azcomputerguru/claudetools
1
0
Fork 0
Code Issues 58 Pull Requests Actions Packages Projects Releases Wiki Activity
Files
bc984d9c78b2140d13b770279b54abd6ebefb290
claudetools/clients/cascades-tucson/session-logs/2026-05-20-howard-phase2.6-printers-gpos-account-cleanup.md
Howard Enos bc984d9c78 sync: auto-sync from HOWARD-HOME at 2026-05-20 17:08:25 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-05-20 17:08:25
2026-05-20 17:08:29 -07:00

18 KiB
Raw Blame History

Cascades of Tucson — Phase 2.6 Session Log

Date: 2026-05-20 Duration: Multi-session (continued from context-limit session)

User

  • User: Howard Enos (howard)
  • Machine: HOWARD-HOME
  • Role: tech

Summary

Completed Phase 2.6: print server build-out, GPO creation, and AD account cleanup. All 13 printers are now installed and shared on CS-SERVER. Four CSC GPOs are created and staged (unlinked until Phase 3 domain join cutover).

Work Completed

1. Front Desk Epson ET-5800 — Printer Installation

Problem: EPWizard.exe fails on Windows Server 2019 — wlanapi.dll stub is present but the WLAN stack is absent.

Fix:

  1. Ran EPWizard.exe on CS-SERVER, let it extract drivers to AppData\Local\Temp\ET-5800\ before dismissing the error
  2. Copied extracted INFs to C:\Users\sysadmin\Documents\ComputerGuru Connect v2\Files\epsonetdrivers\
  3. pnputil /add-driver <INF> /install staged the driver in Windows Driver Store
  4. Add-PrinterDriver -Name "EPSON ET-5800 Series" registered it with the Print Spooler
  5. Add-Printer / Add-PrinterPort created the printer at 192.168.2.147, shared as FrontDesk

Driver name (from INF): EPSON ET-5800 Series INF location: E_WF1XCE.INF (UTF-16 LE with BOM FF FE — Select-String fails on it; must use [System.IO.File]::ReadAllBytes())

2. Memory Care Director + MedTech Printers

Added to CS-SERVER (via GuruRMM remote PowerShell):

Printer Share IP Driver
Memory Care Director - Canon MF751CDW MCDirector 192.168.3.52 Canon Generic Plus PCL6
Memory Care MedTech - Brother MCMedTech 192.168.2.53 Brother Generic Jpeg Type2 Class Driver

Both reachable and shared. Total shared printers on CS-SERVER: 13.

3. Script: phase2-print-server.ps1

Updated clients/cascades-tucson/docs/migration/scripts/phase2-print-server.ps1:

  • Status header updated to COMPLETE 2026-05-20 (all 13 printers)
  • Added FrontDesk, MCDirector, MCMedTech to $printers array
  • Documented Epson ET-5800 workaround in header comments
  • KM driver archived to D:\Shares\Server\Drivers\KM_Universal_PCL6\

4. AD Account Cleanup (5 accounts)

Executed via GuruRMM remote PowerShell on CS-SERVER. All Disable-ADAccount calls succeeded.

Account OU Reason
britney.thompson Care-Assisted Living Departed 2026-04-22
Richard.Adams Transportation Drivers no longer get IT access
Julian.Crim Transportation Drivers no longer get IT access
Christopher.Holick Transportation Drivers no longer get IT access
Shontiel.Nunn Resident Services Old-format account — s.nunn (Caregivers) is correct

Note: britney.thompson's M365 license is still active and not yet harvested. Action needed before next billing cycle.

5. CSC - Security Baseline GPO

Created via New-GPO + Set-GPRegistryValue + direct SYSVOL writes.

Screen saver (HKCU via GPP):

  • ScreenSaveTimeOut = 900 (15 min)
  • ScreenSaveActive = 1
  • ScreenSaverIsSecure = 1
  • SCRNSAVE.EXE = scrnsave.scr

GptTmpl.inf (Machine security — written as Unicode UTF-16):

MinimumPasswordLength = 12
PasswordComplexity = 1
PasswordHistorySize = 24
MaximumPasswordAge = 90
MinimumPasswordAge = 1
LockoutBadCount = 5
ResetLockoutCount = 30
LockoutDuration = 30

GPT.INI: machine version bumped, security extension GUID {827D319E-6EAC-11D2-A4EA-00C04F79F83A}{803E14A0-B4FB-11D0-A0D0-00A0C90F574B} added.

Status: UNLINKED. Link to domain root at Phase 3 cutover.

6. CSC - Windows Update GPO

Created via New-GPO + Set-GPRegistryValue (HKLM AU key).

Setting Value
NoAutoUpdate 0
AUOptions 4 (auto download + install)
ScheduledInstallDay 1 (Sunday)
ScheduledInstallTime 3 (3:00 AM)
NoAutoRebootWithLoggedOnUsers 1
EnableFeaturedSoftware 0

Status: UNLINKED. Link to domain root at Phase 3 cutover.

7. CSC - Printer Deployment GPO

Created Printers.xml in SYSVOL at {GPO-GUID}\User\Preferences\Printers\.

13 printers with OU-based item-level targeting (FilterOrgUnit):

Share ILT
CopyRoom No filter — all staff
BusinessOffice OU=Administrative
Accounting OU=Administrative
AdminOffice OU=Administrative OR OU=Resident Services
ExecDirector OU=Administrative
SalesMarketing OU=Marketing
Kitchen OU=Culinary
CulinaryChef OU=Culinary
FrontDesk OU=Resident Services
HealthServices OU=Care-Assisted Living OR OU=Care-Memorycare
LifeEnrichment OU=Life Enrichment
MCDirector OU=Care-Memorycare
MCMedTech OU=Caregivers OR OU=Care-Memorycare

CSE GUID: {BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}{D02B1F72-3407-48AE-BA88-E8213C6761F1}

Status: UNLINKED. Link to OU=Workstations at Phase 3 cutover.

8. CSC - Drive Mappings GPO

Created Drives.xml in SYSVOL at {GPO-GUID}\User\Preferences\Drives\.

Drive Share ILT
M: \CS-SERVER\Management FilterGroup: CASCADES\SG-Mgmt-RW
S: \CS-SERVER\Sales FilterGroup: CASCADES\SG-Sales-RW
T: \CS-SERVER\Activities FilterGroup: CASCADES\SG-Activities-RW
K: \CS-SERVER\Culinary FilterOrgUnit: OU=Culinary,OU=Departments
R: \CS-SERVER\Receptionist FilterOrgUnit: OU=Resident Services,OU=Departments

CSE GUID: {5794DAFD-BE60-433f-88A2-1A31939AC01F}{D02B1F72-3407-48AE-BA88-E8213C6761F1}

Status: UNLINKED. Link to OU=Departments at Phase 3 cutover.

Final CSC GPO Inventory (8 GPOs, all AllSettingsEnabled)

CSC - Always Wait For Network    (pre-existing)
CSC - Drive Mappings             UNLINKED — link to OU=Departments at Phase 3
CSC - Folder Redirection         UNLINKED — blocked on Phase 3 domain joins
CSC - Folder Redirection (LE)    LIVE — linked to OU=Life Enrichment
CSC - Life Enrichment Printers   LIVE — linked to OU=Life Enrichment
CSC - Printer Deployment         UNLINKED — link to OU=Workstations at Phase 3
CSC - Security Baseline          UNLINKED — link to domain root at Phase 3
CSC - Windows Update             UNLINKED — link to domain root at Phase 3

Docs Updated

  • clients/cascades-tucson/docs/migration/scripts/phase2-print-server.ps1 — Complete status + all 13 printers
  • clients/cascades-tucson/docs/servers/active-directory.md — Accounts disabled, GPO table updated, pending issues updated, printer shares table updated

Phase 3 Prerequisites (next major work)

Domain join order (per migration/phase3-domain-join.md):

  1. DESKTOP-KQSL232 (10.0.20.227)
  2. CHEF-PC (10.0.20.232)
  3. SALES4-PC (10.0.20.203)
  4. MDIRECTOR-PC (192.168.3.20) — needs Windows 10 Pro upgrade first (currently Home)

After first successful join — link GPOs per phase3-domain-join.md step 5c.

Open Items

Item Priority Notes
britney.thompson M365 offboarding Done Sign-in blocked, license removed, litigation hold applied (sysadmin@ via admin center 2026-05-20)

Update: 14:53 PT — britney.thompson M365 offboarding + next session scope

britney.thompson M365 Offboarding (Complete)

Attempted Graph API via device code flow. The well-known PowerShell client ID (1950a258-227b-4e31-a9cf-717495945fc2) is blocked in the tenant (AADSTS65002 — preauthorization required). No Graph-capable modules installed on HOWARD-HOME (Microsoft.Graph, MSOnline, AzureAD all absent). No Azure CLI.

Howard logged into admin.microsoft.com as sysadmin@cascadestucson.com and completed offboarding manually:

  • Sign-in blocked in M365
  • License removed (returned to pool)
  • Litigation hold applied on mailbox

AD account was disabled earlier in this session (see main log above). Offboarding is fully complete.

Next Session — Accounting Office Folder Redirection

Planned work for next session:

  • Machines in the accounting office (Room 103 area): ACCT2-PC (already domain-joined), plus any others in that area
  • Folder redirection for accounting staff: Documents, Downloads, Desktop → \\CS-SERVER\homes\%USERNAME%\
  • Key difference from LE GPO: GrantExclusive=true — removes inherited permissions, grants the user exclusive access (plus Domain Admins). No other domain users can browse sibling folders.
  • Linked to OU=Administrative (or a sub-scope if only accounting staff targeted)
  • Sales department folder redirection possibly follows same session if accounting goes cleanly
  • Pre-check required: OneDrive KFM status on each accounting PC before applying GPO (see 2026-04-17 session log for procedure) | Phase 3 domain joins | High | Block on MDIRECTOR-PC needing Win10 Pro upgrade | | krbtgt password rotation | Medium | 569+ days old — deferred | | Remove Meredith.Kuhn + John.Trozzi from Domain Admins | Low | Deferred | | SG-Mgmt-RW + SG-Sales-RW membership | Medium | Populate before Phase 3 GPO linking | | CSC - Folder Redirection (full) | Medium | Blocked on Phase 3 — check OneDrive KFM on each PC first |

Update: 17:06 PT — Admin folder redirection setup + department migration master plan

Session scope

Continued from context-limit session. Completed the accounting/admin folder redirection GPO setup for Zachary Nelson, resolved architecture questions about OneDrive/HIPAA/AppData, and built the full department migration master plan.

1. Folder Redirection Architecture Decisions

GPO approach — native FRD, not GPP Registry:

  • Inspected CSC - Folder Redirection GPO SYSVOL: had User\Preferences\Registry\Registry.xml (GPP Registry approach, 550 bytes) plus empty Documents & Settings folder.
  • Decision: use native Group Policy Folder Redirection (GPMC UI → User Configuration → Windows Settings → Folder Redirection), not the GPP Registry hack. Howard configured this directly in GPMC on CS-SERVER.

One GPO for all non-LE departments (not per-dept):

  • %USERNAME% in the redirect path makes it universal — \\CS-SERVER\homes\zachary.nelson\Documents, \\CS-SERVER\homes\lauren.hasselman\Documents, etc. all handled by one policy.
  • Keep CSC - Folder Redirection (LE) for Life Enrichment. CSC - Folder Redirection becomes the universal GPO for all other departments.

Security group filter instead of OU scope:

  • All 6 users in OU=Administrative (Zachary.Nelson, lauren.hasselman, Alma.Montt, Meredith.Kuhn, Ashley.Jensen, Allison.Reibschied) — cannot use OU scope without hitting users not ready for redirection.
  • Solution: SG-FolderRedirect security group. Only members get the GPO applied.
  • Future: when all departments migrated, remove SG filter, add Authenticated Users — existing redirected users see zero disruption.

AppData — do not redirect:

  • Confirmed: redirect only Documents, Desktop, Downloads. AppData causes login slowdowns, application breakage, and network overhead with no meaningful benefit for assigned-machine users.

2. GPO Configuration (Howard in GPMC on CS-SERVER)

Howard opened GPMC, edited CSC - Folder Redirection, configured:

  • Documents → \\CS-SERVER\homes (Basic redirection, grant exclusive rights, move contents)
  • Desktop → \\CS-SERVER\homes (same settings)
  • Downloads → \\CS-SERVER\homes (same settings)
  • Policy removal: leave folder in new location

Howard also removed Authenticated Users from Security Filtering directly in GPMC (scripted removal failed — Set-GPPermission -PermissionLevel None triggers interactive confirmation prompt even with -Confirm:$false in NonInteractive PS sessions; GPMC COM CreateSecurityInfo method also unavailable).

3. SG-FolderRedirect Created and Wired

Dispatched via GuruRMM to CS-SERVER:

  • Created SG-FolderRedirect (Global Security group, created in CN=Users fallback since OU=Security Groups,OU=Groups path failed)
  • Added Zachary.Nelson as sole member
  • Added SG-FolderRedirect with GpoApply permission on CSC - Folder Redirection
  • Linked CSC - Folder Redirection to OU=Administrative,OU=Departments,DC=cascades,DC=local (Enabled, Order 1)

Final GPO state:

CSC - Folder Redirection
  Linked: OU=Administrative — Enabled: True
  Security filter: SG-FolderRedirect [GpoApply]
  Members of SG-FolderRedirect: Zachary.Nelson

4. GuruRMM API Auth Change

GuruRMM API (port 3001) now requires JWT auth header. Previous sessions worked without it — behavior changed. Resolved:

TOKEN=$(curl -s -X POST "http://172.16.3.30:3001/api/auth/login" \
  -H "Content-Type: application/json" \
  -d '{"email":"claude-api@azcomputerguru.com","password":"ClaudeAPI2026!@#"}' \
  | grep -o '"token":"[^"]*"' | cut -d'"' -f4)

Command dispatch also now requires command_type field: {"command_type":"powershell","command":"..."}. Result polling endpoint is /api/commands/{id} (not /api/agents/{id}/command/{id}).

5. HIPAA / OneDrive Discussion

Concluded: server folder redirection is the correct posture for PHI-adjacent roles (accounting/admin). OneDrive requires a signed Microsoft HIPAA BAA, conditional access to block personal device sync, and Business Premium or E3 for full compliance tooling. Until BAA status is confirmed for cascadestucson.com tenant, PHI should stay on-prem.

6. Entra Connect — Expansion Plan

Entra Connect is live on CS-SERVER, production mode. Currently syncing OU=Caregivers + OU=Groups only. Not yet syncing Administrative or other department OUs.

Key facts for expansion:

  • On-prem UPN suffix is @cascades.local (non-routable). Must add cascadestucson.com as alternate UPN suffix in AD before syncing any new dept OU.
  • Change user UPNs to @cascadestucson.com → soft-match links to existing M365 cloud accounts.
  • PHS makes on-prem password win — M365 password changes to Windows domain password on first sync. Notify users or align passwords first.
  • Local Windows login behavior is unchanged. GPOs, group memberships, folder paths — all unchanged.

7. Department Migration Master Plan

Created comprehensive multi-day migration plan. Covers:

  • Per-department template: pre-checks → machine prep → domain join → ProfWiz → prep-profile script → SG-FolderRedirect → Entra sync
  • Department sequence (Admin → LE → Culinary → RS → Marketing → Care → Caregivers)
  • Final switchover: SG-FolderRedirect removed, Authenticated Users restored — zero disruption to already-redirected users
  • Clean machine end state: fresh domain join → all GPOs apply automatically, no manual steps
  • Key guardrails from 2026-04-17 LE session (ProfWiz NTUSER.DAT poisoning, KFM conflict procedure)
  • Prerequisites before Phase 3 GPO linking (SG membership, krbtgt rotation, Domain Admins cleanup)

Plan file: C:\Users\Howard\.claude\plans\wise-discovering-panda.md
Resume command: "resume the Cascades migration plan" at session start
Syncro ticket: https://computerguru.syncromsp.com/tickets/110680053

Configuration Changes

File Action Notes
clients/cascades-tucson/session-logs/2026-05-20-howard-phase2.6-printers-gpos-account-cleanup.md Appended This update
C:\Users\Howard\.claude\plans\wise-discovering-panda.md Created Master migration plan with save-point tracking
.claude/memory/project-cascades-migration-plan.md Created Memory entry for plan file + Syncro ticket
.claude/memory/MEMORY.md Updated Added Cascades migration plan pointer
C:\claudetools\.claude\temp\check-frd-gpo.ps1 Created GPO inspection script
C:\claudetools\.claude\temp\frd-prep.ps1 Created SG create + GPO filter setup
C:\claudetools\.claude\temp\frd-link.ps1 Created GPO link to OU=Administrative
C:\claudetools\.claude\temp\find-zachary.ps1 Created AD user lookup + OU=Administrative inventory

AD changes (via GuruRMM on CS-SERVER):

  • Created security group SG-FolderRedirect (CN=Users,DC=cascades,DC=local)
  • Added Zachary.Nelson to SG-FolderRedirect
  • Removed Authenticated Users from CSC - Folder Redirection security filter (done by Howard in GPMC)
  • Linked CSC - Folder Redirection to OU=Administrative (Enabled, Order 1)

GPMC changes (Howard on CS-SERVER directly):

  • Configured native folder redirection in CSC - Folder Redirection:
    • Documents, Desktop, Downloads → \\CS-SERVER\homes (Basic, GrantExclusive, MoveContents)
    • Policy removal: leave folder in new location

Infrastructure & Servers

Resource Value
CS-SERVER agent ID 6766e973-e703-47c1-be56-76950290f87c
GuruRMM API http://172.16.3.30:3001 (now requires JWT auth)
GuruRMM API admin claude-api@azcomputerguru.com / ClaudeAPI2026!@#
cascades.local GPO GUID CSC - Folder Redirection = {512B43A4-F049-4CE5-BFAC-860AD13E92BE}
ACCT2-PC Zachary.Nelson's machine — test folder redirection tonight
DESKTOP-H6QHRR7 lauren.hasselman — OneDrive KFM active, Howard moves data manually first

Pending / Next Steps

Item Priority Notes
Zachary folder redirection live test High Tonight on ACCT2-PC — gpupdate /force as zachary.nelson, verify \CS-SERVER\homes\zachary.nelson\ populated
Lauren Hasselman High Howard moves OneDrive data manually first, then add to SG-FolderRedirect
Entra Connect: add OU=Administrative to sync Medium Set cascadestucson.com UPN suffix first, align passwords, then delta sync
Phase 3 domain joins High DESKTOP-KQSL232 first; MDIRECTOR-PC blocked on Win10 Pro upgrade
Phase 3 GPO linking High After first successful domain join: Security Baseline, Drive Mappings, Printer Deployment, Windows Update
SG-Mgmt-RW / SG-Sales-RW / SG-Activities-RW Medium Populate before Drive Mappings GPO linked
krbtgt password rotation Medium 569+ days old
Remove Meredith.Kuhn + John.Trozzi from Domain Admins Low Deferred
Update Syncro ticket #110680053 Medium Log today's work
Reference in New Issue View Git Blame Copy Permalink