Home»Time Entries Audit loading ... generated 8/7/2026 at 1:33:51 pm took 0.73 seconds version: 5436fa4 helpers: v2
Territory: BMS Dates: 7/1/26 to 7/31/26 Company: all Ticket: all User: all Type: all Role: all Bill: Billable [x] Timesheet: all 6/29 7/6 7/13 7/20 7/27 Board: all Entry Status: all Ticket Status: -Closed [x] Issue: Notes longer than 500 characters [x] [reset] Progress: 100% (10 of 10)
| row | id | Terr | Company | User | Date | Day | Start | End | Actual | Billed | Deduct | Inv Amt | Work Type | Work Role | Bill | Timesheet | Board | Entry Status | Ticket Status | Ticket # | Ticket Summary | Int Notes | Audit Done | Audit Notes | Notes | # issues | all issues | errors | warnings | notices |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 | 42161 | BMS | IC | fdrewett | 7/3 | 9:30 am | 10:30 am | 1.00 | 1.00 | 0 | 125.00 | Remote | Standard Technician | Billable | 6/29 | Help Desk 2.1 | ReadyToBill | -Closed | 78900 | Fraud Email | 1 | 8/6 CS long notes ok | Security incident response - Microsoft 365 account \(Kole Spathelf\) On July 3, our monitoring partner detected that an outside party had signed into Kole Spathelf's Microsoft 365 account from an unauthorized location. The account did not have multi-factor authentication turned on, which allowed the sign-in using only the password. The account was automatically locked down within about 11 minutes of detection, cutting off the intruder's access. We then performed a full investigation and confirmed the intruder did not set up any hidden access, forwarding, or other means to get back in. During the brief access window, the intruder viewed roughly 110 emails, mostly routine company announcements and pay notifications. There was no evidence that any email was sent, moved, or deleted from the account. To secure the account, we reset the password and turned on multi-factor authentication, which will prompt Kole to set up a second verification step at next sign-in. The account has been safely returned to normal use. Recommended next step: we advise enabling multi-factor authentication across all user accounts in your Microsoft 365 environment to prevent this type of intrusion going forward. We're happy to schedule this with you. | 1 | Notices: Notes: Notes longer than 500 characters | Notes: Notes longer than 500 characters | ||||
| 2 | 42162 | BMS | IC | fdrewett | 7/3 | 10:45 am | 11:45 am | 1.00 | 1.00 | 0 | 125.00 | Remote | Standard Technician | Billable | 6/29 | Help Desk 2.1 | ReadyToBill | -Closed | 78900 | Fraud Email | 1 | 8/6 CS long notes ok | Security incident response and account decommission, Microsoft 365 account \(Dijon White\) On July 3, our monitoring partner detected that an outside party had gained access to Dijon White's Microsoft 365 account from an unauthorized location, using a stolen sign-in session. This was the second such attempt against your organization that day from the same source. The account was automatically locked down within about 6 minutes of detection, cutting off the intruder's access. We then performed a full investigation and confirmed the intruder did not set up any hidden access, forwarding, or other means to get back in. Because this account belonged to an employee whose last day was July 2, and at your direction, we converted the mailbox to an archive-only mailbox \(retaining the email for your records\), blocked all sign-in to the account, and removed its paid license to free up the subscription seat. Recommended next step: we advise enabling multi-factor authentication across all user accounts and reviewing sign-in protections for your Microsoft 365 environment, as your organization was targeted twice in one day. We're happy to schedule this with you. | 1 | Notices: Notes: Notes longer than 500 characters | Notes: Notes longer than 500 characters | ||||
| 3 | 42273 | BMS | SVC | fdrewett | 7/5 | Sun | 2:00 pm | 11:59 pm | 10.00 | 10.00 | 0 | 1250.00 | Remote | Standard Technician | Billable | 6/29 | Help Desk 2.1 | ReadyToBill | -Closed | 79047 | File Server Migration | Tue 7/7/2026 10:44 PM MDT - Time Entry has been split into multiple records due to spanning overnight from 7/5/2026 2:00:00 PM thru 7/6/2026 2:30:00 AM | 1 | 8/6 CS duplicate notes ok, internal notes ok, long notes ok | 2026-06-17 Discovery Assessment of legacy file server \(dsrv1\): inventoried shares, permissions, storage utilization, ~2.6M file baseline, mapped drives, and connected instruments/devices to scope migration plan 2.5 Pre-cutover Build & Prep Built new file server \(Server 2022\), joined domain, recreated share structure matching source, remediated NTFS permissions \(removed orphaned ACL entries, cleaned legacy profile artifacts\) 3.0 Pre-cutover Data Migration Performed baseline data copy of ~892GB / 2.6M files from legacy server to new server; validated copy integrity 2.5 2026-07-06 Cutover After-hours cutover: final delta sync and verification, decommissioned legacy server identity, migrated server name/IP to new hardware, re-registered DNS, validated share access and read/write from client workstation 3.5 2026-07-06 Cutover Support Troubleshooting during cutover \(AD object cleanup requiring recursive removal, IP reassignment conflict resolution\) 1.0 | 3 | Warnings: Notes: Duplicate notes; Notices: Int Notes: Internal notes, Notes: Notes longer than 500 characters | Notes: Duplicate notes | Int Notes: Internal notes, Notes: Notes longer than 500 characters | |
| 4 | 42274 | BMS | SVC | fdrewett | 7/6 | 12:00 am | 2:30 am | 2.50 | 2.50 | 0 | 312.50 | Remote | Standard Technician | Billable | 7/6 | Help Desk 2.1 | PendingApproval | -Closed | 79047 | File Server Migration | Tue 7/7/2026 10:44 PM MDT - Time Entry has been split into multiple records due to spanning overnight from 7/5/2026 2:00:00 PM thru 7/6/2026 2:30:00 AM | 1 | 8/6 CS duplicate notes ok, internal notes ok, long notes ok | 2026-06-17 Discovery Assessment of legacy file server \(dsrv1\): inventoried shares, permissions, storage utilization, ~2.6M file baseline, mapped drives, and connected instruments/devices to scope migration plan 2.5 Pre-cutover Build & Prep Built new file server \(Server 2022\), joined domain, recreated share structure matching source, remediated NTFS permissions \(removed orphaned ACL entries, cleaned legacy profile artifacts\) 3.0 Pre-cutover Data Migration Performed baseline data copy of ~892GB / 2.6M files from legacy server to new server; validated copy integrity 2.5 2026-07-06 Cutover After-hours cutover: final delta sync and verification, decommissioned legacy server identity, migrated server name/IP to new hardware, re-registered DNS, validated share access and read/write from client workstation 3.5 2026-07-06 Cutover Support Troubleshooting during cutover \(AD object cleanup requiring recursive removal, IP reassignment conflict resolution\) 1.0 | 3 | Warnings: Notes: Duplicate notes; Notices: Int Notes: Internal notes, Notes: Notes longer than 500 characters | Notes: Duplicate notes | Int Notes: Internal notes, Notes: Notes longer than 500 characters | ||
| 5 | 42503 | BMS | OMNI | fdrewett | 7/11 | Sat | 12:00 pm | 5:00 pm | 5.00 | 5.00 | 0 | 625.00 | Remote | Standard Technician | Billable | 7/6 | Help Desk 2.1 | PendingApproval | -Closed | 79174 | Main Migration | 1 | 8/6 CS long notes ok | build the new bridge and updated the routing for the zerotier networks. this is a big one we are retiring a complete network and switching all the workstations at main. 30+ Update on the Acme Main migration: I've got it automated end to end. One script moves each machine off the old ZT network onto the new one, updates all browser bookmarks to the new server \(Firefox, Chrome, Edge — across every user profile\), and fixes the Firefox homepage. A second script remaps the S: drive to the new server. Tested and working | 1 | Notices: Notes: Notes longer than 500 characters | Notes: Notes longer than 500 characters | |||
| 6 | 43272 | BMS | HH | jirwin | 7/29 | 1:00 pm | 2:30 pm | 1.50 | 1.50 | 0 | 225.00 | Onsite | Standard Technician | Billable | 7/27 | Help Desk 2.1 | PendingApproval | -Closed | 80090 | Date Incorrect For NVR | 1 | 8/6 CS long notes ok | Arrived onsite and replaced the battery for the NVR. Logged onto the computer and connected the cameras again. The time was still set wrong, rebooted the NVR and could not access the bios remotely using the User1 login. Pulled the unit down and connected locallly, but was still locked out of the bios. There is no video display until it gets to the disk check screen \(Two Disks 1 and 2\). Waited for disk check to finish and hooked up the NVR again to the network and placed it back on the top shelf in the distribution room. Remoted onto it after reboot and still get no option for bios entry \(suspect due to security\). We contacted Jesse and he is contacting the old IT company to see if there was an original admin login created. Cameras are back on, but show the year as 2000. | 1 | Notices: Notes: Notes longer than 500 characters | Notes: Notes longer than 500 characters | ||||
| 7 | 42899 | BMS | PPT | pnordlund | 7/21 | 12:05 pm | 1:30 pm | 1.42 | 1.50 | 0 | 187.50 | Onsite | Standard Technician | Billable | 7/20 | Help Desk 2.1 | PendingApproval | -Closed | 79558 | New Card Terminal System through Practice Management Bridge | 1 | 8/6 CS long notes ok | -- Troubleshooting payment terminal. -- The user at this workstation remotes into an RDP session. Checked the RDP session and the terminal isn't showing in device manager. -- Checked device manager on the host machine and there is an unrecognized device. -- Ran Dell Command Update and driver updates didn't fix the terminal in device manager. -- Found an Igenico driver online. Installed the driver and the terminal is now recognized on the host machine. When checking the RDP session, the terminal doesn't show up in device manager. Check boxes for sharing hardware are checked on the RDP settings. -- Tested the terminal in practice management bridge on the RDP session and the host and the payment terminal isn't getting recognized. -- Checked setup on another workstation that is working. This workstation doesn't use RDP, everything is done on the host machine OS. Terminal shows up in device manager the same on both machines. -- Checking support articles and made sure that hardware is set to allow in the browser for the webpage. -- Waiting in support chat to get an agent connected, but taking a while to get an agent connected. -- Talked to Frank and he recommended not to use the RDP session due to the terminal not getting recognized. RDPing into the RDS was due to having thin clients in the past. -- Ari and Melissa are going to wait for a support agent to join the chat and continue troubleshooting. Previous support chats got cut off due to the payment terminal not being recognized by the machine which is now resolved. They will reach out if there is any further assistance needed from us. -- Closing ticket. | 1 | Notices: Notes: Notes longer than 500 characters | Notes: Notes longer than 500 characters | ||||
| 8 | 42995 | BMS | PPT | pnordlund | 7/23 | 9:53 am | 10:11 am | 0.30 | 0.50 | 0 | 62.50 | Remote | Standard Technician | Billable | 7/20 | Help Desk 2.1 | PendingApproval | -Closed | 79577 | Printer | 1 | 8/6 CS long notes ok | Hey Lorraine, I was able to find this one that is a little smaller compared to the previous one I sent you. The Brother laser jets will be a larger footprint than the HP ink printers due to the toner cartridges requiring more space inside the printer. I have also included a comparison of the dimensions below. Once you get a printer ordered, let us know if you need any assistance with getting it setup! https://a.co/d/08XGqqSe HP OfficeJet Pro 8710: 19.7" W x 16.5" D x 12.4" H Brother MFC-L3720CDW: 17.5" W x 16.1" D x 15.8" H Regards, Payden Nordlund | 1 | Notices: Notes: Notes longer than 500 characters | Notes: Notes longer than 500 characters | ||||
| 9 | 43062 | BMS | SVC | pnordlund | 7/23 | 11:10 am | 1:05 pm | 1.92 | 2.00 | 0 | 250.00 | Onsite | Standard Technician | Billable | 7/20 | Help Desk 2.1 | PendingApproval | -Closed | 79718 | Fax to SMB Share | 1 | 8/6 CS long notes ok | -- Before going onsite, Frank noted that the administrator user on the address book for the printer needs to have the domain added. -- Added the domain as svc\\administrator. Tested fax and fax was sent successfully, but the fax isn't getting received into the share drive folder. -- Tested doing administrator@svc for the user and fax is failing. -- Checking share drive path in the printer's address book for the Fax - Heights contact and everything is correct. Tried different formatting for the share drive path. -- Tested multiple faxes and the fax is now failing. -- Tested mapping the share drive on a computer with the administrator user and the drive mapped. Credentials are correct. -- Checking permissions and domain admins have permission to the share drive. Explicitly added svc/administrator as having full permissions to the folder. -- Jason tested a fax to Canon's fax test and the confirmation came through to the share drive. -- Evie is going to watch for faxes to come through and let us know if it is working. -- Closing ticket. | 1 | Notices: Notes: Notes longer than 500 characters | Notes: Notes longer than 500 characters | ||||
| 10 | 42354 | BMS | IC | rclingan | 7/6 | 8:00 pm | 10:00 pm | 2.00 | 2.00 | 0 | 250.00 | Remote | Standard Technician | Billable | 7/6 | Help Desk 2.1 | Open | -Closed | 78900 | Fraud Email | 1 | 8/6 CS long notes ok | TICKET NOTES — M365 Licensing Audit & Identity Security Scoping WORK PERFORMED: - Exported tenant license assignments via Graph PowerShell \(Get-MgSubscribedSku / Get-MgUser\); built SKU GUID-to-name map - Analyzed 179 accounts: 82 unlicensed \(shared mailboxes/service accts\), 68 Business Basic, 24 Business Standard, 3 Office 365 E3 - FINDING: Zero Entra ID P1 in tenant. Conditional Access not possible on current licensing. Note: O365\_BUSINESS\_PREMIUM SKU = Business Standard \(legacy naming\), not Business Premium - Exported per-user mailbox sizes via ExchangeOnlineManagement \(Get-EXOMailboxStatistics\). Resolved module install + WAM broker auth failure \(-DisableWAM\) - Cross-referenced mailbox sizes against license tiers to build three-tier licensing recommendation ENVIRONMENT NOTES: - On-prem AD \(no Entra Connect sync currently\), ESXi host w/ Sage server + DC, NAS, 2 sites w/ S2S VPN - ~24 desktop users on AD accounts; ~12 field laptops on LOCAL accounts \(unmanaged\) - NinjaRMM on all PCs incl. field laptops; Huntress EDR + ITDR \(retain\); Inky Phish Fence \(displace w/ Defender for O365 P1 — client wants off Inky post-Kaseya acquisition\) RECOMMENDATION SUMMARY: - Phase 1 \(38 hrs\): AD prep/IdFix/UPN alignment, Entra Connect w/ PHS + hybrid join, Intune auto-enroll GPO, CA policy set \(report-only -> enforce\), MFA/passkey rollout - Phase 2 \(20 hrs\): Field laptop migration remote via Ninja — Autopilot hash collection, ProfWiz local-to-Entra profile migration, no device collection needed - Phase 3 \(50 hrs, modular\): Intune foundation, Autopilot, app deployment, Defender for Business as AV layer under Huntress, Defender for O365 P1 + Inky cutover, MAM - Licensing: 38x Business Premium \(24 Standard upgrades, 3 E3 swaps, 11 Basic w/ mailboxes >F3 2GB limit\), 57x F3 + DfO add-on \(phone-profile field users\). Est. delta ~+$632/mo, partially offset by Inky cancellation - Pending: laptop-to-user mapping from Ninja inventory — any F3-slated user w/ company laptop moves to Premium DELIVERABLES: - One-page proposal doc \(scope/hours/licensing\) - Per-user license recommendation CSV \(95 users w/ rationale\) NEXT STEPS: - Pull device-to-user assignments from NinjaRMM - Client decision on Huntress Managed SAT \(no conflict w/ BP licensing — attack sim requires DfO P2, not included\) | 1 | Notices: Notes: Notes longer than 500 characters | Notes: Notes longer than 500 characters |
Legend:
(hover over fields for details)
Tickets with over 5 hours in the current view (3)
| Hours | Ticket # | Company | Ticket Summary |
|---|---|---|---|
| 12.50 | 79047 | SVC | File Server Migration |
| 9.75 | 78900 | IC | Fraud Email |
| 9.50 | 79174 | OMNI | Main Migration |
Warnings
| Field | Message | Count |
|---|---|---|
| Notes | Duplicate notes | 2 |
| Total | 2 | |
Notices
| Field | Message | Count |
|---|---|---|
| Int Notes | Internal notes | 2 |
| Notes | Notes longer than 500 characters | 10 |
| Total | 12 | |