azcomputerguru/claudetools
1
0
Fork 0
Code Issues 73 Pull Requests Actions Packages Projects Releases Wiki Activity
Files
9edb424869a3fa339ec2d3c48e843a1b5eb39cb1
claudetools/wiki/clients/cascades-tucson.md

56 KiB
Raw Blame History

slug, display_name, type, last_compiled, compiled_by, sources, backlinks
slug display_name type last_compiled compiled_by sources backlinks
cascades-tucson Cascades of Tucson client 2026-07-17 HOWARD-HOME/claude-main
clients/cascades-tucson/session-logs/2026-07/2026-07-17-howard-nurse-station-kiosk-build.md
clients/cascades-tucson/session-logs/2026-07/2026-07-17-howard-roadmap-finish-line-refresh.md
clients/cascades-tucson/session-logs/2026-07/2026-07-15-howard-technology-plan-final.md
clients/cascades-tucson/session-logs/2026-07/2026-07-15-howard-phish-investigation-amu54618.md
clients/cascades-tucson/session-logs/2026-07/2026-07-14-recovered-wiki-plan-review-hipaa-gaps.md
clients/cascades-tucson/session-logs/2026-07/2026-07-09-howard-charity-menle-caregiver-rename.md
clients/cascades-tucson/session-logs/2026-07/2026-07-09-howard-chris-knight-accounting-mailbox.md
clients/cascades-tucson/session-logs/2026-07/2026-07-02-howard-caretaker-phone-login-pso-roster-cleanup.md
clients/cascades-tucson/session-logs/2026-07/2026-07-02-howard-shelby-webdocs-share.md
clients/cascades-tucson/session-logs/2026-07/2026-07-01-howard-caretaker-roster-update-phone-login-cutover.md
clients/cascades-tucson/session-logs/2026-07/2026-07-01-howard-vlan20-migration-live-reconcile.md
clients/cascades-tucson/docs/REMAINING-WORK-PLAN.md
clients/cascades-tucson/docs/security/hipaa-caregiver-controls.md
clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.md
wiki/clients/cascades-tucson.md (prior compiled 2026-07-15)
projects/gururmm
wiki/systems/uos-server

Cascades of Tucson

Senior living / assisted living facility in Tucson, AZ (201 N Jessica Ave, 85710). Single 6-floor building with a MemCare (Memory Care) wing on floors 5-6. ~236 rooms. ACG took over from a previous MSP in March 2026. Primary compliance driver is HIPAA. Active multi-phase migration project ongoing: domain join (~12 machines done, ~10 remaining), VLAN 20 staff migration largely complete, caregiver phone SSO live as of 2026-07-01, CARF Technology and System Plan finalized and delivered 2026-07-15, nurse-station kiosk GPO built on NURSESTATION-PC 2026-07-17.

Profile

  • Contract type: Prepaid hour block
  • Billing rate: $175/hr all labor
  • Hours remaining: 21.5 hrs as of 2026-07-15 (live Syncro). Always live-check via GET /customers/20149445 before billing.
  • Syncro customer ID: 20149445
  • Managed devices (Syncro assets): 29 (live 2026-07-15)
  • Active tickets: 0 open Syncro tickets as of 2026-07-15. See REMAINING-WORK-PLAN.md and session logs for all active project work.
  • Key contacts (Syncro authoritative):

Infrastructure

Servers & Services

Host IP Role OS Notes
CS-SERVER 192.168.2.254 (Hyper-V vEthernet); SMB at 192.168.2.248 DC, DNS, DHCP (no scopes), File Server, Hyper-V host, Print Server Windows Server 2019 Standard Dell PowerEdge R610 (~2009, 16+ years old). Single DC — CRITICAL risk. GuruRMM agent: c39f1de7-d5b6-45ae-b132-e06977ab1713. RAID HEALTHY (live OMSA 2026-06-24). Datto EDR + AV ACTIVE (agent b41befcf-e418-4d0d-8552-bc7662364d07, installed 2026-07-13). Service Tag 9MQFTK1.
CS-SERVER iDRAC 192.168.2.65 Out-of-band management — Dell OOB. Service Tag 9MQFTK1.
CS-QB (Hyper-V VM) 192.168.2.228 SMB/445 only — NOT a live SIP PBX (2026-06-16 recon). Label "VoIP server" is stale. — Revisit/retire. QuickBooks also runs on CS-SERVER directly (should NOT be on a DC).
cascadesDS (Synology NAS) 192.168.0.120 NAS / onsite backup (planned repurpose 60-90 days) DSM 7.2.1-69057 Update 11 DS718+, ext4, 6 GB RAM, serial 1920PEN537202, 2x WD10EZEX 1 TB. Port 5000 HTTP, Drive Server 6690 SSL. Workgroup "CASCADES" causes Kerberos auth failures from domain-joined machines. Synology shared-folder syncs to CS-SERVER ARE SET UP AND WORKING (confirmed Howard 2026-07-15). Drive Client v7.5.0.16085 syncs folders to D:\Shares\Main on CS-SERVER.
pfSense Firewall 192.168.0.1 Perimeter firewall, inter-VLAN routing, DHCP/DNS pfSense Plus 25.07-RELEASE Netgate device. Dual-WAN. All DHCP served by pfSense (CS-SERVER DHCP role has no scopes). SSH/22 blocked from OpenVPN subnet — use GUI (443) remotely. Logs PLAIN TEXT on 25.07. Netgate AutoConfigBackup NOT yet enabled. Config vaulted point-in-time 2026-06-17.

CS-SERVER RAID detail (live OMSA 2026-06-24, healthy):

ID Size/Type Make/Serial Role
0:0:0 1.2 TB SAS Seagate / Z400WHK8 VD0 (D:) mirror member
0:0:1 1.2 TB SAS Seagate / S400RL2N VD0 (D:) mirror member
0:0:2 320 GB SATA Hitachi / 1DR VD2 (C:) mirror member
0:0:3 320 GB SATA WDC WD3200BEVT / WXEX08URD116 VD2 (C:) mirror member (was flaky 6/15, self-recovered)
1:0:4 1.2 TB SAS Seagate / Z400WHML GLOBAL HOT SPARE — do NOT remove
  • VD0 = D: (1,117 GB RAID-1) Ok; VD2 = C: (297.5 GB RAID-1) Ok.
  • [WARN] PSU redundancy lost — one PSU not delivering; likely just not connected (Howard 2026-07-15). Not an active emergency.
  • Planned reliability upgrade: replace the two consumer 320 GB drives (0:0:2, 0:0:3) with 2x enterprise SATA SSD already purchased. Gate: confirm image/system-state backup is current first (image plan was ~10 days stale at 2026-07-15 check).

Backup:

  • MSP360/CloudBerry cloud backup on CS-SERVER: file-level backup last success 2026-07-15 07:00 (daily, verified live). Image/system-state plan last success 2026-07-05 (~10 days stale at 7/15 — confirm/repair before SSD swap). Installed 2026-06-15.
  • Planned: Synology NAS repurposed as onsite backup target for CS-SERVER (60-90 days, per CARF tech plan). Synology -> CS-SERVER syncs continue as interim file mirror.

Endpoint security:

  • Datto EDR/AV (Infocyte/azcomp4587) is the ACG-managed endpoint stack. Org 2d5ea96e-3228-461b-9c60-13ae464b61d8, target group 1dbd2b02-f7df-45d0-a7f2-18667f48447f, reg key 6qw68y2rwl. 35 agents enrolled, all AV-enabled, 28 online (2026-07-15). Install: Install-EDR -URL "https://azcomp4587.infocyte.com" -RegKey 6qw68y2rwl.
  • CS-SERVER: Datto EDR/AV active (agent b41befcf, heartbeat current, defs current). Legacy prior-MSP Datto stack removed 2026-06-26; ACG-managed EDR reinstalled 2026-07-13.
  • Bitdefender decommission substantially complete. DESKTOP-TRCIEJA still BD_ACTIVE (GravityZone console-only uninstall; retires with hardware replacement). Stale: confirm Cascades removed from Syncro BD deployment; GravityZone portal cleanup stale RECEPTIONIST-PC records (company 66b0448e); reconcile laptop3/laptop1/cascades-laptop EDR agents.

Email & Identity

  • M365 tenant: cascadestucson.com | Tenant ID: 207fa277-e9d8-4eb7-ada1-1064d2221498
  • M365 licenses (live Graph 2026-07-17):
    • Business Premium (SPB): cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46 — 45 owned / 40 consumed / 5 free. Includes Intune, MDE, Entra P1, MFA Premium, AIP, Purview, Windows Business.
    • O365_BUSINESS_PREMIUM (legacy): f245ecc8-75af-4f8e-b61f-27d8114de5f3 — SUSPENDED. 23 consumed post-2026-07-17 shared mailbox conversions (was 29 post-jodi decommission, dropped to 23 after 6 licenses reclaimed on 7/17). Does NOT include Intune, MDE, Entra P1, MFA Premium. These 23 users need to be moved to SPB (5 free seats today, 18 more needed from Pax8).
    • Exchange Essentials: e8f81a67-bd96-4074-b108-cf193eb9433b — SUSPENDED. 1 consumed (Shelby Trozzi — needs both suspended SKUs removed + SPB assigned).
  • Shared mailbox conversions (2026-07-17): 10 functional/role-based accounts converted to shared mailboxes (accounting@, accountingassistant@, boadmin@, hr@, security@, Training@, medtech@, nurse@, transportation@, fax@). Freed 6x O365_BUSINESS_PREMIUM + 4x EXCHANGE_S_ESSENTIALS licenses. frontdesk@ and memcarereceptionist@ left as licensed user mailboxes (active daily sign-ins).
  • On-prem AD domain: cascades.local | UPN suffix: cascadestucson.com
  • MX / mail flow: Exchange Online (EOP direct MX). SPF: -all. DKIM: both M365 selectors published. DMARC: p=quarantine; pct=100 (verified live 2026-07-15). Reports to info@cascadestucson.com (unmonitored). No third-party gateway.
  • MFA: CA policy "Require MFA for all users" (7e87a1c7) enabled. Caregivers excluded from MFA (protected by on-network block + 8h reauth + device restriction). Voice-call MFA disabled tenant-wide; exception: SG-MFA-Voice-Call-Scoped-sysadmin (304f941e, single member sysadmin@).
  • Entra Connect: Installed on CS-SERVER 2026-04-25; exited staging 2026-05-14; actively syncing. Sync scope: ONLY OU=Caregivers, OU=Groups, OU=Caregiver Devices. OU=Administrative not yet in scope. Cloud/Graph group adds to SG-Caregivers fail (HTTP 400) — all membership writes on CS-SERVER via RMM.
  • Break-glass accounts: breakglass1-csc@cascadestucson.com, breakglass2-csc@cascadestucson.com. Not yet created as of 2026-07-17. Must exist + FIDO2 keys enrolled before the final CA allow-list flip (WS3). This is the top prerequisite blocking the caregiver lockdown go-live.
  • Admin accounts:
    • admin@cascadestucson.com — Mike's working admin (cloud-only, Connect-excluded)
    • sysadmin@cascadestucson.com — Howard's working admin (cloud-only, Connect-excluded). Object id: 471b13dc-3cf8-416b-a132-f5f3bc8d1cc8. Vault: clients/cascades-tucson/m365-sysadmin.sops.yaml.
  • ALIS (clinical SaaS): https://cascadestucson.alisonline.com. communityId 622. Vault: clients/cascades-tucson/alis-sso-app-registration.sops.yaml; API user: clients/cascades-tucson/alis-api-howard-user.sops.yaml (username must be howard.enos@cascadestucson). ALIS app id d5108493-cba8-4f08-90b6-1bb0bc09eb2a, client secret expires 2028-05-06 (rotation reminder — expiry breaks ALIS SSO tenant-wide). Staff endpoints read-only via API; writes via alis skill build-import -> upload .xls in ALIS UI.
  • jodi.ramstack DECOMMISSIONED 2026-07-15: account disabled, sessions revoked, Business Standard license removed. No mailbox existed (deprovisioned by suspended subscription; last sign-in 2025-03-28). Account object retained disabled/unlicensed.
  • Audit retention: Approved 2026-04-29. Azure Log Analytics (90d) + Storage Account (6yr) in RG rg-audit-cascadestucson. Not yet built (HIPAA 164.312(b) gap).
  • [SECURITY — OPEN] ComputerGuru - Tenant Admin SP holds a standing Privileged Authentication Administrator role (stranded from Alma Montt offboarding 2026-06-25; Graph blocked teardown). Needs Global Admin to remove in Entra. Leave its Conditional Access Administrator role. Pending Mike.
  • Shared mailboxes (current state):
    • grievances@, Surveys@ — created 2026-06-12; Meredith Kuhn + Ashley Jensen FullAccess+SendAs.
    • accounting@ ("Accounting Dept.") — delegates: Lauren Hasselman, Ashley Jensen, Zachary Nelson, Chris Knight (added 2026-07-09) each FullAccess (auto-mapping) + SendAs.
    • accountingassistant@, boadmin@, hr@, security@, Training@, medtech@, nurse@, transportation@, fax@ — converted to shared mailboxes 2026-07-17; unlicensed.
    • Alma Montt's mailbox — converted to SharedMailbox 2026-06-25 (Shelby Trozzi FullAccess+AutoMap).
    • Tamra Matthews' mailbox — converted to SharedMailbox 2026-06-30 (Crystal Rodriguez, Megan Hiatt, Meredith Kuhn, Ashley Jensen FullAccess+AutoMap).
  • HIPAA BAA: Covered by Microsoft Customer Agreement for Business plan subscribers (confirmed 2026-05-14). Medtelligent (ALIS) BAA not yet verified.
  • Remediation tool: Full tiered app suite consented 2026-04-21. All six apps active: Security Investigator (bfbc12a4), Exchange Operator (b43e7342), User Manager (64fac46b), Tenant Admin (709e6eed), Defender Add-on, Intune Manager.
  • Phishing incident (2026-07-14/15): BEC/vendor-fraud phish from info@syufway.com to accounting@, posing as AMYSH Solutions with fake W-9. Quarantined copy auto-blocked; delivered copy moved to Deleted Items; syufway.com + steqm.com added to Tenant Allow/Block List (Sender block, no expiration). No compromise; no outbound reply.

Entra Access Architecture

Summary: HIPAA-driven identity-based access control splitting staff into two security postures enforced via Microsoft Entra Conditional Access on top of hybrid identity (Entra Connect), with ALIS wired for SSO.

Foundation — hybrid identity

On-prem AD cascades.local synced to Entra/M365 via Entra Connect (PHS + Seamless SSO). UPN suffix cascadestucson.com — Windows login = email = M365/ALIS identity (one credential everywhere).

Two user buckets

  1. Restricted — caregivers + medtechs (group SG-Caregivers, 8b8d9222): sign in only on the Cascades network and only on approved devices (shared Galaxy phones + tagged caregiver laptops/desktops). No MFA (no personal devices) — protected by location + device controls + 8h sign-in frequency. See docs/security/hipaa-caregiver-controls.md for full compensating-controls architecture.
  2. Privileged — admins / directors / managers / nurses (NOT in SG-Caregivers): email + ALIS from anywhere, seamless onsite / 2FA offsite (Authenticator/PIN).

Conditional Access — caregiver enforcement

Policy ID State
CSC - Block caregivers off Cascades network e35614e1 Enabled (live since 2026-04-29; trusted IPs 72.211.21.217/32 + 184.191.143.62/32)
CSC - Block caregivers on non-compliant device ede985e2 DISABLED 2026-07-01 — superseded by allow-list at final lockdown. Do NOT re-enable.
CSC - Caregivers: allow-listed devices only 1b7fd025 Report-only / test-scoped — device filter (device.displayName -startsWith "CSC-") or (device.extensionAttribute1 -eq "CSCCaregiverDevice"). Flip to enforced + live group when break-glass accounts exist.
CSC - Caregiver sign-in frequency 8h 7d491c7a Enabled
Require MFA for all users 7e87a1c7 Enabled — SG-Caregivers + SG-Caregivers-Pilot both excluded
  • Caregiver Named Location: 061c6b06-b980-40de-bff9-6a50a4071f6f, trusted IPs 72.211.21.217/32, 184.191.143.62/32.
  • GDAP exclusion: CA blocking policies must exclude "Service provider users" (GDAP foreign principals) + SG-External-Signin-Allowed + SG-Break-Glass.
  • [ROOT CAUSE 2026-07-01] pilot.test login success masked two separate CA blockers. A pilot passing on a device-test group does NOT prove the production group will pass the same gauntlet.

Caregiver roster & FGPP

  • SG-Caregivers = frontline caregivers ONLY. Roster: 35 as of 2026-07-01 (8 offboarded, 4 new hires added, Zeke Huerta moved to front desk). Admin-adjacent staff, pilot.test, disabled accounts excluded. All writes via CS-SERVER/RMM (Cloud/Graph writes fail HTTP 400).
  • PSO-Caregivers (Fine-Grained Password Policy, created 2026-07-02): Precedence 10, MaxPasswordAge=00:00:00 (never expires). Applies to SG-Caregivers; removal reverts cohort to 42-day domain default.
  • Juan Andrade (j.andrade): offboard pending as of 7/17 (was due 2026-07-16 PM per coord todo 80716a98). Verify status — if not done, disable + remove from SG-Caregivers + reclaim Business Premium.

ALIS SSO

  • Entra app registration -> OIDC SSO into ALIS; tenant-wide admin consent granted 2026-06-03 (AllPrincipals User.Read on SP e1cae4ad). Per-caregiver: ALIS staff Email must equal Entra UPN exactly. ALIS application: d5108493-cba8-4f08-90b6-1bb0bc09eb2a, daily sign-ins verified 2026-07-15.
  • How to enable ALIS SSO for one user: set Email = exact Entra UPN in ALIS admin -> Staff -> record; user signs in via "Sign in with Microsoft"; turn off ALIS-native 2FA (native 2FA conflicts and locked out Karen Rossini).
  • Remaining caregiver ALIS work (Howard handling): Email=UPN for existing caregivers; ALIS records built for Munezero/Cota/Robinson (via alis skill build-import); Vallejo Email=a.vallejo@; 7 discharged-record decisions; turn off ALIS-native 2FA per user; lower ALIS session timeout 20 -> 15 min.

Caregiver devices

  • Phones: Samsung A15s in Intune Shared Device Mode (Android Enterprise, corporate-owned dedicated). Enrollment profile: CSC - Android Shared Phones (Entra SDM) (9a0fcc6d). Dynamic group: Cascades - Shared Phones (ea96f4b7). NEVER create a new enrollment profile — reuse the existing profile's QR. Android enrollment token: vault clients/cascades-tucson/intune-android-enrollment-token.sops.yaml (Replace, not Revoke, when stale).
  • Caregiver desktops/laptops: Hybrid Entra Join + on-prem GPO. CA allow-list targets group Cascades - Caregiver Devices (02c6f698). Relevant GPOs:
    • CSC - Caregiver Workstation (3B5CD9A6-A278-4676-A9FD-9396D21A8261): linked to OU=Caregivers,OU=Departments, filter SG-Caregivers-Test (to be flipped to SG-Caregivers at go-live).
    • CSC - Caregiver Device Lockdown (E6174988-2721-4D96-ADF5-F5BB44E92769): deployed to OU=Caregiver Devices, loopback merge (UserPolicyMode=1). Contains AppLocker Packaged App Deny rules for SG-Caregivers, DontDisplayLastUserName=1, AppIDSvc=Automatic, auto-lock/sign-out (lock @3min, 90s warn, sign-out @15min).
    • CSC - Nurse Station Kiosk (32d76052-4d92-446c-95fb-614653f84742): linked to OU=Caregiver Devices, filter SG-Caregivers. 15 Edge HKCU policies (BrowserSignin=2, EdgeDefaultProfileEnabled=1, ClearBrowsingDataOnExit=1, PasswordManagerEnabled=0, SyncDisabled=1, etc.), GPP Shortcuts (ALIS, PharmCare, Helpany to %DesktopDir%), UI restrictions (NoRun, NoControlPanel, DisableCMD, DisableRegistryTools, DisableTaskMgr, NoSetFolders, RemoveWindowsStore, etc.). Built 2026-07-17.
  • Managed Google Play binding: owned by MDMS@cascadestucson.com — if this account is deleted/disabled/unlicensed, every Android phone loses management. Vault: clients/cascades-tucson/mdm-service-account.sops.yaml.
  • Intune (Windows MDM): INTUNE_A=PendingInput — MS case open, does NOT block caregiver access (hybrid+GPO path replaces Intune dependency).

Nurse-station kiosk (built 2026-07-17)

NURSESTATION-PC configured as a shared caregiver desktop (WS3 step 3b):

  • Hybrid-joined: AzureAdJoined=YES, DomainJoined=YES. DN: CN=NURSESTATION-PC,OU=Caregiver Devices,OU=Staff PCs,OU=Workstations,DC=cascades,DC=local. RMM agent f5a89784-834f-47b1-82e2-7e3e9dd337ff, DeviceId d3bf931f-f128-4261-8398-b46c34a4b342.
  • Edge SSO via PRT (BrowserSignin=2 + EdgeDefaultProfileEnabled=1). Any caregiver signs in with cascades\ username and gets ALIS via SSO automatically.
  • GPP Shortcuts: ALIS, PharmCare, Helpany deployed to per-user desktop via kiosk GPO.
  • AppLocker Packaged App Deny rules for SG-Caregivers (SID S-1-5-21-388235164-2207693853-3666415804-1183): Edge GameAssist, Paint, Photos, Store, Wallet, Cortana, Intel Graphics, Intel Experience, Intel Optane, Realtek Audio blocked. AppLocker policy XML: \\cascades.local\SYSVOL\cascades.local\scripts\applocker-caregiver.xml.
  • Machine-level printers: \\CS-SERVER\Nurses - Brother MFC-L8900CDW (TCP_192.168.2.75) + \\CS-SERVER\Health Services - Konica Minolta C368 (TCP_192.168.1.138).
  • WAM token broker cache cleared 2026-07-17 to fix stale PRT issue (AADSTS50126 for sysadmin@ credential).
  • ASSISTNURSE-PC: still pending. Move from CN=Computers to OU=Caregiver Devices + machine-level printers + gpupdate. GPO settings apply automatically once in the OU.
  • Remaining: PRT/SSO verification (confirm AzureAdPrt: YES after reboot), test non-caregiver login unrestricted, CSC - Reception Workstation Policy still applies to NURSESTATION-PC (pre-existing, unresolved).

Caregiver name change procedure

Established 2026-07-09 (Bariffa Sika -> Charity Menle). Rename, never re-create: Set-ADUser (Surname/DisplayName/UPN/EmailAddress) -> Rename-ADObject (CN) -> Set-ADUser -SamAccountName -> Start-ADSyncSyncCycle -PolicyType Delta. Set proxyAddresses explicitly (primary SMTP new + alias old). Password and group membership do not change. Vault: temp password stays under the OLD sAMAccountName key.

Network

  • ISP / WAN: Dual-WAN Cox. WAN1 igc0 184.191.143.62/30 (Cox Fiber, primary, gw 184.191.143.61) + WAN2 igc3 72.211.21.217/27 (Cox Coax, secondary, static). WAN_Group gateway group.
  • Firewall: pfSense Plus 25.07-RELEASE at 192.168.0.1. Admin vault: clients/cascades-tucson/pfsense-firewall.sops.yaml. Split-tunnel OpenVPN (Howard): clients/cascades-tucson/pfsense-openvpn-howard.sops.yaml (route 192.168.0.0/22; use OpenVPN GUI or OpenVPN Connect with DCO disabled). Config backup vaulted point-in-time 2026-06-17.
  • [ROUTING GOTCHA 2026-06-30] LAN "Default allow LAN to any" rule Gateway=WAN_Group policy-routes LAN->internal-VLAN traffic out the WAN. Fixed with a top LAN pass rule (src CS-SERVER 192.168.2.248, dst 10.0.20.0/24, gw=default). pfSense OpenVPN --inactive idle timeout ~300s (not yet fixed).
  • LAN / VLAN layout: Primary staff/AP network 192.168.0.0/22. Staff/Internal VLAN 20 ("CSCNET", 10.0.20.0/24, gw 10.0.20.1). Voice VLAN 30 (10.0.30.0/24, gw 10.0.30.1). Guest VLAN 50 (10.0.50.0/24, RFC1918 blocked). CSC Internal VLAN 10 (mgmt). Per-unit /28 VLANs: ~240 networks (VLANs 101-631 for per-room resident isolation, 10.[floor].[room].0/28). DHCP backend: ISC (Kea config present, dormant). Unbound DNS.
  • [STATUS 2026-07-01] VLAN 20 migration — machines essentially done, printers lagging. 22 online hosts on VLAN 20 (10.0.20.x); only CS-SERVER (by design) + ~6 stragglers remain on 192.168.x. Printer shares: only 4/15 repointed (FrontDesk .221, BusinessOffice .220, LifeEnrichment .94, MCReception .78); 11 still point at old-LAN IPs. GPO CSC - Point and Print (CS-SERVER) pilot-scoped to DESKTOP-H6QHRR7 only. Map: docs/printer-gpo-map.md.
  • Switching (live 2026-07-15): 11 switch objects in UniFi (8 online, 2 offline USL24PB — Switch 2nd Floor #2 and Switch 4th Floor #2 — offline by design, not an issue, Howard confirmed 2026-07-15; 1 USPM16P pending). 34 active 100Mb switch ports + 5 AP uplinks at 100Mb (APs 122, 145, 204, 236, 240 — highest-impact). p38 (1st Floor USW) 4.0% tx-drop rate.
  • UniFi controller: 172.16.3.29:11443 (UOS). Cascades site va6iba3v, site_id 685f39068e65331c46ef6dd2.
  • WiFi — 77 U7-Pro APs (75 online, 2026-07-15). CSCNet (shared PPSK, ~230-242 per-key->network mappings, wlanconf 685f39078e65331c46ef7ee5, vault clients/cascades-tucson/wifi-cscnet.sops.yaml). CSC ENT (legacy, planned repurpose as 5 GHz-only WPA2 PPSK device island for Poly voice + Helpany). Guest (isolated, VLAN 50). Mesh: 2nd Floor Atrium is wireless-mesh parent for CC Bridge + salon (5 GHz backhaul ch36).
  • Wireless RF (applied 2026-06-19, validated): 2.4 GHz -> MEDIUM power on 47 radios. 5 GHz -> clean DFS 40 MHz plan on 72 non-mesh APs (ch 52/60/100/108/116/124/132/140, 0 co-channel) — retry HALVED (8.7->3.8 avg). CSCNet BSS-transition (802.11v) ON. 6 GHz blocked on CSCNet (WPA3 mandate; Howard's supervised decision required to enable).
  • Voice VLAN 30 (COMPLETE 2026-06-19): HIPAA-isolated. 37 devices: 28 Poly phones + 8 AudioCodes (.224-.231) + Vertical desktop (10.0.30.201, wired). Voice PPSK vault: clients/cascades-tucson/wifi-voice-ppsk.sops.yaml. Bistro phone pulled 2026-06-19 (bad Kitchen phone replaced with Bistro phone — Bistro now has no phone). QoS design ready (docs/network/phase1-voice-qos-design.md) but NOT built; blocker: WAN2 coax upload measurement.
  • VoIP vendor: Vertical (Richard Turner rturner@vertical.com). Two fleets: 8 AudioCodes (wired, external power, PoE OFF) + 28 Poly (WiFi via CSCNet PPSK). Dropped-calls root cause is RF band selection; CSC ENT device-island plan is the fix.

External Vendors

  • Helpany (resident safety sensors): "Paul" ceiling-mounted radar sensors (Sedimentum backend, no camera/mic). WiFi WPA2-only, 5 GHz-capable. Currently on CSC ENT (key: vault clients/cascades-tucson/wifi-cscnet.sops.yaml), migrating to 5 GHz device island. Facility liaison: John Trozzi.
  • bill.com (BILL): Sends from inform.bill.com, hq.bill.com, hello.bill.com, mc.bill.com. Safe sender: account-services@inform.bill.com.
  • BOK Financial: DMARC p=reject; zero historical emails to cascadestucson.com (wrong recipient address on BOK's side, resolved externally).

Business Applications

System Function Notes
ALIS (Medtelligent) Clinical EHR SSO live. HIPAA — BAA required before PHI leaves. communityId 622. Medtelligent BAA not yet verified.
QuickBooks Accounting Running on CS-SERVER (should NOT be on a DC).
Bill.com AP/AR REST API automatable.
Relias Training / LMS Export / API.
You've Got Leads Senior-living CRM Export / API varies.
TELS (Direct Supply) Facilities Export; API uncertain.
Focus HR HR / payroll Export or vendor API.
Helpany (app.safe-living.com) Caregiver app / resident sensors Export-only likely.
POS Point of sale TBD.

[PROPOSED] KPI dashboard (Ashley Jensen request, 2026-06-17): Phase 1 scheduled CSV/Excel exports -> SharePoint -> Power BI Pro; Phase 2 API-capable systems (Bill.com, QuickBooks Online) via Power Automate. Parked pending Ashley's day-one KPIs + data-freshness need + POS/Focus-HR specifics. Scoping: clients/cascades-tucson/docs/proposals/kpi-dashboard.md.

Access

  • CS-SERVER: Via ScreenConnect or GuruRMM (agent c39f1de7-d5b6-45ae-b132-e06977ab1713; re-enrolls — resolve live by hostname). Credentials: vault clients/cascades-tucson/cs-server.sops.yaml (username sysadmin). SMB clients reach it at 192.168.2.248, NOT .254 (Hyper-V vEthernet).
  • CS-SERVER iDRAC: 192.168.2.65
  • pfSense admin (HTTPS): https://192.168.0.1 — vault: clients/cascades-tucson/pfsense-firewall.sops.yaml
  • pfSense SSH: ssh admin@192.168.0.1 (system OpenSSH) — tcp/22 blocked from OpenVPN subnet; use GUI remotely
  • pfSense OpenVPN (Howard): vault: clients/cascades-tucson/pfsense-openvpn-howard.sops.yaml (split-tunnel, route 192.168.0.0/22)
  • pfSense config backup (2026-06-17): vault: clients/cascades-tucson/pfsense-config-backup-2026-06-17.sops.yaml
  • Synology DSM: http://192.168.0.120:5000 — vault: clients/cascades-tucson/synology-cascadesds.sops.yaml. [SECURITY] Cloud Signin Portal credential was committed plaintext at vault commit 1fbc0e1 — encrypted go-forward but must be rotated.
  • M365 admin: admin@cascadestucson.com — vault: clients/cascades-tucson/m365-admin.sops.yaml
  • M365 sysadmin: sysadmin@cascadestucson.com — vault: clients/cascades-tucson/m365-sysadmin.sops.yaml
  • WiFi CSCNet: vault: clients/cascades-tucson/wifi-cscnet.sops.yaml
  • WiFi Voice PPSK (VLAN 30): vault: clients/cascades-tucson/wifi-voice-ppsk.sops.yaml
  • Android enrollment token: vault: clients/cascades-tucson/intune-android-enrollment-token.sops.yaml
  • MDM service account: vault: clients/cascades-tucson/mdm-service-account.sops.yaml
  • svc-scan (scan-to-folder): vault: clients/cascades-tucson/svc-scan.sops.yaml
  • ALIS SSO app registration: vault: clients/cascades-tucson/alis-sso-app-registration.sops.yaml
  • ALIS API user: vault: clients/cascades-tucson/alis-api-howard-user.sops.yaml
  • Caregiver temp passwords (2026-06-30): vault: clients/cascades-tucson/caregiver-temp-passwords-2026-06-30.sops.yaml. Retrieve with vault get (NOT get-field). Do NOT inline values.
  • Caregiver temp passwords (2026-07-01, 4 new hires): vault: clients/cascades-tucson/caregiver-temp-passwords-2026-07-01.sops.yaml. Same retrieval rules.
  • Shelby Trozzi (domain account): vault: clients/cascades-tucson/shelby-trozzi.sops.yaml. Not Entra-synced (safe to reset on-prem without M365 impact).
  • pilot.test AD account (test identity for kiosk work): vault: clients/cascades-tucson/pilot-test-ad.sops.yaml. Added to SG-Caregivers 2026-07-17 for kiosk testing. Reclaim when WS3 pilot complete.
  • UOS controller SSH (root): vault: infrastructure/uos-server-ssh-key
  • UOS controller RW admin (Network API): vault: infrastructure/uos-server-network-api-rw
  • UniFi AP device auth (Cascades): vault: clients/cascades-tucson/unifi-ap-ssh
  • Vault root: clients/cascades-tucson/

Patterns & Known Issues

Syncro / Billing

  • Never set a contact on any Syncro ticket unless explicitly requested. Meredith Kuhn is the recurring wrong default Syncro pre-selects — she is not the correct contact. Leave contact_id blank.
  • Billing product for prepaid block draw: Use a real labor type (Remote, Onsite, etc.) — NOT "Prepaid project labor" (exempt, won't decrement the block).
  • Always live-check hours before billing: GET /customers/20149445.
  • Windows Home->Pro upgrade billing: Syncro product "Windows Pro Upgrade" id 23571919 ($99/machine). MAK: vault infrastructure/windows-pro-mak.sops.yaml. 4 MAK counts consumed to date (MDIRECTOR-PC activated free via digital entitlement; MEMRECEPT-PC + LAPTOP-8P7HDSEI via MAK; NurseAssist + DESKTOP-MD6UQI3 upgraded 2026-06-26 — 2x$99 still to invoice as of 7/13).

Exchange Online / Message Tracing

  • Get-MessageTrace is hard-deprecated (Sept 2025). Use Get-MessageTraceV2 instead (ResultSize not PageSize). V2 max window 10 days — loop 9 consecutive windows for 90-day coverage.
  • Sender-side suppression (SendGrid ESP): If a user never receives mail from a specific sender and message trace shows zero records, consider a SendGrid suppression list (fix = contact sender's support, no M365 action). Confirmed with bill.com.
  • AutoMapping rolls back on rapid sequential grants. Grant one user at a time, spaced ~6-8s; poll until removed before the next grant. (Tamra Matthews offboarding root cause, 2026-06-30.)
  • Get-RecipientPermission replication lag: an immediate read-back after a SendAs grant can miss the new trustee (EXO replica lag); re-read before concluding the write failed. (Chris Knight accounting mailbox, 2026-07-09.)

Active Directory / User Management

  • Security group assignment is always explicit. When creating any Cascades user, ask which security group(s). OU -> group auto-mirror was explicitly declined 2026-05-14.
  • SG-Caregivers = frontline caregivers ONLY. Admin-adjacent staff (Feller, Nyanzunda), pilot.test, disabled accounts excluded. Cloud/Graph adds fail (HTTP 400); all writes on CS-SERVER via RMM.
  • Entra Connect sync scope is narrow — do not OU-move a synced caregiver. Scope covers ONLY OU=Caregivers, OU=Groups, OU=Caregiver Devices. Moving a caregiver to any other OU deletes its cloud object (Zeke Huerta, front desk role change, 2026-07-01 — OU move deferred).
  • New user mandatory order (folder redirection): (1) Create AD user; (2) Run New-HomeFolder -Username "<sam>" on CS-SERVER; (3) Add to SG-FolderRedirect; (4) THEN first domain logon. Skipping step 2 causes fdeploy to cache a failure silently and never retry.
  • Folder redirect recovery: clients/cascades-tucson/scripts/fix-shell-redirect.ps1 via GuruRMM while user is logged in. Must set both GUID-based and legacy-name registry keys. fdeploy1.ini flags=187 (changed from 1211 which caused WRITE_DAC failures on new subfolders).
  • [ROOT CAUSE 2026-06-08] Native Folder Redirection was DOA fleet-wide — GPO targets were in fdeploy1.ini but the Windows FR CSE only reads fdeploy.ini. Fixed by writing correct fdeploy.ini + version bump.
  • Login-screen hide (SpecialAccounts\UserList): An enabled local admin not visible in the sign-in picker has a SpecialAccounts\UserList suppression (DWORD <username>=0). Fix: delete the DWORD.
  • Caregiver name change — rename, never re-create. Procedure: Set-ADUser -> Rename-ADObject -> Set-ADUser -SamAccountName -> delta Start-ADSyncSyncCycle. Set proxyAddresses explicitly. Vault: temp password stays under OLD sAMAccountName key.
  • Never set ChangePasswordAtLogon $true for a caregiver who will sign in on a shared phone — always fails as Entra err=50126 (Microsoft Authentication Broker cannot render forced-change screen).
  • RECEPTIONIST-PC is two physical boxes sharing a hostname (frontdesk MJ0KQHNP, MemCare MJ0KQH4R -> staged rename MEMCARE-STATION, pending reboot). Reconcile fleets by SERIAL, not hostname.

GPO / Kiosk Configuration

  • GPP Shortcuts CSE GUID: {C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7} (verified from client HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions). Correct GUID is critical — wrong CSE (Printers {BC75B1ED-...} or Scripts {42B5FAAE-...}) silently prevents shortcut delivery.
  • GPP shortcuts use %DesktopDir% (per-user desktop, loopback at logon), NOT %CommonDesktopDir% (Public Desktop) — chicken-and-egg problem on first login means per-user is required.
  • Printers added as machine-level connections (/ga flag) via rundll32 printui.dll,PrintUIEntry /ga /n \\CS-SERVER\<share> so every user gets them automatically.
  • PRT acquisition on hybrid-joined machines: Stale WAM token broker cache for a service account causes AzureAdPrt: NO. Fix: clear Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AC\TokenBroker for all users + reboot. Also clear stale Edge profile data if browser SSO is broken.
  • Edge SSO on kiosk PCs requires BrowserSignin=2 + EdgeDefaultProfileEnabled=1. BrowserSignin=0 blocks PRT passthrough entirely.
  • AppLocker Packaged App Deny rules for one group: Allow Everyone: * + Deny SG-Caregivers: [app list] is the only GPO-native approach that restricts one group while leaving all others unrestricted. Deny rules override Allow rules. Requires AppIdentity service (AppIDSvc) set to Automatic.

File Shares & Scan-to-Folder

  • Accounting folder: D:\Shares\Accounting on CS-SERVER, shared as \\CS-SERVER\AcctDept. Share is named AcctDept, NOT Accounting (a printer share named Accounting already exists). REUSE svc-scan for every future scanner->network-folder setup — do NOT create per-printer accounts. Vault: clients/cascades-tucson/svc-scan.sops.yaml.
  • Brother MFC-L8900CDW "Business Office" (10.0.20.220): Scan-to-Network path \\192.168.2.254\AcctDept\Scans, Auth Method NTLMv2 (not Auto/Kerberos — printer can't KDC across VLAN), username cascades\svc-scan.
  • \\CS-SERVER\Company Web Docs: D:\Shares\Public\Company Web Docs, Shelby.Trozzi = Change. RMM cannot push drive map directly (user_session double-hop -> SMB error 67); use cmdkey + persistent HKCU:\Network\W workaround.
  • \\CS-SERVER\Executive: D:\Shares\Executive, inheritance broken; Ashley.Jensen + Meredith.Kuhn = Modify. E: on DESKTOP-U2DHAP0 (Ashley) + ASSISTMAN-PC (Meredith).
  • RMM dispatch gotcha: build UNC from [char]92 in PowerShell payloads — literal \\ collapses to \ through jq/agent.

Printers / VLAN 20 Migration

  • Server-share model is preferred for domain-joined machines. Workgroup machines get direct-IP local printer; switch to server share on domain join.
  • Point-and-Print policy prerequisite for standard users: HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers: RestrictDriverInstallationToAdministrators=0 + subkey PointAndPrint (Restricted=1, TrustedServers=1, ServerList=CS-SERVER, NoWarningNoElevationOnInstall=1, UpdatePromptSettings=2). Symptom without it: elevation prompt 0x800702e4 / PrintService event 513.
  • Canon MF741CDW / MF743CDW are UFR II ONLY — NOT PCL. PCL6 driver produces Error #822. Pull Canon Generic Plus UFR II V250 (INF cnlb0ma64.inf) from client DriverStore.
  • Static VLAN 20 printer IPs: Front Desk Epson ET-5800 = 10.0.20.221; Life Enrichment Canon MF741CDW = 10.0.20.94 (UFR II); Business Office Brother L8900CDW = 10.0.20.220; Dining Room Canon MF743CDW = 10.0.20.228; Chef Office Brother MFC-9330CDW = 10.0.20.236; MedTech Brother MFC-L8900CDW = 10.0.20.74; MC Reception Epson ET-5800 = 10.0.20.78. Full map: docs/printer-gpo-map.md.

Synology NAS

  • synopkg status SynologyDrive falsely returns "stopped" (status 263) even when active. Verify via systemctl is-active pkgctl-SynologyDrive and netstat -tlnp | grep 6690.
  • Accessing cascadesDS from RMM — always use a user session, not CS-SERVER SYSTEM. Domain machine account fails Kerberos against the Synology (workgroup "CASCADES" same short name as AD domain).
  • Stale Word owner lock files on cascadesDS: Word creates hidden ~$<filename> files on abrupt session end. Fix: delete the ~$ file(s).

CS-SERVER SMB

  • RMM-dispatched SMB client commands false-negative. net use/net view/Test-Path/Get-SmbConnection in user_session return error 67/RPC 1702/"none" even for known-good targets. CS-SERVER SMB is healthy. Validate server-side via Get-SmbSession/Get-SmbOpenFile. A drive-map verify failure is NOT proof of a problem.

Conditional Access / CA Policies

  • Phased rollout — never tenant-wide. All caregiver CA policies target SG-Caregivers (8b8d9222-5d71-419a-936d-56d895c6c332).
  • pilot.test login success masked two separate CA blockers. pilot.test is in SG-Caregivers-DeviceTest / SG-Caregivers-Test — excluded from compliance-block and targeted by allow-list. Live SG-Caregivers members hit BOTH problems simultaneously. A pilot passing on a device-test group does NOT prove production will pass.
  • Caregiver device allow-list CA policy 1b7fd025 is still report-only / test-group scoped. Do NOT flip to enforced until break-glass accounts exist + SG-Break-Glass exclusion is in place.

Wireless / UniFi RF

  • [APPLIED 2026-06-19] Production RF optimization: 2.4 GHz power -> MEDIUM on 47 radios; 5 GHz -> clean DFS 40 MHz channels on 72 non-mesh APs; retry HALVED; BSS-transition (802.11v) ON.
  • Primary pain band is 2.4 GHz. Avg TX-retry ~10%; cu_total 69-94% live; catastrophic external neighbor density.
  • DFS channels here are 4-5x cleaner than non-DFS (survey-proven; never apply a non-DFS-only policy without measuring first).
  • Offline switches (Switch 4th Floor #2, USW Pro Max 16) are offline BY DESIGN — not an issue (Howard confirmed 2026-07-15).
  • AP-hang recovery: device-control.sh cascades poe-cycle "<AP name>" --apply. Do NOT use force-provision (took AP 445 offline during the Floor-4 pilot).
  • Tooling (unifi-wifi skill): audit-site.sh, live-stats.sh, survey-report.py, channel-plan.sh, apply-radio.sh, apply-wlan.sh, dfs-check.sh, switch-audit.sh, device-control.sh.

VoIP / Network Device Migration

  • Re-VLANing a wired switch port requires a link bounce to force re-DHCP. UniFi block/unblock is a MAC filter only — does NOT bounce the link.
  • Externally-powered AudioCodes desk phones need a PHYSICAL power-cycle (8 units on ports 1-8 of USW-16-PoE with external bricks; PoE OFF on those ports — controller PoE-cycle is a no-op).
  • Verify VLAN membership via the client vlan field, not the controller's displayed IP (IP field caches/lags).

pfSense Operations

  • pfSense 25.07 logs are PLAIN TEXT. Read with tail/grep. clog returns empty output.
  • LAN "allow LAN to any" rule policy-routes internal-VLAN traffic out the WAN (Gateway=WAN_Group). Fix: top LAN pass rule, Gateway=default, scoped source.
  • pfSense dirty-boot / duplicate dhcpd: After unclean shutdown, dhcpd may start twice. Fix: killall dhcpd && echo "services_dhcpd_configure();" | /usr/local/sbin/pfSsh.php.

Security Incidents (historical)

  • Megan Hiatt (2026-04-16): Active credential stuffing — 126 failed sign-ins from Belfast GB, Hamburg DE. Password reset + SMTP AUTH disable actioned. Re-verify April remediation held (flagged 2026-06-30).
  • John Trozzi (2026-04-16, 2026-04-20): Investigated twice — both times NO BREACH.
  • Crystal Rodriguez (2026-04-19): Phishing investigation. Report: clients/cascades-tucson/reports/2026-04-19-crystal-rodriguez-phish-investigation.md.
  • Canva email delivery (2026-05-20): Resolved by adding canva.com domains to AllowedSenderDomains in EOP.
  • ALIS AADSTS65001 (2026-06-03): Resolved by granting tenant-wide admin consent on ALIS SP (e1cae4ad).
  • Chris Knight bill.com / BOK email delivery (2026-06-04): Root cause sender-side (SendGrid suppression; BOK wrong recipient email). Resolved externally. Ticket #32383.
  • BEC / vendor-fraud phish (2026-07-14): info@syufway.com to accounting@ — fake W-9 for "AMYSH Solutions" EIN 92-4058031. Remediated 2026-07-15; syufway.com + steqm.com blocked in TABL. No compromise.
  • dunedolly21@gmail.com: External guest invited 2026-04-14 by Lauren Hasselman. Status unknown — confirm with Lauren. [unverified]

HIPAA Compliance

  • Primary objective. CS-SERVER and ALIS store PHI.
  • Critical open gaps: No audit logging on D:\Homes (SS164.312(b)); Object Access auditing disabled on CS-SERVER; no SMB encryption on homes share; audit retention infra approved but not built; BAA inventory incomplete; break-glass accounts not created.
  • Closed gaps: Backup (MSP360 cloud backup 2026-06-15); MFA / CA for all users; caregiver access restricted to building network (2026-07-01); auto-lock + auto-sign-out on shared caregiver devices (GPO deployed 2026-06-05); Voice VLAN 30 isolates PHI from phone traffic (2026-06-19); HIPAA BAA covered by MCA (confirmed 2026-05-14); 7 deleted mailboxes restored 2026-04-25 for 7-year retention.
  • Termination policy established: convert to shared mailbox, hide from GAL, retain 7 years. Litigation Hold waived for 2026-06 offboardings (Alma, Tamra) — no PHI per Howard.

Active Work

Canonical remaining-work plan: clients/cascades-tucson/docs/REMAINING-WORK-PLAN.md (built 2026-06-24; refreshed 2026-07-13/14/15/17). 9 sequenced workstreams. Work from it.

0 open Syncro tickets as of 2026-07-15. All active work is project-level.

Finish sequence (re-cut 2026-07-15, updated 2026-07-17)

  1. Juan Andrade offboard (WAS 2026-07-16 PM) — VERIFY STATUS. Disable + remove from SG-Caregivers + reclaim Business Premium. Coord todo 80716a98. If not yet done, do immediately.
  2. Break-glass accounts (breakglass1-csc@, breakglass2-csc@) + FIDO2 YubiKeys + strip stranded PAA role from Tenant Admin SP — prerequisite for WS3 allow-list enforcement flip. Tenant runs live block policies with no break-glass today. Pending Mike for PAA removal.
  3. Caregiver lockdown go-live (WS3 steps 1-8 incl. 3b): flip GPO CSC - Caregiver Workstation filter to SG-Caregivers; flip CA 1b7fd025 to enforced + live group; OU-move caregiver machines to OU=Caregiver Devices; ALIS email-match; disable ALIS-native 2FA; reboot NURSESTATION-PC to activate lockdown; complete ASSISTNURSE-PC (OU move + printers + gpupdate); pilot cleanup (delete pilot.test + groups).
  4. M365 relicense 23 remaining suspended-Standard users (WS4). 5 SPB free today; 18 more needed from Pax8. Howard checking Pax8 for current billing. Seat-mix decision (full vs lighter licenses) required first (~$375-575/mo net-new). Shelby Trozzi needs both suspended SKUs removed + SPB assigned.
  5. Repair/confirm image/system-state backup -> SSD swap (WS5). Image side was ~10 days stale on 7/15. Gate: confirm current before any drive work.
  6. Domain-join tail + dept drives (WS1+2). ~10 machines remaining. Onsite batch: reboots, KFM unlinks, LAPTOP-DRQ5L558 on-LAN. Point-and-Print GPO fleet-wide; MCMedTech + other stale printer shares repointed.
  7. Network tail (WS6) + audit-retention build (WS4): CSC ENT device-island consolidation (~79-client evacuation first) + 34-port/5-AP-uplink gig sweep. Audit retention LAW 90d + Storage 6yr (HIPAA 164.312(b) gap, approved 2026-04-29).
  8. M365 collaboration migration — SharePoint/Teams (WS8). Scoping after WS1/2 tail; permission model rides dept OU/SG structure. Synology backup-only flip follows (WS5).
  9. ALIS online payments (WS9). Scoping questions drafted (docs/proposals/alis-online-payments-scoping-2026-07-15.md, 18 questions) — NOT yet sent. Loop in Jeff Bristol (accounting@). BAA chase item (Medtelligent BAA unverified).
  10. Ticket-verify pass with Howard. Tickets #32194/#32230/#32254/#32319/#32342/#32370 closed in Syncro — verify work was actually completed.

Workstation replacement list (per CARF tech plan 2026-07-15)

5 machines confirmed for replacement + 1 spare: DESKTOP-TRCIEJA (Lupe Sanchez, EOL), ASSISTMAN-PC (Meredith Kuhn, i5-6200U cannot run Win11), MDIRECTOR-PC (Shelby Trozzi, 3.9 GB RAM), MEMRECEPT-PC (Pentium E5500, oldest in fleet), CHEF-PC (Culinary), plus spare deployed to new hire. Lupe Sanchez replacement decision made 2026-06-18. Chef-PC elevated from rebuild to full replace per tech plan 2026-07-15.

Domain join readiness (as of 2026-06-26 pass)

  • READY: DESKTOP-LPOPV30 (Karen), MAINTENANCE-PC, LAPTOP-E0STJJE8; after reboots: ASSISTMAN-PC, ANN-PC, Laptop2, NurseAssist, DESKTOP-MD6UQI3 (all now Pro/PfW).
  • Deferred: LAPTOP-DRQ5L558 (off-network, must be on-LAN first); CHEF-PC (after reinstall/replace ticket); SALES4-PC (Tamra offboarded, machine repurpose TBD).
  • EOL/Replace: DESKTOP-TRCIEJA, ASSISTMAN-PC, MDIRECTOR-PC, MEMRECEPT-PC, CHEF-PC.
  • Script note: phase3-pre-join-verify.ps1 hardcodes DC at 192.168.2.254; correct SMB target is 192.168.2.248 — update before reuse.

Open pending items

  • [URGENT] Verify Juan Andrade offboard status (was due 2026-07-16 PM).
  • [SECURITY] Break-glass accounts not created. Required before CA go-live.
  • [SECURITY] Remove standing PAA role from Tenant Admin SP. Needs Global Admin. Pending Mike.
  • [SECURITY] Rotate exposed Synology Cloud Signin Portal credential (vault commit 1fbc0e1).
  • [PENDING] Zeke Huerta MFA (Authenticator) registration. No registered method since front-desk move (2026-07-01).
  • [PENDING] ASSISTNURSE-PC nurse station kiosk config (OU move + printers + gpupdate).
  • [PENDING] NURSESTATION-PC PRT/SSO verification (confirm AzureAdPrt: YES + ALIS SSO silent after reboot).
  • [PENDING] MEMCARE-STATION rename not applied (pending reboot on MemCare RECEPTIONIST-PC box, S/N MJ0KQH4R).
  • [PENDING] pfSense AutoConfigBackup enable + OpenVPN --inactive timeout fix.
  • [PENDING] DESKTOP-TRCIEJA GravityZone BD uninstall (console-only). Box slated for hardware replacement.
  • [PENDING] 6 GHz on CSCNet — WPA3 conversion required; Howard's supervised decision.
  • [PENDING] Bistro phone replacement — Bistro has no phone since 2026-06-19.
  • [PENDING] WAN2 (coax) upload measurement — needed to size pfSense HFSC voice QoS.
  • [PENDING] Audit retention infra (LAW 90d + Storage 6yr) approved 2026-04-29, not yet built.
  • [PENDING] MemCare min-RSSI (floors 5/6) — deferred until new APs added.
  • [WARN] 34 switch ports + 5 AP uplinks at 100 Mbps — cabling/NIC sweep needed.
  • [PENDING] ALIS app session timeout lower from 20 to 15 min (Howard, ALIS admin).
  • [PENDING] File server audit logging (SS164.312(b) gap — no NTFS/object-access audit trail on D:\Homes).
  • [PLANNED — 60-90 days] Repurpose Synology NAS as onsite backup for CS-SERVER (per tech plan).
  • [PLANNED] CSC ENT device-island consolidation (Poly voice + Helpany sensors -> 5 GHz-only WPA2 PPSK). Design: docs/network/csc-ent-device-island-plan.md. ~79-client evacuation is the prerequisite.
  • [PLANNED] CS-SERVER SSD upgrade (2x enterprise SATA SSD purchased; window requires confirmed image backup).
  • [PLANNED] Voice QoS for VLAN 30 — design done (docs/network/phase1-voice-qos-design.md), not built; blocker: WAN2 coax upload.
  • [PLANNED] SharePoint/Teams migration (WS8) — after WS1/2 tail.
  • [PLANNED] KPI dashboard (Ashley Jensen) — parked pending her day-one KPIs.
  • [PLANNED] DC migration off 16-yr-old R610 — scope and quote included in CARF tech plan.

History Highlights

Date Event
2026-03-06 ACG onboarding begins. Initial audit: CS-SERVER Dell R610, pfSense, UniFi, Synology. 19 machines. No backup, no HIPAA compliance.
2026-03-09 AD security hardening: Monica Ramirez removed from Domain Admins, lockout policy fixed, AD Recycle Bin enabled, MachineAccountQuota set to 0.
2026-03-31 Cascades onboarded to remediation tool. Tenant ID documented. 50 users, Secure Score 34%.
2026-04-13 Major onsite: 13 stale AD accounts deleted, OU structure cleaned, UPNs migrated to cascadestucson.com, Homes share created, Folder Redirection GPO deployed, first domain joins.
2026-04-14 Sandra Fish global admin revoked. ALIS SSO confirmed. Business Premium proposal created.
2026-04-16 Breach checks: Megan Hiatt (credential stuffing, not breached; password reset). John Trozzi (clean). Crystal Rodriguez phish.
2026-04-25 Entra Connect installed on CS-SERVER (staging mode). 7 deleted mailboxes restored for HIPAA. Dual-WAN discovered.
2026-04-28-29 CA policy reconciliation. Audit retention architecture designed. Break-glass design (2 accounts, YubiKeys). Three caregiver CA policies created in Report-only mode.
2026-05-01 Howard billed 33.5 hrs on Entra project ticket #32214 against prepaid block.
2026-05-07-08 SDM phone provisioning. SDM token success. ALIS SSO app registration values captured to vault.
2026-05-11 CA policy CSC - Block caregivers on non-compliant device flipped from Report-only to Enabled. Caregiver fleet re-enrolled (~17 unique SDM phones). ALIS SSO end-to-end validated. Registration Campaign + SSPR exclusion configured for caregivers.
2026-05-14-16 Caregiver AD accounts created. Entra Connect exited staging — actively syncing. Wireless diagnostic (2.4 GHz saturation hypothesis identified).
2026-05-20 Canva email delivery resolved.
2026-05-22 Ashley Jensen domain-joined. RECEPTIONIST-PC domain-joined. GPO ILT fixes.
2026-06-03 ALIS AADSTS65001 resolved: tenant-wide admin consent on ALIS SP. Caregiver device allow-list CA policy 1b7fd025 created (report-only).
2026-06-05 NURSESTATION-PC login issue resolved. Hybrid Entra Join + GPOs deployed: CSC - Caregiver Workstation validated; CSC - Caregiver Device Lockdown deployed to OU=Caregiver Devices. Ticket #32303, 7.0h.
2026-06-08 Chris Knight workstation (DESKTOP-N5G1ROO) domain-joined + GuruRMM-enrolled. Root-caused native Folder Redirection failure (fdeploy.ini misname) and fixed fleet-wide. ASSISTNURSE-PC reinstalled Win10->Win11.
2026-06-09 Accounting scan-to-folder built. D:\Shares\Accounting on CS-SERVER; shared as \CS-SERVER\AcctDept; svc-scan service account vaulted; Brother MFC-L8900CDW Scan-to-Network configured.
2026-06-12 Shared mailboxes grievances@ + Surveys@ created and delegated to Meredith + Ashley. Ticket #32417, 0.5h.
2026-06-15 Wireless RF full audit. 77 U7-Pro APs confirmed. 2.4 GHz saturation as primary pain point confirmed. CS-SERVER backup started (MSP360). pfSense OpenVPN password reset.
2026-06-16 Voice VLAN plan designed. pfSense confirmed pfSense Plus 25.07-RELEASE. unifi-wifi skill feature-complete.
2026-06-17 Voice VLAN 30 built + verified. Vertical desktop + initial Poly phones migrated. Power outage and full recovery (pfSense on UPS surge-only -> dhcpd duplicate + L2 issue; moved pfSense to battery side). Plaintext Synology signin credential discovered in vault commit 1fbc0e1.
2026-06-18 Voice VLAN 30 cutover (8 AudioCodes + 22 Poly). Dropped-calls root-caused to RF band selection, not VLAN. 6 GHz root-caused dark. RF optimization master plan built. DESKTOP-TRCIEJA (Lupe Sanchez) EOL decision.
2026-06-19 PRODUCTION RF OPTIMIZATION APPLIED (2 AM window): 2.4 GHz MEDIUM on 47 radios; clean DFS 40 MHz on 72 non-mesh APs; retry HALVED. Voice VLAN migration COMPLETE (29/29 Poly re-keyed). Billed ticket #32444, 7h.
2026-06-23 Planned power outage (05:30-09:00 MST) — clean shutdown executed.
2026-06-24 CS-SERVER RAID live-verified HEALTHY (1:0:4 = global hot spare). PSU redundancy lost noted. Executive share built (\CS-SERVER\Executive). Live AD+RMM domain-join diff; REMAINING-WORK-PLAN.md built (7 workstreams). CARF Technology Plan deliverable started. CSC ENT device-island consolidation plan drafted.
2026-06-25 Alma Montt OFFBOARDED (MC Life Enrichment, no PHI). Endpoint security migration started: Datto EDR/AV rollout + Bitdefender decommission. RECEPTIONIST-PC identified as two physical boxes.
2026-06-25 Home->Pro upgrades: MDIRECTOR-PC (free digital entitlement), MEMRECEPT-PC + LAPTOP-8P7HDSEI (2 MAK counts, $198 to bill).
2026-06-26 CS-SERVER: full legacy prior-MSP Datto stack removed. SMB "outage" debunked (test-method artifact). NurseAssist + DESKTOP-MD6UQI3 upgraded to Pro for Workstations (2x$99, to invoice).
2026-06-29 ALIS caregiver phone-only + caretaker crosscheck: phone-only caregivers = NONE; 7 caregivers exist in ALIS only as Discharged records.
2026-06-30 Caregiver phone SSO — license + group + temp-password onboarding complete for 40 frontline caregivers. Tamra Matthews OFFBOARDED. VLAN 20 printer migration + pfSense policy-routing fix. MEMCARE-STATION rename staged.
2026-07-01 VLAN 20 migration live-reconciled — 22 machines on VLAN 20, printer shares 4/15. Caretaker roster update: 8 disabled + license reclaimed, 4 new hires (Vallejo, Munezero, Cota, Robinson), Zeke Huerta front desk. SG-Caregivers now 35. CA phone/desktop login verified end-to-end; two CA blockers fixed. Interim caretaker CA posture (desktops + phones, on-network only) — Howard's go.
2026-07-02 Caregiver phone login: forced-change gotcha resolved (cleared ChangePasswordAtLogon for all 35). PSO-Caregivers (never-expire FGPP) created on CS-SERVER. Shelby Trozzi "Company Web Docs" share built; domain account password vaulted.
2026-07-09 Charity Menle caregiver rename (procedure established — rename, never re-create). Chris Knight granted FullAccess+SendAs on accounting@ SharedMailbox. Android enrollment token replaced (Replace, not Revoke).
2026-07-13 Datto EDR installed on CS-SERVER (closed DC coverage gap since 2026-06-26). REMAINING-WORK-PLAN.md + wiki refreshed. Juan Andrade offboard coord todo 80716a98 created for 2026-07-16 PM.
2026-07-14 Wiki + remaining-work-plan reviewed end-to-end (recovered session). HIPAA gaps identified: Juan Andrade access overdue, no break-glass accounts, Named Location too loose, no object-access audit logging, BAA inventory incomplete.
2026-07-15 CARF Technology and System Plan finalized (4-page branded PDF, 8 CARF areas + supplementary). Live verification sweep: EDR/AV active 35 agents incl. CS-SERVER; M365 SPB 45/41/4; DMARC/DKIM/SPF live; VLAN 30 voice 37 clients; MSP360 file backup current. jodi.ramstack DECOMMISSIONED. Synology shared-folder syncs to CS-SERVER confirmed working. WS8 (SharePoint/Teams) + WS9 (ALIS online payments) workstreams added.
2026-07-15 BEC/vendor-fraud phish (info@syufway.com, fake W-9 "AMYSH Solutions") investigated and remediated. syufway.com + steqm.com blocked in Tenant Allow/Block List.
2026-07-17 10 functional/role-based mailboxes converted to shared mailboxes; 6x O365_BUSINESS_PREMIUM + 4x EXCHANGE_S_ESSENTIALS licenses reclaimed. SPB 40 consumed (5 free); O365BP suspended now 23 consumed.
2026-07-17 NURSESTATION-PC nurse-station kiosk GPO built (WS3 step 3b): Edge SSO via PRT, GPP shortcuts (ALIS/PharmCare/Helpany), AppLocker Packaged App Deny rules for SG-Caregivers, UI restrictions, machine-level printers. ASSISTNURSE-PC pending.

Backlinks

  • projects/gururmm — RECEPTIONIST-PC + CS-SERVER enrolled (site CascadesTucson); fleet EDR/BD + Home->Pro + printer work driven via GuruRMM
  • wiki/systems/uos-server — UniFi controller hosts Cascades site va6iba3v
Reference in New Issue View Git Blame Copy Permalink