azcomputerguru/claudetools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
7e1525711a21e9767ce5886f53fd20c95208150e
claudetools/wiki/clients/cascades-tucson.md

73 KiB
Raw Blame History

type, name, display_name, last_compiled, compiled_by, sources, backlinks
type name display_name last_compiled compiled_by sources backlinks
client cascades-tucson Cascades of Tucson 2026-07-15 HOWARD-HOME/claude-main
session-logs/2026-03-24-session.md
session-logs/2026-03-31-session.md
session-logs/2026-04-01-session.md
session-logs/2026-04-16-session.md
session-logs/2026-04-16-howard-client-docs-import.md
session-logs/2026-04-17-session.md
session-logs/2026-04-17-howard-session.md
session-logs/2026-04-18-session.md
session-logs/2026-04-20-session.md
session-logs/2026-04-20-mac-session.md
session-logs/2026-04-21-mac-vault-setup.md
session-logs/2026-04-21-howard-remediation-vault-gap.md
session-logs/2026-04-28-session.md
session-logs/2026-04-29-session.md
session-logs/2026-04-30-session.md
session-logs/2026-05-01-session.md
session-logs/2026-05-01-howard-syncro-billing-batch-and-tmp-path-incident.md
session-logs/2026-05-10-session.md
session-logs/2026-05-18-session.md
session-logs/2026-05-18-howard-billing-review-and-ticket-updates.md
session-logs/2026-05-20-session.md
session-logs/2026-05-21-session.md
session-logs/2026-05-23-session.md
session-logs/2026-05-24-GURU-KALI-session.md
clients/cascades-tucson/session-logs/2026-05-22-session.md
session-logs/2026-05-26-howard-session.md
clients/cascades-tucson/session-logs/2026-06-02-howard-efax-scanner-ticket.md
clients/cascades-tucson/session-logs/2026-06-03-session.md
clients/cascades-tucson/session-logs/2026-06-04-howard-email-delivery-investigation.md
clients/cascades-tucson/session-logs/2026-06-04-howard-caregiver-laptop-enrollment.md
clients/cascades-tucson/session-logs/2026-06-04-session.md
clients/cascades-tucson/session-logs/2026-06-05-session.md
clients/cascades-tucson/session-logs/2026-06-05-howard-cascades-entra-ticket-billing.md
clients/cascades-tucson/session-logs/2026-06/2026-06-08-howard-edge-unc-download-bug-diagnosis.md
clients/cascades-tucson/session-logs/2026-06/2026-06-10-howard-meredith-locked-word-doc.md
clients/cascades-tucson/session-logs/2026-06/2026-06-12-howard-shared-mailboxes-grievances-surveys.md
clients/cascades-tucson/session-logs/2026-05-16-howard-wireless-diagnostic.md
clients/cascades-tucson/session-logs/2026-06/2026-06-15-howard-cascades-wifi-rf-audit.md
clients/cascades-tucson/session-logs/2026-06/2026-06-15-howard-cs-server-raid-vpn-reset.md
clients/cascades-tucson/session-logs/2026-06/2026-06-16-howard-vertical-voice-vlan-plan.md
clients/cascades-tucson/docs/network/voice-vlan-cutover.md
clients/cascades-tucson/docs/network/voice-phone-inventory.md
clients/cascades-tucson/docs/network/network-logging-plan.md
clients/cascades-tucson/session-logs/2026-06/2026-06-18-howard-voice-vlan-migration-logging-plan.md
clients/cascades-tucson/reports/2026-06-16-unifi-full-audit.md
clients/cascades-tucson/reports/2026-06-16-2.4ghz-remediation-runbook.md
clients/cascades-tucson/docs/overview.md
clients/cascades-tucson/docs/network/topology.md
clients/cascades-tucson/docs/network/vlans.md
clients/cascades-tucson/docs/servers/cs-server.md
clients/cascades-tucson/docs/billing-log.md
.claude/memory/project_cascades_admin_accounts.md
.claude/memory/project_cascades_ca_phased_rollout.md
.claude/memory/project_cascades_pilot_cleanup.md
.claude/memory/feedback_syncro_cascades_contact.md
.claude/memory/feedback_cascades_user_security_group.md
.claude/memory/project-cascades-migration-plan.md
.claude/memory/feedback_cascades_folder_redirect.md
.claude/memory/howard-home-lan-shadow.md
clients/cascades-tucson/session-logs/2026-06/2026-06-17-howard-kpi-dashboard-scoping.md
clients/cascades-tucson/docs/proposals/kpi-dashboard.md
clients/cascades-tucson/docs/proposals/kpi-dashboard-onepager.md
.claude/memory/project_cascades_kpi_dashboard.md
clients/cascades-tucson/session-logs/2026-06/2026-06-17-howard-cascades-poly-phone-drops-network-smoothing.md
clients/cascades-tucson/session-logs/2026-06/2026-06-17-howard-cascades-power-outage-recovery-and-5ghz.md
clients/cascades-tucson/session-logs/2026-06/2026-06-17-howard-cs-server-drive-review-and-spike-question.md
clients/cascades-tucson/session-logs/2026-06/2026-06-17-howard-voice-vlan30-build.md
clients/cascades-tucson/session-logs/2026-06/2026-06-18-howard-cascades-outage-followup-openvpn-printer.md
clients/cascades-tucson/session-logs/2026-06/2026-06-18-howard-synology-drive-sync-diagnosis.md
clients/cascades-tucson/session-logs/2026-06/2026-06-18-howard-lupesanchez-desktop-trcieja-perf-diag.md
clients/cascades-tucson/session-logs/2026-06/2026-06-18-howard-cascades-rf-voice-optimization-plan.md
clients/cascades-tucson/docs/network/network-optimization-master-plan.md
clients/cascades-tucson/docs/network/phase1-voice-qos-design.md
clients/cascades-tucson/reports/2026-06-18-voice-quality-diagnostic.md
clients/cascades-tucson/session-logs/2026-06/2026-06-18-howard-memcare-baseline-and-change-window.md
clients/cascades-tucson/session-logs/2026-06/2026-06-19-howard-2am-rf-run-phase2b-applied.md
clients/cascades-tucson/session-logs/2026-06/2026-06-19-howard-5ghz-attempt-and-rollback.md
clients/cascades-tucson/session-logs/2026-06/2026-06-19-howard-5ghz-dfs-datadriven-applied.md
clients/cascades-tucson/session-logs/2026-06/2026-06-19-howard-cascades-rf-night-capstone.md
clients/cascades-tucson/session-logs/2026-06/2026-06-19-howard-voice-vlan-migration-complete-and-vertical-handoff.md
clients/cascades-tucson/docs/network/2026-06-19-vertical-5ghz-lock-request.md
clients/cascades-tucson/docs/runbooks/2026-06-23-planned-power-outage.md
clients/cascades-tucson/session-logs/2026-06/2026-06-23-howard-cascades-planned-outage-shutdown-verify.md
clients/cascades-tucson/docs/REMAINING-WORK-PLAN.md
clients/cascades-tucson/session-logs/2026-06/2026-06-24-howard-carf-technology-plan.md
clients/cascades-tucson/session-logs/2026-06/2026-06-24-howard-csc-ent-voice-helpany-consolidation-plan.md
clients/cascades-tucson/session-logs/2026-06/2026-06-25-howard-synology-skill-verify-fixes.md
clients/cascades-tucson/session-logs/2026-06/2026-06-25-howard-alma-offboarding-recovery-verify.md
clients/cascades-tucson/docs/security/offboarding-2026-06-25-alma-montt.md
clients/cascades-tucson/session-logs/2026-06/2026-06-25-howard-edr-rollout-bitdefender-removal.md
clients/cascades-tucson/session-logs/2026-06/2026-06-25-howard-cs-server-smb-migration-diagnosis.md
clients/cascades-tucson/session-logs/2026-06/2026-06-26-howard-cs-server-datto-removal-smb-rootcause.md
clients/cascades-tucson/session-logs/2026-06/2026-06-26-howard-edr-bd-straggler-9am-pass.md
clients/cascades-tucson/session-logs/2026-06/2026-06-26-howard-home-to-pro-upgrades-continued.md
clients/cascades-tucson/session-logs/2026-06/2026-06-29-howard-alis-caregiver-phoneonly-caretaker-crosscheck.md
clients/cascades-tucson/session-logs/2026-06/2026-06-30-howard-caregiver-phone-sso-license-onboarding.md
clients/cascades-tucson/session-logs/2026-06/2026-06-30-howard-tamra-matthews-offboarding.md
clients/cascades-tucson/session-logs/2026-06/2026-06-30-howard-vlan20-printer-migration.md
clients/cascades-tucson/session-logs/2026-06/2026-06-24-howard-ticket-review-and-cascades-consolidation.md
clients/cascades-tucson/session-logs/2026-06/2026-06-30-howard-alis-sso-login-model-recall.md
clients/cascades-tucson/session-logs/2026-07/2026-07-01-howard-vlan20-migration-live-reconcile.md
clients/cascades-tucson/docs/printer-gpo-map.md
.claude/memory/project_cascades_vlan20_migration_routing.md
clients/cascades-tucson/session-logs/2026-07/2026-07-01-howard-caretaker-roster-update-phone-login-cutover.md
clients/cascades-tucson/reports/2026-07-01-caretaker-roster-update.md
clients/cascades-tucson/docs/cloud/caretaker-phones-only-list.md
clients/cascades-tucson/session-logs/2026-07/2026-07-02-howard-caretaker-phone-login-pso-roster-cleanup.md
clients/cascades-tucson/session-logs/2026-07/2026-07-02-howard-shelby-webdocs-share.md
clients/cascades-tucson/session-logs/2026-07/2026-07-09-howard-charity-menle-caregiver-rename.md
clients/cascades-tucson/session-logs/2026-07/2026-07-09-howard-chris-knight-accounting-mailbox.md
.claude/memory/reference_rmm_map_network_drive.md
clients/cascades-tucson/session-logs/2026-07/2026-07-14-recovered-wiki-plan-review-hipaa-gaps.md
clients/cascades-tucson/session-logs/2026-07/2026-07-15-howard-technology-plan-final.md
clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.md
clients/cascades-tucson/docs/cloud/m365.md
session-logs/2026-07/2026-07-15-mike-taylen-uisp-cascades-techplan.md
projects/gururmm
wiki/systems/uos-server

Cascades of Tucson

Senior living / assisted living facility in Tucson, AZ (201 N Jessica Ave, 85710). Single 6-floor building plus a MemCare (Memory Care) wing on floors 5-6. ~236 rooms. ACG took over from a previous MSP. Primary compliance driver is HIPAA. Active multi-phase migration project: domain join / VLAN 20 staff-machine move largely complete (22 machines migrated, ~6 stragglers), printer re-IP/GPO work is the lagging piece. Caregiver phone SSO Entra/identity side complete as of 2026-07-01 (35-member roster, licensed, CA cutover live). CARF Technology and System Plan finalized and delivered 2026-07-15.

2026-07-08 GPS-RMM reconciliation

GPS is billed via a counter tied to the number of Syncro assets (not a fixed device qty). Currently 29 on the GPS line / 32 in GuruRMM; reconciles through the asset counter, not a discrepancy (Winter/Mike, 2026-07-08).

Entra Access Architecture (canonical overview)

In one line: a HIPAA-driven, identity-based access-control system that splits staff into two security postures and enforces them with Microsoft Entra Conditional Access on top of hybrid identity (Entra Connect), with ALIS (clinical EHR) wired for SSO.

Foundation -- hybrid identity

  • On-prem AD cascades.local synced to Entra/M365 via Entra Connect (PHS + Seamless SSO). UPN suffix cascadestucson.com, so a user's Windows login = email = M365/ALIS identity (one credential everywhere).

Two user buckets (the core design)

  1. Restricted -- caregivers + medtechs (group SG-Caregivers, 8b8d9222): sign in only on the Cascades network and only on approved devices (shared Galaxy phones + a set of caregiver laptops/desktops). No MFA (no personal devices) -- protected by location + device controls + 8h sign-in frequency instead.
  2. Privileged -- admins / directors / managers / nurses (NOT in SG-Caregivers): email + ALIS from anywhere, seamless onsite / 2FA offsite (Authenticator/PIN). Untouched by the caregiver lockdown.

Conditional Access enforcement (caregivers)

  • CSC - Block caregivers off Cascades network (e35614e1)
  • CSC - Block caregivers on non-compliant device (ede985e2) -- DISABLED 2026-07-01 (superseded by allow-list at final lockdown; do not re-enable)
  • CSC - Caregivers: allow-listed devices only (1b7fd025): phones (displayName -startsWith "CSC-") + tagged caregiver machines (extensionAttribute1 -eq "CSCCaregiverDevice", or explicit deviceId). Still report-only / TEST-group scoped.
  • CSC - Caregiver sign-in frequency 8h (7d491c7a)
  • [FIXED 2026-07-01] Require MFA for all users (7e87a1c7) now excludes BOTH SG-Caregivers-Pilot and live SG-Caregivers (8b8d9222); break-glass excludeUsers preserved.
  • Rollout is per-user via group membership (test group SG-Caregivers-DeviceTest db5849ec for one-at-a-time validation).
  • Caregiver Named Location: trusted IPs 72.211.21.217/32, 184.191.143.62/32; live since 2026-04-29. CA location ID 061c6b06-b980-40de-bff9-6a50a4071f6f.

Devices

  • Phones: Samsung A15s in Intune Shared Device Mode (Android Enterprise, corporate-owned dedicated). Enrollment profile: CSC - Android Shared Phones (Entra SDM) (9a0fcc6d). Dynamic group: Cascades - Shared Phones (ea96f4b7), rule (device.enrollmentProfileName -startsWith "CSC - Android Shared Phones"). NEVER create a new enrollment profile -- a differently-named profile falls outside the group rule. Reuse the existing profile's QR. Android enrollment token: clients/cascades-tucson/intune-android-enrollment-token.sops.yaml (expiry ~2091; treat tokenExpirationDateTime as a claim, not a fact -- use Replace, not Revoke, when the token goes stale).
  • Laptops/desktops: caregiver shared machines (Laptop2, LAPTOP-DRQ5L558, LAPTOP-E0STJJE8, ASSISTNURSE-PC, NURSESTATION-PC) joined to Entra via Hybrid Entra Join; CA allow-list targets group Cascades - Caregiver Devices (02c6f698).
  • Managed Google Play binding: owned by MDMS@cascadestucson.com -- if this account is deleted/disabled/unlicensed, every Android phone loses management. Vault: clients/cascades-tucson/mdm-service-account.sops.yaml.

ALIS SSO

  • Entra app registration -> OIDC SSO into ALIS; tenant-wide admin consent granted 2026-06-03 (AllPrincipals User.Read on SP e1cae4ad). Per-caregiver: ALIS staff Email must equal Entra UPN exactly. Caregivers SSO silently on phones (ALIS-native 2FA off); office users SSO with offsite MFA. ALIS application: d5108493-cba8-4f08-90b6-1bb0bc09eb2a, daily sign-ins verified 2026-07-15.
  • How to enable ALIS SSO for one user: set Email = exact Entra UPN in ALIS admin -> Staff -> record; user signs in via "Sign in with Microsoft"; turn off ALIS-native 2FA (native 2FA conflicts and locked out Karen Rossini). No local ALIS password needed for SSO users.

Caregiver phone SSO -- current state (as of 2026-07-15)

  • Entra/identity side COMPLETE for the current 35-member SG-Caregivers roster. All 35 licensed Business Premium; forced-change flag cleared fleet-wide 2026-07-02 (temp passwords now valid for phone sign-in). Temp passwords vaulted: clients/cascades-tucson/caregiver-temp-passwords-2026-06-30.sops.yaml (40 initial) + clients/cascades-tucson/caregiver-temp-passwords-2026-07-01.sops.yaml (4 new hires). Retrieve with vault get (NOT get-field -- dotted keys). Do NOT inline values.
  • Remaining gate (ALIS side, Howard handling): set each caregiver's ALIS staff Email = Entra UPN. Outstanding: 7 no-ALIS-record caregivers (need ALIS records built via alis skill build-import -> upload .xls in ALIS UI); Munezero/Cota/Robinson ALIS records needed; Vallejo Email=UPN; 5 Med Techs revisit; 7 discharged-record reactivate-vs-recreate decisions.
  • Interim CA posture (2026-07-01, Howard): caretakers sign in on desktops AND phones, on-network only. Phones-only lockdown deferred to end of rollout; tracking list docs/cloud/caretaker-phones-only-list.md.
  • [RULE] Caregiver phone onboarding: never set ChangePasswordAtLogon $true for a caregiver who will sign in on a shared phone -- it always fails as Entra err=50126 (Microsoft Authentication Broker cannot render the forced-change screen). Diagnose: pull sign-in logs (unfiltered ?$top=50, grep client-side) + check pwdLastSet/PasswordExpired on CS-SERVER.
  • SG-Caregivers is frontline caregivers ONLY. Admin-adjacent staff (Feller, Nyanzunda), pilot.test, disabled accounts excluded. Cloud/Graph adds fail (HTTP 400) -- all membership writes on CS-SERVER via RMM.
  • PSO-Caregivers (Fine-Grained Password Policy, created 2026-07-02): Precedence 10, MaxPasswordAge=00:00:00 (never expires). AppliesTo = SG-Caregivers -- auto-covers future hires; removal reverts cohort to 42-day domain default. Undo: Remove-ADFineGrainedPasswordPolicy PSO-Caregivers.

Caregiver name changes -- rename, never re-create

Case: b.sika (Bariffa Sika) -> c.menle (Charity Menle, legal name change, 2026-07-09). Procedure: Set-ADUser (Surname/DisplayName/UPN/EmailAddress) -> Rename-ADObject (CN) -> Set-ADUser -SamAccountName -> Start-ADSyncSyncCycle -PolicyType Delta. Set proxyAddresses explicitly (primary SMTP new + alias old). Password and group membership do NOT change. Vault gotcha: Charity Menle's temp password is still filed under key b.sika in the 6/30 vault.

Caregiver shared phones -- Intune (verified 2026-07-09)

  • 25 Samsung shared caregiver phones (SM-A146U x16, SM-S146VL x9, SM-A146U1 x1). 14 powered off as of 2026-07-09 (noncompliant status is not a fault). Two duplicate Intune objects (CSC-R92W60LRA8Z, CSC-R9TW20DGYKF) from re-enrollment.
  • Graph storage fields (freeStorageSpaceInBytes, totalStorageSpaceInBytes) are NOT collected for Android Enterprise dedicated devices -- all 26 phones report free=0, which means "not reported," not "out of space." detectedApps is empty on every phone -- not an app-inventory source here.
  • samsungSM-F731U (John Trozzi's Galaxy Z Flip 5, trustType: Workplace) is BYOD -- NOT a shared phone, correctly outside the profile/group.
  • Unresolved: CSC-R9TX70L693H enrolled 2026-07-09, cycled MHS install/uninstall 6 times, stopped checking in. Root cause not established; handset swapped as bad. Stale Intune/Entra records should be deleted. Also stale: com.microsoft.launcher (consumer launcher) sits unassigned in the tenant app list -- harmless unless assigned.
  • Caregiver desktop/laptop management: Hybrid Entra Join + on-prem GPO (Intune Windows MDM INTUNE_A=PendingInput -- MS case open, does NOT block caregiver access). CSC - Caregiver Workstation GPO ({3B5CD9A6-A278-4676-A9FD-9396D21A8261}) built + validated on NURSESTATION pilot.test. CSC - Caregiver Device Lockdown GPO ({E6174988-2721-4D96-ADF5-F5BB44E92769}) deployed to OU=Caregiver Devices 2026-06-05. NURSESTATION still needs reboot to activate lockdown GPO.

Status (as of 2026-07-15)

  • [ROSTER 2026-07-02] 7 already-disabled leavers hard-deleted from AD (b.mendoza, c.tate, g.williford, k.flores, d.fierros, m.baker, m.kariuki). SG-Caregivers stays 35.
  • [PENDING] Juan Andrade (j.andrade) offboard 2026-07-16 afternoon -- still active and in SG-Caregivers. On 7/16 PM: disable + remove from SG-Caregivers + reclaim Business Premium. Coord todo 80716a98.
  • [PENDING] Zeke Huerta (moved to front desk 2026-07-01, removed from SG-Caregivers): no registered MFA method -- Authenticator registration pending. OU move to OU=Administrative deferred until that OU enters Entra Connect sync scope.
  • [PENDING] Pilot cleanup: delete pilot.test@cascadestucson.com, clean up howard.enos@cascadestucson.com, remove SG-Caregivers-Pilot from CA policy targets + delete the group.

Profile

  • Contract type: Prepaid hour block
  • Billing rate: $175/hr all labor
  • Hours remaining: 21.5 hrs as of 2026-07-15 (live Syncro). Always live-check via GET /customers/20149445 before billing.
  • Syncro customer ID: 20149445
  • Managed devices (Syncro assets): 29 (live 2026-07-15)
  • Key contacts (Syncro authoritative):
  • Active tickets: 0 open Syncro tickets as of 2026-07-15. See session logs for active project work.

Infrastructure

Servers & Services

Host IP Role OS Notes
CS-SERVER 192.168.2.254 (Hyper-V vEthernet); SMB at 192.168.2.248 DC, DNS, DHCP (no scopes), File Server, Hyper-V host, Print Server Windows Server 2019 Standard Dell PowerEdge R610 (~2009, 16+ years old). Single DC -- CRITICAL risk. GuruRMM agent: c39f1de7-d5b6-45ae-b132-e06977ab1713 (re-enrolls -- resolve live by hostname). RAID HEALTHY (live OMSA 2026-06-24). Datto EDR + Datto AV ACTIVE (agent b41befcf-e418-4d0d-8552-bc7662364d07, heartbeat current, defs current; verified live 2026-07-15). Legacy Datto stack fully removed 2026-06-26; ACG-managed Datto EDR reinstalled 2026-07-13.
CS-SERVER iDRAC 192.168.2.65 Out-of-band management -- Dell OOB. Service Tag 9MQFTK1.
CS-QB (Hyper-V VM) 192.168.2.228 SMB/445 only -- NOT a live SIP PBX (2026-06-16 recon). Label "VoIP server" is stale. -- Revisit/retire.
cascadesDS (Synology NAS) 192.168.0.120 NAS / onsite backup (planned repurpose, 60-90 days) DSM 7.2.1-69057 DS718+, ext4, 6 GB RAM, 2x WD10EZEX 1 TB. Port 5000 HTTP, Drive Server 6690 SSL. Workgroup "CASCADES" causes Kerberos auth failures from domain-joined machines. Synology shared-folder syncs to CS-SERVER are SET UP AND WORKING (Howard confirmed 2026-07-15). Drive Client (v7.5.0.16085) syncs shared folders to D:\Shares\Main on CS-SERVER. Planned: repurpose NAS as onsite backup for the server once migration completes (active plan item, 60-90 days).
pfSense Firewall 192.168.0.1 Perimeter firewall, inter-VLAN routing, DHCP/DNS pfSense Plus 25.07-RELEASE Netgate device. cert CN=pfSense-685f277aa6886. Dual-WAN. All DHCP (CS-SERVER DHCP role has no scopes). SSH/22 blocked from OpenVPN subnet -- use GUI (443) remotely. Admin vault: clients/cascades-tucson/pfsense-firewall. OpenVPN: clients/cascades-tucson/pfsense-openvpn-howard. Config vaulted point-in-time 2026-06-17: clients/cascades-tucson/pfsense-config-backup-2026-06-17.sops.yaml. Netgate AutoConfigBackup NOT yet enabled. Logs PLAIN TEXT on 25.07.

CS-SERVER RAID detail (live OMSA 2026-06-24, healthy):

ID Size/Type Make/Serial Role
0:0:0 1.2 TB SAS Seagate / Z400WHK8 VD0 (D:) mirror member
0:0:1 1.2 TB SAS Seagate / S400RL2N VD0 (D:) mirror member
0:0:2 320 GB SATA Hitachi / 1DR VD2 (C:) mirror member
0:0:3 320 GB SATA WDC WD3200BEVT / WXEX08URD116 VD2 (C:) mirror member (was flaky 6/15, self-recovered)
1:0:4 1.2 TB SAS Seagate / Z400WHML GLOBAL HOT SPARE -- do NOT remove
  • VD0 = D: (1,117 GB RAID-1) Ok; VD2 = C: (297.5 GB RAID-1) Ok.
  • [WARN] PSU redundancy lost (ESM log "Power supply redundancy is lost") -- one PSU not delivering; check cords/feeds/LEDs onsite. Note per Howard 2026-07-15: likely just not connected, not an active work item.
  • Planned reliability upgrade: replace the two consumer 320 GB drives (0:0:2, 0:0:3) with 2x enterprise SATA SSD already purchased, on a scheduled window with confirmed backup. Service Tag 9MQFTK1.

Backup:

  • MSP360/CloudBerry cloud backup on CS-SERVER -- file-level backup plan last success 2026-07-15 07:00 (daily, verified live). Image-based plan last success 2026-07-05. Installed 2026-06-15 (closes HIPAA SS164.308(a)(7) gap). Retention confirm still pending.
  • Planned: Synology NAS repurposed as onsite backup target for CS-SERVER (60-90 days, per tech plan).
  • Netgate AutoConfigBackup NOT yet enabled (pfSense config vaulted 2026-06-17 as point-in-time only).

Endpoint security:

  • Datto EDR/AV (Infocyte/azcomp4587) is the ACG-managed endpoint stack. Org 2d5ea96e-3228-461b-9c60-13ae464b61d8, target group 1dbd2b02-f7df-45d0-a7f2-18667f48447f, reg key 6qw68y2rwl. 35 agents enrolled, all AV-enabled, 28 online (2026-07-15). Install: Install-EDR -URL "https://azcomp4587.infocyte.com" -RegKey 6qw68y2rwl.
  • CS-SERVER: Datto EDR/AV active (agent b41befcf, heartbeat current, defs current). Legacy Datto stack removed 2026-06-26; ACG-managed EDR reinstalled 2026-07-13 (RMM cmd 0a60cac7).
  • Long-stale agents: desktop-kqsl232 (47d offline -- decommissioned), maintenance-pc (26d offline).
  • Bitdefender decommission substantially complete. DESKTOP-TRCIEJA still BD_ACTIVE (GravityZone console-only uninstall; retires with planned hardware replacement). DESKTOP-F94M8UT: removed from Datto console (gone as of 2026-07-15 verification). Pending: confirm Cascades removed from Syncro's BD deployment (GUI-only); GravityZone portal cleanup of stale RECEPTIONIST-PC records (company 66b0448e); reconcile laptop3 (EDR agent, no RMM agent); confirm/remove stale EDR agents laptop1 + cascades-laptop.

Email & Identity

  • M365 tenant: cascadestucson.com | Tenant ID: 207fa277-e9d8-4eb7-ada1-1064d2221498
  • M365 licenses (live Graph 2026-07-15):
    • Business Premium (SPB): 45 owned / 41 assigned / 4 free
    • Business Standard: SUSPENDED -- 30 office staff still on it; 29 consumed (jodi.ramstack removed 2026-07-15). Relicensing these users onto supported licenses is a 30-day to-do ($375-575/mo net-new spend, not savings -- 26 net-new seats; best case ~$374/mo after converting shared mailboxes). Not everyone needs full Office.
  • On-prem AD domain: cascades.local | UPN suffix: cascadestucson.com
  • MX / mail flow: Exchange Online (EOP direct MX). SPF: -all. DKIM: both M365 selectors published. DMARC: p=quarantine; pct=100 (live, verified 2026-07-15). Reports to info@cascadestucson.com (unmonitored). No third-party email gateway.
  • MFA: CA policy "Require MFA for all users" enabled. Caregivers excluded from MFA (protected by on-network block + 8h reauth). Voice-call MFA disabled tenant-wide; exception: SG-MFA-Voice-Call-Scoped-sysadmin (304f941e, single member sysadmin@).
  • Entra Connect: Installed on CS-SERVER 2026-04-25; exited staging 2026-05-14; actively syncing. Sync scope: ONLY OU=Caregivers, OU=Groups, OU=Caregiver Devices. OU=Administrative not yet in scope (UPN suffix updates for that OU pending). Cloud/Graph group adds to SG-Caregivers fail (HTTP 400) -- all membership writes on CS-SERVER via RMM.
  • Break-glass accounts: breakglass1-csc@cascadestucson.com, breakglass2-csc@cascadestucson.com. Not yet created as of 2026-07-15. Must exist before the final CA allow-list flip.
  • Admin accounts:
    • admin@cascadestucson.com -- Mike's working admin (cloud-only, Connect-excluded)
    • sysadmin@cascadestucson.com -- Howard's working admin (cloud-only, Connect-excluded). Object id: 471b13dc-3cf8-416b-a132-f5f3bc8d1cc8. Vault: clients/cascades-tucson/m365-sysadmin.sops.yaml.
  • ALIS (clinical SaaS): https://cascadestucson.alisonline.com. communityId 622. Vault: clients/cascades-tucson/alis-sso-app-registration.sops.yaml; API user: clients/cascades-tucson/alis-api-howard-user.sops.yaml (username must be howard.enos@cascadestucson). ALIS app id d5108493-cba8-4f08-90b6-1bb0bc09eb2a, client secret expires 2028-05-06 (rotation reminder -- expiry breaks ALIS SSO tenant-wide). Staff endpoints are read-only via API -- writes via alis skill build-import -> upload .xls in ALIS UI.
  • jodi.ramstack DECOMMISSIONED 2026-07-15: account disabled, sessions revoked, Business Standard license removed (user id b7cddbeb-6026-436b-a3aa-67c4be43e3fb). No mailbox existed (deprovisioned by the suspended subscription; last sign-in 2025-03-28). Account object retained disabled/unlicensed.
  • Audit retention: Approved 2026-04-29. Azure Log Analytics (90d) + Storage Account (6yr) in ACG subscription e507e953-2ce9-4887-ba96-9b654f7d3267, RG rg-audit-cascadestucson. Not yet built.
  • [SECURITY -- OPEN] ComputerGuru - Tenant Admin SP holds a standing Privileged Authentication Administrator role (stranded from Alma Montt offboarding; Graph blocked teardown). Needs a Global Admin to remove in Entra (Roles & admins -> PAA -> remove SP). Leave its Conditional Access Administrator role. Pending Mike's decision.
  • Shared mailboxes (live state):
    • grievances@cascadestucson.com, Surveys@cascadestucson.com -- created 2026-06-12; Meredith Kuhn + Ashley Jensen, FullAccess+SendAs.
    • accounting@cascadestucson.com ("Accounting Dept.") -- delegates: Lauren Hasselman, Ashley Jensen, Zachary Nelson, Chris Knight (added 2026-07-09), each FullAccess (auto-mapping) + SendAs.
    • Alma Montt's mailbox -> SharedMailbox (Shelby Trozzi FullAccess+AutoMap, 2026-06-25).
    • Tamra Matthews' mailbox -> SharedMailbox (Crystal Rodriguez, Megan Hiatt, Meredith Kuhn, Ashley Jensen FullAccess+AutoMap, 2026-06-30).
  • Inky: No deployment exists. Confirmed 2026-06-04.
  • HIPAA BAA: Covered by Microsoft Customer Agreement for Business plan subscribers (confirmed 2026-05-14). Medtelligent (ALIS) BAA not yet verified.

Network

  • ISP / WAN: Dual-WAN Cox. WAN1 igc0 184.191.143.62/30 (Cox Fiber, primary, gw 184.191.143.61) + WAN2 igc3 72.211.21.217/27 (Cox Coax, secondary, static). WAN_Group gateway group. Measured: WAN1 ~522 Mbps upload; WAN2 coax upload unmeasured.
  • Firewall: pfSense Plus 25.07-RELEASE at 192.168.0.1. Admin vault: clients/cascades-tucson/pfsense-firewall.sops.yaml. Split-tunnel OpenVPN (Howard): clients/cascades-tucson/pfsense-openvpn-howard.sops.yaml (route 192.168.0.0/22; use OpenVPN GUI or OpenVPN Connect with DCO disabled). [ROUTING GOTCHA 2026-06-30] LAN "Default allow LAN to any" rule Gateway=WAN_Group policy-routes LAN->internal-VLAN traffic out the WAN. Fixed with a top LAN pass rule (src CS-SERVER 192.168.2.248, dst 10.0.20.0/24, gw=default). pfSense OpenVPN --inactive idle timeout ~300s (not yet fixed).
  • LAN / VLAN layout: Primary staff/AP network 192.168.0.0/22. Staff/Internal VLAN 20 ("CSCNET", 10.0.20.0/24, gw 10.0.20.1). Voice VLAN 30 (10.0.30.0/24, gw 10.0.30.1). Guest VLAN 50 (10.0.50.0/24, RFC1918 blocked). CSC Internal VLAN 10 (mgmt). Per-unit /28 VLANs: ~240 networks (VLANs 101-631 for per-room resident isolation, 10.[floor].[room].0/28). DHCP backend: ISC (Kea config present, dormant). Unbound DNS.
  • [STATUS 2026-07-01] VLAN 20 migration -- machines essentially done, printers lagging. 22 online hosts on VLAN 20 (10.0.20.x); only CS-SERVER (by design) + ~6 stragglers remain on 192.168.x. Printer shares: only 4/15 repointed (FrontDesk .221, BusinessOffice .220, LifeEnrichment .94, MCReception .78); the other 11 still point at old-LAN IPs. MCMedTech stale at 192.168.2.53 (target 10.0.20.74 live+reachable). GPO CSC - Point and Print (CS-SERVER) pilot-scoped to DESKTOP-H6QHRR7 only. Map: docs/printer-gpo-map.md.
  • Switching (live 2026-07-15): 11 switch objects in UniFi (8 online, 2 offline USL24PB -- "Switch 2nd Floor #2" and "Switch 4th Floor #2" -- offline by design, not an issue, Howard confirmed 2026-07-15; 1 USPM16P pending). ~25 switch ports at 100 Mbps but gig-capable (systematic cabling/NIC issue, 1st/2nd/3rd-floor switches). 34 active 100Mb switch ports + 5 APs uplinked at 100Mb (APs 122, 145, 204, 236, 240 -- highest-impact). Port p38 (1st Floor USW) 4.0% tx-drop rate. Full UniFi managed via UOS controller (172.16.3.29, HTTPS 11443; Cascades site va6iba3v, site_id 685f39068e65331c46ef6dd2).
  • WiFi -- 77 U7-Pro APs (75 online, 2026-07-15). CSCNet (shared PPSK, ~230-242 per-key->network mappings, wlanconf 685f39078e65331c46ef7ee5, vault clients/cascades-tucson/wifi-cscnet.sops.yaml). CSC ENT (legacy, being repurposed as 5 GHz-only WPA2 PPSK "device island" for Poly voice + Helpany sensors). Guest (isolated, VLAN 50). Mesh topology: 2nd Floor Atrium is wireless-mesh parent for CC Bridge + salon (5 GHz backhaul ch36); 206 U7 Pro carries AP 108.
  • Wireless RF (applied 2026-06-19, validated): 2.4 GHz -> MEDIUM power on 47 radios (non-regressive; corrected over-thinning regression). 5 GHz -> clean DFS 40 MHz plan on 72 non-mesh APs (ch 52/60/100/108/116/124/132/140, 0 co-channel) -- retry HALVED (8.7->3.8 avg). CSCNet BSS-transition (802.11v) ON. 6 GHz BLOCKED on CSCNet (WPA3 mandate; Howard's supervised decision to enable). DFS channels at this site 4-5x cleaner than non-DFS (survey-proven); never apply a non-DFS-only policy without measuring first.
  • Voice VLAN 30 (COMPLETE 2026-06-19): HIPAA-isolated VLAN 30 (10.0.30.0/24). 37 devices: 28 Poly phones + 8 AudioCodes (.224-.231) + Vertical desktop (10.0.30.201, MAC e4:e7:49:52:3a:06, wired, LogMeIn). Phones mark DSCP EF (46). Voice PPSK vault: clients/cascades-tucson/wifi-voice-ppsk.sops.yaml. Bistro phone replaced Kitchen server phone (bad, pulled 2026-06-19) -- Bistro now has no phone (pending replacement). QoS design ready (docs/network/phase1-voice-qos-design.md) but NOT built; blocker: WAN2 coax upload figure.
  • VoIP vendor: Vertical (Richard Turner rturner@vertical.com). Two phone fleets: 8 AudioCodes (wired, externally powered, PoE OFF) + 28 Poly (WiFi via CSCNet PPSK). Vertical manages phones remotely. Dropped-calls root cause is RF band selection (Poly on saturated 2.4 GHz); CSC ENT device-island plan is the fix (dedicate 5 GHz SSID for Poly + Helpany). Poly cannot statically select a band -- a separate 5 GHz SSID is required (confirmed by Richard Turner 2026-06-24).

External Vendors & Mail Senders

  • Helpany (resident safety sensors): "Paul" = ceiling-mounted radar fall/motion sensors (Sedimentum backend, no camera/mic). WiFi: WPA2-only, NOT WPA3/hybrid; 5 GHz-capable. Currently on CSC ENT (key Ftfd85710#), migrating to the 5 GHz device-island. Facility liaison: John Trozzi.
  • bill.com (BILL): Sends from inform.bill.com, hq.bill.com, hello.bill.com, mc.bill.com. Safe sender: account-services@inform.bill.com. Confirmed delivering to accounting staff.
  • BOK Financial: DMARC p=reject; zero historical emails to cascadestucson.com (wrong recipient address on BOK's side).

Business Applications & Reporting Systems

System Function Notes
ALIS (Medtelligent) Clinical EHR SSO live. HIPAA -- BAA required before PHI leaves. communityId 622.
QuickBooks Accounting Running on CS-SERVER (should NOT be on a DC).
Bill.com AP/AR REST API automatable.
Relias Training / LMS Export / API.
You've Got Leads Senior-living CRM Export / API varies.
TELS (Direct Supply) Facilities Export; API uncertain.
Focus HR HR / payroll Export or vendor API.
Helpany (app.safe-living.com) Caregiver app Export-only likely.
POS Point of sale TBD.

[PROPOSED] KPI dashboard (Ashley Jensen request, 2026-06-17): Phase 1 scheduled CSV/Excel exports -> SharePoint -> Power BI Pro; Phase 2 API-capable systems (Bill.com, QuickBooks Online) via Power Automate. Parked pending Ashley's day-one KPIs + data-freshness need + POS/Focus-HR specifics + ALIS analytics availability. Scoping: clients/cascades-tucson/docs/proposals/kpi-dashboard.md.

Access

  • CS-SERVER: Via ScreenConnect or GuruRMM (agent c39f1de7-d5b6-45ae-b132-e06977ab1713; re-enrolls -- resolve live by hostname). Vault: clients/cascades-tucson/cs-server.sops.yaml (username sysadmin).
  • CS-SERVER iDRAC: 192.168.2.65
  • pfSense admin (HTTPS): https://192.168.0.1 -- vault: clients/cascades-tucson/pfsense-firewall.sops.yaml
  • pfSense SSH: ssh admin@192.168.0.1 (system OpenSSH) -- tcp/22 blocked from OpenVPN subnet; use GUI remotely
  • pfSense OpenVPN (Howard): vault: clients/cascades-tucson/pfsense-openvpn-howard.sops.yaml (split-tunnel, route 192.168.0.0/22)
  • pfSense config backup (2026-06-17): clients/cascades-tucson/pfsense-config-backup-2026-06-17.sops.yaml
  • Synology DSM: http://192.168.0.120:5000 -- vault: clients/cascades-tucson/synology-cascadesds.sops.yaml. [SECURITY] Cloud Signin Portal credential was committed plaintext at vault commit 1fbc0e1 -- encrypted go-forward but must be rotated.
  • M365 admin: admin@cascadestucson.com -- vault: clients/cascades-tucson/m365-admin.sops.yaml
  • M365 sysadmin: sysadmin@cascadestucson.com -- vault: clients/cascades-tucson/m365-sysadmin.sops.yaml
  • WiFi CSCNet: vault: clients/cascades-tucson/wifi-cscnet.sops.yaml
  • WiFi Voice PPSK (VLAN 30): vault: clients/cascades-tucson/wifi-voice-ppsk.sops.yaml
  • Android enrollment token: vault: clients/cascades-tucson/intune-android-enrollment-token.sops.yaml
  • MDM service account: vault: clients/cascades-tucson/mdm-service-account.sops.yaml
  • svc-scan (scan-to-folder): vault: clients/cascades-tucson/svc-scan.sops.yaml
  • ALIS SSO app registration: vault: clients/cascades-tucson/alis-sso-app-registration.sops.yaml; API user: clients/cascades-tucson/alis-api-howard-user.sops.yaml
  • Caregiver temp passwords (2026-06-30): vault: clients/cascades-tucson/caregiver-temp-passwords-2026-06-30.sops.yaml. Retrieve with vault get (NOT get-field). Do NOT inline values.
  • Caregiver temp passwords (2026-07-01, 4 new hires): vault: clients/cascades-tucson/caregiver-temp-passwords-2026-07-01.sops.yaml. Same retrieval rules.
  • Shelby Trozzi (domain account): vault: clients/cascades-tucson/shelby-trozzi.sops.yaml. Not Entra-synced (safe to reset on-prem without M365 impact).
  • UOS controller SSH (root): vault: infrastructure/uos-server-ssh-key
  • UOS controller RW admin (Network API): vault: infrastructure/uos-server-network-api-rw
  • UniFi AP device auth (Cascades): vault: clients/cascades-tucson/unifi-ap-ssh
  • Remediation tool: Full tiered app suite consented 2026-04-21. All six apps active: Security Investigator (bfbc12a4), Exchange Operator (b43e7342), User Manager (64fac46b), Tenant Admin (709e6eed), Defender Add-on, Intune Manager.
  • Vault root: clients/cascades-tucson/

Patterns & Known Issues

Syncro / Billing

  • Never set a contact on any Syncro ticket unless explicitly requested. Meredith Kuhn is the recurring wrong default Syncro pre-selects -- she is not the correct contact. Leave contact_id blank.
  • Billing product for prepaid block draw: Use a real labor type (Remote, Onsite, etc.) -- NOT "Prepaid project labor" (exempt, won't decrement the block).
  • Always live-check hours before billing: GET /customers/20149445.
  • Windows Home->Pro upgrade billing: Syncro product "Windows Pro Upgrade" id 23571919 ($99/machine). MAK: vault infrastructure/windows-pro-mak.sops.yaml.

Exchange Online / Message Tracing

  • Get-MessageTrace is hard-deprecated (Sept 2025). Use Get-MessageTraceV2 instead (ResultSize not PageSize). V2 max window 10 days -- loop 9 consecutive windows for 90-day coverage. Deprecation error may be silently swallowed by downstream jq filters -- check the raw response if trace returns unexpectedly empty.
  • Sender-side suppression (SendGrid ESP): If a user never receives mail from a specific sender and message trace shows zero records, consider a SendGrid suppression list (fix = contact sender's support, no M365 action). Confirmed with bill.com.
  • AutoMapping rolls back on rapid sequential grants. Grant one user at a time, spaced ~6-8s; poll until removed before the next grant. (Tamra Matthews offboarding root cause, 2026-06-30.)
  • Get-RecipientPermission replication lag: an immediate read-back after a SendAs grant can miss the new trustee (EXO replica lag); re-read before concluding the write failed. (Chris Knight accounting mailbox, 2026-07-09.)

Active Directory / User Management

  • Security group assignment is always explicit. When creating any Cascades user, ask which security group(s). OU -> group auto-mirror was explicitly declined 2026-05-14.
  • SG-Caregivers = frontline caregivers ONLY (Howard 2026-06-30). Admin-adjacent staff (Feller, Nyanzunda), pilot.test, disabled accounts excluded. Cloud/Graph adds fail (HTTP 400); all writes on CS-SERVER via RMM.
  • Entra Connect sync scope is narrow -- do not OU-move a synced caregiver. Scope covers ONLY OU=Caregivers, OU=Groups, OU=Caregiver Devices. Moving a caregiver to any other OU deletes its cloud object (Zeke Huerta, front desk role change, 2026-07-01 -- OU move deferred).
  • Caretaker roster reconciliation is a standard cycle (last run 2026-07-01): pull live OU=Caregivers + SG-Caregivers via RMM, diff 1:1 against the client's list, per-person decisions (disable+remove+reclaim for leavers; create+group+license+temp-password for new hires; resolve name duplicates). License math and CA policy exclusions ride on SG-Caregivers membership.
  • New user mandatory order (folder redirection):
    1. Create AD user
    2. Run New-HomeFolder -Username "<sam>" on CS-SERVER
    3. Add to SG-FolderRedirect
    4. THEN first domain logon
    • Skipping step 2 causes fdeploy to cache a failure silently and never retry.
  • Folder redirect recovery: clients/cascades-tucson/scripts/fix-shell-redirect.ps1 via GuruRMM while user is logged in. Must set both GUID-based and legacy-name registry keys.
  • fdeploy1.ini flags: Flags=187 (changed from 1211 which caused WRITE_DAC failures on new subfolders).
  • [ROOT CAUSE 2026-06-08] Native Folder Redirection was DOA fleet-wide -- GPO targets were in fdeploy1.ini but the Windows FR CSE only reads fdeploy.ini. Fixed by writing correct fdeploy.ini + version bump. Native FR now works on first logon.
  • LE GPO ({889BE7BE-...}) has empty \User tree -- Sharon Edwards / Susan Hicks working via registry workaround only. Follow-up: retire the LE GPO and put LE users into SG-FolderRedirect.
  • Login-screen hide (SpecialAccounts\UserList): An enabled local admin not visible in the sign-in picker has a SpecialAccounts\UserList suppression (DWORD <username>=0). Fix: delete the DWORD.
  • Caregiver name change procedure (Charity Menle, 2026-07-09): Set-ADUser -> Rename-ADObject -> Set-ADUser -SamAccountName -> delta Start-ADSyncSyncCycle. Set proxyAddresses explicitly. Password and group/license unchanged. Vault: temp password stays under the OLD sAMAccountName key.

File Shares & Scan-to-Folder (Accounting)

  • Accounting folder: D:\Shares\Accounting on CS-SERVER, shared as \\CS-SERVER\AcctDept. Share is named AcctDept, NOT Accounting (a printer share named Accounting already exists; do not collide). Users: lauren.hasselman, chris.knight, zachary.nelson (Modify). svc-scan for scanner auth (Change). REUSE svc-scan for every future scanner->network-folder setup at Cascades -- do NOT create a per-printer/per-folder scan account. Vault: clients/cascades-tucson/svc-scan.sops.yaml.
  • Brother MFC-L8900CDW "Business Office" (10.0.20.220): Scan-to-Network profile: path \\192.168.2.254\AcctDept\Scans, Auth Method NTLMv2 (not Auto/Kerberos -- printer can't KDC across VLAN), username cascades\svc-scan.
  • Drive maps: Chris Knight (DESKTOP-N5G1ROO) Y:; Zachary (ACCT2-PC) Y:; Lauren (DESKTOP-H6QHRR7) X: -- all to \\CS-SERVER\AcctDept.
  • \\CS-SERVER\Company Web Docs (built 2026-07-02): D:\Shares\Public\Company Web Docs, gated at share ACL (Shelby.Trozzi = Change; Admins = Full; NTFS left inherited from Public). RMM cannot push the drive map directly (user_session double-hop -> SMB error 67); workaround: cmdkey + persistent HKCU:\Network\W map (mounts at next logon). Reusable pattern: memory reference_rmm_map_network_drive.
  • \\CS-SERVER\Executive (built 2026-06-24): D:\Shares\Executive, inheritance broken; Ashley.Jensen + Meredith.Kuhn = Modify. Persistent E: on DESKTOP-U2DHAP0 (Ashley) + ASSISTMAN-PC (Meredith). Note: CS-SERVER SMB clients reach it at 192.168.2.248 (registered DNS), NOT .254 (Hyper-V vEthernet).
  • RMM dispatch gotcha: build UNC from [char]92 in PowerShell payloads -- literal \\ collapses to \ through jq/agent.
  • \\CS-SERVER\BusinessOffice = the Accounting Assistant printer (Canon MF455DW, 10.0.20.220) in room 101. One physical L8900CDW, one share. Do NOT create a duplicate "Accounting Assistant Printer" queue.

Printers / VLAN 20 Migration

  • Server-share model is preferred for domain-joined machines (\\CS-SERVER\<share>). Workgroup machines get direct-IP local printer installed as SYSTEM (switch to server share on domain join).
  • Point-and-Print policy prerequisite for standard users pulling a driver from CS-SERVER: HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers: RestrictDriverInstallationToAdministrators=0 + subkey PointAndPrint (Restricted=1, TrustedServers=1, ServerList=CS-SERVER, NoWarningNoElevationOnInstall=1, UpdatePromptSettings=2). Symptom without it: elevation prompt 0x800702e4 / PrintService event 513 / 0xBCB.
  • Canon MF741CDW / MF743CDW are UFR II ONLY -- NOT PCL. A PCL6 driver produces Error #822. Pull Canon Generic Plus UFR II V250 (INF cnlb0ma64.inf) from a client DriverStore.
  • Static VLAN 20 printer IPs: Front Desk Epson ET-5800 = 10.0.20.221 (\\CS-SERVER\FrontDesk); Life Enrichment Canon MF741CDW = 10.0.20.94 (\\CS-SERVER\LifeEnrichment, UFR II); Business Office Brother L8900CDW = 10.0.20.220; Dining Room Canon MF743CDW = 10.0.20.228 (DESKTOP-MD6UQI3, direct-IP UFR II); Chef Office Brother MFC-9330CDW = 10.0.20.236 (CHEF-PC, direct-IP); MedTech Brother MFC-L8900CDW = 10.0.20.74; MC Reception Epson ET-5800 = 10.0.20.78. Running map: docs/printer-gpo-map.md.

Synology NAS (cascadesDS) / Shared File Access

  • Device (confirmed live 2026-06-25): DS718+, DSM 7.2.1-69057 Update 11, 6 GB RAM, serial 1920PEN537202. Filesystem ext4; 2x WD10EZEX 1 TB. 10 shares + hidden folders. 30 packages incl. Active Backup for Business 3.1.0, Synology Drive Server 3.5.0.
  • Synology Drive sync to CS-SERVER is ACTIVE AND WORKING (Howard confirmed 2026-07-15). The earlier "Team Folder migration [PENDING]" notes were stale. Drive Client (v7.5.0.16085, runs as sysadmin) syncs shared folders to D:\Shares\Main on CS-SERVER. Note: synopkg status SynologyDrive falsely returns "stopped" (status 263) even when active -- verify via systemctl is-active pkgctl-SynologyDrive and netstat -tlnp | grep 6690.
  • Stale Word owner (lock) files on cascadesDS: Word creates hidden ~$<filename> files on abrupt session end. Fix: delete the ~$ file(s). (Meredith Kuhn locked doc, 2026-06-10.)
  • Accessing cascadesDS from RMM -- always use a user session, not CS-SERVER SYSTEM. Domain-joined machine account fails Kerberos against the Synology (workgroup "CASCADES" same short name as AD domain). Run in user_session context of a machine where the target user is logged in.

CS-SERVER SMB & Endpoint AV

  • RMM-dispatched SMB client commands false-negative. net use/net view/Test-Path/Get-SmbConnection in user_session return error 67 (BAD_NETWORK_NAME) / RPC 1702 / "none" even for known-good targets. CS-SERVER SMB is healthy. Validate server-side via Get-SmbSession/Get-SmbOpenFile or an interactive test -- never from RMM client-side results. A drive-map verify failure is NOT proof of a problem.
  • CS-SERVER endpoint AV history (for context): Prior-MSP installed Datto EDR "Endpoint Protection SDK" (Bitdefender engine) managed by old Datto RMM/CentraStage -- NOT GravityZone. That stack was fully removed 2026-06-26 (the "Datto removed from CS-SERVER 2026-06-26" note referred to the legacy prior-MSP stack). ACG-managed Datto EDR (Infocyte HUNT agent b41befcf) was installed 2026-07-13 and is active today (verified live 2026-07-15). The DC was unprotected between 2026-06-26 and 2026-07-13.

Datto EDR / Bitdefender Decommission

  • Datto EDR/AV (Infocyte/azcomp4587) is the ACG-managed endpoint stack (org 2d5ea96e, target group 1dbd2b02, reg key 6qw68y2rwl). Install: Install-EDR -URL "https://azcomp4587.infocyte.com" -RegKey 6qw68y2rwl.
  • Bitdefender GravityZone BEST removal is CONSOLE-ONLY. GravityZone Public API createUninstallTask is DEAD; BEST anti-tampering blocks endpoint-side uninstall. Use the console "Uninstall client" task (Network -> Cascades company 66b0448e). New/replacement machines: provision Datto EDR/AV only, never Bitdefender, never carry over prior-MSP Datto RMM/CentraStage artifacts.
  • RECEPTIONIST-PC is two physical boxes sharing a hostname (frontdesk MJ0KQHNP, MemCare MJ0KQH4R -> staged rename to MEMCARE-STATION, not yet applied -- needs reboot). Reconcile fleets by SERIAL, not hostname.
  • BD detection script: services ^EP(Security|Protected|Update|Redline|Integration)Service$ + uninstall-registry DisplayName ~ Bitdefender|GravityZone + Test-Path 'C:\Program Files\Bitdefender'.

Browser / Edge

  • [BUG - FLEET] Edge 149 cannot open Office files via download-list when Downloads is a UNC-redirected folder (Chromium issue 519243472). Prepends \\?\ to UNC paths without converting to \\?\UNC\. Affected build: Edge stable 149.0.4022.52. Fix options: (1) update Edge past the fix; (2) interim: --disable-features=LaunchShellExecuteViaExplorer; (3) zero-config: use "Show in folder" then double-click; (4) rollback to 148.

Conditional Access / Caregiver Policies

  • Phased rollout -- never tenant-wide. CA policies for caregivers target SG-Caregivers (8b8d9222-5d71-419a-936d-56d895c6c332). SG-Caregivers is 35 members as of 2026-07-01 (after 8 offboarded, 4 new hires, roster reconciled).
  • Enforced caregiver CA policy set:
    • CSC - Block caregivers off Cascades network (e35614e1) -- BLOCK if location not Cascades
    • CSC - Block caregivers on non-compliant device (ede985e2) -- DISABLED 2026-07-01. Do not re-enable; superseded by the allow-list at final lockdown.
    • CSC - Caregiver sign-in frequency 8h (7d491c7a)
  • Caregiver device allow-list (report-only): 1b7fd025; state enabledForReportingButNotEnforced. Device filter (mode exclude): (device.displayName -startsWith "CSC-") -or (device.extensionAttribute1 -eq "CSCCaregiverDevice"). Includes: NURSESTATION-PC (deviceId d3bf931f), Laptop2, LAPTOP-DRQ5L558, LAPTOP-E0STJJE8, LAPTOP-8P7HDSEI, ASSISTNURSE-PC (needs re-join + re-tag after Win11 reinstall).
  • GDAP exclusion: CA blocking policies must exclude "Service provider users" (GDAP foreign principals) + SG-External-Signin-Allowed + SG-Break-Glass.
  • [ROOT CAUSE 2026-07-01] pilot.test login success masked two separate blockers. pilot.test is in SG-Caregivers-DeviceTest / SG-Caregivers-Test -- excluded from the compliance-block and targeted by the allow-list. Live SG-Caregivers members hit BOTH problems. A pilot passing on a device-test group does NOT prove the production group will pass the same CA gauntlet.
  • Interim caretaker CA posture (2026-07-01): desktops AND phones allowed, on-network only. Phones-only lockdown deferred to end of rollout.

Wireless / UniFi RF

  • [APPLIED 2026-06-19 -- validated] Production RF optimization:
    • 2.4 GHz power -> MEDIUM on 47 radios; 24 thinned-disabled radios stayed disabled.
    • 5 GHz -> clean DFS 40 MHz channels on 72 non-mesh APs; retry HALVED (8.7->3.8 avg, median 8.2->2.1); 0 radar events.
    • CSCNet BSS-transition (802.11v) ON.
  • Primary pain band is 2.4 GHz. Avg TX-retry ~10%; cu_total 69-94% live; catastrophic external neighbor BSSID density (ch6 ~33k BSSIDs). IoT/legacy clients stuck on 2.4.
  • 6 GHz nearly unused -- CSCNet not broadcasting 6 GHz (wlan_bands=[2g,5g]). 75 radios active but only ~1 client. Enabling requires WPA3+PMF conversion on the 427-client SSID -- Howard's supervised decision.
  • DFS channels here are 4-5x cleaner than non-DFS (survey-proven; ch149=12%, ch157=28% vs DFS 2-3% busy). Always: scan -> survey-report.py -> channel-plan --channels -> apply -> validate. Do NOT use UniFi auto-channel or a non-DFS-only policy without measuring.
  • Offline switches (Switch 4th Floor #2, USW Pro Max 16) are offline BY DESIGN -- not an issue (Howard confirmed 2026-07-15). Do not flag or investigate.
  • AP-hang recovery: device-control.sh cascades poe-cycle "<AP name>" --apply. Do NOT use force-provision (took AP 445 offline during the Floor-4 pilot).
  • Tooling (unifi-wifi skill): audit-site.sh, live-stats.sh, survey-report.py (the channel-decision driver), channel-plan.sh (data-driven: --channels <list> or --dfs ok|avoid|only), apply-radio.sh, apply-wlan.sh, dfs-check.sh, switch-audit.sh, device-control.sh, pfsense-ssh.sh (onsite only -- blocked over VPN).

VoIP / Network Device Migration

  • Re-VLANing a wired switch port requires a link bounce to force re-DHCP. Changing native VLAN does not reset the NIC link. Bounce via PoE power-cycle (PoE devices) or disable/enable via controller API (non-PoE). A UniFi block/unblock is a MAC filter only -- does NOT bounce the link.
  • Externally-powered devices (AudioCodes desk phones) need a PHYSICAL power-cycle. 8 AudioCodes are on USW-16-PoE ports 1-8 with external power bricks (PoE OFF on those ports) -- controller PoE-cycle and port disable/enable are both no-ops.
  • UniFi controller PUT 403 / CSRF: rapid writes can 403 -- read CSRF token from x-updated-csrf-token response header.
  • Verify VLAN membership via the client vlan field, not the controller's displayed IP. IP field caches/lags.
  • Build UNC from [char]92 in RMM PowerShell payloads. Literal \\ collapses to \ through jq/agent.

Voice QoS (VLAN 30) -- design, NOT yet built

Design: docs/network/phase1-voice-qos-design.md. pfSense HFSC shaper on BOTH WANs -- 3 queues qVoice (prio 7, realtime ~30%, src 10.0.30.0/24), qACK (~10%), qDefault (~60%). UniFi WMM maps DSCP EF -> WiFi Voice AC. Blocker for sizing: WAN2 coax upload number. QoS is insurance (WAN2 failover + rare WAN1 saturation); everyday dropped-calls cause is RF (band selection).

pfSense Operations

  • pfSense 25.07 logs are PLAIN TEXT. Read with tail/grep. clog returns empty output.
  • LAN "allow LAN to any" rule policy-routes internal-VLAN traffic out the WAN (Gateway=WAN_Group). Fix: top LAN pass rule, Gateway=default, scoped source. Do it in the GUI (SSH/22 blocked from OpenVPN subnet).
  • pfSense OpenVPN --inactive idle timeout: ~300s; disconnects idle clients after ~5 min. Keepalive pings do NOT reset it. Fix proposed 2026-06-18; not applied.
  • pfSense dirty-boot / duplicate dhcpd: After unclean shutdown, dhcpd may start twice. Fix: killall dhcpd && echo "services_dhcpd_configure();" | /usr/local/sbin/pfSsh.php; verify one instance: pgrep -f "dhcpd -user" | wc -l == 1.

Known Issues / Pending Hygiene

  • [URGENT -- 2026-07-16 PM] Juan Andrade offboarding. Disable + remove from SG-Caregivers + reclaim Business Premium. Coord todo 80716a98.
  • [PENDING] Zeke Huerta MFA (Authenticator) registration. No registered method since front-desk move.
  • [PENDING] Break-glass accounts (breakglass1-csc@, breakglass2-csc@) not yet created. Required before final CA allow-list flip.
  • [PENDING] Object-access audit logging on file server (SS164.312(b) gap). No forensic trail on D:\Homes / PHI shares.
  • [PENDING] BAA inventory incomplete. Several potential business associates unaccounted for.
  • [PENDING] Stale SG-Caregivers-Pilot exclude-group on Require MFA for all users policy. Remove at pilot cleanup.
  • [PENDING] ALIS-native 2FA disable. Force all ALIS logins through Entra SSO; disable per-user then globally.
  • [PENDING] Microsoft case for INTUNE_A PendingInput -- does NOT block caregiver access (hybrid+GPO path replaces Intune dependency).
  • [PENDING] Named Location tightening. Non-caregiver devices on the building network can currently pass the location check.
  • [SECURITY] Synology Cloud Signin Portal credential exposed in vault git history (commit 1fbc0e1). Encrypted go-forward but credential must be rotated.
  • [SECURITY -- OPEN] Tenant Admin SP holds standing PAA role. See Access section. Pending Mike's decision.
  • [PENDING] MEMCARE-STATION rename not applied. Staged 2026-06-30 on MemCare RECEPTIONIST-PC box (S/N MJ0KQH4R); still reports as RECEPTIONIST-PC -- needs reboot.
  • [PENDING] pfSense OpenVPN --inactive timeout fix and Netgate AutoConfigBackup enable.
  • [PENDING] DESKTOP-TRCIEJA GravityZone BD uninstall (console-only). Box slated for hardware replacement.
  • [PENDING] 6 GHz on CSCNet -- WPA3 conversion required; Howard's supervised decision.
  • [PENDING] Bistro phone replacement -- Bistro has no phone (Kitchen server phone pulled 2026-06-19; Bistro phone relocated to Kitchen).
  • [PENDING] MemCare min-RSSI (floors 5/6) -- deferred until Howard adds new APs to floors 5/6.
  • [PENDING] WAN2 (coax) upload measurement -- needed to size pfSense HFSC voice QoS.
  • [PENDING] Audit retention infra (LAW 90d + Storage 6yr) approved 2026-04-29, not yet built.
  • [PENDING] M365 relicensing -- 30 office staff on suspended Business Standard; right-size onto supported licenses ($375-575/mo net-new depending on mix).
  • [WARN] ~25 switch ports at 100 Mbps but gig-capable. 34 active 100Mb ports + 5 APs uplinked at 100Mb (APs 122, 145, 204, 236, 240). Investigate after WiFi optimization stable.

Security Incidents (historical)

  • Megan Hiatt (2026-04-16): Active credential-stuffing -- 126 failed sign-ins, bursts from Belfast GB, Hamburg DE. Password reset + SMTP AUTH disable were action items. Mailbox clean. Re-verify April remediation held (flagged again during Tamra offboarding 2026-06-30).
  • John Trozzi (2026-04-16, 2026-04-20): Investigated twice -- both times NO BREACH.
  • Crystal Rodriguez (2026-04-19): Phishing investigation. Report: clients/cascades-tucson/reports/2026-04-19-crystal-rodriguez-phish-investigation.md.
  • Canva email delivery (2026-05-20): Resolved by adding canva.com domains to AllowedSenderDomains in EOP.
  • ALIS AADSTS65001 (2026-06-03): Resolved by granting tenant-wide admin consent on ALIS SP (e1cae4ad).
  • Chris Knight bill.com / BOK email delivery (2026-06-04): Root cause sender-side (SendGrid suppression; BOK wrong recipient email). Resolved externally. Ticket #32383.
  • dunedolly21@gmail.com: External guest invited 2026-04-14 by Lauren Hasselman. Status unknown -- confirm with Lauren. [unverified]

HIPAA Compliance

  • Primary objective. CS-SERVER and ALIS store PHI.
  • Critical open gaps: No audit logging on D:\Homes (SS164.312(b)); Object Access auditing disabled on CS-SERVER; no SMB encryption on homes share; audit retention infra approved but not built; BAA inventory incomplete; break-glass accounts not created.
  • Closed gaps: Backup (MSP360 cloud backup 2026-06-15); MFA / CA for all users; caregiver access restricted to building network (2026-07-01); auto-lock + auto-sign-out on shared caregiver devices (GPO deployed 2026-06-05); Voice VLAN 30 isolates PHI from phone traffic (2026-06-19); HIPAA BAA covered by MCA (confirmed 2026-05-14); 7 deleted mailboxes restored 2026-04-25 for 7-year retention.
  • Termination policy established: convert to shared mailbox, hide from GAL, retain 7 years. Litigation Hold available (Exchange Plan 2) but waived for the two 2026-06 offboardings (Alma, Tamra) per Howard's explicit no-PHI/PHI-adjacent-authorized calls.

Active Work

Canonical remaining-work plan: docs/REMAINING-WORK-PLAN.md (built 2026-06-24; refreshed 2026-07-13/14). 7 sequenced workstreams. Work from it.

No open tickets in Syncro as of 2026-07-15. See session logs for recent work.

  • [URGENT -- 2026-07-16 PM] Juan Andrade offboarding -- disable + remove from SG-Caregivers + reclaim Business Premium. Coord todo 80716a98.
  • [IN PROGRESS] Caregiver phone SSO -- ALIS email-match (Howard handling), roster now 35. Remaining: ALIS Email=UPN match for existing caregivers; build ALIS staff records for Munezero, Cota, Robinson; set Vallejo's ALIS Email=a.vallejo@; 7 discharged-record decisions; Kariuki ALIS dup (429856/429858) if she returns.
  • [IN PROGRESS, machines ~done / printers lagging] VLAN 20 (CSCNET) staff + printer migration. 22 machines on VLAN 20; only CS-SERVER (by design) + ~6 stragglers remain. Printer shares 4/15 repointed. Next: decide reboot-test vs pre-stage-drivers for Point-and-Print GPO, take it fleet-wide; repoint MCMedTech + 4 remaining stale caregiver-GPO shares; reboot MemCare RECEPTIONIST-PC box (MEMCARE-STATION rename pending reboot); domain-join workgroup boxes.
  • [SECURITY] Break-glass accounts (breakglass1-csc@, breakglass2-csc@) not created. Required before final CA lockdown.
  • [SECURITY] Remove standing PAA role from Tenant Admin SP. Needs Global Admin. Pending Mike.
  • [FOLLOW-UP] Megan Hiatt breach re-check -- CREDENTIAL_STUFFING_ACTIVE marker from April; verify remediation held.
  • [IN PROGRESS] CARF Technology and System Plan -- finalized 2026-07-15 (clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.md + .html/.pdf, 4-page branded deliverable). Howard delivering to Mike/client. Governance placeholders ([at adoption]) to be filled when Cascades formally adopts.
  • [IN PROGRESS] Datto EDR/AV rollout + Bitdefender decommission. 35 agents enrolled; CS-SERVER covered. Remaining: DESKTOP-TRCIEJA GravityZone console uninstall; confirm Cascades removed from Syncro BD deployment; GravityZone portal cleanup stale RECEPTIONIST-PC records; reconcile laptop3; confirm/remove stale EDR agents laptop1 + cascades-laptop.
  • [URGENT] Order replacement workstation for Lupe Sanchez (DESKTOP-TRCIEJA). EOL hardware; decision made 2026-06-18.
  • [URGENT] Rotate exposed Synology Cloud Signin Portal credential (vault commit 1fbc0e1 plaintext exposure).
  • [PENDING] Bistro phone replacement (no phone in Bistro since 2026-06-19 Kitchen relocation).
  • [PLANNED -- 60-90 days] Repurpose Synology NAS as onsite backup for CS-SERVER (per tech plan; online off-site backup continues).
  • [PLANNED] CSC ENT device-island consolidation (Poly voice + Helpany sensors -> 5 GHz-only WPA2 PPSK; enables later CSCNet WPA3/WiFi7/6 GHz). Design: docs/network/csc-ent-device-island-plan.md.
  • [PLANNED -- hardware] CS-SERVER SSD upgrade (2x enterprise SATA SSD already purchased; scheduled window with confirmed backup).
  • [PLANNED] Voice QoS for VLAN 30 -- design done, not built. Blocker: WAN2 coax upload.
  • [PLANNED] Network logging / observability -- Synology as syslog collector, pfSense + UniFi + AP sources. Spec: docs/network/network-logging-plan.md.
  • [PLANNED] KPI dashboard (Ashley Jensen) -- parked pending Ashley's day-one KPIs.
  • [PENDING] Home->Pro upgrade: CascadesProxess -- deferred to a late-night window (access-control appliance, active use). 2 x $99 (NurseAssist + DESKTOP-MD6UQI3) not yet invoiced -- Syncro product 23571919.
  • [PENDING] Enable 6 GHz on CSCNet -- WPA3 conversion, Howard's decision.
  • [PENDING] Enable Netgate AutoConfigBackup on pfSense.
  • [PENDING] pfSense OpenVPN --inactive timeout fix.
  • [PENDING] ALIS app session timeout lower from 20 to 15 min (Howard, ALIS admin).
  • [PENDING] File server audit logging (SS164.312(b) gap -- no NTFS/object-access audit trail on D:\Homes).

Device-readiness for domain migration (2026-06-24 audit + 6/26 upgrades):

  • READY to join: DESKTOP-LPOPV30 (Karen), MAINTENANCE-PC, LAPTOP-E0STJJE8; after reboot: ASSISTMAN-PC, ANN-PC, Laptop2; NurseAssist + DESKTOP-MD6UQI3 now Pro (6/26).
  • BLOCKED -- Windows Home: LAPTOP-8P7HDSEI, MDIRECTOR-PC, MEMREct-PC. CascadesProxess deferred.
  • EOL/replace: DESKTOP-TRCIEJA (Lupe Sanchez), ASSISTMAN-PC (Meredith), MDIRECTOR-PC (Shelby), MEMRECEPT-PC (MC front desk), CHEF-PC (Culinary) + spare deploy. Per CARF tech plan.

History Highlights

Date Event
2026-03-06 ACG onboarding begins. Initial audit (CS-SERVER Dell R610, pfSense, UniFi, Synology). 19 machines. No backup, no HIPAA compliance.
2026-03-09 AD security hardening: Monica Ramirez removed from Domain Admins, lockout policy fixed, AD Recycle Bin enabled, MachineAccountQuota set to 0.
2026-03-31 Cascades onboarded to remediation tool. Tenant ID documented. 50 users, Secure Score 34%.
2026-04-13 Major onsite: 13 stale AD accounts deleted, OU structure cleaned, UPNs migrated to cascadestucson.com, Homes share created, Folder Redirection GPO deployed (registry workaround), first domain joins.
2026-04-14 Sandra Fish global admin revoked. ALIS SSO confirmed. Business Premium proposal created.
2026-04-16 Breach checks: Megan Hiatt (credential stuffing, not breached; password reset). John Trozzi (clean). Crystal Rodriguez phish.
2026-04-17 Howard onsite: folder redirect Sharon Edwards diagnosis. John Trozzi WiFi (TP-Link + UniFi roaming instability).
2026-04-25 Entra Connect installed on CS-SERVER (staging mode). 7 deleted mailboxes restored for HIPAA. Dual-WAN discovered.
2026-04-28-29 CA policy reconciliation. Audit retention architecture (ACG-billed, LAW 90d + Storage 6yr). Break-glass design (2 accounts, YubiKeys). Caregiver pilot scope corrected (phased only).
2026-04-30 CA rollout (Report-only mode): 3 caregiver policies created. SDM bootstrap.
2026-05-01 Howard billed 33.5 hrs against prepaid block on Entra project ticket #32214 ($0 invoice).
2026-05-07-08 SDM phone provisioning. SDM token success. ALIS SSO app registration values captured to vault.
2026-05-14-16 Caregiver AD accounts created. Entra Connect exited staging -- actively syncing. Wireless diagnostic (2.4 GHz saturation hypothesis identified).
2026-05-18 Billing review. 7 hrs billed separately.
2026-05-20 Canva email delivery resolved (canva.com domains added to EOP).
2026-05-21 Crystal Rodriguez folder redirect confirmed working.
2026-05-22 Ashley Jensen domain-joined. RECEPTIONIST-PC domain-joined. GPO ILT fixes. cascadesDS auth failure diagnosed (workgroup collision) and deferred.
2026-05-23 Lauren Hasselman folder redirect complete.
2026-05-26 Access control vendor meeting onsite (ticket #32324). 0.5h Howard + 0.5h Mike billed.
2026-06-03 ALIS AADSTS65001 resolved: tenant-wide admin consent on ALIS SP. Caregiver device allow-list CA policy created (report-only, 1b7fd025).
2026-06-04 Three same-day tickets: #32381 Tamra scanner (0.5h onsite), #32382 Megan file access (1.5h onsite), #32383 Chris Knight bill.com/BOK email delivery (1.5h remote, root cause sender-side).
2026-06-05 NURSESTATION-PC localadmin login-screen issue resolved. Hybrid Entra Join + GPOs deployed: CSC - Caregiver Workstation validated; CSC - Caregiver Device Lockdown deployed to OU=Caregiver Devices. Ticket #32303, 7.0h.
2026-06-08 Chris Knight workstation setup (onsite). DESKTOP-N5G1ROO domain-joined + GuruRMM-enrolled. Root-caused native Folder Redirection failure -- fdeploy1.ini misnamed; fixed with correct fdeploy.ini + version bump. ASSISTNURSE-PC reinstalled (Win10->Win11). Edge UNC download bug diagnosed.
2026-06-09 Accounting scan-to-folder built. D:\Shares\Accounting on CS-SERVER; shared as \CS-SERVER\AcctDept; svc-scan service account vaulted; Brother MFC-L8900CDW Scan-to-Network configured (NTLMv2, confirmed).
2026-06-10 Meredith Kuhn locked Word doc -- stale owner files on cascadesDS. Five ~$ files deleted. Ticket #32403, 0.5h remote.
2026-06-12 Created shared mailboxes grievances@ + Surveys@ and delegated to Meredith + Ashley. All 8 permission grants verified. Ticket #32417, 0.5h remote.
2026-06-15 Wireless RF full audit -- controller access gained. 77 U7-Pro APs, ~574->587 clients, 2.4 GHz saturation confirmed as primary pain. CS-SERVER backup started (MSP360/CloudBerry). pfSense OpenVPN password reset.
2026-06-16 Voice VLAN plan for Vertical phones designed. Floor-4 2.4 GHz power-down pilot applied. dfs-check.sh confirmed ZERO real radar events fleet-wide. unifi-wifi skill feature-complete. pfSense confirmed pfSense Plus 25.07-RELEASE.
2026-06-17 Voice VLAN 30 built + verified; Vertical desktop + initial Poly phones migrated. Power outage -- full site down + recovery (pfSense on UPS surge-only side -> unclean shutdown -> duplicate dhcpd + 2nd-floor switch one-way L2; recovered; pfSense moved to battery). Plaintext Synology signin credential found (vault commit 1fbc0e1). KPI dashboard scoping (advisory, parked).
2026-06-18 Voice VLAN 30 cutover (8 AudioCodes added; 22 Poly done). AudioCodes required physical power-cycle. Per-phone diagnosis: dropped-calls are RF (band selection), not VLAN. 6 GHz root-caused dark. Optimization master plan built. DESKTOP-TRCIEJA (Lupe Sanchez) perf diagnosed; replace decision. Synology Drive sync architecture diagnosed.
2026-06-19 PRODUCTION RF OPTIMIZATION APPLIED (2 AM window): 2.4 GHz power -> MEDIUM on 47 radios; clean DFS 40 MHz plan applied to 72 non-mesh APs; 5 GHz retry HALVED. Voice VLAN migration COMPLETE (29/29 Poly re-keyed). Kitchen server phone bad (pulled); Bistro phone relocated. Billed ticket #32444, 7h.
2026-06-23 Planned power outage (05:30-09:00 MST) -- clean shutdown executed. All three core devices self-shut-down on local schedules. Verified clean at 05:31.
2026-06-24 CS-SERVER RAID live-verified healthy (live OMSA; the earlier "degraded" flag was stale; 6/15 self-recovered; 1:0:4 = GLOBAL HOT SPARE). PSU redundancy lost noted. Executive share built (\cs-server\Executive, billed 0.5h). Live AD+RMM domain-join diff; built docs/REMAINING-WORK-PLAN.md (7 workstreams). CARF Technology and System Plan deliverable started (Ashley Jensen). CSC ENT device-island consolidation plan (voice + Helpany).
2026-06-25 Alma Montt OFFBOARDED (terminated; MC Life Enrichment; no PHI/ALIS). Endpoint security migration begins: Datto EDR/AV rollout + Bitdefender decommission started; RECEPTIONIST-PC identified as two physical boxes.
2026-06-26 CS-SERVER: full legacy Datto stack removal + SMB "outage" debunked (was a test-method artifact -- RMM-dispatched SMB cmds false-negative). EDR/Bitdefender straggler 9am pass. Windows Home->Pro upgrades: NurseAssist + DESKTOP-MD6UQI3 upgraded to Pro for Workstations (2 x $99, to invoice).
2026-06-29 ALIS caregiver phone-only + caretaker-only crosscheck: phone-only caregivers = NONE (only 3 Transportation drivers are phone-only, no ALIS needed). 7 caregiver-list people exist in ALIS only as Discharged records.
2026-06-30 Caregiver phone SSO -- license + group + temp-password onboarding complete for 40 frontline caregivers (Business Premium assigned; vaulted temp passwords; SG-Caregivers corrected to frontline-only). Tamra Matthews OFFBOARDED (Move-In Coordinator). VLAN 20 printer migration (FrontDesk, LifeEnrichment, others); policy-routing root cause found + fixed in pfSense. MEMCARE-STATION rename staged.
2026-07-01 VLAN 20 migration live-reconciled -- 22 machines on VLAN 20, printer shares 4/15. Caretaker roster update: 8 accounts disabled + license reclaimed, 4 new hires created (Vallejo, Munezero, Cota, Robinson), Zeke Huerta moved to front desk (OU move deferred). SG-Caregivers now 35. CA phone/desktop login verified end-to-end; two CA blockers fixed (pilot.test had masked both). Interim caretaker CA posture (desktops + phones, on-network only) -- Howard's go, overrides 6/24 hold.
2026-07-02 Caregiver phone login: forced-change gotcha resolved (cleared ChangePasswordAtLogon for all 35 SG-Caregivers -- had failed as err=50126). PSO-Caregivers (never-expire FGPP) created on CS-SERVER. Shelby Trozzi "Company Web Docs" share built; domain account password vaulted.
2026-07-09 Charity Menle caregiver rename (AD rename procedure established, never re-create). Chris Knight granted FullAccess+SendAs on accounting@ SharedMailbox. Android enrollment token replaced (Replace, not Revoke -- stale token root-caused). Intune: 14 phones powered off (noncompliant status not a fault); storage fields confirmed not collected for COSU devices.
2026-07-13 Datto EDR installed on CS-SERVER (closing DC coverage gap since 2026-06-26 legacy-Datto removal). HUNTAgent=Running, RMM cmd 0a60cac7. Wiki + REMAINING-WORK-PLAN.md refreshed. Juan Andrade offboard moved to 2026-07-16 afternoon; coord todo 80716a98 created.
2026-07-14 Wiki + remaining-work-plan reviewed end-to-end (recovered session). HIPAA gaps identified: Juan Andrade access overdue, no break-glass accounts, Named Location too loose, no object-access audit logging, BAA inventory incomplete.
2026-07-15 CARF Technology and System Plan finalized (4-page branded PDF, Done/To-do per area, 8 CARF areas + supplementary). Live verification sweep confirmed: EDR/AV active on all 35 agents incl. CS-SERVER; M365 SPB 45/41/4; DMARC/DKIM/SPF live; VLAN 30 voice 37 clients; MSP360 file backup success today. jodi.ramstack DECOMMISSIONED (disabled, sessions revoked, Business Standard license removed; no mailbox existed). Synology shared-folder syncs to CS-SERVER confirmed working (stale wiki notes corrected). Mike (GURU-5070) verified EDR and M365 licensing live; sent correction to Howard via coord.

Backlinks

  • projects/gururmm -- RECEPTIONIST-PC + CS-SERVER enrolled (site CascadesTucson); fleet EDR/BD + Home->Pro + printer work driven via GuruRMM
  • wiki/systems/uos-server -- UniFi controller hosts Cascades site va6iba3v
Reference in New Issue View Git Blame Copy Permalink