claudetools/clients/cascades-tucson/session-logs/2026-06/2026-06-30-howard-vlan20-printer-migration.md

User

• User: Howard Enos (howard)
• Machine: Howard-Home
• Role: tech

Session Summary

Migrated the front-desk Epson ET-5800 and the Life Enrichment Canon MF741CDW onto the new Staff VLAN 20 (10.0.20.0/24 / "CSCNET"), as part of the ongoing move of staff machines + printers off the flat old LAN ("CSC ENT", 192.168.0.0/22). All work driven via GuruRMM (CS-SERVER + the client agents) plus one pfSense GUI change.

First, the front-desk ET-5800: confirmed RECEPTIONIST-PC is two physical boxes (frontdesk = serial MJ0KQHNP at 10.0.20.102; the other is Memory Care reception). Repointed the CS-SERVER FrontDesk share from TCP_192.168.2.147 to TCP_10.0.20.221 (printer set to static .221 by Howard), removed the old port, removed the stale local ET-5800 Series(Network) printer from the frontdesk box, mapped \\CS-SERVER\FrontDesk and set it default. Test page printed.

Hit a hard blocker: CS-SERVER could not reach ANY VLAN 20 printer (.221/.220/.94/.78:9100) even though it pinged the VLAN20 gateway 10.0.20.1. Root cause was not a firewall block — the LAN "Default allow LAN to any" rule has Gateway = WAN_Group (dual-WAN policy routing), shoving LAN->internal-VLAN traffic out the WAN. Fixed with one pass rule at the top of the pfSense LAN interface (source CS-SERVER 192.168.2.248, dest 10.0.20.0/24, gateway = default). This also un-broke the already-migrated Business Office/Life Enrichment/MC Reception shares. (pfSense SSH from the VPN is blocked, so the unifi-wifi pfsense-ssh.sh skill returned empty; did the rule in the GUI.)

Then Life Enrichment (room 132, users sharon.edwards @ DESKTOP-DLTAGOI and susan.hicks @ DESKTOP-ROK7VNM). The old per-user mapping \\CS-SERVER\1F-132-RecRoom-Canon was orphaned (share renamed to LifeEnrichment on the server). Added \\CS-SERVER\LifeEnrichment for both users (defaults left as Copy Room per Howard). Mapping initially failed with the PrintNightmare elevation prompt (0x800702e4) and the per-machine /ga path silently failed at logon (PrintService event 513 / error 0xBCB) — both are the default RestrictDriverInstallationToAdministrators blocking the standard user from pulling the driver. Resolved by setting the Point-and-Print policy (scoped to CS-SERVER) on both machines, after which the user-session add was promptless+immediate.

Final blocker: jobs spooled but nothing printed; the Canon panel showed Error #822. Diagnosis: the rebuilt LifeEnrichment share used the wrong PDL — Canon Generic Plus PCL6 — but the MF741 is UFR II only (can't parse PCL). CS-SERVER only had PCL6/PS3/XPS staged. Pulled the Canon Generic Plus UFR II V250 driver from a client's DriverStore to CS-SERVER (using the vaulted sysadmin domain-admin cred), installed it, and switched the share to it. Test prints from the server, Susan's machine, and Sharon's machine all printed (Howard confirmed at the printer). Both LE machines verified on the UFR II driver, defaults unchanged.

Key Decisions

• pfSense fix = policy-route bypass, not an allow rule. The traffic was never blocked; it was misrouted out the WAN by the LAN catch-all's WAN_Group gateway. Added a top LAN pass rule with gateway=default scoped to CS-SERVER's source IP, so residents (per-unit /28 VLANs) and guests (VLAN 50) can't match it (different ingress interface + different source). Did it in the GUI because pfSense SSH/22 is blocked from the OpenVPN subnet.
• Point-and-Print policy is the correct "apply our admin rights" fix, not making end users local admins and not a security bypass. Scoped silent driver install to CS-SERVER only. This is the prerequisite a printer-deployment GPO needs; without it a GPO-pushed printer fails the same 0xBCB way. The caregiver machines already have this (why their printer GPO works).
• Server-share model kept (Howard's preference) rather than falling back to direct-IP printers, even when the UFR II driver wasn't on the server — pulled the driver across with the domain-admin cred instead.
• Driver transfer direction = client -> server. CS-SERVER (192.168.2.x) cannot reach a client's C$ (client host-firewall scopes File/Print sharing to LocalSubnet; CS-SERVER is off-subnet). The client pushes to \\CS-SERVER\C$ instead.
• Defaults left untouched on the LE users per explicit instruction (they keep Copy Room).

Problems Encountered

• CS-SERVER could not reach VLAN 20 printers -> LAN "allow LAN to any" rule policy-routed via WAN_Group. Fixed with top LAN pass rule, gateway=default, src CS-SERVER, dst 10.0.20.0/24.
• pfSense SSH from VPN timed out (tcp/22 dropped, GUI 443 open) -> the unifi-wifi pfsense-ssh.sh skill silently returned empty (sends ssh stderr to /dev/null). Worked around via the pfSense GUI.
• Printer mapping elevation prompt (0x800702e4) for standard users, and per-machine /ga silently failing at logon (event 513 / 0xBCB) -> set Point-and-Print policy (RestrictDriverInstallationToAdministrators=0 + trusted CS-SERVER) -> promptless.
• LE Canon: spooled but nothing printed, Error #822 -> wrong driver (PCL6) on an UFR-II-only device -> installed Canon Generic Plus UFR II V250 on CS-SERVER and switched the share.
• Stale cached driver on clients after the server driver swap -> refreshed each client connection (Remove + AddWindowsPrinterConnection) so it dropped PCL6 and pulled UFR II.
• Backslash mangling in RMM PowerShell payloads (literal \\ -> single \ through jq/agent) -> build UNC with [char]92. Logged to errorlog as friction.

Configuration Changes

• pfSense (Cascades, 192.168.0.1): added LAN firewall rule (top) — Pass, IPv4, proto Any, Source 192.168.2.248, Dest 10.0.20.0/24, Gateway = default. Description "CS-SERVER to VLAN20 (full server access, bypass WAN policy-route)".
• CS-SERVER FrontDesk share: port TCP_192.168.2.147 -> TCP_10.0.20.221; old port removed; ShareName FrontDesk unchanged.
• CS-SERVER Life Enrichment - Canon MF741CDW share (LifeEnrichment): driver Canon Generic Plus PCL6 -> Canon Generic Plus UFR II V250 (port TCP_10.0.20.94 unchanged). Installed UFR II driver package (now oem15.inf); staging files left at C:\Temp\ufr2drv on CS-SERVER (can be deleted).
• DESKTOP-ROK7VNM (susan.hicks) + DESKTOP-DLTAGOI (sharon.edwards): set Point-and-Print policy (HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers): RestrictDriverInstallationToAdministrators=0; subkey PointAndPrint: Restricted=1, TrustedServers=1, ServerList=CS-SERVER, InForest=0, NoWarningNoElevationOnInstall=1, UpdatePromptSettings=2. Added \\CS-SERVER\LifeEnrichment (UFR II), removed orphaned 1F-132-RecRoom-Canon. Defaults unchanged.
• RECEPTIONIST-PC (frontdesk box, MJ0KQHNP): removed local ET-5800 Series(Network); mapped \\CS-SERVER\FrontDesk, set default.
• Memory: updated .claude/memory/project_cascades_vlan20_migration_routing.md (+ MEMORY.md index line). Errorlog: 2 friction entries (UNC backslash, rmm printer elevation).

Credentials & Secrets

• Used the vaulted CS-SERVER admin: clients/cascades-tucson/cs-server.sops.yaml (username sysadmin, domain admin on cascades.local) — for the cross-machine driver pull. No new credentials created or discovered. Not exposed here (already vaulted).

Infrastructure & Servers

• CS-SERVER 192.168.2.254 / 192.168.2.248 (DC, DNS, File + Print server), GuruRMM agent c39f1de7-d5b6-45ae-b132-e06977ab1713. Routes to VLAN20 from .248.
• pfSense 192.168.0.1 (Plus 25.07). LAN = 192.168.0.0/22. Dual-WAN (WAN_Group). VLAN 20 (Staff/Internal) 10.0.20.0/24 gw 10.0.20.1. SSH/22 blocked from OpenVPN subnet (GUI 443 open).
• Printers (VLAN 20, static): Front Desk Epson ET-5800 = 10.0.20.221 (RAW 9100); Life Enrichment Canon MF741CDW = 10.0.20.94 (RAW 9100, UFR II); Business Office Brother = 10.0.20.220 (was powered off this session); MC Reception Epson ET-5800 = 10.0.20.78; Life Enrichment also reachable .94.
• Agents: DESKTOP-ROK7VNM (susan.hicks) 4832ff97-196d-4de5-a3b9-dadf9adb2c7a; DESKTOP-DLTAGOI (sharon.edwards) 4bdf92f6-7a84-4b71-81df-75d59febf39d; RECEPTIONIST-PC frontdesk box 2e8d8b73-82f6-4151-a3ce-879c55de4b82; MemCare reception box 57f19e17-8792-46cc-b9fd-f1909836cd17.

GPO Reference (for the printer-GPO work Howard flagged)

Existing GPOs on cascades.local (from CS-SERVER Get-GPO -All): CSC - Always Wait For Network, CSC - Caregiver Device Lockdown, CSC - Caregiver Workstation, CSC - Drive Mappings, CSC - Folder Redirection, CSC - Folder Redirection (LE), CSC - Life Enrichment Printers, CSC - Printer Deployment, CSC - Reception Workstation Policy, CSC - Security Baseline, CSC - Windows Update, Power Options, + the two Defaults.

For the printer GPO to work promptlessly, it needs TWO layers:

1. Point-and-Print policy (computer GPO, fleet-wide) = the exact registry values set manually this session (see Configuration Changes). Caregiver machines already have it; staff/LE machines did not. Put this in a computer GPO so every staff machine can silently install CS-SERVER printers.
2. Printer deployment = GPP Printers item / Deployed Printers mapping \\CS-SERVER\<share> to the right users/OU/room. CSC - Life Enrichment Printers likely still references the OLD share name (1F-132-RecRoom-Canon) — repoint it to \\CS-SERVER\LifeEnrichment. NOTE: CSC - Printer Deployment is the known disabled/empty/reference-only one.

Per-user/room printer map confirmed this session (extend as machines migrate):

• Front desk (RECEPTIONIST-PC frontdesk box) -> \\CS-SERVER\FrontDesk (Epson ET-5800, default).
• Life Enrichment room 132 -> \\CS-SERVER\LifeEnrichment (Canon MF741CDW, UFR II driver) for sharon.edwards + susan.hicks (NOT default; their default stays Copy Room).

CRITICAL driver note for any GPO deploying the LE Canon: it MUST use Canon Generic Plus UFR II V250 (INF cnlb0ma64.inf), NOT PCL6 — PCL6 produces Error #822 (nothing prints).

Commands & Outputs

• pfSense verify (RMM, CS-SERVER): 10.0.20.221:9100=True, .94=True, .78=True, .220=False (powered off). VLAN20->CS-SERVER 445 = True.
• Error #822 confirmation: raw PCL to 10.0.20.94:9100 -> Error 822 (printer can't parse PCL). Get-PrinterDriver on CS-SERVER had only PCL6/PS3/XPS Canon; client had Canon Generic Plus UFR II V250 (InfPath cnlb0ma64.inf).
• Driver install: client pushed package to \\CS-SERVER\C$\Temp\ufr2drv (159 files); pnputil /add-driver cnlb0ma64.inf /install -> oem15.inf; Add-PrinterDriver -Name "Canon Generic Plus UFR II V250"; Set-Printer -DriverName.
• PrintService event 513 / error 0xBCB on DESKTOP-ROK7VNM = per-machine /ga failing to install driver for the standard user (pre Point-and-Print fix).

Pending / Incomplete Tasks

• Printer GPO (Howard's next focus): put the Point-and-Print policy into a computer GPO fleet-wide; repoint CSC - Life Enrichment Printers to \\CS-SERVER\LifeEnrichment (UFR II); build out per-room printer-deployment items as the who-needs-what map firms up.
• Business Office printer (10.0.20.220) was powered off / unreachable this session — verify it when onsite.
• Cascades printer skill (Howard's idea): package this migration's how-to (VLAN routing/pfSense bypass, server-share repoint, Point-and-Print policy, UFR II driver, [char]92 UNC) into a reusable skill so future printer adds are one call.
• Optional cleanup: delete C:\Temp\ufr2drv on CS-SERVER (driver staging files).
• pfSense SSH-from-VPN still blocked (separate; only needed to use the pfsense-ssh.sh skill remotely).

Reference Information

• GuruRMM API: http://172.16.3.30:3001 (vault infrastructure/gururmm-server.sops.yaml).
• Memory: .claude/memory/project_cascades_vlan20_migration_routing.md.
• UFR II driver: Canon Generic Plus UFR II V250, INF cnlb0ma64.inf, client DriverStore path C:\Windows\System32\DriverStore\FileRepository\cnlb0ma64.inf_amd64_d4f4062dad259878.
• Point-and-Print policy key: HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers (+ \PointAndPrint).

Update: 12:44 PT — more VLAN20 printers (dining/chef/medtech), workgroup machines, machine rename, GPO planning doc

Continued the VLAN 20 printer migration with several workgroup (not-domain-joined) machines, where the clean approach is a direct-IP local printer installed as SYSTEM (machine-wide / all users) — no \\CS-SERVER share, no domain auth, no point-and-print prompt.

• Dining Room Manager (DESKTOP-MD6UQI3, WORKGROUP, user dining manager / Alyssa): set up direct-IP Dining Room Manager - Canon MF743CDW -> 10.0.20.228 (UFR II driver Canon Generic Plus UFR II V250, already present), machine-wide, default. Removed stale Kitchen Admin USB printer (per Howard). Initially misnamed it "Kitchen -" -> renamed to "Dining Room Manager -" (Howard: the kitchen printer is a separate device with the chefs; this is her own-room printer).
• Chef's Office (CHEF-PC, WORKGROUP): set up direct-IP Chef Office - Brother MFC-9330CDW -> 10.0.20.236 (driver Brother MFC-9330CDW Printer), machine-wide / all users (Howard: machine still needs to be domain-joined). LEFT the existing USB Chef Printer in place and LEFT it as the chef's default — verified per-user defaults via registry: real user JD Martin still defaults to USB Chef Printer (the "default = Chef Office" seen post-install was only SYSTEM's context, not a user). So JD Martin = chef on CHEF-PC.
• Memory Care front desk (MEMRECEPT-PC, WORKGROUP, user memfrtdesk): identified + marked in the GPO doc. Printer = MCReception Epson ET-5800 @ 10.0.20.78. Currently only has the Epson via OLD vendor/WSD ports (EP833571:ET-5800 SERIES), not the static .78. NOT set up yet (Howard asked to mark it down for the GPO; setup TBD).
• Memory Care MedTech Brother MFC-L8900CDW @ 10.0.20.74 set up direct-IP machine-wide on BOTH the memcare box and DESKTOP-LPOPV30 (user karen rossini); removed the OLD connections on the retired IP 192.168.2.53 (+ a stale WSD Med Tech on the memcare box). On LPOPV30 the old one was Karen's default -> set the NEW printer as her default. Memcare box default left as iR-ADV.
• Machine rename: RECEPTIONIST-PC (the Memory Care box, "memory care" user, S/N MJ0KQH4R, agent 57f19e17) shares its hostname with the front-desk RECEPTIONIST-PC box and was hard to tell apart -> Rename-Computer -NewName MEMCARE-STATION -Force STAGED (applies on next reboot; not forced, user active). The OTHER RECEPTIONIST-PC (frontdesk user, S/N MJ0KQHNP) is the real front desk.
• GPO planning doc created: clients/cascades-tucson/docs/printer-gpo-map.md — running printer->machine->user->IP->driver map for the eventual printer GPO, including the required Point-and-Print policy layer, the per-room/per-user assignments, the UFR II driver requirement for Canon MF741/743, and TODOs (add to GPO + map to domain accounts once the workgroup machines are domain-joined; repoint CSC - Life Enrichment Printers GPO to the new share).

Decisions/notes this update:

• Workgroup machines get direct-IP printers now; switch to GPO-deployed \\CS-SERVER\<share> once domain-joined.
• A SYSTEM-context Get-CimInstance Win32_Printer .Default reports SYSTEM's default, NOT the logged-on user's — read per-user defaults from HKU\<sid>\...\Windows\Device to see the real user default.
• Building the direct-IP printers used Add-PrinterPort/Add-Printer (SYSTEM) so they're machine-wide; per-user default changes done via WScript.Network.SetDefaultPrinter in the user session.

Problem: on the memcare box the spooler went unreachable (0x800706ba) right at the test-print step after add+remove; recovered with Restart-Service Spooler -Force, re-verified the new printer (Normal) and re-sent the test.

Pending after this update:

• Reboot MEMCARE-STATION (memcare box) when convenient to apply the rename.
• Set up the Memory Care front-desk Epson ET-5800 (10.0.20.78) on MEMRECEPT-PC if desired (currently only marked down).
• Confirm dining/chef/medtech test pages printed (Howard verifying at the printers).
• All workgroup machines (DESKTOP-MD6UQI3, CHEF-PC, MEMCARE-STATION, MEMRECEPT-PC, DESKTOP-LPOPV30): domain-join + GPO migration still pending.

New IPs/printers this update: Dining Canon MF743CDW 10.0.20.228; Chef Brother MFC-9330CDW 10.0.20.236; MedTech Brother MFC-L8900CDW 10.0.20.74; MemCare front desk Epson ET-5800 10.0.20.78 (not yet set up).

Update: 17:27 PT — printer GPO inspection, Point-and-Print GPO build, single-machine pilot (revealed silent-install gap)

Shifted from per-machine printer setup to the printer GPO ("go over it, update docs + policies, keep building"). Inspected the live GPO state, built the missing Point-and-Print policy GPO dark, and piloted it on one machine before going live (per Howard: "not make it live until we can test on a machine that mapping works correctly"). The pilot surfaced a real gap.

GPO inspection (live, via CS-SERVER RMM + Get-GPOReport):

• No GPO sets the Point-and-Print policy anywhere (the missing prerequisite; explains the 0xBCB failures).
• Printer deployment = User-side GPP Printers, per-department OU:
  • CSC - Caregiver Workstation -> OU Departments/Caregivers (ComputerSettingsDisabled): deploys 6 shares \\CS-SERVER\{NursesPrinter, HealthServices, MCMedTech, MCReception, MCDirector, CopyRoom}; defaults = NursesPrinter + MCMedTech (default=1 entries, no item-level targeting currently).
  • CSC - Life Enrichment Printers -> OU Departments/Life Enrichment: deploys ONE printer \\CS-SERVER\RecRoom-Canon = STALE share name (now LifeEnrichment).
  • CSC - Reception Workstation Policy -> OU Workstations/Staff PCs: Registry only, no printers.
  • CSC - Printer Deployment: not linked, empty. Dead.
• Gotcha: reading SYSVOL Printers.xml via \\$env:USERDNSDOMAIN\... FAILS under SYSTEM (that env var is empty for SYSTEM) -> use Get-GPOReport XML (SelectNodes local-name()='SharedPrinter') or the GPO's gpcFileSysPath instead.

Built the P&P policy GPO (dark): CSC - Point and Print (CS-SERVER) guid {BFAB721A-513D-4C14-8255-DEB1D4266830}, Computer config: RestrictDriverInstallationToAdministrators=0 + PointAndPrint{Restricted=1,TrustedServers=1,ServerList=CS-SERVER,InForest=0,NoWarningNoElevationOnInstall=1,UpdatePromptSettings=2}. Created via New-GPO + Set-GPRegistryValue as the DC's SYSTEM (SYSTEM CAN create/manage GPOs on this DC). Left UNLINKED initially.

Pilot (scoped to ONE machine): DESKTOP-H6QHRR7 (Lauren Hasselman, Staff PCs OU, domain-joined). Scoped via security filter (H6QHRR7=Apply, Authenticated Users=Read) + linked to OU=Staff PCs,OU=Workstations. gpupdate -> policy registry landed correctly on the machine (verified). BUT the in-session test (map \\CS-SERVER\FrontDesk, whose Epson ET-5800 driver was NOT present) STILL prompted (watchdog-timeout = elevation dialog), even after a spooler restart; driver did not install. The earlier LE-machine "silent" maps only worked because that driver was already present -> the install path was never actually exercised before.

Conclusion: the P&P policy (manual or GPO) is necessary but NOT sufficient alone to make a brand-new driver install silent in a running session. Likely RestrictDriverInstallationToAdministrators=0 needs a reboot to take effect (CVE-2021-34527 mitigation) and/or v3 (Epson/Canon Generic Plus) drivers still elevate. Two paths proposed to Howard: (1) reboot-test a machine; (2) pre-stage drivers machine-wide (computer GPO startup script installing from CS-SERVER as SYSTEM) so GPP connections always attach to a present driver = silent forever (RECOMMENDED). Awaiting Howard's choice.

State: P&P GPO is scoped to DESKTOP-H6QHRR7 ONLY (security-filtered; not fleet-live, harmless). Lauren's machine cleaned (back to Accounting + Copy Room, no test artifacts, Epson driver NOT installed). Full current-state + target-state design + action list captured in clients/cascades-tucson/docs/printer-gpo-map.md.

DC gotcha: the GroupPolicy module (Get-GPOReport / Get-GPO / New-GPLink) is SLOW on the R610 DC via RMM (frequently hit the 90-170s server-side reaper). New-GPO/Set-GPRegistryValue DO complete (only the trailing report render times out) — verify GPO state via fast LDAP ([adsisearcher]"(objectClass=groupPolicyContainer)") + read registry.pol from gpcFileSysPath, NOT Get-GPOReport. Pass big PS scripts via jq --rawfile (a file) not --arg (inline) — the inline heredoc payloads kept breaking jq ("Invalid numeric literal").

Pending (GPO): decide reboot-test vs pre-stage-drivers; then repoint CSC - Life Enrichment Printers RecRoom-Canon->LifeEnrichment; update CS-SERVER share ports (MCMedTech .53->.74); broaden the P&P GPO link/filter to go live; add per-printer GPP items as printers migrate.