claudetools/clients/cascades-tucson/session-logs/2026-06/2026-06-26-howard-home-to-pro-upgrades-continued.md

User

• User: Howard Enos (howard)
• Machine: Howard-Home
• Role: tech

Session Summary

Continued the Cascades of Tucson Windows Home -> Pro upgrade workstream from 2026-06-25. Started with a fleet-aware audit: pulled the GuruRMM agent inventory and identified non-Pro (Windows Home) machines. Confirmed RMM's os_name field is trustworthy for edition (yesterday's three upgrades now report Pro/Pro for Workstations correctly, so it reads true edition, not the stale "Home" ProductName string). The remaining Cascades Home boxes were NurseAssist, SALES4-PC, DESKTOP-MD6UQI3, and CascadesProxess; NURSESTATION-PC (Business), ANN-PC (Enterprise), and CS-SERVER (Server 2019) are domain-join-capable and were not flagged.

Per Howard's direction, upgraded NurseAssist and DESKTOP-MD6UQI3 (excluding CascadesProxess as an appliance and SALES4-PC pending a who-pays decision). New requirement this session: send the logged-on user a reboot warning 2 minutes before the restart. Implemented as msg * /time:120 "..." plus shutdown /r /t 120 /f /c "..." (the shutdown countdown also shows a save-your-work message). Both machines followed the proven flow: silent changepk.exe /productkey <generic Pro key> edition flip (Core -> Professional, no auto-reboot as SYSTEM) -> warned reboot to reconcile registry+licensing -> slmgr /ipk <MAK> + /ato -> /dli verify. Both activated as Pro for Workstations (VOLUME_MAK, Licensed). NurseAssist had no active user; DESKTOP-MD6UQI3 had user "Dining Manager" active, so the 2-minute warning mattered there. NurseAssist needed an /ato retry; DESKTOP-MD6UQI3 activated first try (the 0xC004E028 on first /ato is benign "activation already in progress").

Confirmed NurseAssist is a distinct physical machine from Assistnurse-pc (one is Home, the other Pro for Workstations -- a single box cannot be both), resolving the earlier duplicate concern.

Ran a fleet-wide Home-edition audit at Howard's request: 26 Home installs across many clients, most likely intentional (non-domain small clients). Flagged AMT-PC (Arizona Medical Transit) on Windows 7 Home Premium as an EOL security risk separate from any Pro/Home upgrade. Howard scoped the rest of the work back to Cascades only.

Howard reported SALES4-PC was upgraded by the machine's supplier (an outside party that supplied it to Cascades), so it needs no action and no charge from us. He then asked to upgrade CascadesProxess; the pre-check confirmed it is the Proxess access-control server (ProxessIQ Server service running, console user "Unwired", EditionID=Core). Before dispatching changepk, Howard interrupted: CascadesProxess must be done late at night because it is still actively in use for the access-control hardware install. No disruptive action was taken on it -- only the read-only pre-check. CascadesProxess upgrade deferred.

Key Decisions

• Send a 2-minute reboot warning (msg + shutdown /t 120) to the logged-on user before each reboot (Howard's new requirement; mid-morning upgrades mean users are active).
• changepk runs silently as SYSTEM and does not disrupt the user, so it is dispatched first; the user-facing warning + reboot is the second step.
• Excluded CascadesProxess (appliance) and SALES4-PC (supplier-owned, who-pays pending) per Howard.
• Deferred CascadesProxess to a late-night window because it is in active use for the access-control hardware install; will verify ProxessIQ Server restarts after the reboot.
• Treated NurseAssist as a real distinct machine (different edition than Assistnurse-pc proves they are separate boxes) -> safe to upgrade.
• For non-Cascades Home machines: informational only; do not upgrade without a reason (domain join).

Problems Encountered

• Repeated the doubled-single-quote PowerShell registry-path bug AGAIN (day after logging it; cited feedback_windows_quote_stripping). Inside a single-quoted bash $SCRIPT, ''HKLM:...\Windows NT...'' collapses and the space in "Windows NT" breaks the read. Logged a second --friction entry noting the rule is not sticking; the durable fix is to always use double-quotes for paths inside the bash script (or build PS via heredoc), never doubled single-quotes.
• DESKTOP-MD6UQI3 was unresponsive to even trivial commands at session start (just came online, likely thrashing) -- commands sat "running" for 80+ seconds. Deferred it, proceeded with NurseAssist, then it recovered on its own a few minutes later and upgraded cleanly.
• Both NurseAssist and DESKTOP-MD6UQI3 briefly dropped offline right after changepk completed, so the warning+reboot command queued as "pending" and fired automatically on reconnect -- still correct, just required waiting for the reconnect before verifying.
• NurseAssist /ato first attempt left License Status: Notification; retry activated successfully (same transient pattern as MEMRECEPT yesterday).

Configuration Changes

• Appended: errorlog.md -- second bash/PowerShell quoting --friction entry (repeat).
• No repo doc edits this session (REMAINING-WORK-PLAN.md / billing memory updates from 2026-06-25 still current; SALES4-PC supplier-upgrade and CascadesProxess deferral noted here -- update the plan/memory next session when CascadesProxess is done).

Credentials & Secrets

• ACG Windows Pro (for Workstations) MAK: vault infrastructure/windows-pro-mak.sops.yaml, field credentials.product_key. Consumed 2 more counts this session (NurseAssist, DESKTOP-MD6UQI3). No new secrets. Generic public Pro key (not secret): VK7JG-NPHTM-C97JM-9MPGT-3V66T.

Infrastructure & Servers

• GuruRMM: http://172.16.3.30:3001. Cascades agent IDs used -- NurseAssist fc88f14b-06eb-47ac-b9e6-971c44d700ba, DESKTOP-MD6UQI3 99d7c8a7-8efb-4416-b9df-da22e0797aa0, CascadesProxess f41f02a8-6e80-4f8c-a427-0436decc3147 (deferred).
• CascadesProxess: Proxess access-control server; service "ProxessIQ Server"; console user "Unwired"; reboot briefly interrupts door-access management -- do late at night.

Commands & Outputs

• Edition flip (as SYSTEM, no auto-reboot): changepk.exe /productkey VK7JG-NPHTM-C97JM-9MPGT-3V66T -> Core -> Professional, exit 0.
• 2-min warning + reboot: msg * /time:120 "..." then shutdown /r /t 120 /f /c "...".
• Activate: slmgr /ipk <MAK> -> /ato (retry if License Status stays Notification / 0x8004FE92) -> /dli.
• Result both boxes: "Windows(R), ProfessionalWorkstation edition ... VOLUME_MAK ... License Status: Licensed".
• Trust EditionID (and RMM os_name) over ProductName for edition.

Pending / Incomplete Tasks

• CascadesProxess Home -> Pro upgrade: deferred to a late-night window (in use for access-control install). Flow ready; verify ProxessIQ Server restarts post-reboot. Will be +1 MAK count / $99 unless it self-activates via digital entitlement.
• Billing: NurseAssist + DESKTOP-MD6UQI3 = 2 x $99 = $198 to Cascades (not yet invoiced this session). Reuse Syncro product "Windows Pro Upgrade" (id 23571919); machine-named lines; optional labor.
• SALES4-PC: upgraded by supplier -- no ACG action, no charge.
• Then domain-join the now-Pro Cascades boxes per REMAINING-WORK-PLAN.md.

Reference Information

• Prior session log: clients/cascades-tucson/session-logs/2026-06/2026-06-25-howard-home-to-pro-upgrades.md
• Yesterday's billing: Syncro ticket #32466, invoice #1650806091; product "Windows Pro Upgrade" id 23571919.
• Generic Pro key: VK7JG-NPHTM-C97JM-9MPGT-3V66T (edition flip only, does not activate).
• Cascades non-Pro remaining: CascadesProxess (deferred). SALES4-PC done by supplier.