azcomputerguru/claudetools
1
0
Fork 0
Code Issues 58 Pull Requests Actions Packages Projects Releases Wiki Activity
Files
a386eba05f1c96845e430f1c5cb16f263588b72d
claudetools/clients/cascades-tucson/session-logs/2026-05-20-howard-phase2.6-printers-gpos-account-cleanup.md
Howard Enos f78ccf97da sync: auto-sync from HOWARD-HOME at 2026-05-20 14:53:36 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-05-20 14:53:36
2026-05-20 14:53:38 -07:00

8.9 KiB
Raw Blame History

Cascades of Tucson — Phase 2.6 Session Log

Date: 2026-05-20 Duration: Multi-session (continued from context-limit session)

User

  • User: Howard Enos (howard)
  • Machine: HOWARD-HOME
  • Role: tech

Summary

Completed Phase 2.6: print server build-out, GPO creation, and AD account cleanup. All 13 printers are now installed and shared on CS-SERVER. Four CSC GPOs are created and staged (unlinked until Phase 3 domain join cutover).

Work Completed

1. Front Desk Epson ET-5800 — Printer Installation

Problem: EPWizard.exe fails on Windows Server 2019 — wlanapi.dll stub is present but the WLAN stack is absent.

Fix:

  1. Ran EPWizard.exe on CS-SERVER, let it extract drivers to AppData\Local\Temp\ET-5800\ before dismissing the error
  2. Copied extracted INFs to C:\Users\sysadmin\Documents\ComputerGuru Connect v2\Files\epsonetdrivers\
  3. pnputil /add-driver <INF> /install staged the driver in Windows Driver Store
  4. Add-PrinterDriver -Name "EPSON ET-5800 Series" registered it with the Print Spooler
  5. Add-Printer / Add-PrinterPort created the printer at 192.168.2.147, shared as FrontDesk

Driver name (from INF): EPSON ET-5800 Series INF location: E_WF1XCE.INF (UTF-16 LE with BOM FF FE — Select-String fails on it; must use [System.IO.File]::ReadAllBytes())

2. Memory Care Director + MedTech Printers

Added to CS-SERVER (via GuruRMM remote PowerShell):

Printer Share IP Driver
Memory Care Director - Canon MF751CDW MCDirector 192.168.3.52 Canon Generic Plus PCL6
Memory Care MedTech - Brother MCMedTech 192.168.2.53 Brother Generic Jpeg Type2 Class Driver

Both reachable and shared. Total shared printers on CS-SERVER: 13.

3. Script: phase2-print-server.ps1

Updated clients/cascades-tucson/docs/migration/scripts/phase2-print-server.ps1:

  • Status header updated to COMPLETE 2026-05-20 (all 13 printers)
  • Added FrontDesk, MCDirector, MCMedTech to $printers array
  • Documented Epson ET-5800 workaround in header comments
  • KM driver archived to D:\Shares\Server\Drivers\KM_Universal_PCL6\

4. AD Account Cleanup (5 accounts)

Executed via GuruRMM remote PowerShell on CS-SERVER. All Disable-ADAccount calls succeeded.

Account OU Reason
britney.thompson Care-Assisted Living Departed 2026-04-22
Richard.Adams Transportation Drivers no longer get IT access
Julian.Crim Transportation Drivers no longer get IT access
Christopher.Holick Transportation Drivers no longer get IT access
Shontiel.Nunn Resident Services Old-format account — s.nunn (Caregivers) is correct

Note: britney.thompson's M365 license is still active and not yet harvested. Action needed before next billing cycle.

5. CSC - Security Baseline GPO

Created via New-GPO + Set-GPRegistryValue + direct SYSVOL writes.

Screen saver (HKCU via GPP):

  • ScreenSaveTimeOut = 900 (15 min)
  • ScreenSaveActive = 1
  • ScreenSaverIsSecure = 1
  • SCRNSAVE.EXE = scrnsave.scr

GptTmpl.inf (Machine security — written as Unicode UTF-16):

MinimumPasswordLength = 12
PasswordComplexity = 1
PasswordHistorySize = 24
MaximumPasswordAge = 90
MinimumPasswordAge = 1
LockoutBadCount = 5
ResetLockoutCount = 30
LockoutDuration = 30

GPT.INI: machine version bumped, security extension GUID {827D319E-6EAC-11D2-A4EA-00C04F79F83A}{803E14A0-B4FB-11D0-A0D0-00A0C90F574B} added.

Status: UNLINKED. Link to domain root at Phase 3 cutover.

6. CSC - Windows Update GPO

Created via New-GPO + Set-GPRegistryValue (HKLM AU key).

Setting Value
NoAutoUpdate 0
AUOptions 4 (auto download + install)
ScheduledInstallDay 1 (Sunday)
ScheduledInstallTime 3 (3:00 AM)
NoAutoRebootWithLoggedOnUsers 1
EnableFeaturedSoftware 0

Status: UNLINKED. Link to domain root at Phase 3 cutover.

7. CSC - Printer Deployment GPO

Created Printers.xml in SYSVOL at {GPO-GUID}\User\Preferences\Printers\.

13 printers with OU-based item-level targeting (FilterOrgUnit):

Share ILT
CopyRoom No filter — all staff
BusinessOffice OU=Administrative
Accounting OU=Administrative
AdminOffice OU=Administrative OR OU=Resident Services
ExecDirector OU=Administrative
SalesMarketing OU=Marketing
Kitchen OU=Culinary
CulinaryChef OU=Culinary
FrontDesk OU=Resident Services
HealthServices OU=Care-Assisted Living OR OU=Care-Memorycare
LifeEnrichment OU=Life Enrichment
MCDirector OU=Care-Memorycare
MCMedTech OU=Caregivers OR OU=Care-Memorycare

CSE GUID: {BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}{D02B1F72-3407-48AE-BA88-E8213C6761F1}

Status: UNLINKED. Link to OU=Workstations at Phase 3 cutover.

8. CSC - Drive Mappings GPO

Created Drives.xml in SYSVOL at {GPO-GUID}\User\Preferences\Drives\.

Drive Share ILT
M: \CS-SERVER\Management FilterGroup: CASCADES\SG-Mgmt-RW
S: \CS-SERVER\Sales FilterGroup: CASCADES\SG-Sales-RW
T: \CS-SERVER\Activities FilterGroup: CASCADES\SG-Activities-RW
K: \CS-SERVER\Culinary FilterOrgUnit: OU=Culinary,OU=Departments
R: \CS-SERVER\Receptionist FilterOrgUnit: OU=Resident Services,OU=Departments

CSE GUID: {5794DAFD-BE60-433f-88A2-1A31939AC01F}{D02B1F72-3407-48AE-BA88-E8213C6761F1}

Status: UNLINKED. Link to OU=Departments at Phase 3 cutover.

Final CSC GPO Inventory (8 GPOs, all AllSettingsEnabled)

CSC - Always Wait For Network    (pre-existing)
CSC - Drive Mappings             UNLINKED — link to OU=Departments at Phase 3
CSC - Folder Redirection         UNLINKED — blocked on Phase 3 domain joins
CSC - Folder Redirection (LE)    LIVE — linked to OU=Life Enrichment
CSC - Life Enrichment Printers   LIVE — linked to OU=Life Enrichment
CSC - Printer Deployment         UNLINKED — link to OU=Workstations at Phase 3
CSC - Security Baseline          UNLINKED — link to domain root at Phase 3
CSC - Windows Update             UNLINKED — link to domain root at Phase 3

Docs Updated

  • clients/cascades-tucson/docs/migration/scripts/phase2-print-server.ps1 — Complete status + all 13 printers
  • clients/cascades-tucson/docs/servers/active-directory.md — Accounts disabled, GPO table updated, pending issues updated, printer shares table updated

Phase 3 Prerequisites (next major work)

Domain join order (per migration/phase3-domain-join.md):

  1. DESKTOP-KQSL232 (10.0.20.227)
  2. CHEF-PC (10.0.20.232)
  3. SALES4-PC (10.0.20.203)
  4. MDIRECTOR-PC (192.168.3.20) — needs Windows 10 Pro upgrade first (currently Home)

After first successful join — link GPOs per phase3-domain-join.md step 5c.

Open Items

Item Priority Notes
britney.thompson M365 offboarding Done Sign-in blocked, license removed, litigation hold applied (sysadmin@ via admin center 2026-05-20)

Update: 14:53 PT — britney.thompson M365 offboarding + next session scope

britney.thompson M365 Offboarding (Complete)

Attempted Graph API via device code flow. The well-known PowerShell client ID (1950a258-227b-4e31-a9cf-717495945fc2) is blocked in the tenant (AADSTS65002 — preauthorization required). No Graph-capable modules installed on HOWARD-HOME (Microsoft.Graph, MSOnline, AzureAD all absent). No Azure CLI.

Howard logged into admin.microsoft.com as sysadmin@cascadestucson.com and completed offboarding manually:

  • Sign-in blocked in M365
  • License removed (returned to pool)
  • Litigation hold applied on mailbox

AD account was disabled earlier in this session (see main log above). Offboarding is fully complete.

Next Session — Accounting Office Folder Redirection

Planned work for next session:

  • Machines in the accounting office (Room 103 area): ACCT2-PC (already domain-joined), plus any others in that area
  • Folder redirection for accounting staff: Documents, Downloads, Desktop → \\CS-SERVER\homes\%USERNAME%\
  • Key difference from LE GPO: GrantExclusive=true — removes inherited permissions, grants the user exclusive access (plus Domain Admins). No other domain users can browse sibling folders.
  • Linked to OU=Administrative (or a sub-scope if only accounting staff targeted)
  • Sales department folder redirection possibly follows same session if accounting goes cleanly
  • Pre-check required: OneDrive KFM status on each accounting PC before applying GPO (see 2026-04-17 session log for procedure) | Phase 3 domain joins | High | Block on MDIRECTOR-PC needing Win10 Pro upgrade | | krbtgt password rotation | Medium | 569+ days old — deferred | | Remove Meredith.Kuhn + John.Trozzi from Domain Admins | Low | Deferred | | SG-Mgmt-RW + SG-Sales-RW membership | Medium | Populate before Phase 3 GPO linking | | CSC - Folder Redirection (full) | Medium | Blocked on Phase 3 — check OneDrive KFM on each PC first |
Reference in New Issue View Git Blame Copy Permalink