azcomputerguru/claudetools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
918afc5c26f05eb2f20ec44269e7825d5b9f4e5b
claudetools/wiki/clients/attrebesch.md
Howard Enos 918afc5c26 sync: auto-sync from HOWARD-HOME at 2026-06-01 21:11:22 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-06-01 21:11:22
2026-06-01 21:11:31 -07:00

7.7 KiB
Raw Blame History

type, name, display_name, last_compiled, compiled_by, sources, backlinks
type name display_name last_compiled compiled_by sources backlinks
client attrebesch AT Trebesch 2026-06-01 Howard-Home/claude-main
clients/attrebesch/session-logs/2026-06-01-session.md
projects/gururmm

AT Trebesch

Residential client in Tucson, AZ. Single workstation. Syncro customer 238740. Onboarded into GuruRMM 2026-06-01. Primary active work: PST contact consolidation (Syncro #31953).

Profile

  • Company type: Residential (individual)
  • Contract type: [unverified — check Syncro]
  • Billing rate: [unverified]
  • Key contact: treb737@earthlink.net | 520-529-4999
  • Address: 7280 N. Cathedral Rock, Tucson AZ
  • Syncro customer ID: 238740
  • Open tickets: #31953 (address book / contact recovery), #32160 (assess for threats)

Infrastructure

Workstations

  • DESKTOP-QNP3ON5 — Windows, single local user Owner. Agent ID ba173f0c-19e8-488d-834c-1b6f6dfd5699. Outlook = Microsoft 365 Apps x64, 16.0.19929.20172. Free space: C: 593 GB, D: 915 GB.
    • Runs a third-party Explorer shell replacement — Win32_Process explorer.exe owner detection returns blank. Use Win32_ComputerSystem.UserName to detect the logged-on user (DESKTOP-QNP3ON5\Owner). See memory note reference_trebesch_qnp3on5.md.

Email & Identity

  • Outlook / PST-based (no M365 tenant confirmed). Client uses earthlink.net email (treb737@earthlink.net). Very large PST archive collection (~155 GB across 24 files).
  • M365 tenant: Not documented. Outlook is M365 Apps x64 but no tenant-side management confirmed.

Network

  • ISP / WAN: [unverified]
  • Firewall: [unverified]

GuruRMM

  • Client name: AT Trebesch
  • Client ID: a6dbe776-c3b0-4345-8c2c-597cff8a9b4d
  • Site name: Main
  • Site ID: 2df75e13-4268-49db-babe-489b66729f87
  • Site code: SWIFT-LION-2892
  • Install page: https://rmm.azcomputerguru.com/install/SWIFT-LION-2892
  • Agent enrollment key: Encrypted at clients/attrebesch/gururmm-site-main.sops.yaml (vault; do not regenerate unless compromised)

Enrolled Agents

Agent OS Agent ID User Notes
DESKTOP-QNP3ON5 Windows ba173f0c-19e8-488d-834c-1b6f6dfd5699 Owner Third-party Explorer shell; use Win32_ComputerSystem.UserName for session detection

Access

Patterns & Known Issues

  • Third-party Explorer shell — logged-on-user detection blank. Win32_Process explorer.exe .GetOwner() returns empty. Workaround: (Get-WmiObject Win32_ComputerSystem).UserName correctly returns DESKTOP-QNP3ON5\Owner. Apply this to any WMI-based session-detection scripts targeting this machine.
  • PST email field corruption. Source address book E-mail Address (Email1Address) field contained junk single-letter values for ~95% of contacts (666/695 rows). Real emails were scattered across E-mail Display Name, additional email fields, and Notes free-text. Any contact-extraction pipeline for this client must reconstruct real (@-bearing) emails from all available fields and key dedup on real-email-or-name — never on Email1Address alone.
  • Contacts stored in Notes free-text. Phone numbers, street addresses, and secondary emails are encoded in the Notes field rather than in structured columns. A parse+enrich pass is required to populate Outlook's standard phone/address/email columns.
  • Heavy PST duplication. 24 PST files total but only 16 are unique (byte-identical copies across Desktop\Outlook\backup\ and D:\E). Deduplicate by name+size before mounting to avoid redundant AddStore work.
  • Large unmounted PSTs take ~9s per AddStore (Outlook reads only the store index). Two 48 GB Outlook2.pst files each took ~9s and turned out to contain real address books (793 and 725 contacts). Do not skip large archives without probing — they may hold contact data.
  • Run COM scripts in user_session context. Outlook COM requires the Owner session; SYSTEM context fails. GuruRMM command context must be user_session for treb-extract.ps1.

Active Work

Ticket Summary Status
#31953 Address book / contact recovery — consolidate 24 PSTs into one Outlook-importable CSV Delivery pending (CSV on Howard-Home; needs transfer to DESKTOP-QNP3ON5 for import)
#32160 Assess for threats — pairs with /rmm diagnose once agent reporting confirmed Open

PST Contact Recovery (Syncro #31953)

Goal: Extract all address-book contacts from the client's 24 PSTs and consolidate into one Outlook-importable CSV.

Pipeline:

  1. treb-extract.ps1 — Phase 1: Outlook COM in user_session; mounts each unique PST via AddStore, reads real address-book folders (excludes Suggested Contacts / Recipient Cache), captures raw JSON per PST. MaxMB cap skips large unmounted stores (mounted stores always read); $MaxMB=0 overrides.
  2. treb-merge.ps1 — Phase 2: runs as SYSTEM; union-find identity model (EmailsOf + BestName functions; dedup signals: real email, clean First+Last, FullName/FileAs/Subject, email-derived name); reconstructs real emails from all four email fields + email-split-across-name-fields; keys on real-email-or-name, never on junk Email1Address.
  3. treb-enhance.ps1 — Phase 3: non-destructive; parses phones, street addresses (high-confidence pattern), and emails from Notes into structured Outlook columns; Notes left verbatim.

Final result: 6,118 raw records → 674 unique contacts. 633 with email (all valid, 0 junk), 206 with phone, 67 with address, 272 notes preserved. 532 first+last, 71 first-only, 71 email-only (legitimately nameless in source — mostly role/business addresses). 16 unique PSTs scanned; 8 contact-bearing stores.

Deliverable: C:\claudetools\.claude\tmp\treb-data\AT-Trebesch-Contacts-FINAL-20260601-210118.csv (local, Howard-Home). 674 rows, 48 Outlook-native columns + 3 audit cols (Source PSTs / Source folders / Copies merged — ignored by Outlook on import).

Scripts: .claude/tmp/treb-extract.ps1, treb-merge.ps1, treb-enhance.ps1, treb-merge-local.ps1, treb-enhance-local.ps1 (local path-swapped copies for Howard-Home iteration)

Data (local): C:\claudetools\.claude\tmp\treb-data\ — 15 per-PST JSON files + FINAL CSV. Source ZIP on owner box: C:\Users\Owner\Desktop\Contacts\treb-contacts-data.zip.

Pending delivery steps:

  • Transfer final CSV from Howard-Home to DESKTOP-QNP3ON5 (RMM push or manual copy)
  • Import into Outlook and verify with client
  • Log time + resolution note on Syncro #31953
  • Optional: name-cleanup pass for handle-style names; clean up intermediate CSVs from Desktop\Contacts

History Highlights

Date Event
2026-06-01 Howard: GuruRMM onboarding — client + Main site created, SWIFT-LION-2892 enrollment key vaulted. DESKTOP-QNP3ON5 confirmed enrolled and checking in.
2026-06-01 PST inventory scan: 24 files, ~155 GB. COM probe confirmed Outlook COM works in Owner session; 794/374/366 contacts in three live stores; archive1.pst contact-empty.
2026-06-01 ~20:16 MST Extraction executed (Owner session via RMM): safe set first (771 unique), then all-PSTs (826 unique — giants held real address books).
2026-06-01 ~21:08 MST Multi-pass data cleaning: email field corruption found and fixed, union-find dedup rewrite, enrichment pass (Notes → structured fields), data moved to Howard-Home for local iteration. Final: 6118 raw → 674 unique contacts, 0 invalid emails, 0 duplicate groups. CSV verified import-ready.

Backlinks

Reference in New Issue View Git Blame Copy Permalink