135 lines
10 KiB
Markdown
135 lines
10 KiB
Markdown
# 2026-06-12 — Jim Parkinson mail migration (Neptune -> lamaddux M365) + RMM log triage + IX API token
|
|
|
|
## User
|
|
- **User:** Mike Swanson (mike)
|
|
- **Machine:** GURU-5070
|
|
- **Role:** admin
|
|
|
|
## Summary
|
|
Multi-thread session. Headline: migrated **Jim Parkinson** (`jparkinsonaz.com`, mail on on-prem
|
|
Neptune Exchange) into **LeeAnn Maddux's** existing **lamaddux.com** M365 tenant to fix shared-calendar
|
|
sync issues (Syncro #32411). Also: triaged a stale GuruRMM AI log-analysis report (filed 2 root-caused
|
|
bugs + a signal-design refinement), recovered the lost IX WHM API access method (now a vaulted full-access
|
|
token), restored the "vault every credential" CORE rule, and handled a Bardach M365 sign-in error.
|
|
|
|
## Threads
|
|
|
|
### 1. Bardach (barbara@bardach.net) — AADSTS165000 on iPhone
|
|
Client-side session-cookie failure (Missing session context cookie). NOT password/MFA/Smart-Lockout, and
|
|
NOT caused by our 2026-06-05 Security Defaults change (she passed password + Authenticator). Gave iPhone
|
|
fix steps (full Safari not in-app webview, allow cookies, clear site data, fresh single-pass sign-in,
|
|
auto date/time). Offered Entra sign-in-log lookup for Correlation Id `71fa2d99-2607-4cfc-a032-da30b925d04d`.
|
|
Tenant: bardach.net `dd4a82e8-85a3-44ac-8800-07945ab4d95f`.
|
|
|
|
### 2. GuruRMM log-analysis triage (stale report reconciliation)
|
|
Report came from GuruRMM's own `/api/logs/analyze` (cut over to Claude Haiku today). Reconciled vs live logs:
|
|
- **Ollama unreachable** = HEALED (cutover; last stray 13:27 pre-deploy).
|
|
- "1,100+ WS errors" = real (~1504/24h) but benign reconnect churn + deploy restart-storms; fleet reconnecting.
|
|
- Auth timeouts 7/24h = benign.
|
|
- **2 real bugs filed** in `projects/msp-tools/guru-rmm/docs/RMM_THOUGHTS.md` (submodule, pushed `8d5bb9d`):
|
|
1. Hardware inventory NUL -> Postgres jsonb reject (7 Windows agents: IMC1, Seth-PC, QWM-JOHN, QWM-SHEILA,
|
|
goldstar19, SIF-SERVER, Christine-Win10). Fix: strip NUL before jsonb insert in `upsert_agent_hardware`.
|
|
2. Update scanner execs non-.exe binaries for `--version`; macOS Mach-O can't run on the Linux server ->
|
|
`continue`-skipped -> macOS/Linux agents never offered updates. Fix: trust filename version for non-Windows.
|
|
3. Feature 4a refinement: alert on STATE (offline-past-budget / flapping / mass-drop) not the disconnect
|
|
event; reclassify "connection reset without closing handshake" ERROR->INFO (ships standalone).
|
|
|
|
### 3. IX WHM API access recovered (the ~1h time-sink)
|
|
Password+legacy `json-api` basic-auth to `ix.azcomputerguru.com:2087` now returns **403 pre-auth** (not
|
|
cpHulk/Imunify IP block — WHM login page 200s; bad creds also 403). Mike created a **full-access root WHM
|
|
API token "ClaudeTools"**. Correct method: header `Authorization: whm root:<token>`, force `curl -4`.
|
|
Stored at vault `infrastructure/ix-server` `credentials.whm-api-token` + documented in entry notes.
|
|
Restored CORE rule in `.claude/CLAUDE.md` ("vault + document EVERY in-session credential, via the vault
|
|
skill"); added memories `ix-whm-dns-api-access` + `feedback-vault-every-credential`.
|
|
|
|
### 4. Leeann Maddux RMM onboarding
|
|
New RMM client **Leeann Maddux** + site **Home** (`DARK-OCEAN-9950`, site_id `7357db16-114c-4404-92be-4a587056d9e5`,
|
|
client_id `bd8c4027-7cbe-41c0-bc2c-c8e6c4846b62`). Enrollment key vaulted `clients/lamaddux/gururmm-site-home.sops.yaml`.
|
|
Jim's 2 machines enrolled: **DESKTOP-EDN9UDO** (`2b24e8de-a774-4277-bad3-689c00f9eacc`) + **DESKTOP-M0GBKF3**
|
|
(`4fdecea6-19d9-4dd0-bf6c-f2b1ab6c6c28`). (jpark = logged-in user on M0G, SID ...-1014.)
|
|
|
|
### 5. Jim Parkinson mail migration (the main work)
|
|
- **Tenant lamaddux.com** `2f0c4c92-c608-4ee0-bdc2-87d5fd8fe929` (LeeAnn Maddux) onboarded via single-consent
|
|
(`onboard365`); all apps + roles provisioned (recorded YES in remediation-tool `tenants.md`).
|
|
- Added + verified custom domain `jparkinsonaz.com` (TXT `MS=ms74863246`); Mike added the domain in portal
|
|
(our Tenant Admin app lacks `Domain.ReadWrite.All` — flagged as future automation item).
|
|
- Created **jim@jparkinsonaz.com** (obj `387dc966-fd91-4512-9b0f-d80b125769f4`) + **Exchange Online Plan 1**
|
|
(skuId `4b9405b0-7788-4568-add1-99614e613b69`; Mike bought the 2nd license). Mailbox provisioned, primary
|
|
SMTP matches source.
|
|
- **DNS cutover** on IX (token) to O365 + zone cleanup: MX `jparkinsonaz-com.mail.protection.outlook.com`,
|
|
SPF `v=spf1 include:spf.protection.outlook.com -all`, autodiscover CNAME -> `autodiscover.outlook.com`,
|
|
**DKIM** selector1/selector2 CNAMEs -> `selector{1,2}-jparkinsonaz-com._domainkey.lamaddux.a-v1.dkim.mail.microsoft`
|
|
(new MS format, resolves to live keys). Removed: **root A** (was -> Neptune 67.206.163.124), `mail` CNAME,
|
|
4x CalDAV/CardDAV SRV + path TXTs, cPanel `_cpanel-dcv-test-record` + `_acme-challenge`.
|
|
- **PST export** off Neptune: `New-MailboxExportRequest` -> `\\NEPTUNE\PSTExport$\jim-jparkinsonaz.pst`,
|
|
Completed 100%, 1.776 GB, 8316 items. Mike to copy + Outlook-import himself.
|
|
- **Outlook autodiscover fix (Exclude365):** ran undo of `C:\Users\guru\ownCloud\Toolbox\!-Utils\RegistryFixes\Exclude365-Final.reg`
|
|
on both machines (removed exclusions + acghosting RedirectServers pins, HKLM policy + user hives incl offline).
|
|
Fresh profile still hit mail.acghosting.com because **root A pointed to Neptune** -> root-domain autodiscover
|
|
probe answered on-prem. Set `ExcludeHttpsRootDomain=1` on both machines (interim), then **removed the root A
|
|
record** (permanent global fix -> root probe NXDOMAIN -> falls through to autodiscover CNAME -> O365).
|
|
- Set password + MFA: see Credentials.
|
|
|
|
### 6. Syncro #32411 (id 112542872, LeeAnn Parkinson, customer 139908)
|
|
PUT status -> In Progress, problem_type -> Server Migration; posted customer-visible (no-email) note scoping
|
|
it to a mail migration to resolve calendar sync. Comment id 418758100.
|
|
|
|
## Credentials (unredacted — private repo)
|
|
- **jim@jparkinsonaz.com** / `jP48504850$` (permanent, no force-change). MFA mobile **+1 520-349-2222**.
|
|
Vaulted `clients/lamaddux/jim-parkinson-m365.sops.yaml`.
|
|
- **IX WHM API token "ClaudeTools"** (FULL-ACCESS ROOT): `HAUGCPQGJGDK3YDAMVA0B4ELR9CVNAQ6`.
|
|
Vaulted `infrastructure/ix-server` `credentials.whm-api-token`. Use: header `Authorization: whm root:<token>`,
|
|
`curl -4`. Password basic-auth on json-api now 403s.
|
|
- Leeann Maddux RMM site key: vaulted `clients/lamaddux/gururmm-site-home.sops.yaml`.
|
|
|
|
## Infrastructure
|
|
- IX: `ix.azcomputerguru.com` = 72.194.62.5 (WHM:2087). Public NS `ns1/ns2.acghosting.com` = 52.52.94.202
|
|
(cluster; edits auto-sync). Neptune external 67.206.163.124 / 172.16.3.11 (mail.acghosting.com, Exchange 2016).
|
|
- RMM API `http://172.16.3.30:3001`. (Brief `.30` outage mid-session — networking, Mike fixed.)
|
|
- Imunify360 (cpHulk disabled) gated WHM; whitelisted our IPv4 98.97.118.217 + IPv6 2605:59c0:43a6:9710::/64.
|
|
|
|
### 7. Continued (post-/scc): autodiscover, DNS cleanup, DKIM, sharing, calendar, contacts
|
|
- **IX WHM API token** recovered the lost access (see thread 3): full-access root token "ClaudeTools"
|
|
`HAUGCPQGJGDK3YDAMVA0B4ELR9CVNAQ6` vaulted `infrastructure/ix-server` `credentials.whm-api-token`;
|
|
header auth `Authorization: whm root:<token>`, `curl -4`. Used the ACG **ComputerGuru-Management** app
|
|
(`0df4e185...`, tenant ce61461e, Application.ReadWrite.All, vault `msp-tools/computerguru-management`) to
|
|
patch app registrations. **Claude-MSP-Access secret is INVALID** (AADSTS7000215) — rotate.
|
|
- **Outlook autodiscover fix** on Jim's 2 machines (DESKTOP-EDN9UDO `2b24e8de`, DESKTOP-M0GBKF3 `4fdecea6`):
|
|
undid `C:\Users\guru\ownCloud\Toolbox\!-Utils\RegistryFixes\Exclude365-Final.reg` (HKLM policy + user hives);
|
|
set `ExcludeHttpsRootDomain=1`; ROOT CAUSE = `jparkinsonaz.com` root A pointed to Neptune so the root-domain
|
|
autodiscover probe answered on-prem. **Removed root A + all cPanel junk** (mail CNAME, CalDAV/CardDAV SRV,
|
|
DCV/ACME) -> zone is O365-only -> permanent global fix. **DKIM** selector1/selector2 CNAMEs published
|
|
(`...lamaddux.a-v1.dkim.mail.microsoft`, new MS format, resolves to live keys) — Mike to flip "Enable" in Defender.
|
|
- **Mailbox sharing:** `jim@` granted **FullAccess (AutoMapping on) + Send-on-Behalf** on `leeann@lamaddux.com` (EXO adminapi).
|
|
- **Calendar reconciliation:** found Jim's events inviting LeeAnn that weren't on her calendar; only **8** genuine
|
|
(Jim-organized one-off appts, mostly medical) — created them on her calendar (48 others were her own recurring/
|
|
birthday noise, left alone). Enabler: added `Calendars.ReadWrite`+`Contacts.ReadWrite` (Graph) to the **Exchange
|
|
Operator** app (objId `bae27250...`), consented in lamaddux, **scoped via ApplicationAccessPolicy RestrictAccess**
|
|
to mail-enabled group `app-calscope@lamaddux.onmicrosoft.com` (jim@+leeann@ only). Used a Graph-scoped token for
|
|
the Exchange Operator app (its client_secret). Forward route failed (needs Mail.Send) -> direct-create instead.
|
|
- **Contacts:** Jim's 355 contacts clean of X500/on-prem; created `LeeAnn Maddux <leeann@lamaddux.com>`, removed
|
|
junk "Audible Leeann@lamaddux.com". Autocomplete cache may still hold legacy X500 for LeeAnn (clear in Outlook).
|
|
|
|
### 8. Wolkin — Julie Guda MFA/profile (tenant rswolkin.com `ceb6dbe7-82c8-4d8f-9c6b-49aa26208e9b`)
|
|
Removed Julie Guda (`julie@rswolkin.com`, id `acaeb49c...`) cell `702-624-3765` from directory `mobilePhone`
|
|
(was GAL-visible); retained ONLY as MFA phone method `+1 7026243765`. Sign-in unaffected (password + Windows Hello too).
|
|
|
|
### 9. Syncro #32411 billed
|
|
2.0h remote (`1190473` @ $150) = **$300**, invoice `1650664905`, ticket -> Invoiced. Customer LeeAnn Parkinson (139908,
|
|
not prepaid). Resolution comment on-ticket, no customer email.
|
|
|
|
### Wiki updated this session
|
|
- CREATED `wiki/clients/lamaddux.md` (household client + full migration).
|
|
- UPDATED `wiki/clients/wolkin.md` (Julie MFA/profile note).
|
|
- UPDATED `wiki/systems/ix-server.md` (WHM API token access + Imunify + jparkinsonaz O365 zone).
|
|
|
|
## Pending / next
|
|
1. Mike: copy PST + Outlook-import on M0G/EDN9; confirm Outlook connects to **Microsoft**; clear Jim's autocomplete (legacy X500 for LeeAnn).
|
|
2. Mike: **Enable DKIM signing** for jparkinsonaz.com in Defender (CNAMEs live).
|
|
3. After import confirmed: **final delta export + decommission `jparkinsonaz.com` on Neptune**; then **close #32411**.
|
|
Optional: remove stale `s1`/`default` DKIM TXT; remove now-redundant `ExcludeHttpsRootDomain` reg value.
|
|
4. Rotate the invalid **Claude-MSP-Access** app secret (vault `msp-tools/claude-msp-access-graph-api`).
|
|
5. GuruRMM: 2 bugs + Feature 4a filed (ROOT-CAUSED) — await build decision.
|
|
6. Future: add `Domain.ReadWrite.All` to Tenant Admin app to automate domain-adds.
|
|
7. Bardach: Barbara to retry per iPhone steps; sign-in-log lookup on standby.
|