claudetools/clients/cascades-tucson/session-logs/2026-07/2026-07-02-howard-shelby-webdocs-share.md

Cascades - Shelby Trozzi "Company Web Docs" share + mapped drive

User

• User: Howard Enos (howard)
• Machine: Howard-Home
• Role: tech

Session Summary

Set up file-share access for Shelby Trozzi (MemCare Director) to the "Company Web Docs" folder on CS-SERVER (Cascades DC). The request was to make D:\Shares\Public\Company Web Docs an SMB share and grant Shelby access so the share could then be mapped as a drive on her workstation (MDIRECTOR-PC).

Work proceeded via GuruRMM against CS-SERVER (agent resolved live by hostname). A read-only discovery pass confirmed the folder existed (NTFS = inherited Everyone:FullControl), that it was NOT currently shared (no SMB share pointed at it or at Public), and that Shelby already had a domain account (CASCADES\Shelby.Trozzi, enabled). Howard chose the share name Company Web Docs (with spaces) and Read/Write (Change) access. Created the SMB share with New-SmbShare granting CASCADES\Shelby.Trozzi Change and BUILTIN\Administrators Full — the share ACL is the effective gate (NTFS left as inherited Everyone:Full), so Shelby's effective access is Change.

Discovered Shelby had never logged into her domain account (logonCount = 0, lastLogon = never) and there was no vaulted password for her. Confirmed her account is in OU=Care-Memorycare,OU=Departments with no ConsistencyGuid = NOT Entra-synced, so an on-prem password reset was safe (would not affect any M365 sign-in). Reset her password (first attempt Shelby1173! was rejected by AD complexity for containing her name; used Cascades1173! at Howard's direction to keep the 1173! pattern), set never-expires / no change-at-logon, and vaulted it at clients/cascades-tucson/shelby-trozzi.sops.yaml.

Attempted to push the drive map to MDIRECTOR-PC (Win Home, not domain-joined) via RMM user_session context. The map failed with System error 67 (and net view with 1702) even with explicit credentials — the RMM agent's impersonated token has no network credential to reach CS-SERVER (double-hop; the documented "SMB error 67 RMM artifact"). Worked around it by storing the credential via cmdkey and planting a persistent map in her hive at HKCU:\Network\W, which reconnects at her next interactive logon. Howard then mapped the drive himself in Shelby's live session (ScreenConnect), confirming it mounted cleanly. Task complete.

Key Decisions

• Share name Company Web Docs (with spaces), Change access — Howard's explicit choice via AskUserQuestion (offered WebDocs/CompanyWebDocs/exact-name and Read vs Read/Write).
• Gate at the share ACL, leave NTFS untouched — folder already inherits Everyone:FullControl from Public; the new share is the only network path to it, so granting only Shelby + Admins at the share level limits access without disturbing the Public NTFS tree. Effective = Change.
• On-prem password reset deemed safe — verified not Entra-synced (no ConsistencyGuid, OU not in sync scope), so reset does not ripple to M365.
• Password Cascades1173! — Shelby1173! blocked by AD complexity (contains user name); kept the 1173! numbers per Howard, swapped name part for Cascades.
• Planted HKCU map + cmdkey instead of live net use — RMM cannot drive an outbound authenticated mount from the impersonated session; the registry/cmdkey approach mounts at next logon. Immediate visibility left to interactive session (Howard did it).

Problems Encountered

• RMM dispatch JSON malformed (hand-escaped nested quotes) → jq parse error on response. Fix: build payload with jq -n --arg per the /rmm skill. Logged --friction.
• PowerShell parse errors from backslash-before-closing-quote ("W:\", "W:\\") broke two dispatches (compile error = nothing ran). Fix: bare path tokens (Test-Path W:\) or single quotes. Logged --friction.
• AD password complexity rejection — Shelby1173! contained her name; AD blocks names in passwords regardless of length/symbols. Resolved with Cascades1173!.
• SMB error 67 / RPC 1702 on the map — RMM user_session impersonation double-hop; cannot make outbound authenticated SMB to CS-SERVER. Resolved via cmdkey + HKCU:\Network\W (mounts at logon), then Howard mapped it interactively. Logged --friction with ref to wiki SMB-error-67 note.
• Used raw Set-ADAccountPassword instead of GuruRMM User Manager — memory reference_gururmm_user_manager says use the built-in User Manager for domain password resets. Result correct, not redone; logged --correction.
• Vault push rejected (non-fast-forward) — remote had newer auto-sync commits; resolved with git pull --rebase then push.

Configuration Changes

Created:

• CS-SERVER SMB share Company Web Docs -> D:\Shares\Public\Company Web Docs (ACL: CASCADES\Shelby.Trozzi Change, BUILTIN\Administrators Full).
• D:/vault clients/cascades-tucson/shelby-trozzi.sops.yaml (encrypted, committed + pushed).
• .claude/memory/reference_rmm_map_network_drive.md + MEMORY.md index line.
• MDIRECTOR-PC: HKCU:\Network\W persistent map keys (RemotePath/UserName/ProviderType 131072/ ConnectionType 1/DeferFlags 4) + stored credential via cmdkey /add:CS-SERVER.

Modified on CS-SERVER:

• CASCADES\Shelby.Trozzi password reset; PasswordNeverExpires True; ChangePasswordAtLogon False.

Repo:

• errorlog.md — 2 friction + 1 correction entries (via log-skill-error.sh).
• .claude/current-mode -> clients/cascades-tucson.

Credentials & Secrets

• CASCADES\Shelby.Trozzi — domain login. Password: Cascades1173! (set 2026-07-02). UPN Shelby.Trozzi@cascadestucson.com. Never-expires, no change-at-logon. NOT Entra-synced (on-prem/SMB only, not M365). Vaulted: clients/cascades-tucson/shelby-trozzi.sops.yaml.

Infrastructure & Servers

• CS-SERVER — Cascades DC (cascades.local). GuruRMM agent id c39f1de7-d5b6-45ae-b132-e06977ab1713 (re-enrolls; resolve live). Reachable on 445 from MDIRECTOR-PC.
• MDIRECTOR-PC — Shelby's workstation, Windows Home, NOT domain-joined. GuruRMM agent id 6b7990aa-edad-41c7-8f2d-5efdcaa41046. Local user mdirector-pc\shelby trozzi (logged in since 6/29/2026). Only C: drive prior to map; W: now mapped.
• New share UNC: \\CS-SERVER\Company Web Docs.
• GuruRMM API: http://172.16.3.30:3001 (creds vault infrastructure/gururmm-server.sops.yaml).

Commands & Outputs

• New-SmbShare -Name "Company Web Docs" -Path "D:\Shares\Public\Company Web Docs" -FullAccess "BUILTIN\Administrators" -ChangeAccess "CASCADES\Shelby.Trozzi" -> created; ACL verified.
• Set-ADAccountPassword -Identity Shelby.Trozzi -Reset ... — first attempt ADPasswordComplexityException (1325) on Shelby1173!; succeeded with Cascades1173! (PasswordLastSet 7/2/2026).
• Map attempt in user_session: net use W: \\CS-SERVER\Company Web Docs -> System error 67; net view \\CS-SERVER -> System error 1702 (binding handle is invalid); Test-Path UNC -> False.
• Fix: cmdkey /add:CS-SERVER /user:CASCADES\Shelby.Trozzi /pass:... -> "added successfully"; HKCU:\Network\W keys written; cmdkey /list:CS-SERVER confirms stored Domain Password cred.
• Howard mapped W: himself interactively afterward — mounted cleanly.

Pending / Incomplete Tasks

• None. Share live, access granted, password vaulted, drive mapped and confirmed by Howard.
• Future: additional users needing this share -> grant via Grant-SmbShareAccess -Name "Company Web Docs".
• Standing follow-up (unchanged): MDIRECTOR-PC is Win Home; domain join still blocked until Pro.

Reference Information

• Vault: clients/cascades-tucson/shelby-trozzi.sops.yaml
• Memory: .claude/memory/reference_rmm_map_network_drive.md
• Wiki: wiki/clients/cascades-tucson.md (SMB-error-67 RMM-artifact note; Access section)
• #dev-alerts message ids: 1522266883636854804 (share), 1522269030394626152 (pw reset), 1522270727368343682 (drive map).
• RMM command ids: share df903ca8, pw reset 86ef25a6, map plant dec3d11c.