claudetools/clients/prairie-schooner/cutover-runbook.md

The Prairie Schooner — Cutover Runbook (tonight + tomorrow morning)

Prepared 2026-07-14 for the after-hours data move + morning UDM Pro cable swap. Companion file: udm-dhcp-plan.md (LAN/DHCP/reservations detail).

Facts this plan is built on (verified today via RMM/SC)

• Data to move: C:\Share\Quickbooks (154.8 GB, 55,915 files) + C:\Share\Deployment (24.0 GB, 10,623 files). Everything else is empty Essentials defaults (Company, Users, Folder Redirection: 0 bytes) or role data (SYSVOL/NETLOGON/CertEnroll — replicates via AD, do NOT copy).
• TPS-SVR: C: 5.3 TB, 4.83 TB free. Already shares Share -> C:\Share — copy into C:\Share\Quickbooks / C:\Share\Deployment and paths mirror the old server.
• The ONLY client-side dependency is drive Q: -> \tps-server\quickbooks, delivered as a GPP drive map in Default Domain Policy (User Prefs > Drives, action=U, persistent=0, bypassErrors=1). Same on all 3 workstations (TINA, JAYMI, MEL-PC). No logon scripts, no other maps, DFS root unused ("Shared Folders" — legacy, empty).
• QB ACLs show QBDataServiceUser27/28/31/34 (QB 2017/2018/2021/2024 DB managers installed over the years on the old box). robocopy /COPYALL carries these SIDs.
• 3x Yealink phones (.141/.142/.146) + Dahua NVR (.145) — outbound-only, unaffected except brief outage during the swap.

TONIGHT — after users leave

1. Data copy (run in ScreenConnect session on TPS-SVR as TPS\guru)

QuickBooks must be CLOSED on all workstations (QBW/TLG lock + change under copy).

robocopy \\TPS-SERVER\C$\Share\Quickbooks C:\Share\Quickbooks /E /COPYALL /DCOPY:DAT /R:1 /W:1 /MT:16 /NP /TEE /LOG:C:\Backups\robocopy-quickbooks.log
robocopy \\TPS-SERVER\C$\Share\Deployment C:\Share\Deployment /E /COPYALL /DCOPY:DAT /R:1 /W:1 /MT:16 /NP /TEE /LOG:C:\Backups\robocopy-deployment.log

• ~179 GB over gigabit: expect roughly 30–60 min total.
• Verify: tail of each log — FAILED column must be 0. Re-run the same command for a delta/repair pass (robocopy is idempotent here; do NOT add /MIR on the first night — nothing to mirror-delete anyway).
• Run as guru (SYSTEM/RMM cannot auth to \TPS-SERVER\C$ — that is why this step is interactive, not dispatched).

2. Create the shares on TPS-SVR (match old server exactly)

New-SmbShare -Name Quickbooks -Path C:\Share\Quickbooks -Description "QuickBooks data" -FullAccess Everyone
New-SmbShare -Name Deployment -Path C:\Share\Deployment -FullAccess "NT AUTHORITY\Authenticated Users" -ReadAccess Everyone

• NTFS perms arrive with /COPYALL — do not re-ACL.
• Old empty shares (Company, Users, "Folder Redirection", "Shared Folders" DFS root): intentionally NOT recreated — zero bytes, no map/script references them.

3. QuickBooks Database Server Manager on TPS-SVR

• Install the QB DBSM matching the client's current QB year (ACL evidence: 27/28/31/34 = 2017/2018/2021/2024 — 2024 is presumably live; confirm the .QBW's version).
• Run DBSM -> scan C:\Share\Quickbooks -> confirm company file(s) found; it fixes service-user ACLs itself.
• Firewall: DBSM installer opens its ports; verify QBDBMgrN service running.

4. Repoint the Q: drive GPP (GPMC on TPS-SVR)

Default Domain Policy -> User Configuration -> Preferences -> Windows Settings -> Drive Maps -> Q: -> change path \\tps-server\quickbooks -> \\tps-svr\Quickbooks. (persistent=0 + action=Update means every morning logon re-applies it — no per-PC work.)

Optional immediate test tonight: gpupdate /force + logoff/logon on one workstation, open the company file on Q:, confirm multi-user mode works — while the old server is still fully up. Zero-risk rollback window.

5. Enter the UDM Pro config (UniFi app, Pro LAN still ISOLATED)

Full detail in udm-dhcp-plan.md:

• LAN 192.168.1.1/24, domain tps.local
• DHCP pool 192.168.1.100–199, DNS handed to clients: .135, .125
• 7 fixed-IP reservations (3 PCs, 3 Yealink phones, Dahua NVR)
• Content filtering / DNS Shield OFF

TOMORROW MORNING — cable swap + test

1. Pull SonicWall (.1) and USG; patch the office switch into the UDM Pro LAN port.
2. On one workstation: ipconfig /renew -> expect SAME IP, gateway .1, DNS .135/.125, internet up. (nslookup tps.local should answer from .135.)
3. Log users on normally -> Q: now maps to \tps-svr\Quickbooks (GPP applies at logon).
4. Open QuickBooks on 2 workstations -> company file opens multi-user.
5. Phones: confirm dial tone / registration on all 3 Yealinks (reboot any that sulk).
6. NVR: confirm local UI (https://192.168.1.145) and remote/P2P view.
7. Spot-check internet + printing.

Rollback (if the Pro misbehaves): plug the SonicWall back in — nothing on the old path was changed. Q:/shares work under either gateway since both servers are on the LAN.

Explicitly OUT of scope for tomorrow (old server stays ON)

TPS-SERVER remains DC/DNS/CA until the AD migration completes: FSMO transfer, CA migration (test Backup-CARoleService key export first), DNS role checks, demote + power off, then shrink the DHCP DNS list to .135 only (or add .1). Do NOT power off the old server after the file cutover — .125 is still second DNS and a live DC.