claudetools/clients/valleywide/session-logs/2026-06/2026-06-13-mike-vwp-gpo-disable.md

User

• User: Mike Swanson (mike)
• Machine: GURU-5070
• Role: admin

Session Summary

Disabled two RMM-agent deployment GPOs in the Valley Wide Plastering (VWP) Active Directory domain. The session began with a quick credential question (Gemini API key — none exists; the agy/Gemini CLI integration is keyless via Google OAuth), then moved to the primary task on the VWP domain controllers.

Loaded VWP context from wiki/clients/valleywide.md and the vault. Confirmed the live AD domain is VWP.US (NetBIOS VWP, PDC = VWP-DC1.VWP.US) — correcting the wiki's vwp.local reference, which is not the actual AD DNS root. Both DCs were reachable over the already-connected VPN: VWP_ADSRVR (192.168.0.25) and VWP-DC1 (172.16.9.2). Used VWP_ADSRVR as the entry point because it has working ed25519 SSH key auth for vwp\guru.

Enumerated all domain GPOs and located the target: a GPO named Syncro ({F6C27AA4-4A8B-4AA0-B5B9-B0DD47ECF6CA}), a machine-assigned software-installation policy that deploys the Syncro agent MSI, linked at the domain root (applies to all domain computers) and fully enabled. After confirming method with the user, disabled it (set GpoStatus to AllSettingsDisabled). The user then requested the same for the second RMM GPO — Datto RMM Agent install by immediate scheduled task ({9795454E-4C25-4B3F-8655-9DF5F46054FF}), also linked at the domain root — which was likewise disabled. Both are confirmed flags=3 on ADSRVR. This looks like a Syncro→Datto migration cleanup, but both deployment mechanisms were disabled per the user's instruction.

Key Decisions

• Disabled via LDAP Set-ADObject (flags=3) rather than Set-GPO/GPMC. Get-GPO/Set-GPO failed with 0x80072020 over SSH — the GPMC COM layer needs to bind to SYSVOL over SMB, and the key-based SSH logon has no delegatable credentials (classic double-hop). Pure-LDAP cmdlets (Get-ADDomain, Get-ADObject, Set-ADObject) work because they bind directly to the local DC. Setting the GPC flags attribute to 3 is exactly equivalent to Set-GPO -Status AllSettingsDisabled.
• Chose AllSettingsDisabled over unlinking. Disables the GPO wherever linked, is fully reversible (set flags back to 0), and is a single object change. Both GPOs are only linked at the domain root today, so the effect is identical to disabling the link.
• Left the GPOs linked and present (not deleted/unlinked). Reversible and non-destructive.
• Did not attempt to uninstall existing agents. Disabling a deployment GPO stops future installs/reinstalls but does not remove agents already present — flagged to the user as a separate task.

Problems Encountered

• Get-GPO -All → 0x80072020 (operations error) over SSH. Cause: GPMC COM double-hop (no delegatable creds on the SSH key logon). Resolution: enumerated GPOs and read/wrote status via LDAP cmdlets instead, and read GPO contents from the local SYSVOL path on the DC.
• Cross-DC verification via -Server VWP-DC1.VWP.US failed ("Unable to contact the server … AD Web Services"). Cause: ADWS on the remote DC not answering from the SSH session context (ADWS/double-hop). Not a write failure — the writes committed locally on ADSRVR and will replicate via normal AD replication. Verified flags=3 on ADSRVR for both GPOs.

Configuration Changes

AD directory changes on domain VWP.US (no repo files changed for the VWP work):

• GPO Syncro {F6C27AA4-4A8B-4AA0-B5B9-B0DD47ECF6CA}: flags 0 → 3 (AllSettingsDisabled).
• GPO Datto RMM Agent install by immediate scheduled task {9795454E-4C25-4B3F-8655-9DF5F46054FF}: flags 0 → 3 (AllSettingsDisabled).

Repo:

• Created this session log.

Credentials & Secrets

No new credentials discovered or created. Used existing vaulted access:

• clients/vwp/adsrvr — SSH key auth vwp\guru (ed25519); domain admin vwp\sysadmin.
• Gemini API key: confirmed none exists — agy/Gemini CLI is keyless (Google OAuth, ~/.gemini/oauth_creds.json).

Infrastructure & Servers

• AD domain: VWP.US (NetBIOS VWP). PDC emulator: VWP-DC1.VWP.US.
  • Note: wiki says vwp.local; the actual AD DNS root is VWP.US. SYSVOL path: C:\Windows\SYSVOL\sysvol\vwp.us\Policies\{GUID}.
• VWP_ADSRVR — 192.168.0.25, DC + SSH entry point, Server 2019. SSH ed25519 key auth for vwp\guru. Default shell cmd.exe — wrap with powershell -NoProfile -Command.
• VWP-DC1 — 172.16.9.2, PDC emulator, NPS/RADIUS, VWP-DC1.VWP.US.
• Both reachable over VPN this session.

Commands & Outputs

• Domain identity: Get-ADDomain → DNSRoot=VWP.US NetBIOS=VWP PDC=VWP-DC1.VWP.US.
• Enumerate GPOs (LDAP, avoids GPMC double-hop): Get-ADObject -Filter { objectClass -eq 'groupPolicyContainer' } -Properties displayName,gPCFileSysPath,flags
• Find links: Get-ADObject -LDAPFilter "(gPLink=*<guid>*)" -SearchBase <domainDN> → both target GPOs linked at DC=VWP,DC=US (domain root, ;0 = enabled, not enforced).
• Syncro GPO contents (local SYSVOL): Machine\Applications\{B2B45EC0-548F-4187-9065-E4575A652ACD}.aas → machine-assigned software installation (MSI deploy).
• Disable: Set-ADObject -Identity "CN={<guid>},CN=Policies,CN=System,DC=VWP,DC=US" -Replace @{flags=3} → verified flags=3 for both on ADSRVR.
• Get-GPO -All → 0x80072020 (double-hop; use LDAP path instead).

Pending / Incomplete Tasks

• Existing RMM agents not removed. Disabling the GPOs stops deployment/reinstall only. If the intent is full Syncro removal (and/or Datto), uninstall existing agents separately (managed uninstall, or removal via the RMM platform). Awaiting user direction.
• Wiki correction: update wiki/clients/valleywide.md to reflect the AD DNS root is VWP.US, not vwp.local (vwp.us is the live AD domain, not just an external FQDN domain).
• Replication spot-check: ADWS on VWP-DC1 not reachable from the SSH session; confirm the flags=3 change replicated to DC1 on a future visit if desired (normal replication expected).
• Next project (this session): Peaceful Spirit AD + DFS investigation and setup (started a few days ago) — resuming after this save.

Reference Information

• Syncro GPO GUID: {F6C27AA4-4A8B-4AA0-B5B9-B0DD47ECF6CA}
• Datto RMM GPO GUID: {9795454E-4C25-4B3F-8655-9DF5F46054FF}
• Other domain-root GPOs observed (untouched): Default Domain Policy {31B2F340-016D-11D2-945F-00C04FB984F9}, Enable SMB1 Client {22068DEC-5E9A-4539-B8C5-2C08F2DD9AE0}, MappedDrives {7D1AAC5B-2E39-4D6C-9248-AEC511E2A86D}, Default Domain Controllers Policy {6AC1786C-016F-11D2-945F-00C04FB984F9}.
• Vault: clients/vwp/adsrvr, clients/vwp/dc1.
• Wiki: wiki/clients/valleywide.md.