71 lines
4.3 KiB
Markdown
71 lines
4.3 KiB
Markdown
---
|
|
title: Safe Site Utility Services LLC
|
|
type: client
|
|
slug: safesite
|
|
last_verified: 2026-06-08
|
|
source_logs:
|
|
- session-logs/2026-06/2026-06-08-mike-safesite-investigation.md
|
|
---
|
|
|
|
# Safe Site Utility Services LLC
|
|
|
|
MSP client. Fragmented endpoint management across **four** systems (Datto RMM, Intune/MDM,
|
|
ScreenConnect, Syncro) — a GuruRMM consolidation is in progress.
|
|
|
|
## M365 tenant
|
|
- **Domain:** safesitellc.com · **Tenant ID:** `71b4e637-c802-4137-a812-ae50dbc839e3`
|
|
- **Onboarded apps (ComputerGuru MSP suite), verified live 2026-06-08:**
|
|
- Security Investigator, User Manager, Tenant Admin — Graph, consented + reading.
|
|
- **Intune Manager** (`46986910-aa47-4e5e-b596-f65c6b485abb`) — **consented 2026-06-08** (Mike, GA).
|
|
Holds full Intune write scopes (DeviceManagementConfiguration/ManagedDevices/Apps ReadWrite.All
|
|
+ ManagedDevices.PrivilegedOperations.All). Use the `intune-manager` get-token tier.
|
|
- Exchange Operator/Investigator-EXO: token issues but EXO `InvokeCommand` 401 — the SP lacks the
|
|
**Exchange Administrator** role in-tenant (not yet assigned). Defender tier: reachable but **0
|
|
devices onboarded** to MDE (no endpoint EDR telemetry).
|
|
- **get-token note:** `~/.claude/identity.json` lacks `vault_path` on GURU-5070 → pass
|
|
`VAULT_ROOT_ENV=D:/vault` to `remediation-tool/scripts/get-token.sh`.
|
|
|
|
## Intune posture (45 Windows devices, enrollment-only)
|
|
- 45 Windows MDM devices; **no compliance policies, no configuration profiles** (settings catalog
|
|
empty). Enrollment configs are all default. **One** deployed app: **ScreenConnect Client**.
|
|
- **Security gaps:** 22 of 45 **unencrypted** (no BitLocker, nothing enforcing it); 8 noncompliant.
|
|
- Devices enrolled under **IT/admin accounts** (JonathanB@, sysadmin@, subhamb@, mailadmin1@), NOT
|
|
end users — so Intune's `userPrincipalName` does NOT identify the real operator. Use **Datto's
|
|
Last User** for person→machine attribution instead.
|
|
|
|
## Endpoint management fragmentation (reconciled 2026-06-08)
|
|
Unified inventory by hostname across all four sources = **73 unique machines**.
|
|
- **Datto RMM = the near-master list (71/73)** and carries real `Last User` + AV/EDR status.
|
|
Only `0325-DELL3550` and `LAPTOP` are absent from Datto (Intune-only).
|
|
- Intune 42 · Syncro 24 · GuruRMM 18 (as of 2026-06-08).
|
|
- No Datto API creds in vault — Datto data comes from console CSV export.
|
|
- ScreenConnect API key only supports `GetSessionsByName` (blank for agents) → **cannot enumerate**
|
|
the fleet; see [[reference_screenconnect_api]].
|
|
|
|
## GuruRMM
|
|
- Client **Safesite** `fe17552f-736b-42ec-86a2-0e6f107f2397`. Sites: **Bell** (RED-HAWK-6595),
|
|
**Glendale** (SWIFT-OCEAN-8321), **Unknown** (LIGHT-CLOUD-3585, created 2026-06-08 as the
|
|
catch-all bucket for un-attributed push installs).
|
|
- 18 agents enrolled; **55 of 73 machines still need the agent**. Agents observed **offline /
|
|
WS-disconnected** 2026-06-08 (dispatches go to `pending`) while the same machines are **Online in
|
|
Datto** — Datto/Intune are the live push channels, not GuruRMM, right now.
|
|
|
|
## NexSite recalled-email investigation (2026-06-08)
|
|
External sender m.paris@nexsitepartners.com sent "Re: NWWells - SafeSite - Vendor Forms" with
|
|
attachment **`SSUS 06122026.PDF`** to 9 Safe Site recipients on 2026-06-08 ~18:54 UTC; recalled.
|
|
IT contact: Jonathan Byrd (j.byrd@nexsitepartners.com). Goal: determine if the PDF was
|
|
accessed/downloaded on managed endpoints.
|
|
- **No EDR back-telemetry** (MDE 0 devices) → endpoint history can only come from **on-disk
|
|
artifact recovery** (file search + Zone.Identifier MotW + Outlook cache + browser DL history +
|
|
RecentDocs), run via a live channel.
|
|
- **Recipient → machine (via Datto Last User):** beeanna=`0225-DELL3550`, david=`0622-DAVID-HP`,
|
|
jon=`0525-ASUSFX707Z`, justinb=`0525-DELL3550-1`, lennyg=`DESKTOP-3USU20B`,
|
|
suzannep=`1122-SUZANNE-DELL`, travisf=`MSI`, jeremiahw=`DESKTOP-LOPKB4G`, thomasc=`0724-DELL3550`.
|
|
- Caveat: artifact recovery proves "downloaded=yes"; it cannot prove "never accessed". Only covers
|
|
managed machines (not phones/personal). Time-sensitive — artifacts age out.
|
|
|
|
## Open items
|
|
- Choose forensic channel (Datto console job vs Intune proactive remediation) — GuruRMM agents
|
|
offline. Push GuruRMM agent to the 55 gap machines. Assign Exchange Admin role to the Sec
|
|
Investigator SP if mailbox-audit forensic is wanted. Remediate the 22 unencrypted endpoints.
|