Mike Swanson
ba2ed379f8
Comprehensive infrastructure improvements for AD2 (Domain Controller) remote management and NAS sync system modernization. ## AD2 Remote Access Enhancements **WinRM Configuration:** - Enabled PowerShell Remoting (port 5985) with full logging - Configured TrustedHosts for LAN/VPN access (172.16.*, 192.168.*, 10.*) - Created read-only service account (ClaudeTools-ReadOnly) for safe automation - Set up transcript logging for all remote sessions - Deployed 6 automation scripts to C:\ClaudeTools\Scripts\ (AD user/computer reports, GPO status, replication health, log rotation) **SSH Access:** - Installed OpenSSH Server (v10.0p2) - Generated ED25519 key for passwordless authentication - Configured SSH key authentication for sysadmin account **Benefits:** - Efficient remote operations via persistent WinRM sessions (vs individual SSH commands) - Secure read-only access for queries (no admin rights needed) - Comprehensive audit trail of all remote operations ## Sync System Modernization (AD2 <-> NAS) **Replaced PuTTY with OpenSSH:** - Migrated from pscp.exe/plink.exe to native OpenSSH scp/ssh tools - Added verbose logging (-v flag) for detailed error diagnostics - Implemented auto host-key acceptance (StrictHostKeyChecking=accept-new) - Enhanced error logging to capture actual SCP failure reasons **Problem Solved:** - Original sync errors (738 failures) had no root cause details - PuTTY's batch mode silently failed without error messages - New OpenSSH implementation logs full error output to sync-from-nas.log **Scripts Created:** - setup-openssh-sync.ps1: SSH key generation and NAS configuration - check-openssh-client.ps1: Verify OpenSSH availability - restore-and-fix-sync.ps1: Update Sync-FromNAS.ps1 to use OpenSSH - investigate-sync-errors.ps1: Analyze sync failures with context - test-winrm.ps1: WinRM connection testing (admin + service accounts) - demo-ad2-automation.ps1: WinRM automation examples (AD stats, sync status) ## DOS Batch File Line Ending Fixes **Problem:** All DOS batch files had Unix (LF) line endings instead of DOS (CRLF), causing parsing errors on DOS 6.22 machines. **Fixed:** - Local: 13 batch files converted to CRLF - Remote (AD2): 492 batch files scanned, 10 converted to CRLF - Affected files: DEPLOY.BAT, NWTOC.BAT, CTONW.BAT, UPDATE.BAT, STAGE.BAT, CHECKUPD.BAT, REBOOT.BAT, and station-specific batch files **Scripts Created:** - check-dos-line-endings.ps1: Scan and detect LF vs CRLF - convert-to-dos.ps1: Bulk conversion to DOS format - fix-ad2-dos-files.ps1: Remote conversion via WinRM ## Credentials & Documentation Updates **credentials.md additions:** - Peaceful Spirit VPN configuration (L2TP/IPSec) - AD2 WinRM/SSH access details (both admin and service accounts) - SSH keys and known_hosts configuration - Complete WinRM connection examples **Files Modified:** - credentials.md: +91 lines (VPN, AD2 automation access) - CTONW.BAT, NWTOC.BAT, REBOOT.BAT, STAGE.BAT: Line ending fixes - Infrastructure configs: vpn-connect.bat, vpn-disconnect.bat (CRLF) ## Test Results **WinRM Automation (demo-ad2-automation.ps1):** - Retrieved 178 AD users (156 enabled, 22 disabled, 40 active) - Retrieved 67 AD computers (67 Windows, 6 servers, 53 active) - Checked Dataforth sync status (2,249 files pushed, 738 errors logged) - All operations completed in single remote session (efficient!) **Sync System:** - OpenSSH tools confirmed available on AD2 - Backup created: Sync-FromNAS.ps1.backup-20260119-140918 - Script updated with error logging and verbose output - Next sync run will reveal actual error causes ## Technical Decisions 1. **WinRM over SSH:** More efficient for PowerShell operations, better error handling, native Windows integration 2. **Service Account:** Follows least-privilege principle, safer for automated queries, easier audit trail 3. **OpenSSH over PuTTY:** Modern, maintained, native Windows tool, better error reporting, supports key authentication without external tools 4. **Verbose Logging:** Critical for debugging 738 sync errors - now we'll see actual SCP failure reasons (permissions, paths, network issues) ## Next Steps 1. Monitor next sync run (every 15 minutes) for detailed error messages 2. Analyze SCP error output to identify root cause of 738 failures 3. Implement SSH key authentication for NAS (passwordless) 4. Consider SFTP batch mode for more reliable transfers Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
246 lines
8.5 KiB
Batchfile
246 lines
8.5 KiB
Batchfile
@ECHO OFF
|
|
REM STAGE.BAT - Stage system files for update after reboot
|
|
REM Called by NWTOC.BAT when AUTOEXEC.NEW or CONFIG.NEW are detected
|
|
REM
|
|
REM This script:
|
|
REM 1. Verifies staged files exist (C:\AUTOEXEC.NEW, C:\CONFIG.NEW)
|
|
REM 2. Backs up current AUTOEXEC.BAT to C:\AUTOEXEC.SAV
|
|
REM 3. Creates REBOOT.BAT to apply changes after reboot
|
|
REM 4. Modifies AUTOEXEC.BAT to call REBOOT.BAT once on next boot
|
|
REM 5. Instructs user to reboot
|
|
REM
|
|
REM Version: 1.0 - DOS 6.22 compatible
|
|
REM Last modified: 2026-01-19
|
|
|
|
REM ==================================================================
|
|
REM STEP 1: Verify staged files exist
|
|
REM ==================================================================
|
|
|
|
SET HASAUTO=0
|
|
SET HASCONF=0
|
|
|
|
IF EXIST C:\AUTOEXEC.NEW SET HASAUTO=1
|
|
IF EXIST C:\CONFIG.NEW SET HASCONF=1
|
|
|
|
REM Check if any updates need staging
|
|
IF "%HASAUTO%"=="0" IF "%HASCONF%"=="0" GOTO NO_UPDATES
|
|
|
|
ECHO.
|
|
ECHO ==============================================================
|
|
ECHO Staging System File Updates
|
|
ECHO ==============================================================
|
|
|
|
IF "%HASAUTO%"=="1" ECHO [STAGED] C:\AUTOEXEC.NEW ??? Will replace AUTOEXEC.BAT
|
|
IF "%HASCONF%"=="1" ECHO [STAGED] C:\CONFIG.NEW ??? Will replace CONFIG.SYS
|
|
ECHO ==============================================================
|
|
ECHO.
|
|
|
|
REM ==================================================================
|
|
REM STEP 2: Backup current AUTOEXEC.BAT
|
|
REM ==================================================================
|
|
|
|
ECHO [1/3] Backing up current system files...
|
|
|
|
REM Check if AUTOEXEC.BAT exists
|
|
IF NOT EXIST C:\AUTOEXEC.BAT GOTO NO_AUTOEXEC
|
|
|
|
REM Create backup
|
|
COPY C:\AUTOEXEC.BAT C:\AUTOEXEC.SAV >NUL
|
|
IF ERRORLEVEL 1 GOTO BACKUP_ERROR
|
|
|
|
ECHO [OK] C:\AUTOEXEC.BAT ??? C:\AUTOEXEC.SAV
|
|
|
|
REM Also backup CONFIG.SYS if it exists
|
|
IF EXIST C:\CONFIG.SYS COPY C:\CONFIG.SYS C:\CONFIG.SAV >NUL
|
|
IF EXIST C:\CONFIG.SYS IF NOT ERRORLEVEL 1 ECHO [OK] C:\CONFIG.SYS ??? C:\CONFIG.SAV
|
|
|
|
ECHO.
|
|
|
|
REM ==================================================================
|
|
REM STEP 3: Create REBOOT.BAT
|
|
REM ==================================================================
|
|
|
|
ECHO [2/3] Creating reboot update script...
|
|
|
|
REM Create C:\BAT directory if it doesn't exist
|
|
IF NOT EXIST C:\BAT\NUL MD C:\BAT
|
|
|
|
REM Create REBOOT.BAT - this runs once after reboot
|
|
ECHO @ECHO OFF > C:\BAT\REBOOT.BAT
|
|
ECHO REM REBOOT.BAT - Apply staged system updates (AUTO-GENERATED) >> C:\BAT\REBOOT.BAT
|
|
ECHO REM This file is automatically deleted after running >> C:\BAT\REBOOT.BAT
|
|
ECHO. >> C:\BAT\REBOOT.BAT
|
|
ECHO ECHO. >> C:\BAT\REBOOT.BAT
|
|
ECHO ECHO ============================================================== >> C:\BAT\REBOOT.BAT
|
|
ECHO ECHO Applying System Updates >> C:\BAT\REBOOT.BAT
|
|
ECHO ECHO ============================================================== >> C:\BAT\REBOOT.BAT
|
|
ECHO ECHO. >> C:\BAT\REBOOT.BAT
|
|
ECHO. >> C:\BAT\REBOOT.BAT
|
|
|
|
REM Apply AUTOEXEC.NEW if it exists
|
|
IF "%HASAUTO%"=="1" ECHO IF EXIST C:\AUTOEXEC.NEW ECHO [1/2] Updating AUTOEXEC.BAT... >> C:\BAT\REBOOT.BAT
|
|
IF "%HASAUTO%"=="1" ECHO IF EXIST C:\AUTOEXEC.NEW COPY C:\AUTOEXEC.NEW C:\AUTOEXEC.BAT ^>NUL >> C:\BAT\REBOOT.BAT
|
|
IF "%HASAUTO%"=="1" ECHO IF EXIST C:\AUTOEXEC.NEW IF NOT ERRORLEVEL 1 ECHO [OK] AUTOEXEC.BAT updated >> C:\BAT\REBOOT.BAT
|
|
IF "%HASAUTO%"=="1" ECHO IF EXIST C:\AUTOEXEC.NEW IF ERRORLEVEL 1 ECHO [ERROR] AUTOEXEC.BAT update failed >> C:\BAT\REBOOT.BAT
|
|
IF "%HASAUTO%"=="1" ECHO IF EXIST C:\AUTOEXEC.NEW DEL C:\AUTOEXEC.NEW >> C:\BAT\REBOOT.BAT
|
|
IF "%HASAUTO%"=="1" ECHO ECHO. >> C:\BAT\REBOOT.BAT
|
|
|
|
REM Apply CONFIG.NEW if it exists
|
|
IF "%HASCONF%"=="1" ECHO IF EXIST C:\CONFIG.NEW ECHO [2/2] Updating CONFIG.SYS... >> C:\BAT\REBOOT.BAT
|
|
IF "%HASCONF%"=="1" ECHO IF EXIST C:\CONFIG.NEW COPY C:\CONFIG.NEW C:\CONFIG.SYS ^>NUL >> C:\BAT\REBOOT.BAT
|
|
IF "%HASCONF%"=="1" ECHO IF EXIST C:\CONFIG.NEW IF NOT ERRORLEVEL 1 ECHO [OK] CONFIG.SYS updated >> C:\BAT\REBOOT.BAT
|
|
IF "%HASCONF%"=="1" ECHO IF EXIST C:\CONFIG.NEW IF ERRORLEVEL 1 ECHO [ERROR] CONFIG.SYS update failed >> C:\BAT\REBOOT.BAT
|
|
IF "%HASCONF%"=="1" ECHO IF EXIST C:\CONFIG.NEW DEL C:\CONFIG.NEW >> C:\BAT\REBOOT.BAT
|
|
IF "%HASCONF%"=="1" ECHO ECHO. >> C:\BAT\REBOOT.BAT
|
|
|
|
REM Delete REBOOT.BAT after running
|
|
ECHO ECHO ============================================================== >> C:\BAT\REBOOT.BAT
|
|
ECHO ECHO System Updates Applied >> C:\BAT\REBOOT.BAT
|
|
ECHO ECHO ============================================================== >> C:\BAT\REBOOT.BAT
|
|
ECHO ECHO. >> C:\BAT\REBOOT.BAT
|
|
ECHO ECHO Rollback files available: >> C:\BAT\REBOOT.BAT
|
|
ECHO ECHO C:\AUTOEXEC.SAV - Previous AUTOEXEC.BAT >> C:\BAT\REBOOT.BAT
|
|
ECHO ECHO C:\CONFIG.SAV - Previous CONFIG.SYS >> C:\BAT\REBOOT.BAT
|
|
ECHO ECHO. >> C:\BAT\REBOOT.BAT
|
|
ECHO ECHO To rollback, run: >> C:\BAT\REBOOT.BAT
|
|
ECHO ECHO COPY C:\AUTOEXEC.SAV C:\AUTOEXEC.BAT >> C:\BAT\REBOOT.BAT
|
|
ECHO ECHO COPY C:\CONFIG.SAV C:\CONFIG.SYS >> C:\BAT\REBOOT.BAT
|
|
ECHO ECHO. >> C:\BAT\REBOOT.BAT
|
|
ECHO PAUSE Press any key to continue boot... >> C:\BAT\REBOOT.BAT
|
|
ECHO. >> C:\BAT\REBOOT.BAT
|
|
ECHO REM Delete this script >> C:\BAT\REBOOT.BAT
|
|
ECHO DEL C:\BAT\REBOOT.BAT >> C:\BAT\REBOOT.BAT
|
|
|
|
IF NOT EXIST C:\BAT\REBOOT.BAT GOTO CREATE_ERROR
|
|
|
|
ECHO [OK] C:\BAT\REBOOT.BAT created
|
|
ECHO.
|
|
|
|
REM ==================================================================
|
|
REM STEP 4: Modify AUTOEXEC.BAT to call REBOOT.BAT once
|
|
REM ==================================================================
|
|
|
|
ECHO [3/3] Modifying AUTOEXEC.BAT for one-time reboot update...
|
|
|
|
REM Create temporary file with REBOOT.BAT call at the top
|
|
ECHO @ECHO OFF > C:\AUTOEXEC.TMP
|
|
ECHO REM One-time system update on next reboot >> C:\AUTOEXEC.TMP
|
|
ECHO IF EXIST C:\BAT\REBOOT.BAT CALL C:\BAT\REBOOT.BAT >> C:\AUTOEXEC.TMP
|
|
ECHO. >> C:\AUTOEXEC.TMP
|
|
|
|
REM Append current AUTOEXEC.BAT contents (skip first @ECHO OFF line)
|
|
REM Use FIND to skip the first line, then append the rest
|
|
FOR /F "skip=1 delims=" %%L IN (C:\AUTOEXEC.BAT) DO ECHO %%L >> C:\AUTOEXEC.TMP
|
|
|
|
REM Replace AUTOEXEC.BAT with modified version
|
|
COPY C:\AUTOEXEC.TMP C:\AUTOEXEC.BAT >NUL
|
|
IF ERRORLEVEL 1 GOTO MODIFY_ERROR
|
|
|
|
REM Clean up temporary file
|
|
DEL C:\AUTOEXEC.TMP
|
|
|
|
ECHO [OK] AUTOEXEC.BAT modified to run update on next boot
|
|
ECHO.
|
|
|
|
REM ==================================================================
|
|
REM STEP 5: Instruct user to reboot
|
|
REM ==================================================================
|
|
|
|
ECHO ==============================================================
|
|
ECHO REBOOT REQUIRED
|
|
ECHO ==============================================================
|
|
ECHO.
|
|
ECHO System files have been staged for update.
|
|
ECHO.
|
|
ECHO On next boot, AUTOEXEC.BAT will automatically:
|
|
ECHO 1. Apply AUTOEXEC.NEW and/or CONFIG.NEW
|
|
ECHO 2. Delete staging files
|
|
ECHO 3. Continue normal boot
|
|
ECHO.
|
|
ECHO To apply updates now:
|
|
ECHO 1. Press Ctrl+Alt+Del to reboot
|
|
ECHO 2. Or type: EXIT and reboot from DOS prompt
|
|
ECHO.
|
|
ECHO To cancel update:
|
|
ECHO 1. Delete C:\AUTOEXEC.NEW
|
|
ECHO 2. Delete C:\CONFIG.NEW
|
|
ECHO 3. Delete C:\BAT\REBOOT.BAT
|
|
ECHO 4. Restore C:\AUTOEXEC.BAT from C:\AUTOEXEC.SAV
|
|
ECHO.
|
|
ECHO ==============================================================
|
|
ECHO.
|
|
PAUSE Press any key to return to DOS...
|
|
GOTO END
|
|
|
|
REM ==================================================================
|
|
REM ERROR HANDLERS
|
|
REM ==================================================================
|
|
|
|
:NO_UPDATES
|
|
ECHO.
|
|
ECHO [WARNING] No staged update files found
|
|
ECHO.
|
|
ECHO Expected files:
|
|
ECHO C:\AUTOEXEC.NEW (not found)
|
|
ECHO C:\CONFIG.NEW (not found)
|
|
ECHO.
|
|
ECHO Run NWTOC to download updates from network.
|
|
ECHO.
|
|
PAUSE Press any key to exit...
|
|
GOTO END
|
|
|
|
:NO_AUTOEXEC
|
|
ECHO.
|
|
ECHO [ERROR] C:\AUTOEXEC.BAT not found
|
|
ECHO.
|
|
ECHO Cannot stage updates without existing AUTOEXEC.BAT
|
|
ECHO.
|
|
PAUSE Press any key to exit...
|
|
GOTO END
|
|
|
|
:BACKUP_ERROR
|
|
ECHO.
|
|
ECHO [ERROR] Failed to create backup
|
|
ECHO.
|
|
ECHO Could not copy C:\AUTOEXEC.BAT to C:\AUTOEXEC.SAV
|
|
ECHO.
|
|
ECHO Check:
|
|
ECHO - Sufficient disk space on C:
|
|
ECHO - C: drive is not write-protected
|
|
ECHO.
|
|
PAUSE Press any key to exit...
|
|
GOTO END
|
|
|
|
:CREATE_ERROR
|
|
ECHO.
|
|
ECHO [ERROR] Failed to create C:\BAT\REBOOT.BAT
|
|
ECHO.
|
|
ECHO Check:
|
|
ECHO - C:\BAT directory exists
|
|
ECHO - Sufficient disk space on C:
|
|
ECHO - C: drive is not write-protected
|
|
ECHO.
|
|
PAUSE Press any key to exit...
|
|
GOTO END
|
|
|
|
:MODIFY_ERROR
|
|
ECHO.
|
|
ECHO [ERROR] Failed to modify AUTOEXEC.BAT
|
|
ECHO.
|
|
ECHO AUTOEXEC.BAT may be corrupted!
|
|
ECHO.
|
|
ECHO Recovery:
|
|
ECHO COPY C:\AUTOEXEC.SAV C:\AUTOEXEC.BAT
|
|
ECHO.
|
|
PAUSE Press any key to exit...
|
|
GOTO END
|
|
|
|
REM ==================================================================
|
|
REM CLEANUP AND EXIT
|
|
REM ==================================================================
|
|
|
|
:END
|
|
REM Clean up environment variables
|
|
SET HASAUTO=
|
|
SET HASCONF=
|