Blaster2 — Onboarding Remediation (2026-06-19)

Client: Jimmy Company (jimmy) · Site: Main (SILVER-LION-5647) Machine: BLASTER2 — Windows 10 Pro 22H2 (build 19045), Lenovo, i5-3470 / 3.8 GB RAM RMM agent: abddc0ce-a226-48f1-b913-263a81013389 (v0.6.66) Tech: Mike Swanson · Onboarding grade: RED (baseline: onboarding-baselines/BLASTER2-20260619T191759.md)

Actions completed

Security

RDP NLA enabled — set UserAuthentication=1 on RDP-Tcp. RDP was on with NLA off (pre-auth exposure, critical). RDP left enabled, now requires Network Level Authentication.
Kaseya leftover removed — deleted service KaseyaConnectAPIService (kav2srv.exe), install dir C:\Program Files (x86)\Kaseya\ECGRP939762241516006, and registry hives HKLM\SOFTWARE\Kaseya + HKLM\SOFTWARE\WOW6432Node\Kaseya\Agent. Post-removal sweep clean: no services, no dir, no scheduled tasks, no other references. (Leftover foreign-RMM agent from a prior provider — control/security risk.)

Cleanup / health scan

Machine is clean. C: = 159 GB used / 70.8 GB free. Temp/junk negligible (Windows Temp 0.05 GB, user temps 0.12 GB, SoftwareDistribution/Recycle Bin ~0; no Windows.old / hiberfil / MEMORY.dmp). No real bloatware among 80 installed programs — only a dead "Google Toolbar for Internet Explorer" (left in place; removable on request).

Backup (MSP360 / mspbackups)

Root problem: external backup drive E: full — 7.45 TB, 0.74 GB free. Two local MSP360 plans failing with NotEnoughSpaceOnLocalDestination (image-based + file). The cloud (Backblaze B2) plan is healthy.
90-day retention applied to both local plans (cbb editBackupPlan / editBackupIBBPlan -purge "3m"; plans are new-backup-format). Confirmed "Retention time is set to 90 days."
Space NOT yet reclaimed — blocked by provider policy. Agent-side deletion (cbb delete) is refused: "File deletion on backup storage is restricted due to your service provider policy." The MBS REST API is monitoring-only. The full disk also deadlocks the automatic retention purge (no successful pass can run). Reclamation must be done provider-side in the MSP360 management console.

E: storage breakdown (6.7 TB MSP360 + 0.7 TB legacy + 0.7 TB non-MSP360)

Active NBF generations: image aae0be51 3.24 TB, file 5277ed3c 2.48 TB (history back to 2024).
Orphaned legacy bunches (pre-2024, no plan, dead weight): "Image Based" 793 GB (last 2022-07-24), "C:" folder 216 GB.
Non-MSP360 squatters on E:: VeeamBackup 543 GB, "My backups" 98 GB, FileHistory 81 GB.

Console purge worklist (handed to Mike, cutoff 2026-03-21 = 90 days)

Lift the MSP360 "restrict backup deletion" provider policy (or delete from the console Storage view).
Image plan: keep restore points 2026-06-07 / 05-04 / 04-06; delete 2026-03-01 and older (~20).
File plan: keep 2026-03-23 onward; delete 2026-03-17 and older (~65).
Delete the 2 orphaned legacy bunches ("Image Based" 793 GB, "C:" 216 GB).
Optional (Explorer, not MSP360, only if abandoned): E:\VeeamBackup, E:\My backups, E:\FileHistory (722 GB).
After space frees, the 90-day retention keeps both plans bounded — re-run both Local plans to confirm Success.

Still open (not addressed today)

Win10 22H2 is EOL (end-of-servicing 2025-10-14) on weak 2012-era hardware (i5-3470, 3.8 GB RAM, 2013 BIOS) — realistically a machine replacement, not in-place upgrade.
5 pending Windows updates + pending reboot; 2 unexpected shutdowns (event 41) in 14 days.
BitLocker status unavailable (likely unencrypted — verify), firewall-profile + SMART checks returned "unknown" in the diagnostic (manual follow-up).

References

RMM write ops alerted to #dev-alerts. Provider-policy delete blocker logged to errorlog.md.
Vault: clients/jimmy/gururmm-site-main.sops.yaml (enrollment key); MSP360 API msp-tools/msp360-api.sops.yaml.

3.9 KiB Raw Blame History