claudetools/clients/cascades-tucson/session-logs/2026-05-20-howard-phase2.6-printers-gpos-account-cleanup.md

Cascades of Tucson — Phase 2.6 Session Log

Date: 2026-05-20 Duration: Multi-session (continued from context-limit session)

User

• User: Howard Enos (howard)
• Machine: HOWARD-HOME
• Role: tech

Summary

Completed Phase 2.6: print server build-out, GPO creation, and AD account cleanup. All 13 printers are now installed and shared on CS-SERVER. Four CSC GPOs are created and staged (unlinked until Phase 3 domain join cutover).

---

Work Completed

1. Front Desk Epson ET-5800 — Printer Installation

Problem: EPWizard.exe fails on Windows Server 2019 — wlanapi.dll stub is present but the WLAN stack is absent.

Fix:

1. Ran EPWizard.exe on CS-SERVER, let it extract drivers to AppData\Local\Temp\ET-5800\ before dismissing the error
2. Copied extracted INFs to C:\Users\sysadmin\Documents\ComputerGuru Connect v2\Files\epsonetdrivers\
3. pnputil /add-driver <INF> /install staged the driver in Windows Driver Store
4. Add-PrinterDriver -Name "EPSON ET-5800 Series" registered it with the Print Spooler
5. Add-Printer / Add-PrinterPort created the printer at 192.168.2.147, shared as FrontDesk

Driver name (from INF): EPSON ET-5800 Series INF location: E_WF1XCE.INF (UTF-16 LE with BOM FF FE — Select-String fails on it; must use [System.IO.File]::ReadAllBytes())

2. Memory Care Director + MedTech Printers

Added to CS-SERVER (via GuruRMM remote PowerShell):

Printer	Share	IP	Driver
Memory Care Director - Canon MF751CDW	MCDirector	192.168.3.52	Canon Generic Plus PCL6
Memory Care MedTech - Brother	MCMedTech	192.168.2.53	Brother Generic Jpeg Type2 Class Driver

Both reachable and shared. Total shared printers on CS-SERVER: 13.

3. Script: phase2-print-server.ps1

Updated clients/cascades-tucson/docs/migration/scripts/phase2-print-server.ps1:

• Status header updated to COMPLETE 2026-05-20 (all 13 printers)
• Added FrontDesk, MCDirector, MCMedTech to $printers array
• Documented Epson ET-5800 workaround in header comments
• KM driver archived to D:\Shares\Server\Drivers\KM_Universal_PCL6\

4. AD Account Cleanup (5 accounts)

Executed via GuruRMM remote PowerShell on CS-SERVER. All Disable-ADAccount calls succeeded.

Account	OU	Reason
britney.thompson	Care-Assisted Living	Departed 2026-04-22
Richard.Adams	Transportation	Drivers no longer get IT access
Julian.Crim	Transportation	Drivers no longer get IT access
Christopher.Holick	Transportation	Drivers no longer get IT access
Shontiel.Nunn	Resident Services	Old-format account — s.nunn (Caregivers) is correct

Note: britney.thompson's M365 license is still active and not yet harvested. Action needed before next billing cycle.

5. CSC - Security Baseline GPO

Created via New-GPO + Set-GPRegistryValue + direct SYSVOL writes.

Screen saver (HKCU via GPP):

• ScreenSaveTimeOut = 900 (15 min)
• ScreenSaveActive = 1
• ScreenSaverIsSecure = 1
• SCRNSAVE.EXE = scrnsave.scr

GptTmpl.inf (Machine security — written as Unicode UTF-16):

MinimumPasswordLength = 12
PasswordComplexity = 1
PasswordHistorySize = 24
MaximumPasswordAge = 90
MinimumPasswordAge = 1
LockoutBadCount = 5
ResetLockoutCount = 30
LockoutDuration = 30

GPT.INI: machine version bumped, security extension GUID {827D319E-6EAC-11D2-A4EA-00C04F79F83A}{803E14A0-B4FB-11D0-A0D0-00A0C90F574B} added.

Status: UNLINKED. Link to domain root at Phase 3 cutover.

6. CSC - Windows Update GPO

Created via New-GPO + Set-GPRegistryValue (HKLM AU key).

Setting	Value
NoAutoUpdate	0
AUOptions	4 (auto download + install)
ScheduledInstallDay	1 (Sunday)
ScheduledInstallTime	3 (3:00 AM)
NoAutoRebootWithLoggedOnUsers	1
EnableFeaturedSoftware	0

Status: UNLINKED. Link to domain root at Phase 3 cutover.

7. CSC - Printer Deployment GPO

Created Printers.xml in SYSVOL at {GPO-GUID}\User\Preferences\Printers\.

13 printers with OU-based item-level targeting (FilterOrgUnit):

Share	ILT
CopyRoom	No filter — all staff
BusinessOffice	OU=Administrative
Accounting	OU=Administrative
AdminOffice	OU=Administrative OR OU=Resident Services
ExecDirector	OU=Administrative
SalesMarketing	OU=Marketing
Kitchen	OU=Culinary
CulinaryChef	OU=Culinary
FrontDesk	OU=Resident Services
HealthServices	OU=Care-Assisted Living OR OU=Care-Memorycare
LifeEnrichment	OU=Life Enrichment
MCDirector	OU=Care-Memorycare
MCMedTech	OU=Caregivers OR OU=Care-Memorycare

CSE GUID: {BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}{D02B1F72-3407-48AE-BA88-E8213C6761F1}

Status: UNLINKED. Link to OU=Workstations at Phase 3 cutover.

8. CSC - Drive Mappings GPO

Created Drives.xml in SYSVOL at {GPO-GUID}\User\Preferences\Drives\.

Drive	Share	ILT
M:	\CS-SERVER\Management	FilterGroup: CASCADES\SG-Mgmt-RW
S:	\CS-SERVER\Sales	FilterGroup: CASCADES\SG-Sales-RW
T:	\CS-SERVER\Activities	FilterGroup: CASCADES\SG-Activities-RW
K:	\CS-SERVER\Culinary	FilterOrgUnit: OU=Culinary,OU=Departments
R:	\CS-SERVER\Receptionist	FilterOrgUnit: OU=Resident Services,OU=Departments

CSE GUID: {5794DAFD-BE60-433f-88A2-1A31939AC01F}{D02B1F72-3407-48AE-BA88-E8213C6761F1}

Status: UNLINKED. Link to OU=Departments at Phase 3 cutover.

---

Final CSC GPO Inventory (8 GPOs, all AllSettingsEnabled)

CSC - Always Wait For Network    (pre-existing)
CSC - Drive Mappings             UNLINKED — link to OU=Departments at Phase 3
CSC - Folder Redirection         UNLINKED — blocked on Phase 3 domain joins
CSC - Folder Redirection (LE)    LIVE — linked to OU=Life Enrichment
CSC - Life Enrichment Printers   LIVE — linked to OU=Life Enrichment
CSC - Printer Deployment         UNLINKED — link to OU=Workstations at Phase 3
CSC - Security Baseline          UNLINKED — link to domain root at Phase 3
CSC - Windows Update             UNLINKED — link to domain root at Phase 3

---

Docs Updated

• clients/cascades-tucson/docs/migration/scripts/phase2-print-server.ps1 — Complete status + all 13 printers
• clients/cascades-tucson/docs/servers/active-directory.md — Accounts disabled, GPO table updated, pending issues updated, printer shares table updated

---

Phase 3 Prerequisites (next major work)

Domain join order (per migration/phase3-domain-join.md):

1. DESKTOP-KQSL232 (10.0.20.227)
2. CHEF-PC (10.0.20.232)
3. SALES4-PC (10.0.20.203)
4. MDIRECTOR-PC (192.168.3.20) — needs Windows 10 Pro upgrade first (currently Home)

After first successful join — link GPOs per phase3-domain-join.md step 5c.

---

Open Items

Item	Priority	Notes
britney.thompson M365 license harvest	Medium	Account disabled; license still active
Phase 3 domain joins	High	Block on MDIRECTOR-PC needing Win10 Pro upgrade
krbtgt password rotation	Medium	569+ days old — deferred
Remove Meredith.Kuhn + John.Trozzi from Domain Admins	Low	Deferred
SG-Mgmt-RW + SG-Sales-RW membership	Medium	Populate before Phase 3 GPO linking
CSC - Folder Redirection (full)	Medium	Blocked on Phase 3 — check OneDrive KFM on each PC first