Mike Swanson
ba2ed379f8
Comprehensive infrastructure improvements for AD2 (Domain Controller) remote management and NAS sync system modernization. ## AD2 Remote Access Enhancements **WinRM Configuration:** - Enabled PowerShell Remoting (port 5985) with full logging - Configured TrustedHosts for LAN/VPN access (172.16.*, 192.168.*, 10.*) - Created read-only service account (ClaudeTools-ReadOnly) for safe automation - Set up transcript logging for all remote sessions - Deployed 6 automation scripts to C:\ClaudeTools\Scripts\ (AD user/computer reports, GPO status, replication health, log rotation) **SSH Access:** - Installed OpenSSH Server (v10.0p2) - Generated ED25519 key for passwordless authentication - Configured SSH key authentication for sysadmin account **Benefits:** - Efficient remote operations via persistent WinRM sessions (vs individual SSH commands) - Secure read-only access for queries (no admin rights needed) - Comprehensive audit trail of all remote operations ## Sync System Modernization (AD2 <-> NAS) **Replaced PuTTY with OpenSSH:** - Migrated from pscp.exe/plink.exe to native OpenSSH scp/ssh tools - Added verbose logging (-v flag) for detailed error diagnostics - Implemented auto host-key acceptance (StrictHostKeyChecking=accept-new) - Enhanced error logging to capture actual SCP failure reasons **Problem Solved:** - Original sync errors (738 failures) had no root cause details - PuTTY's batch mode silently failed without error messages - New OpenSSH implementation logs full error output to sync-from-nas.log **Scripts Created:** - setup-openssh-sync.ps1: SSH key generation and NAS configuration - check-openssh-client.ps1: Verify OpenSSH availability - restore-and-fix-sync.ps1: Update Sync-FromNAS.ps1 to use OpenSSH - investigate-sync-errors.ps1: Analyze sync failures with context - test-winrm.ps1: WinRM connection testing (admin + service accounts) - demo-ad2-automation.ps1: WinRM automation examples (AD stats, sync status) ## DOS Batch File Line Ending Fixes **Problem:** All DOS batch files had Unix (LF) line endings instead of DOS (CRLF), causing parsing errors on DOS 6.22 machines. **Fixed:** - Local: 13 batch files converted to CRLF - Remote (AD2): 492 batch files scanned, 10 converted to CRLF - Affected files: DEPLOY.BAT, NWTOC.BAT, CTONW.BAT, UPDATE.BAT, STAGE.BAT, CHECKUPD.BAT, REBOOT.BAT, and station-specific batch files **Scripts Created:** - check-dos-line-endings.ps1: Scan and detect LF vs CRLF - convert-to-dos.ps1: Bulk conversion to DOS format - fix-ad2-dos-files.ps1: Remote conversion via WinRM ## Credentials & Documentation Updates **credentials.md additions:** - Peaceful Spirit VPN configuration (L2TP/IPSec) - AD2 WinRM/SSH access details (both admin and service accounts) - SSH keys and known_hosts configuration - Complete WinRM connection examples **Files Modified:** - credentials.md: +91 lines (VPN, AD2 automation access) - CTONW.BAT, NWTOC.BAT, REBOOT.BAT, STAGE.BAT: Line ending fixes - Infrastructure configs: vpn-connect.bat, vpn-disconnect.bat (CRLF) ## Test Results **WinRM Automation (demo-ad2-automation.ps1):** - Retrieved 178 AD users (156 enabled, 22 disabled, 40 active) - Retrieved 67 AD computers (67 Windows, 6 servers, 53 active) - Checked Dataforth sync status (2,249 files pushed, 738 errors logged) - All operations completed in single remote session (efficient!) **Sync System:** - OpenSSH tools confirmed available on AD2 - Backup created: Sync-FromNAS.ps1.backup-20260119-140918 - Script updated with error logging and verbose output - Next sync run will reveal actual error causes ## Technical Decisions 1. **WinRM over SSH:** More efficient for PowerShell operations, better error handling, native Windows integration 2. **Service Account:** Follows least-privilege principle, safer for automated queries, easier audit trail 3. **OpenSSH over PuTTY:** Modern, maintained, native Windows tool, better error reporting, supports key authentication without external tools 4. **Verbose Logging:** Critical for debugging 738 sync errors - now we'll see actual SCP failure reasons (permissions, paths, network issues) ## Next Steps 1. Monitor next sync run (every 15 minutes) for detailed error messages 2. Analyze SCP error output to identify root cause of 738 failures 3. Implement SSH key authentication for NAS (passwordless) 4. Consider SFTP batch mode for more reliable transfers Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
299 lines
8.6 KiB
Batchfile
299 lines
8.6 KiB
Batchfile
@ECHO OFF
|
|
REM NWTOC.BAT - Network to Computer update script
|
|
REM Pulls software updates from network share to local C: drive
|
|
REM
|
|
REM Usage: NWTOC
|
|
REM
|
|
REM Updates these directories:
|
|
REM T:\COMMON\ProdSW\*.bat ??? C:\BAT\
|
|
REM T:\%MACHINE%\ProdSW\*.* ??? C:\BAT\ and C:\ATE\
|
|
REM T:\COMMON\DOS\*.NEW ??? Staged for reboot
|
|
REM
|
|
REM Version: 1.0 - DOS 6.22 compatible
|
|
REM Last modified: 2026-01-19
|
|
|
|
REM ==================================================================
|
|
REM STEP 1: Verify machine name is set
|
|
REM ==================================================================
|
|
|
|
IF NOT "%MACHINE%"=="" GOTO CHECK_DRIVE
|
|
|
|
:NO_MACHINE
|
|
ECHO.
|
|
ECHO [ERROR] MACHINE variable not set
|
|
ECHO.
|
|
ECHO Set MACHINE in AUTOEXEC.BAT:
|
|
ECHO SET MACHINE=TS-4R
|
|
ECHO.
|
|
ECHO Then reboot or run:
|
|
ECHO SET MACHINE=TS-4R
|
|
ECHO NWTOC
|
|
ECHO.
|
|
PAUSE Press any key to exit...
|
|
GOTO END
|
|
|
|
REM ==================================================================
|
|
REM STEP 2: Verify T: drive is accessible
|
|
REM ==================================================================
|
|
|
|
:CHECK_DRIVE
|
|
REM Test T: drive access by switching to it
|
|
T: 2>NUL
|
|
IF ERRORLEVEL 1 GOTO NO_T_DRIVE
|
|
|
|
REM Successfully switched to T:, go back to C:
|
|
C:
|
|
|
|
REM Double-check with NUL device test
|
|
IF NOT EXIST T:\NUL GOTO NO_T_DRIVE
|
|
|
|
GOTO START_UPDATE
|
|
|
|
:NO_T_DRIVE
|
|
C:
|
|
ECHO.
|
|
ECHO [ERROR] T: drive not available
|
|
ECHO.
|
|
ECHO Network drive T: must be mapped to \\D2TESTNAS\test
|
|
ECHO.
|
|
ECHO Run network startup:
|
|
ECHO C:\NET\STARTNET.BAT
|
|
ECHO.
|
|
ECHO Or map manually:
|
|
ECHO NET USE T: \\D2TESTNAS\test /YES
|
|
ECHO.
|
|
PAUSE Press any key to exit...
|
|
GOTO END
|
|
|
|
REM ==================================================================
|
|
REM STEP 3: Display update banner
|
|
REM ==================================================================
|
|
|
|
:START_UPDATE
|
|
ECHO.
|
|
ECHO ==============================================================
|
|
ECHO Update: %MACHINE% from Network
|
|
ECHO ==============================================================
|
|
ECHO Source: T:\COMMON and T:\%MACHINE%
|
|
ECHO Target: C:\BAT, C:\ATE, C:\NET
|
|
ECHO ==============================================================
|
|
ECHO.
|
|
|
|
REM ==================================================================
|
|
REM STEP 4: Check if update directories exist
|
|
REM ==================================================================
|
|
|
|
IF NOT EXIST T:\COMMON\NUL GOTO NO_COMMON
|
|
IF NOT EXIST T:\COMMON\ProdSW\NUL GOTO NO_PRODSW
|
|
|
|
REM Machine-specific directory is optional
|
|
IF NOT EXIST T:\%MACHINE%\NUL GOTO SKIP_MACHINE_CHECK
|
|
IF NOT EXIST T:\%MACHINE%\ProdSW\NUL GOTO SKIP_MACHINE_CHECK
|
|
|
|
GOTO UPDATE_BATCH_FILES
|
|
|
|
:NO_COMMON
|
|
ECHO [ERROR] T:\COMMON directory not found
|
|
ECHO.
|
|
ECHO Network share structure is incorrect.
|
|
ECHO Expected: T:\COMMON\ProdSW\
|
|
ECHO.
|
|
PAUSE Press any key to exit...
|
|
GOTO END
|
|
|
|
:NO_PRODSW
|
|
ECHO [ERROR] T:\COMMON\ProdSW directory not found
|
|
ECHO.
|
|
ECHO Update directory is missing.
|
|
ECHO Expected: T:\COMMON\ProdSW\*.bat
|
|
ECHO.
|
|
PAUSE Press any key to exit...
|
|
GOTO END
|
|
|
|
:SKIP_MACHINE_CHECK
|
|
ECHO [WARNING] T:\%MACHINE%\ProdSW not found - skipping machine-specific updates
|
|
ECHO.
|
|
|
|
REM ==================================================================
|
|
REM STEP 5: Update batch files from COMMON
|
|
REM ==================================================================
|
|
|
|
:UPDATE_BATCH_FILES
|
|
ECHO [1/4] Updating batch files from T:\COMMON\ProdSW...
|
|
|
|
REM Create C:\BAT directory if it doesn't exist
|
|
IF NOT EXIST C:\BAT\NUL MD C:\BAT
|
|
|
|
REM Backup existing batch files before update
|
|
ECHO Creating backups (.BAK files)...
|
|
FOR %%F IN (C:\BAT\*.BAT) DO COPY %%F %%~dpnF.BAK >NUL 2>NUL
|
|
|
|
REM Copy newer batch files from COMMON
|
|
ECHO Copying updated files...
|
|
XCOPY T:\COMMON\ProdSW\*.bat C:\BAT\ /D /Y /Q
|
|
IF ERRORLEVEL 4 GOTO UPDATE_ERROR_INIT
|
|
IF ERRORLEVEL 2 GOTO UPDATE_ERROR_USER
|
|
IF ERRORLEVEL 1 ECHO [OK] No new batch files in COMMON
|
|
IF NOT ERRORLEVEL 1 ECHO [OK] Batch files updated from COMMON
|
|
|
|
ECHO.
|
|
|
|
REM ==================================================================
|
|
REM STEP 6: Update machine-specific files
|
|
REM ==================================================================
|
|
|
|
ECHO [2/4] Updating machine-specific files from T:\%MACHINE%\ProdSW...
|
|
|
|
REM Check if machine-specific directory exists
|
|
IF NOT EXIST T:\%MACHINE%\ProdSW\NUL GOTO SKIP_MACHINE_FILES
|
|
|
|
REM Create directories if they don't exist
|
|
IF NOT EXIST C:\BAT\NUL MD C:\BAT
|
|
IF NOT EXIST C:\ATE\NUL MD C:\ATE
|
|
|
|
REM Copy batch files
|
|
ECHO Copying batch files to C:\BAT...
|
|
FOR %%F IN (T:\%MACHINE%\ProdSW\*.BAT) DO COPY %%F C:\BAT\ /Y >NUL 2>NUL
|
|
IF NOT ERRORLEVEL 1 ECHO [OK] Machine-specific batch files updated
|
|
|
|
REM Copy executables
|
|
ECHO Copying programs to C:\ATE...
|
|
FOR %%F IN (T:\%MACHINE%\ProdSW\*.EXE) DO COPY %%F C:\ATE\ /Y >NUL 2>NUL
|
|
IF NOT ERRORLEVEL 1 ECHO [OK] Machine-specific programs updated
|
|
|
|
REM Copy data files
|
|
ECHO Copying data files to C:\ATE...
|
|
FOR %%F IN (T:\%MACHINE%\ProdSW\*.DAT) DO COPY %%F C:\ATE\ /Y >NUL 2>NUL
|
|
IF NOT ERRORLEVEL 1 ECHO [OK] Machine-specific data files updated
|
|
|
|
GOTO CHECK_SYSTEM_FILES
|
|
|
|
:SKIP_MACHINE_FILES
|
|
ECHO [SKIP] No machine-specific directory (T:\%MACHINE%\ProdSW)
|
|
ECHO.
|
|
|
|
REM ==================================================================
|
|
REM STEP 7: Check for system file updates
|
|
REM ==================================================================
|
|
|
|
:CHECK_SYSTEM_FILES
|
|
ECHO [3/4] Checking for system file updates...
|
|
|
|
REM Check if DOS directory exists
|
|
IF NOT EXIST T:\COMMON\DOS\NUL GOTO NO_SYSTEM_FILES
|
|
|
|
REM Check for AUTOEXEC.NEW
|
|
SET SYSUPD=0
|
|
IF EXIST T:\COMMON\DOS\AUTOEXEC.NEW SET SYSUPD=1
|
|
IF EXIST T:\COMMON\DOS\CONFIG.NEW SET SYSUPD=1
|
|
|
|
REM If no system updates, continue
|
|
IF "%SYSUPD%"=="0" GOTO NO_SYSTEM_FILES
|
|
|
|
REM System files need updating - stage them
|
|
ECHO [FOUND] System file updates available
|
|
ECHO Staging AUTOEXEC.BAT and/or CONFIG.SYS updates...
|
|
ECHO.
|
|
|
|
REM Copy staging files
|
|
IF EXIST T:\COMMON\DOS\AUTOEXEC.NEW COPY T:\COMMON\DOS\AUTOEXEC.NEW C:\AUTOEXEC.NEW >NUL
|
|
IF EXIST T:\COMMON\DOS\CONFIG.NEW COPY T:\COMMON\DOS\CONFIG.NEW C:\CONFIG.NEW >NUL
|
|
|
|
REM Call staging script
|
|
IF EXIST C:\BAT\STAGE.BAT GOTO CALL_STAGE
|
|
|
|
REM STAGE.BAT doesn't exist - warn user
|
|
ECHO [WARNING] C:\BAT\STAGE.BAT not found
|
|
ECHO System files copied to C:\AUTOEXEC.NEW and C:\CONFIG.NEW
|
|
ECHO Manually copy these files after reboot:
|
|
ECHO COPY C:\AUTOEXEC.NEW C:\AUTOEXEC.BAT
|
|
ECHO COPY C:\CONFIG.NEW C:\CONFIG.SYS
|
|
ECHO.
|
|
GOTO UPDATE_COMPLETE
|
|
|
|
:CALL_STAGE
|
|
CALL C:\BAT\STAGE.BAT
|
|
GOTO END
|
|
|
|
:NO_SYSTEM_FILES
|
|
ECHO [OK] No system file updates
|
|
ECHO.
|
|
|
|
REM ==================================================================
|
|
REM STEP 8: Update network client files (optional)
|
|
REM ==================================================================
|
|
|
|
ECHO [4/4] Checking for network client updates...
|
|
|
|
REM Check if NET directory exists on network
|
|
IF NOT EXIST T:\COMMON\NET\NUL GOTO NO_NET_FILES
|
|
|
|
REM Backup network client files
|
|
ECHO Creating backups of C:\NET\...
|
|
FOR %%F IN (C:\NET\*.DOS) DO COPY %%F %%~dpnF.BAK >NUL 2>NUL
|
|
|
|
REM Copy newer network files
|
|
ECHO Copying updated network files...
|
|
XCOPY T:\COMMON\NET\*.* C:\NET\ /D /Y /Q
|
|
IF NOT ERRORLEVEL 1 ECHO [OK] Network client files updated
|
|
GOTO UPDATE_COMPLETE
|
|
|
|
:NO_NET_FILES
|
|
ECHO [OK] No network client updates
|
|
ECHO.
|
|
|
|
REM ==================================================================
|
|
REM STEP 9: Update complete
|
|
REM ==================================================================
|
|
|
|
:UPDATE_COMPLETE
|
|
ECHO ==============================================================
|
|
ECHO Update Complete
|
|
ECHO ==============================================================
|
|
ECHO.
|
|
ECHO Files updated from:
|
|
ECHO T:\COMMON\ProdSW ??? C:\BAT
|
|
ECHO T:\%MACHINE%\ProdSW ??? C:\BAT and C:\ATE
|
|
ECHO.
|
|
ECHO Backup files (.BAK) created in C:\BAT
|
|
ECHO.
|
|
ECHO System file updates: %SYSUPD%
|
|
IF "%SYSUPD%"=="1" ECHO [WARNING] Reboot required to apply system changes
|
|
IF "%SYSUPD%"=="1" ECHO Run REBOOT command or press Ctrl+Alt+Del
|
|
ECHO.
|
|
GOTO END
|
|
|
|
REM ==================================================================
|
|
REM ERROR HANDLERS
|
|
REM ==================================================================
|
|
|
|
:UPDATE_ERROR_INIT
|
|
ECHO.
|
|
ECHO [ERROR] Update initialization failed
|
|
ECHO.
|
|
ECHO Possible causes:
|
|
ECHO - Insufficient memory
|
|
ECHO - Invalid path
|
|
ECHO - Target drive not accessible
|
|
ECHO.
|
|
PAUSE Press any key to exit...
|
|
GOTO END
|
|
|
|
:UPDATE_ERROR_USER
|
|
ECHO.
|
|
ECHO [ERROR] Update terminated by user (Ctrl+C)
|
|
ECHO.
|
|
ECHO Update may be incomplete!
|
|
ECHO Run NWTOC again to complete update.
|
|
ECHO.
|
|
PAUSE Press any key to exit...
|
|
GOTO END
|
|
|
|
REM ==================================================================
|
|
REM CLEANUP AND EXIT
|
|
REM ==================================================================
|
|
|
|
:END
|
|
REM Clean up environment variables
|
|
SET SYSUPD=
|