Files

Howard Enos a6d8d8173f sync: auto-sync from HOWARD-HOME at 2026-07-14 17:02:24

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-14 17:02:24

2026-07-14 17:02:57 -07:00

6.3 KiB

Raw Blame History

2026-07-14 — BCB-OFFICE26: duplicate Dropbox/iCloud Explorer sidebar entry removal

User

User: Howard Enos (howard)
Machine: Howard-Home
Role: tech

Session Summary

Howard reported two "Dropbox" icons on BCB-OFFICE26 (Bardach, Barbara — Main site), one correct and one pointing at an iCloud file that is double-backed-up in both Dropbox and iCloud. Initial request was to rename the wrong icon Dropbox → iCloud, then → "Photos" (since an iCloud Drive entry already exists), and finally the user settled on: just remove it.

Investigation ran entirely through GuruRMM (agent e0ad1c3f-2b19-491f-bbf1-4657b4eee058, online, user barbarabardach logged on at console). Enumerated desktop .lnk files across all user profiles + Public Desktop, resolved shortcut targets via WScript.Shell and Shell.Application (including CLSID/IDList folder shortcuts), checked Desktop known-folder redirection in the user's registry hive, and inspected Dropbox PC-backup folders and iCloudDrive. Her real Desktop folder (C:\Users\BarbaraBardach\Desktop, not redirected) contains exactly one shortcut — Dropbox.lnk → her real Dropbox folder — so no desktop file explained the duplicate.

Asked Howard where the icons appear: File Explorer sidebar (navigation pane). Enumerated pinned shell namespace CLSIDs in her hive + HKLM. Found the offender: a per-user pinned entry named "iCloud Photos" (CLSID {98B050B1-6360-483D-AEF0-C78C96A3F5D2}) whose target is C:\Users\BarbaraBardach\Dropbox\PC (4)\Pictures\iCloud Photos\Photos — iCloud Photos content nested inside a Dropbox PC-backup folder, hence double-synced to both clouds. Howard confirmed that was the entry to remove.

Removal (registry-only, no files touched): set System.IsPinnedToNameSpaceTree = 0 on the CLSID in her hive and deleted the matching Desktop\NameSpace\{98B050B1-...} key. Verified pin=0 and key gone. Posted [RMM] alert to #dev-alerts.

Key Decisions

Used ps-encoded.sh (Write tool script file + -EncodedCommand dispatch) after the first inline heredoc JSON dispatch failed — Git Bash collapses \\ in heredocs, producing invalid JSON escapes (known fleet-wide gotcha).
Chose to unpin via registry flags rather than delete the CLSID key wholesale — reversible, and iCloud may recreate/manage the key.
Left the second genuine duplicate alone: sidebar still has TWO literal "Dropbox" entries (per-user {E0B6F00F-6493-42EC-B060-9DCFCFD070AC} → real Dropbox folder, plus machine-wide HKLM {E31EA727-12ED-4702-820C-4B6445F28E1A}/{...1B}). User only asked for the iCloud Photos one.
Did not touch the underlying double-backup problem (files still sync to both clouds) — flagged to Howard as follow-up.
Asked via AskUserQuestion before deleting anything — the only Dropbox .lnk on her visible desktop was the CORRECT one; deleting on assumption would have removed the wrong icon.

Problems Encountered

Inline JSON heredoc dispatch to RMM failed with "invalid escape" — Git Bash heredoc collapsed \\ in Windows paths. Fixed by switching to ps-encoded.sh.
WScript.Shell returned empty TargetPath for folder/CLSID shortcuts — resolved with Shell.Application GetLink.Target.Path (returned ::{E0B6F00F-...} for the desktop Dropbox.lnk).
Running as SYSTEM, %USERPROFILE%-based .lnk targets resolved to C:\windows\system32\config\systemprofile\... — misleading; actual targets are under her profile.
Get-ChildItem Registry::HKEY_USERS enumeration silently returned nothing for her hive in one script; direct reg.exe query HKU\<SID> worked.

Configuration Changes

On BCB-OFFICE26 (registry, hive HKU\S-1-12-1-1104233520-1256390324-3559642798-2806790374):

...\Software\Classes\CLSID\{98B050B1-6360-483D-AEF0-C78C96A3F5D2}\System.IsPinnedToNameSpaceTree = 0 (was 1)
Deleted ...\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{98B050B1-6360-483D-AEF0-C78C96A3F5D2}

No files in repo changed (temp .ps1 helpers created and deleted).

Credentials & Secrets

None new. RMM auth via vault infrastructure/gururmm-server.sops.yaml as usual.

Infrastructure & Servers

BCB-OFFICE26 — Bardach, Barbara / Main, Windows, GuruRMM agent id e0ad1c3f-2b19-491f-bbf1-4657b4eee058
Logged-on user: barbarabardach (console), profile C:\Users\BarbaraBardach, SID S-1-12-1-1104233520-1256390324-3559642798-2806790374
Cloud sync stack on the box: Dropbox (with PC backup: My PC (BCB), PC, PC (2), PC (4) folders), iCloud Drive (C:\Users\BarbaraBardach\iCloudDrive), OneDrive personal + "OneDrive - Long Realty Company"
Syncro installer present on old desktop backup: SyncroSetup-bardach_barbara-v1-641151.exe

Commands & Outputs

bash .claude/scripts/rmm-search.sh BCB-OFFICE26 → 1 match
bash .claude/scripts/ps-encoded.sh rmm <agent-id> <script>.ps1 --timeout 60 [--user-session] — used for all dispatches
Sidebar namespace enumeration key output:
- {E0B6F00F-6493-42EC-B060-9DCFCFD070AC} name=[Dropbox] user hive, target=C:\Users\BarbaraBardach\Dropbox (correct)
- {98B050B1-6360-483D-AEF0-C78C96A3F5D2} name=[iCloud Photos] target=C:\Users\BarbaraBardach\Dropbox\PC (4)\Pictures\iCloud Photos\Photos (removed)
- {C6BBCD82-88F8-405A-8EA2-559227F01177} name=[iCloud Drive] target=C:\Users\BarbaraBardach\iCloudDrive
- HKLM {E31EA727-12ED-4702-820C-4B6445F28E1A} + {...1B} name=[Dropbox] (machine-wide, still pinned)
Unpin command id: 59f65e95-52b8-4cd5-8797-a8937613c8f9 (exit 0, verified)

Pending / Incomplete Tasks

Double-backup still active: iCloud Photos lives inside Dropbox\PC (4)\Pictures — syncing to both Dropbox and iCloud, burning quota in both. Fix = disable Dropbox folder backup for Pictures or relocate iCloud Photos. Awaiting Howard's go.
Two literal "Dropbox" sidebar entries remain (per-user + HKLM machine-wide). One-line unpin of {E31EA727-...} if the client complains.
If the iCloud Photos entry lingers in the sidebar, a new Explorer window or sign-out/in refreshes it; iCloud for Windows may also re-pin it on update — re-run the unpin if so.

Reference Information

GuruRMM API: http://172.16.3.30:3001; agent id e0ad1c3f-2b19-491f-bbf1-4657b4eee058
RMM command ids: enumeration 6fcf0969, 964d03b1, e9b06c3c, ea6554fb, fb09d69f, 998b3e28, 0fdfce5f, 104ddd56; fix 59f65e95
#dev-alerts message id: 1526737970487627839

6.3 KiB Raw Blame History