azcomputerguru/claudetools
1
0
Fork 0
Code Issues 58 Pull Requests Actions Packages Projects Releases Wiki Activity
Files
eb04287396080805135768bb508f7b00fd65f40c
claudetools/clients/four-paws/session-logs/2026-07/2026-07-08-howard-avimark-localadmin-rmm-enrollment.md
Howard Enos fa97bcc49b sync: auto-sync from HOWARD-HOME at 2026-07-08 13:01:22 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-08 13:01:22
2026-07-08 13:01:51 -07:00

8.8 KiB
Raw Blame History

User

  • User: Howard Enos (howard)
  • Machine: Howard-Home
  • Role: tech

Session Summary

Started with a Syncro billing task: Four Paws (vet clinic, customer id 33050383) had a missing Avimark desktop shortcut. The Avimark install was located at C:\avimark and a new desktop shortcut was created. Created ticket #32508 and invoice #67993 (0.5h remote labor, $75.00) via the /syncro skill.

The user then provided full inventory detail for the Four Paws "Server" machine, including the localadmin credential (r3tr0gradE99#, auto-login). A vault entry (clients/four-paws/localadmin) already existed with a matching password (set up by Mike 2026-06-23); it was enriched with host-identification details (model, serial, IPs, MAC, Syncro id) and the auto-login status.

The user requested removing the localadmin password (blank) while keeping it as the default/auto-login account. Before changing, a read-only recon confirmed nothing depended on localadmin for shares — the AVImark share (\\SERVER\AVImark) is served to the staff and avimark local accounts via workgroup pass-through, and no workstation had mapped drives or stored cmdkey credentials referencing localadmin. The password was blanked (net user Localadmin ""), set to never-expire, and Winlogon auto-login re-armed with a blank DefaultPassword. LimitBlankPasswordUse=1 was left at its secure default.

A reboot to verify auto-login revealed the blank password BROKE auto-login — Windows 11 AutoAdminLogon does not proceed with an empty DefaultPassword; the server stalled at the logon screen (no console session after ~4 min uptime). Per the user's decision, the original password r3tr0gradE99# was restored and stored for auto-login, then reboot-tested: auto-login confirmed working (localadmin on console, explorer + WMI console owner = SERVER\Localadmin). All three RMM-enrolled machines (SERVER, STATION2, DESKTOP-3T5P291) were rebooted per the user request.

Finally, the user asked why machines were missing from GuruRMM and to add them. A network sweep from SERVER identified 4PAWS-DOC (192.168.0.148, Dell Vostro 3910) as an unmanaged Windows workstation and FOVEADR-DR5258X (192.168.0.248) as a vet radiography imaging appliance. 4PAWS-DOC was in ScreenConnect, so the GuruRMM agent was deployed via SC send-command. The first attempt failed because the box was thread-exhausted (0x800700a4 No more threads can be created); a reboot cleared it and the re-run enrolled 4PAWS-DOC successfully (agent id 79d5243b). An onboarding diagnostic was run on 4PAWS-DOC (Grade AMBER, 0 critical / 3 warning).

Key Decisions

  • Blanked localadmin password only after read-only recon proved shares use the staff/avimark accounts, not localadmin — so blanking could not break file sharing (LimitBlankPasswordUse=1 confines a blank-password account to console-only anyway).
  • Restored the localadmin password after empirically proving blank-password + AutoAdminLogon is impossible on this Windows 11 build. Chose the original r3tr0gradE99# (known-good, already documented) to return to a proven state. Auto-login = "no password needed to log in" in practice, which was the user's underlying goal.
  • Did NOT enroll FOVEADR-DR5258X (Fovea DR X-ray imaging appliance) — RMM agents should not be dropped on vet imaging equipment without vendor confirmation; also not in ScreenConnect.
  • Deployed the GuruRMM agent to 4PAWS-DOC via ScreenConnect send-command (site one-liner) rather than RMM push, because the box had no existing agent.
  • Rebooted 4PAWS-DOC to clear thread exhaustion rather than retrying the enroll command (command delivery was fine; the machine was degraded).

Problems Encountered

  • Blank-password auto-login failure: After blanking localadmin's password, the server stalled at the logon screen on reboot. Root cause: Win11 AutoAdminLogon will not proceed with an empty DefaultPassword. Resolved by restoring the password and re-storing it for auto-login; reboot-verified.
  • 4PAWS-DOC enroll failure (0x800700a4): GuruRMM install one-liner died at Get-CimInstance Win32_Processor with "No more threads can be created in the system" (ERROR_MAX_THRDS_REACHED). The box was resource-exhausted from long uptime. Resolved by rebooting the machine (down ~6 min, applied pending updates) and re-running the enroll — succeeded. Logged to errorlog.md.
  • iconv missing on Howard-Home: ps-encoded.sh rmm failed (iconv: command not found). Worked around by encoding the PowerShell script to UTF-16LE base64 with py and dispatching powershell.exe -EncodedCommand <b64> directly.

Configuration Changes

  • Four Paws SERVER (192.168.0.5): localadmin password blanked then restored to r3tr0gradE99#; set PasswordNeverExpires; Winlogon auto-login re-armed (AutoAdminLogon=1, DefaultUserName=Localadmin, DefaultDomainName=SERVER, DefaultPassword=r3tr0gradE99#). Net state = unchanged from pre-session (password restored). Rebooted.
  • STATION2, DESKTOP-3T5P291: rebooted (no config change).
  • 4PAWS-DOC (192.168.0.148): GuruRMM agent installed + enrolled (Four Paws / Main); rebooted once to clear thread exhaustion.
  • Vault clients/four-paws/localadmin.sops.yaml: enriched with host details; password field cycled blank -> restored to r3tr0gradE99#; auth_note documents the blank-password/autologon incompatibility.
  • New file: clients/four-paws/onboarding-baselines/4PAWS-DOC-20260708T193830.{json,md} (diagnostic baseline).

Credentials & Secrets

  • Four Paws SERVER localadmin: username Localadmin, password r3tr0gradE99# (restored; auto-login account). Vault: clients/four-paws/localadmin.
  • Four Paws staff workgroup account: username staff, password avimark! (intra-machine SMB/printer auth; also a local admin on 4PAWS-DOC). Vault: clients/four-paws/staff-workgroup.
  • No new credentials created this session.

Infrastructure & Servers

  • Four Paws LAN (192.168.0.0/24), workgroup (no domain), gateway .1
  • SERVER — 192.168.0.5, Dell OptiPlex 5060, serial 32XGBZ2, Win11 Pro 26200, MAC E4:54:E8:6A:98:04. Runs AVImarkServer service (Automatic, Session 0) + \\SERVER\AVImark share (C:\AVImark). Auto-logs in as Localadmin. RMM agent ccb55043-b310-47df-afe3-2671c8ff113c.
  • STATION2 — 192.168.0.87, MAC E4-54-E8-6B-0A-11. RMM agent 75350628-bd5d-4d92-af35-51148fc98a62.
  • DESKTOP-3T5P291 — 192.168.0.112 (+.250), MAC 20-88-10-96-1B-6C. RMM agent 97bccd08-b33d-4090-9318-53111c475891.
  • 4PAWS-DOC — 192.168.0.148, Dell Vostro 3910, serial FDQ5Y04, i5-12400/16GB, Win11 Pro 25H2 (26200), MAC 20-88-10-8E-C7-FA. NEW RMM agent 79d5243b-1b7d-4097-82f6-17b7b701bee5. SC session 0bb9172c-1d8f-4a44-8b2a-58d89a211031.
  • FOVEADR-DR5258X — 192.168.0.248, Fovea DR radiography imaging appliance. NOT managed (by design).
  • GuruRMM site: Four Paws / Main, site_code COPPER-HAWK-2085, site_id b5993733-8c98-426e-9ea6-673517dff97f, client_id 02a5a011-c53f-4a55-879c-4957086b52c3.

Commands & Outputs

  • Blank password: net user Localadmin "" + Set-LocalUser -PasswordNeverExpires $true + Winlogon New-ItemProperty (DefaultPassword=""). Result: auto-login broke (logon screen).
  • Restore: net user Localadmin 'r3tr0gradE99#' + Winlogon DefaultPassword=pw. Reboot -> query user shows localadmin console Active; Win32_ComputerSystem.UserName = SERVER\Localadmin.
  • Network sweep (SERVER): async ping 1..254 + nbtstat. Found 4PAWS-DOC (.148), FOVEADR-DR5258X (.248), printers/router.
  • SC enroll: send-command --session 0bb9172c... --command 'powershell ... iex (irm https://rmm.azcomputerguru.com/install/COPPER-HAWK-2085/windows)'.
    • First attempt error: Get-CimInstance : No more threads can be created in the system. HRESULT 0x800700a4 at line 30 (Win32_Processor).
    • Fix: shutdown /r /t 5 /f via SC; wait ~6 min; re-send enroll -> enrolled (79d5243b).
  • Diagnostic: run-onboarding-diagnostic.sh 4PAWS-DOC four-paws -> AMBER, 0 crit / 3 warn.

Pending / Incomplete Tasks

  • 4PAWS-DOC AMBER warnings (not remediated — user declined for now): BitLocker OFF on C:, 2 pending Windows updates, Intel Platform License Manager service stopped (benign). Also: staff is a local admin (shared cred), no backup agent detected, W32Time service stopped.
  • FOVEADR-DR5258X imaging appliance: confirm with vendor whether it should be managed/backed up.
  • Workstations (SERVER, STATION2, DESKTOP-3T5P291, 4PAWS-DOC) need AVImark relaunched by staff after the reboots.
  • SERVER clock read ~6h ahead of expected during the session — possible time-sync drift worth checking.

Reference Information

Reference in New Issue View Git Blame Copy Permalink