claudetools/session-logs/2026-06-13-mike-rmm-legacy-nativescm-and-smb1.md

Session 2026-06-13 — GuruRMM legacy native-SCM MSRV probe + SMB1 client enable

User

• User: Mike Swanson (mike)
• Machine: GURU-5070
• Role: admin

Summary

Two threads:

1. GuruRMM legacy 32-bit installer decision (due-today item). Investigated whether the legacy tier can adopt native SCM (the multi-AI recommendation in installer/legacy/README.md / SPEC-029 §12), which was documented as blocked on a Rust-1.77 / i686 MSRV check for the windows-service crate. Result: GREEN, end-to-end. The MSRV wall does not exist, and the legacy and native-service Cargo features are orthogonal (TLS gates on legacy alone).
2. SMB1 client enable on this Win11 box to reach 192.168.0.20 over the VWP VPN. Staged; reboot pending.

Thread 1 — GuruRMM legacy native-SCM (GREEN)

Findings

• Isolated MSRV probe (throwaway crate, windows-service = "0.7" + windows = "0.58" with the agent's exact feature set): compiles clean on Rust 1.77 -> i686-pc-windows-msvc. Run on Beast (guru@100.101.122.4). Resolved to 1.77-safe versions (windows-sys 0.52.0, windows-targets 0.52.6). GURU-5070 itself has NO MSVC build tools, so the probe was run on Beast.
• README premise was wrong on two counts: (a) the crates DO build on 1.77/i686; (b) the legacy rustls TLS-1.2 path gates on the legacy feature ONLY (agent/src/transport/tls.rs header says so) — NOT on the absence of native-service. So --features legacy,native-service gives both Win7 rustls TLS 1.2 AND native SCM. The legacy feature is purely additive (rustls/webpki/zeroize); zero overlap with native-service (agent/Cargo.toml).
• End-to-end build (the confirmation Mike approved): real agent crate, cargo +1.77 build --ignore-rust-version --release --no-default-features --features legacy,native-service --target i686-pc-windows-msvc, built in an isolated git worktree on Beast (C:\Temp\gururmm-nsvc, detached at fad54ed) with a separate target dir (C:\Temp\gururmm-nsvc-target), lock moved aside so 1.77 re-resolves scoped to the feature set (mirrors the pipeline's legacy wave). Full-graph lock resolution SUCCEEDED (the edition-2024 transitive-dep fear did not materialize). Built in 2m39s, exit 0, 17 warnings (incl. the already-tracked unused TrayLauncher::terminate_all).

Artifact

• Path (GURU-5070): C:\Users\guru\Downloads\gururmm-agent-legacy-nativeSCM-x86-0.6.66.exe
• SHA256: b0a25e17401c4c16a1334a65c75c6fde7a2ac26d1b60a8cfbca8d13b65e891d3
• Confirmed 32-bit PE (machine 0x014C), 5.29 MB. Unsigned (isolated build — not via pipeline).
• Compiled-in endpoints (production): wss://rmm-api.azcomputerguru.com/ws / https://rmm-api.azcomputerguru.com. Will enroll as a real device.

Enrollment gotcha (traced for the Valleywide test)

• Native install() (agent/src/service.rs:476) writes the input into agent.toml's api_key; it does NOT set registry SiteId. The runtime resolver resolve_windows_config() (agent/src/main.rs) only ENROLLS when HKLM\SOFTWARE\GuruRMM\SiteId is set (enrolls via /api/enroll with the site UUID; a friendly code 422s). With only a TOML api_key it uses the value verbatim and the server rejects a site code.
• Bulletproof test procedure (elevated):
  1. reg add HKLM\SOFTWARE\GuruRMM /v SiteId /t REG_SZ /d <VALLEYWIDE-SITE-UUID> /f (UUID, not code; FIRST)
  2. gururmm-agent-...exe install --api-key <UUID> --skip-legacy-check
  3. gururmm-agent-...exe start (service name GuruRMMAgent, install dir C:\Program Files\GuruRMM)
  • Verify: sc query GuruRMMAgent = RUNNING (real SCM, no NSSM); reg query HKLM\SOFTWARE\GuruRMM /v AgentKey appears within ~120s (enrolled over rustls TLS 1.2); device online in dashboard.
  • Teardown: gururmm-agent-...exe uninstall.

Beast cleanup pending

• Leftover on Beast: C:\Temp\gururmm-nsvc (git worktree — remove with git -C C:\gururmm worktree remove --force C:\Temp\gururmm-nsvc) and C:\Temp\gururmm-nsvc-target, C:\Temp\nsvc-build.bat, C:\Temp\nsvc-build.log. Left in place in case signing/rebuild needed.

Next

• Mike validates the binary on a Valleywide machine. On runtime-PASS, correct the SPEC-029 §12 / installer/legacy/README.md "blocked / ship NSIS+NSSM" note and pursue the unified x86-MSI + native-SCM direction (drops NSIS + NSSM). Optional: sign the test exe via sign-windows.sh.

Thread 2 — SMB1 client enable (GURU-5070, Win11)

• Goal: reach 192.168.0.20 over VWP VPN (Tailscale off). Both SMB ports reachable (TCP 445 + 139 open; ICMP blocked, normal). No per-connection SMB1 switch exists — must install the SMB1 client optional feature.
• Done: SMB1Protocol (parent) + SMB1Protocol-Client ENABLED; SMB1Protocol-Server left DISABLED (client-only). Payload was present (state was Disabled, not payload-removed).
• Reboot REQUIRED — mrxsmb10 driver registers only on restart. (This /scc ends with a reboot.)
• After reboot: reconnect VWP VPN; net use \\192.168.0.20\<share> ...; verify with Get-SmbConnection Dialect = 1.5.
• Caveat: EnableInsecureGuestLogons = False. If .20 is a guest/NAS share, also need Set-SmbClientConfiguration -EnableInsecureGuestLogons $true.
• REVERT when done (security): disable SMB1Protocol-Client + parent (+ insecure-guest if set), reboot to unload driver. SMB1 = EternalBlue-class exposure; do not leave on.

Pending tasks

• Mike: validate native-SCM legacy agent on a Valleywide machine (artifact + procedure above).
• On PASS: correct SPEC-029 §12 / legacy README; pursue unified x86-MSI + native-SCM.
• Clean up Beast C:\Temp\gururmm-nsvc* worktree/target/bat/log.
• After SMB1 task: revert SMB1 client enable on GURU-5070 + reboot.
• Other due-today item still open: SPEC-030 Phase 1 (failed-install visibility) — not started.