stale; corrected).
|
||
> - **New workstreams added**: WS8 (SharePoint/Teams HIPAA migration), WS9 (ALIS online
|
||
> payments), WS3 step 3b (nurse-station phone-parity shared login).
|
||
> - Prepaid block: **21.5 hrs** (live 7/15).
|
||
> - Goal restated: **close every workstream out** — the sequence at the bottom is the
|
||
> finish order.
|
||
|
||
---
|
||
|
||
## Live snapshot — domain-join inventory (2026-06-24, AD vs RMM diff)
|
||
|
||
**Domain (`cascades.local`) — joined staff workstations (12):**
|
||
ACCT2-PC, CRYSTAL-PC, DESKTOP-DLTAGOI (Sharon/LE), DESKTOP-F94M8UT, DESKTOP-H6QHRR7,
|
||
DESKTOP-N5G1ROO (Chris Knight), DESKTOP-ROK7VNM, DESKTOP-U2DHAP0 (Ashley),
|
||
ASSISTNURSE-PC, NURSESTATION-PC, RECEPTIONIST-PC, MEGAN.
|
||
(Plus infra: CS-SERVER = DC, CS-QB = QB VM. Stale AD objects to clean: DESKTOP-1ISF081 (last logon 2025-03), AZUREADSSOACC is the Seamless-SSO object — leave.)
|
||
|
||
**In RMM but NOT domain-joined — still to migrate (~17):**
|
||
|
||
| Machine | User / role | Plan |
|
||
|---|---|---|
|
||
| ASSISTMAN-PC | Meredith Kuhn (on LOCAL acct `meredithk`) | Domain-join + migrate her to `cascades\Meredith.Kuhn` |
|
||
| ANN-PC | (verify user) | Join + OU + drives |
|
||
| DESKTOP-LPOPV30 | (verify) | Join + OU + drives |
|
||
| DESKTOP-MD6UQI3 | (verify, offline) | Join + OU + drives |
|
||
| MAINTENANCE-PC | Maintenance | Join -> OU=Maintenance |
|
||
| MDIRECTOR-PC | Shelby Trozzi (MC Director) | Join -> OU=Care-Memorycare |
|
||
| MEMRECEPT-PC | MC reception (shared) | Join -> OU=Shared PCs |
|
||
| NurseAssist | (distinct from ASSISTNURSE-PC) | Join or retire-as-dupe — verify |
|
||
| SALES4-PC | Sales | Join -> OU=Marketing |
|
||
| LAPTOP-8P7HDSEI | (verify) | Join or caregiver path |
|
||
| Health-Services-Director | vs AD `HEALTH-SERVICES` | Verify dup/rename before acting |
|
||
| **CHEF-PC** | Culinary (Chef JD) | **Ticket #32254** — reinstall Windows, THEN join -> OU=Culinary |
|
||
| DESKTOP-TRCIEJA | Lupe Sanchez | EOL — **replace machine** (decision 2026-06-18), join the replacement |
|
||
| DESKTOP-KQSL232 | Lois Lane | **DECOMMISSIONED 6/26** (her HEALTH-SERVICES box is already domain-joined) |
|
||
| CascadesProxess | Proxess access-control appliance | Likely leave un-joined — verify it's an appliance |
|
||
| Laptop2, LAPTOP-DRQ5L558, LAPTOP-E0STJJE8, Laptop4 | Caregiver shared laptops | Join via the **Caregiver Devices** path (Workstream 3), not the staff path |
|
||
|
||
**OU structure (built):** `OU=Departments` -> Administrative, Marketing, Care-Assisted Living
|
||
(+ Nurses), Care-Memorycare, Culinary, Housekeeping, Life Enrichment, Maintenance, Resident
|
||
Services, Transportation, Caregivers. `OU=Workstations` -> Staff PCs, Shared PCs,
|
||
`OU=Caregiver Devices` (under Staff PCs). Groups in `OU=Groups`.
|
||
|
||
---
|
||
|
||
## Workstream 1 — Workstation domain migration
|
||
|
||
**Goal:** every staff PC on `cascades.local` + GuruRMM + correct dept OU + mapped dept drives;
|
||
retire per-PC Synology Drive Client.
|
||
|
||
**Per-machine runbook** (scripts in `docs/migration/scripts/`):
|
||
1. `phase3-pre-join-verify.ps1` (OneDrive KFM unlinked, no poisoned shell folders, name OK)
|
||
2. `phase3-join-domain.ps1` -> join `cascades.local`
|
||
3. `phase3-post-join-verify.ps1`
|
||
4. Move computer object into the correct **department OU**
|
||
5. Confirm GuruRMM agent still checks in; migrate the user profile/data
|
||
6. Map department drives (Workstream 2); uninstall Synology Drive Client; delete local cache once clean
|
||
7. Log the change
|
||
|
||
**Tickets in this workstream:** #32194 (deploy spare machine for new hire — join + enroll + AD acct),
|
||
#32254 (Chef-PC reinstall then join).
|
||
|
||
### Device readiness audit (2026-06-24, live probe of 15 un-joined online machines)
|
||
|
||
| Machine | User | Edition | Readiness |
|
||
|---|---|---|---|
|
||
| DESKTOP-LPOPV30 | Karen Rossini | Win11 Pro | READY |
|
||
| MAINTENANCE-PC | Bruce Miller | Win11 Pro WS | READY |
|
||
| LAPTOP-E0STJJE8 | caregiver | Win11 Pro WS | READY (caregiver path) |
|
||
| ASSISTMAN-PC | Meredith Kuhn | Win11 Pro | pending reboot |
|
||
| ANN-PC | christina | Win11 Enterprise | pending reboot |
|
||
| Laptop2 | caregiver | Win11 Pro | pending reboot |
|
||
| CHEF-PC | Ramon Castaneda | Win11 Pro | do #32254 reinstall first |
|
||
| LAPTOP-8P7HDSEI | User | **Win10 Home** | BLOCKED: Home->Pro + OneDrive KFM ON |
|
||
| MDIRECTOR-PC | Shelby Trozzi | **Win11 Home** | BLOCKED: Home->Pro + reboot |
|
||
| MEMRECEPT-PC | memfrtdesk | **Win10 Home** | BLOCKED: Home->Pro + reboot |
|
||
| NurseAssist | Veronica | ~~Win11 Home~~ **Pro WS (upgraded 6/26)** | READY-ish: KFM ON (unlink) + reboot; confirmed distinct from ASSISTNURSE-PC |
|
||
| SALES4-PC | Tamra (OFFBOARDED 6/30) | ~~Win11 Home~~ **Pro (supplier upgrade)** | Repurpose TBD; join when reassigned |
|
||
| LAPTOP-DRQ5L558 | caregiver | Win11 Pro WS | BLOCKED: off-network (public DNS, no DC reach) |
|
||
| DESKTOP-TRCIEJA | Lupe Sanchez | Win11 Pro | SKIP — EOL, being replaced |
|
||
| Health-Services-Director | Lois Lane | Win11 Pro WS | already domain-joined (= AD `HEALTH-SERVICES`) |
|
||
|
||
**Prep blockers / decisions (2026-06-24):**
|
||
- **5 machines on Windows Home cannot domain-join** until upgraded to Pro (need license keys):
|
||
LAPTOP-8P7HDSEI, MDIRECTOR-PC, MEMRECEPT-PC, NurseAssist, SALES4-PC. **Howard handling the
|
||
Home->Pro upgrades himself, ONSITE** (decision 2026-06-25).
|
||
- *2026-06-25 live re-check: the 6PM cron `ad0a56a9` never completed — all 5 still `EditionID=Core`
|
||
(Home), Licensed on Home keys, none half-upgraded. ProductName reads "Windows 10 Home" even on the
|
||
Win11 boxes (stale registry string) — trust EditionID, not ProductName.*
|
||
- **DONE 2026-06-25 (~8:45 PM, remotely via RMM, no users logged in):** the 3 online Home boxes
|
||
upgraded Home->Pro. Process: `changepk.exe /productkey <generic Pro key>` flips Core->Professional
|
||
(as SYSTEM it does NOT auto-reboot; registry vs licensing go out of sync — **reboot once to finalize**),
|
||
then activate. Results:
|
||
- **MDIRECTOR-PC** -> Professional, **self-activated FREE via a built-in Pro digital entitlement**
|
||
(no MAK used, no charge). READY to domain-join.
|
||
- **MEMRECEPT-PC** + **LAPTOP-8P7HDSEI** -> activated with the ACG MAK
|
||
(`infrastructure/windows-pro-mak`). NOTE: the MAK is a **Pro for Workstations** MAK — `/ipk` retargets
|
||
the edition to `ProfessionalWorkstation` (higher SKU, fine for domain join), `/dli` = Licensed,
|
||
VOLUME_MAK channel. **2 MAK counts consumed -> bill 2x $99 = $198 to Cascades** (line items name each
|
||
machine). MEMRECEPT needed an `/ato` retry (first attempt hit transient `0x8004FE92`).
|
||
- **[RESOLVED 6/26-6/30]** NurseAssist + DESKTOP-MD6UQI3 upgraded to Pro for Workstations 6/26
|
||
(2 x $99 to bill — Syncro product 23571919, not yet invoiced as of 7/10); NurseAssist confirmed
|
||
a distinct machine from ASSISTNURSE-PC. SALES4-PC upgraded to Pro by its supplier (no ACG
|
||
charge); Tamra offboarded 6/30, machine repurpose TBD.
|
||
- Next step for the 3 upgraded boxes = **domain-join** (they now read `EditionID=Professional`/PfW).
|
||
- **OneDrive KFM ON** (unlink before folder-redirect GPO): LAPTOP-8P7HDSEI, NurseAssist.
|
||
- **Pending reboots + KFM unlinks: held for onsite** (Howard) — disruptive to clear remotely.
|
||
- **LAPTOP-DRQ5L558** is off the Cascades network (8.8.8.8/1.1.1.1 DNS, no DC reachability) —
|
||
must be on-site/on-LAN before any join.
|
||
- Note: the legacy `phase3-pre-join-verify.ps1` hardcodes the DC at `192.168.2.254`; clients
|
||
actually reach it at `192.168.2.248` (the `.254` NIC is the Hyper-V vEthernet and does not
|
||
cleanly serve domain SMB) — update the script's target before reuse.
|
||
- Pro/Enterprise + internal machines are READY to join once reboots are cleared onsite:
|
||
DESKTOP-LPOPV30, MAINTENANCE-PC, ASSISTMAN-PC, ANN-PC, LAPTOP-E0STJJE8, Laptop2 (+ CHEF-PC after #32254).
|
||
|
||
---
|
||
|
||
## Workstream 2 — Users, departments & file-share access
|
||
|
||
**Goal:** every user in the right OU + `SG-*-RW` group; department drives mapped per the
|
||
access matrix; Synology retired as primary.
|
||
|
||
- Shares already created on CS-SERVER (`D:\Shares\...`): Management, Sales/SalesDept, Server,
|
||
Accounting, Culinary, Activities, directoryshare, IT, Receptionist, **Executive (NEW — Ashley+Meredith)**.
|
||
Confirm ALdocs/WebDocs/LifeEnrichment exist + NTFS per the matrix.
|
||
- Populate `SG-*-RW` groups per `docs/migration/share-access-matrix-2026-04-23.md`.
|
||
- Map dept drives per user via GPP/logon script (Receptionist drive = machine+user scoped, Tower desk only).
|
||
- **Close out the matrix open questions** (per-user interviews): Lois Lane, Karen Rossini, Susan Hicks,
|
||
John Trozzi, Lupe Sanchez, Shelby Trozzi, Matt Brooks, Christine Nyanzunda; `pacs`/Clinical-PHI
|
||
create-or-retire; `web` retire.
|
||
|
||
**Tickets:** #32193 (Executive restricted share — **DONE 2026-06-24**, E: mapped both machines),
|
||
#32230 (Karen Rossini -> ALDOCS on Synology — **recheck when she's in**, she was out 2026-06-24).
|
||
|
||
---
|
||
|
||
## Workstream 3 — HIPAA caregiver lockdown — GO-LIVE (highest value, mostly built)
|
||
|
||
**[UPDATED 2026-07-15]** The 7/1 cutover put caregivers in an **interim posture**: all 35
|
||
`SG-Caregivers` may sign in on desktops AND phones, **on-network only** (`e35614e1` off-network
|
||
block — policy itself enabled since 2026-04-29 per live CA read 7/15, trusted IPs
|
||
72.211.21.217/32 + 184.191.143.62/32 — + `7d491c7a` 8h sign-in frequency enforced;
|
||
`SG-Caregivers` excluded from MFA-for-all).
|
||
The compliance-block policy `ede985e2` was **DISABLED 2026-07-01 — do not re-enable** (superseded
|
||
by the allow-list). Temp passwords are live for phone sign-in (must-change cleared fleet-wide 7/2;
|
||
`PSO-Caregivers` never-expire FGPP in place). Roster = **35** after the 7/1 reconcile.
|
||
**Juan Andrade offboards 2026-07-16 afternoon** (coord todo `80716a98`).
|
||
|
||
Final lockdown = flip from test scope to real caregivers, one device at a time
|
||
(detail: wiki "Entra Access Architecture"):
|
||
|
||
1. Swap GPO `CSC - Caregiver Workstation` security filter `SG-Caregivers-Test` -> `SG-Caregivers`.
|
||
2. CA allow-list policy `1b7fd025`: **two changes** — retarget test group `SG-Caregivers-DeviceTest`
|
||
-> `SG-Caregivers` AND flip from report-only (`enabledForReportingButNotEnforced`) to enforced.
|
||
Prereqs: `SG-Break-Glass` + GDAP/service-provider exclusions in place (break-glass accounts still
|
||
NOT created — do this first).
|
||
3. Move each caregiver machine into `OU=Caregiver Devices` + `SG-PC-MainTower`/`SG-PC-MemoryCare`
|
||
one at a time: Laptop2, LAPTOP-DRQ5L558, LAPTOP-E0STJJE8, ASSISTNURSE-PC (needs re-join + re-tag
|
||
after Win11 reinstall), NURSESTATION-PC (+ verify NurseAssist/Laptop4). NOTE: the device-lockdown
|
||
(auto-logoff) GPO only applies once machines are in `OU=Caregiver Devices` — until then desktops
|
||
caregivers use under the interim posture have NO auto-logoff enforcement.
|
||
3b. **[ADDED 2026-07-15, Howard] Nurse-station desktops = phone-parity shared login.** The TWO
|
||
nurse-station desktops — **NURSESTATION-PC + ASSISTNURSE-PC** (explicitly NOT the medtech
|
||
laptops) — get the same model as the caregiver phones: ANY caregiver signs in with their own
|
||
`cascades\` username, lands on ALIS via SSO, and sees the SAME standardized desktop shortcuts
|
||
to the SAME sites as the phones. Implementation: allow `SG-Caregivers` interactive logon on
|
||
those two machines; deploy the shortcut set via the `CSC - Caregiver Workstation` GPO
|
||
(per-machine, all-users desktop) so every profile is identical; no per-user profile
|
||
customization; auto-lock/sign-out from the device-lockdown GPO applies (step 6). Define the
|
||
canonical shortcut list from the phone home-screen set (ALIS + the same sites — capture the
|
||
list from a phone before building).
|
||
4. ALIS email-match the 35 caregivers + medtechs (ALIS staff Email = Entra UPN); ALIS records still
|
||
to create for Munezero/Cota/Robinson; Vallejo email-match; 7 discharged-record decisions;
|
||
turn off ALIS-native 2FA per user, then move to SSO-only (native login is a CA bypass path).
|
||
5. Lower ALIS app session timeout 20 -> 15 min (Howard, ALIS admin).
|
||
6. **Reboot NURSESTATION-PC** to activate + verify the device-lockdown GPO (lock @3min, 90s warn, sign-out @15min).
|
||
7. Phones-only lockdown cohort: deferred to end of rollout — `docs/cloud/caretaker-phones-only-list.md`.
|
||
8. Pilot cleanup: delete `pilot.test`, remove stale `SG-Caregivers-Pilot` exclude from the MFA policy,
|
||
delete the pilot/test groups.
|
||
|
||
---
|
||
|
||
## Workstream 4 — M365
|
||
|
||
- **Relicense remaining suspended Business Standard users -> Business Premium** (Standard SKU is
|
||
SUSPENDED — time-sensitive). Live 7/15: SPB 45 enabled / 41 consumed (4 free); suspended
|
||
Standard **29 consumed** after the jodi.ramstack reclaim — 29 users to move needs ~25 more SPB
|
||
seats OR a per-user needs pass (lighter licenses where full Office isn't needed — the CARF plan
|
||
Area 2 budgets ~$375–575/mo for the mix). Count seats + decide mix before touching licenses.
|
||
- ~~Decommission jodi.ramstack~~ — **DONE 2026-07-15** (disabled, sessions revoked, license
|
||
reclaimed; mailbox already gone via the suspended sub — nothing recoverable in-tenant).
|
||
- **Create break-glass accounts (`breakglass1/2-csc@`) + enroll FIDO2 YubiKeys** — still not created
|
||
(confirmed 5/27); now a **prerequisite for the WS3 allow-list enforcement flip**.
|
||
- **Remove the standing Privileged Authentication Administrator role from the
|
||
`ComputerGuru - Tenant Admin` SP** (stranded by Alma's 6/25 offboarding; needs a Global Admin;
|
||
keep its Conditional Access Administrator role). Pending Mike.
|
||
- Build audit retention (Log Analytics 90d + Storage 6yr) in `rg-audit-cascadestucson` — approved
|
||
2026-04-29, still unbuilt (HIPAA SS164.312(b) gap, includes D:\Homes object-access auditing).
|
||
- Zeke Huerta: register Authenticator MFA (under MFA-for-all with no method since 7/1).
|
||
- Megan Hiatt: re-verify the April credential-stuffing remediation held (flagged 6/30).
|
||
|
||
---
|
||
|
||
## Workstream 5 — Server / infrastructure
|
||
|
||
- **Cloud backup (MSP360 -> ACG-backup): re-verified 2026-07-15** — daily file-level backup
|
||
running clean (incrementals current). **[WARN] The image/system-state side was ~10 days stale
|
||
at the 7/15 check** — confirm/repair the image plan + set retention BEFORE the SSD swap.
|
||
[GATE for any drive work]
|
||
- **CS-SERVER RAID -- CORRECTED 2026-06-24: HEALTHY, not degraded** (live OMSA: both mirrors Ok, all 5 disks Online, all LEDs green; the 6/15 degraded self-recovered). **NO emergency drive swap.** 1:0:4 = global hot spare (do not remove). **Planned** reliability upgrade: replace the 2 consumer 320 GB drives (esp. flaky WD 0:0:3) with the 2x enterprise SSD **already purchased**, on a scheduled window w/ confirmed image/system-state backup. **[WARN] PSU redundancy lost** -- one PSU not delivering, check onsite. Service Tag 9MQFTK1. Real fix = DC migration off the 16-yr-old R610.
|
||
- ~~Clean up old-MSP agent sprawl (Datto RMM/CentraStage + Datto EDR/Infocyte) thrashing the spindle~~
|
||
— **DONE on CS-SERVER 2026-06-26** (full legacy Datto stack removed). **Current Datto EDR installed
|
||
on CS-SERVER 2026-07-13** (HUNTAgent=Running, cmd `0a60cac7`) — the DC is back under managed
|
||
endpoint protection. Fleet stragglers tracked in the wiki (DESKTOP-TRCIEJA BD_ACTIVE, laptop3/laptop1/
|
||
cascades-laptop reconcile, Syncro BD-deployment removal, GravityZone portal cleanup).
|
||
- Synology -> backup-only: **the share syncs Synology -> CS-SERVER ARE set up and working**
|
||
(confirmed by Howard 7/15; wiki corrected). Remaining: finish the role flip (server is primary,
|
||
Synology becomes the onsite backup target per CARF plan Area 5) + close the workgroup/Kerberos quirk.
|
||
- Rotate the Synology signin-portal credential (was committed plaintext historically).
|
||
- pfSense: **AutoConfigBackup not enabled** (found 7/15) — enable it (config IS backed up via
|
||
our repo copy, but ACB gives point-in-time restore).
|
||
|
||
---
|
||
|
||
## Workstream 6 — Network (mostly complete)
|
||
|
||
- **CSC ENT device-island consolidation (phones + Helpany on 5 GHz)** — repurpose CSC ENT as a
|
||
**5 GHz-only WPA2 PPSK** SSID and consolidate BOTH the Poly voice handsets (-> VLAN 30) and the
|
||
Helpany "Paul" radar sensors (-> new VLAN 40) onto it, separated at the VLAN layer. Gets both
|
||
off congested 2.4 GHz; keeps WPA2-only gear isolated so CSCNet can later move to WPA3/WiFi7/6GHz.
|
||
Supersedes the standalone "Voice 5 GHz lock" item below and the earlier "delete CSC ENT" idea
|
||
(deleting it would orphan the Pauls). Both vendors can move their devices remotely once we
|
||
provide the network. **Onsite gate: verify per-room 5 GHz coverage before the band flip**
|
||
(steel walls; weak-5GHz devices stay on 2.4). Full design + sequence:
|
||
`docs/network/csc-ent-device-island-plan.md`.
|
||
- Build VLAN 40 (Helpany, egress-only to `*.sedimentum.com` + snapcraft/ubuntu) on pfSense.
|
||
- Enable PPSK on CSC ENT: key `Ftfd85710#` -> VLAN 40 (Pauls keep SSID+key, not reprogrammed);
|
||
new voice key -> VLAN 30 (phones re-pointed by Howard/Richard).
|
||
- Flip CSC ENT to 5 GHz-only (`apply-wlan.sh ... bands 5g`) in a coordinated window; pilot a few
|
||
phones + Pauls, then full rollout.
|
||
- Helpany = Sandro Cilurzo / Eugenie Nicoud; Poly = Richard Turner (Vertical).
|
||
- **PREREQUISITE (live 2026-06-24): CSC ENT has 149 clients, only 68 are Helpany.** ~79 non-Helpany
|
||
devices must be evacuated first — 14 staff PCs (domain mig), 11 printers, **11 DIRECTV + 11
|
||
resident IoT/TV + 15 personal phones + 17 unknown (resident-facing — need help reconnecting)**.
|
||
~51 are on 2.4 GHz and would drop on a 5 GHz-only flip. Per-device inventory + resident
|
||
help-list: `docs/network/csc-ent-client-inventory-2026-06-24.md`. TODO: pull `stat/alluser`
|
||
for offline resident TVs; identify the 17 unknowns + generic phones with John Trozzi.
|
||
- **#32319** WiFi Room 343 — relocate a floor-2/4 AP for coverage (unifi-wifi skill, site `va6iba3v`).
|
||
- **#32342** Copy Room switch — install + adopt into UniFi.
|
||
- Sub-gigabit sweep (live 7/15): **34 switch ports at 100 Mbps + 5 AP uplinks below gig** —
|
||
cabling/NIC sweep, prioritize the AP uplinks. (Live UniFi count 7/15: **11 switches**, 77 APs,
|
||
voice VLAN exactly 37 devices.)
|
||
- *(Superseded)* Voice 5 GHz lock — now folded into the CSC ENT consolidation above (single
|
||
dedicated 5 GHz network for phones + sensors, not just a phone-side band lock).
|
||
|
||
---
|
||
|
||
## Workstream 7 — Onsite peripheral
|
||
|
||
- **#32370** eFax setup (Karen & Christin) + portable scanner on both machines.
|
||
|
||
---
|
||
|
||
## Workstream 8 — M365 collaboration migration (SharePoint / Teams) — HIPAA lockdown
|
||
|
||
> Added 2026-07-15 (Howard): move Cascades onto SharePoint, Teams, and the wider Microsoft 365
|
||
> platform to lock down data access and advance HIPAA compliance. Pairs with the network upgrade
|
||
> work (WS6) and the domain migration (WS1/2) — the dept OU/group structure built there becomes
|
||
> the SharePoint/Teams permission model.
|
||
|
||
- **Scope/plan the migration**: department file shares (CS-SERVER `D:\Shares` + Synology) ->
|
||
SharePoint document libraries with role-based permissions mapped from the existing AD dept
|
||
groups; Teams for internal comms/collab (replaces ad-hoc channels); OneDrive for per-user files.
|
||
- **HIPAA guardrails first-class**: role-scoped access (same SG model as caregiver lockdown),
|
||
audit logging (ties into the WS4 audit-retention build), retention policies, DLP evaluation,
|
||
sensitivity labels for PHI, external-sharing OFF by default.
|
||
- **Licensing already supports it** — Business Premium (45 seats) includes SharePoint/Teams/
|
||
OneDrive/Intune/Purview basics; the WS4 relicensing moves the office staff onto it.
|
||
- Sequencing: after (or alongside tail of) the domain migration — don't build SharePoint
|
||
permissions on the pre-migration flat-share model. Candidate first movers: the newer
|
||
role-based shares (Executive restricted, Company Web Docs, ALDOCS).
|
||
- Synology then finishes its transition to backup-only (WS5) once shares live in SharePoint.
|
||
- Also on the plan doc: Copilot evaluation under HIPAA guardrails + the KPI dashboard's
|
||
SharePoint/Power BI Phase 1 (scheduled exports) land on this same platform.
|
||
|
||
---
|
||
|
||
## Workstream 9 — ALIS online payment system
|
||
|
||
> Added 2026-07-15 (Howard): get Cascades onto ALIS's online payment system (resident/family
|
||
> billing payments through the clinical-record platform, Medtelligent).
|
||
|
||
- **Scope with Medtelligent** — **scoping questions DRAFTED 2026-07-15**
|
||
(`docs/proposals/alis-online-payments-scoping-2026-07-15.md`, 18 questions: availability/
|
||
pricing/processor/PCI/BAA/ledger-posting/API/rollout). Next action: send to the Medtelligent
|
||
rep, loop in Jeff Bristol (accounting@) on replies. Q9 doubles as the BAA chase (Medtelligent
|
||
BAA unverified — feeds the area-4 BAA inventory regardless).
|
||
- Coordinate with the business office (Jeff Bristol / accounting@) on the AR workflow change
|
||
and family communication.
|
||
- IT-side items: SSO already live for ALIS (staff side); verify family-facing payment portal
|
||
access needs nothing on our network/identity side; add Medtelligent's payment processing to
|
||
the BAA/vendor tracker (plan area 4).
|
||
- Ties into the KPI dashboard (ALIS billing data is a Phase 1 export source).
|
||
|
||
---
|
||
|
||
## Finish sequence — re-cut 2026-07-15 (order of completion)
|
||
|
||
Everything below is scoped, built, or blocked on exactly one prerequisite — this is the
|
||
close-out order, not a wish list.
|
||
|
||
1. **2026-07-16 afternoon: offboard Juan Andrade** (disable + SG-Caregivers removal + license
|
||
reclaim) — coord todo `80716a98`. Do NOT disable before then.
|
||
2. **Break-glass accounts (`breakglass1/2-csc@`) + FIDO2 keys + strip the stranded PAA role**
|
||
(WS4) — THE blocking prerequisite for the allow-list enforcement flip; the tenant runs live
|
||
block policies with no break-glass today. Also the CARF plan's 30-day security item.
|
||
3. **Caregiver lockdown go-live** (WS3 steps 1–8, incl. 3b nurse-station phone-parity build) —
|
||
highest HIPAA value; the real control (`1b7fd025` allow-list) is still report-only/test-scoped.
|
||
Capture the phone shortcut list for 3b while onsite for the OU moves.
|
||
4. **M365 relicense the 29 suspended-Standard users** (WS4) — time-sensitive; decide seat mix
|
||
first (4 SPB free vs 29 to move).
|
||
5. **Repair/confirm the image/system-state backup -> scheduled SSD swap** (WS5) — image side was
|
||
~10 days stale on 7/15; single-DC risk until done.
|
||
6. **Remaining staff domain joins + dept drives** (WS1+2: ~10 machines left after readiness
|
||
blockers cleared) + printer-share repoints / Point-and-Print GPO fleet-wide (wiki VLAN 20).
|
||
Onsite batch: reboots, KFM unlinks, LAPTOP-DRQ5L558 on-LAN.
|
||
7. **Network tail** (WS6: CSC ENT device island incl. the ~79-client evacuation, 34-port +
|
||
5-AP-uplink gig sweep) + **audit-retention build** (WS4 — HIPAA 164.312(b) gap, approved
|
||
since 4/29).
|
||
8. **M365 collaboration migration (WS8)** — SharePoint/Teams scoping once the domain-migration
|
||
tail is done; permission model rides the dept OU/SG structure from WS1/2. Synology finishes
|
||
its backup-only role flip (WS5) behind it.
|
||
9. **ALIS online payments (WS9)** — vendor-driven, runs in parallel with everything above:
|
||
scoping questions are DRAFTED (`docs/proposals/alis-online-payments-scoping-2026-07-15.md`)
|
||
— send to Medtelligent when ready; business-office coordination (Jeff Bristol) is the long pole.
|
||
10. **Ticket-verify pass with Howard** (table below) — confirm the 6 closed-in-Syncro tickets
|
||
were actually completed; any that weren't fold back into WS1/2/6/7 and get done in step 6–7
|
||
onsite trips.
|
||
|
||
---
|
||
|
||
## Open Syncro tickets -> workstream map
|
||
|
||
**[RECONCILE 2026-07-13] Syncro showed 0 open tickets as of 7/10**, but the 6 tickets below were
|
||
"Open — onsite" in the 6/24 plan and no completion is recorded in the wiki/session logs.
|
||
**VERIFY with Howard: completed-and-closed, or closed-without-work?** Any not actually done go back
|
||
on the board as workstream items (the underlying work — Chef-PC reinstall+join, Room 343 AP,
|
||
Copy Room switch, eFax/scanner, spare machine, Karen ALDOCS — is still required by WS1/2/6/7).
|
||
|
||
| Ticket | Workstream | Status |
|
||
|---|---|---|
|
||
| #32193 Executive restricted share | 2 | **DONE 2026-06-24** (E: both machines, billed 0.5h block) |
|
||
| #32194 spare machine for new hire | 1 | Closed in Syncro — **verify work done** |
|
||
| #32230 Karen -> ALDOCS | 2 | Closed in Syncro — Karen's ALDocs shortcut WAS set 6/26 (drive-map); likely done |
|
||
| #32254 Chef-PC reinstall | 1 | Closed in Syncro — **verify reinstall + domain-join happened** |
|
||
| #32319 WiFi Room 343 | 6 | Closed in Syncro — **verify AP relocation done** |
|
||
| #32342 Copy Room switch | 6 | Closed in Syncro — **verify switch installed/adopted** |
|
||
| #32370 eFax + scanner | 7 | Closed in Syncro — **verify eFax + scanner delivered** |
|