{
  "documentation/bb9fe57b6085": {
    "title": "Linux01 SSSD Remediation Validation",
    "description": "Retained technical documentation: Linux01 SSSD Remediation Validation",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Linux01 SSSD Remediation Validation</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/on-prem-home-lab/current-validated-state/direct-evidence/linux01-sssd-remediation-validation.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Linux01 SSSD Remediation Validation</h2>\n<h2>Claim supported</h2>\n<p>Direct Linux01 remediation evidence supports a narrow Linux01-only SSSD responder/socket conflict remediation and post-remediation validation.</p>\n<h2>Directly observed values</h2>\n<ul>\n<li>Initial condition: SSSD NSS, PAM, and PAC sockets were enabled and failed.</li>\n<li>Initial condition: SSSD was configured for direct responder activation through <code>services = nss, pam</code>.</li>\n<li>Initial condition: <code>config_file_version = 2</code> was rejected by SSSD 2.12 config validation.</li>\n<li>Remediation action: removed only the rejected <code>config_file_version = 2</code> directive.</li>\n<li>Remediation action: disabled conflicting NSS, PAM, and PAC sockets.</li>\n<li>Remediation action: restarted sssd.service.</li>\n<li>Remediation action: cleared failed-unit state.</li>\n<li>Post-remediation service state: sssd.service enabled and active/running.</li>\n<li>Post-remediation failed-unit state: zero failed units.</li>\n<li>SSSD configuration validation: passed.</li>\n<li>AD identity lookup: passed.</li>\n<li>New AD-authenticated SSH session: passed.</li>\n<li>Initial diagnostic SHA-256: 3CAD0FB73202D777D41DEE40D6F4D19D4019B9AD30552B37970B55A5CA5AB3BB.</li>\n<li>Original/backup configuration SHA-256: 23ACE1BECA5FF6F7D58200EFE054EA8E5A938E02F37FCE25B1CA1B5D2F05BD14.</li>\n<li>Post-remediation diagnostic SHA-256: FD55604BFB94487B86FBF631703FA995B9726471689385CCB2D277492AA7CBEE.</li>\n</ul>\n<h2>Source command or source object</h2>\n<p>Linux01 SSSD remediation evidence record.</p>\n<h2>Source repository</h2>\n<p>fontenotjeremy71-hub/jeremy-homelab-ops</p>\n<h2>Source commit</h2>\n<p>fb6c286873285778d88d6d5cfde0b9bd00b96f36</p>\n<h2>Source path</h2>\n<p><code>evidence/linux01-sssd-remediation-20260626-110159.md</code></p>\n<h2>Source file SHA-256</h2>\n<p><code>evidence/linux01-sssd-remediation-20260626-110159.md</code>: 04773570FBE305353F5EB370B8F9629AC335E35A7BEF7151A2CBB98D7371CC49</p>\n<h2>Public artifact SHA-256</h2>\n<p>Recorded in <code>evidence-library/integrity/evidence-hashes.json</code> for this artifact path. The self-hash is recorded outside this file so the digest does not invalidate itself.</p>\n<h2>Sanitization performed</h2>\n<p>Removed diagnostic artifact paths, backup filesystem path, account context, raw command history, and implementation details not needed to support the remediation claim. Retained hashes because they are part of the validation evidence.</p>\n<h2>Limitations</h2>\n<ul>\n<li>Personal nonproduction home lab only.</li>\n<li>Captured-state evidence only.</li>\n<li>Linux01 only.</li>\n<li>This does not claim that all Linux domain-authentication paths were tested.</li>\n<li>This does not prove production readiness, employer-system administration, or recurring assurance.</li>\n</ul>\n<h2>Validation date</h2>\n<p>2026-06-30</p>\n<h2>Classification</h2>\n<p>Validated</p></article>",
    "active": "Projects"
  },
  "documentation/f442266b3082": {
    "title": "Linux01 System, Network, and Domain Validation",
    "description": "Retained technical documentation: Linux01 System, Network, and Domain Validation",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Linux01 System, Network, and Domain Validation</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/on-prem-home-lab/current-validated-state/direct-evidence/linux01-system-network-domain-validation.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Linux01 System, Network, and Domain Validation</h2>\n<h2>Claim supported</h2>\n<p>Direct Linux01 inventory, Proxmox inventory, and source reconciliation evidence support Linux01 VM association, Ubuntu version, kernel, VLAN, IP addressing, DNS, gateway, current-versus-historical address boundary, and directly proven domain integration state.</p>\n<h2>Directly observed values</h2>\n<ul>\n<li>Proxmox VM association: VM 400 name linux01, running.</li>\n<li>Operating system: Ubuntu 26.04 LTS.</li>\n<li>Kernel: Linux 7.0.0-22-generic.</li>\n<li>Architecture: x86_64.</li>\n<li>VLAN: 30, from current source reconciliation.</li>\n<li>Interface state: ens18 UP.</li>\n<li>Current IPv4 address: 10.10.30.20/24.</li>\n<li>Default gateway: 10.10.30.1.</li>\n<li>DNS server: 10.10.20.10.</li>\n<li>DNS domain: ad.jeremyfontenot.online.</li>\n<li>Current-versus-historical boundary: current Linux01 address is 10.10.30.20/24; older Linux01 10.10.20.x evidence is historical.</li>\n<li>Domain integration state: realmd reports ad.jeremyfontenot.online configured as a Kerberos member, server software active-directory, client software SSSD, and domain identity resolution returned <code>resolved</code>.</li>\n<li>Kerberos configuration: present.</li>\n</ul>\n<h2>Source command or source object</h2>\n<ul>\n<li>Authenticated Linux01 target-local inventory result objects: Distribution, Kernel, IP addresses, Routes, DNS, realmd, Domain identity resolution, and Kerberos config.</li>\n<li>Proxmox read-only inventory object: <code>virtualMachines[]</code> entry for VM 400.</li>\n<li>Source reconciliation table for Linux01 VLAN and current-versus-historical address boundary.</li>\n</ul>\n<h2>Source repository</h2>\n<p>fontenotjeremy71-hub/jeremy-homelab-ops</p>\n<h2>Source commit</h2>\n<p>fb6c286873285778d88d6d5cfde0b9bd00b96f36</p>\n<h2>Source path</h2>\n<ul>\n<li><code>inventories/linux01-inventory-20260626-084312.json</code></li>\n<li><code>inventories/proxmox-inventory-20260626-010601.json</code></li>\n<li><code>evidence/home-lab-source-reconciliation-20260626-012606.md</code></li>\n</ul>\n<h2>Source file SHA-256</h2>\n<ul>\n<li><code>inventories/linux01-inventory-20260626-084312.json</code>: 75F82AF4882FA9C869C78C1AC127C5D4F37C5CB62F4E8894361A352695EFC40D</li>\n<li><code>inventories/proxmox-inventory-20260626-010601.json</code>: D652D1EF753E14242C07F84F19FBF09F642F07C3B09CFE2E98AA7F2B176ADE3D</li>\n<li><code>evidence/home-lab-source-reconciliation-20260626-012606.md</code>: 2D377A7A6703F8C3C5FBB77AA093569806DDB7939CFA88FD6A0ECF801484C3EE</li>\n</ul>\n<h2>Public artifact SHA-256</h2>\n<p>Recorded in <code>evidence-library/integrity/evidence-hashes.json</code> for this artifact path. The self-hash is recorded outside this file so the digest does not invalidate itself.</p>\n<h2>Sanitization performed</h2>\n<p>Removed executing account, machine identifiers, link-local IPv6 address, raw boot/session identifiers, unrelated package/service details, unnecessary filesystem paths, and distro metadata not needed for the public claim.</p>\n<h2>Limitations</h2>\n<ul>\n<li>Personal nonproduction home lab only.</li>\n<li>Captured-state evidence only.</li>\n<li>Domain integration is limited to the directly observed realmd, SSSD client, Kerberos config, and identity-resolution indicators.</li>\n<li>This artifact does not claim that all Linux domain-authentication paths were tested.</li>\n<li>Timeout or listener observations are not complete firewall validation.</li>\n</ul>\n<h2>Validation date</h2>\n<p>2026-06-30</p>\n<h2>Classification</h2>\n<p>Validated</p></article>",
    "active": "Projects"
  },
  "documentation/fa0beca36156": {
    "title": "Proxmox Backup Configuration",
    "description": "Retained technical documentation: Proxmox Backup Configuration",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Proxmox Backup Configuration</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/on-prem-home-lab/current-validated-state/direct-evidence/proxmox-backup-configuration.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Proxmox Backup Configuration</h2>\n<h2>Claim supported</h2>\n<p>Direct Proxmox backup configuration evidence supports the configured weekly snapshot job for primary lab VMs.</p>\n<h2>Directly observed values</h2>\n<ul>\n<li>Backup job ID: backup-critical-lab-vms.</li>\n<li>Enabled state: enabled.</li>\n<li>Schedule: Sunday 02:00 (<code>sun 02:00</code>).</li>\n<li>Mode: snapshot.</li>\n<li>Compression: zstd.</li>\n<li>Retention: keep-last=4.</li>\n<li>Storage target: backup-hdd.</li>\n<li>Target VMs: 100, 200, 300, and 400.</li>\n</ul>\n<h2>Source command or source object</h2>\n<ul>\n<li>Proxmox read-only inventory object: <code>backupJobs[]</code>.</li>\n<li>Backup and restore validation text: backup job block with prune/retention details.</li>\n</ul>\n<h2>Source repository</h2>\n<p>fontenotjeremy71-hub/jeremy-homelab-ops</p>\n<h2>Source commit</h2>\n<p>fb6c286873285778d88d6d5cfde0b9bd00b96f36</p>\n<h2>Source path</h2>\n<ul>\n<li><code>inventories/proxmox-inventory-20260626-010601.json</code></li>\n<li><code>evidence/home-lab-backup-restore-validation-20260629.txt</code></li>\n</ul>\n<h2>Source file SHA-256</h2>\n<ul>\n<li><code>inventories/proxmox-inventory-20260626-010601.json</code>: D652D1EF753E14242C07F84F19FBF09F642F07C3B09CFE2E98AA7F2B176ADE3D</li>\n<li><code>evidence/home-lab-backup-restore-validation-20260629.txt</code>: 4637E848C9B318B8C74BB9C6E4569B3CC03E6686CE64FA367CF6DEC05FA52E13</li>\n</ul>\n<h2>Public artifact SHA-256</h2>\n<p>Recorded in <code>evidence-library/integrity/evidence-hashes.json</code> for this artifact path. The self-hash is recorded outside this file so the digest does not invalidate itself.</p>\n<h2>Sanitization performed</h2>\n<p>Removed scheduling metadata not needed for the claim, command context, host details, and any unrelated storage, VM, or task information.</p>\n<h2>Limitations</h2>\n<ul>\n<li>Personal nonproduction home lab only.</li>\n<li>Configuration presence does not prove that every recent backup task succeeded.</li>\n<li>This artifact does not claim successful recent backups for VMs 200 or 300 because no direct recent OK task output is published here.</li>\n<li>This artifact does not prove restore integrity, RTO, RPO, recurring restore assurance, or disaster-recovery readiness.</li>\n</ul>\n<h2>Validation date</h2>\n<p>2026-06-30</p>\n<h2>Classification</h2>\n<p>Configured</p></article>",
    "active": "Projects"
  },
  "documentation/39f7bbaf9ecb": {
    "title": "Proxmox Backup Inventory",
    "description": "Retained technical documentation: Proxmox Backup Inventory",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Proxmox Backup Inventory</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/on-prem-home-lab/current-validated-state/direct-evidence/proxmox-backup-inventory.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Proxmox Backup Inventory</h2>\n<h2>Claim supported</h2>\n<p>Direct backup inventory evidence supports active backup-hdd storage, retained archive presence by VM count, and the boundary that archive presence is not the same as recurring restore assurance.</p>\n<h2>Directly observed values</h2>\n<ul>\n<li>Storage: backup-hdd.</li>\n<li>Storage path retained as claim-relevant evidence: <code>/mnt/pve/backup-hdd</code>.</li>\n<li>Storage status from current inventory: type <code>dir</code>, content <code>backup</code>, total 982,809,350,144 bytes, used 172,812,951,552 bytes, available 759,996,993,536 bytes.</li>\n<li>Backup validation storage view: 916 GB size, 127 GB used, 743 GB available, 15 percent used.</li>\n<li>Retained backup counts: VM 100 count 4, VM 200 count 4, VM 300 count 4, VM 400 count 4.</li>\n<li>No successful recent per-VM vzdump task status is claimed from this artifact.</li>\n<li>Operational limitation retained: Proxmox thin-pool risk is visible. The retained storage source directly shows a 428 GB thin pool and provisioned VM/snapshot thin volumes that exceed that physical thin-pool size. The requested auto-extension warning is retained as a limitation boundary; the retained source set inspected for this publication does not include a separate thin-pool auto-extension configuration dump.</li>\n</ul>\n<h2>Source command or source object</h2>\n<ul>\n<li>Proxmox read-only inventory object: <code>storage[]</code>.</li>\n<li>Backup and restore validation text: backup counts and storage block.</li>\n<li>Retained public storage evidence: Proxmox storage status, logical volume, and thin-pool usage sections.</li>\n</ul>\n<h2>Source repository</h2>\n<ul>\n<li>fontenotjeremy71-hub/jeremy-homelab-ops</li>\n<li>fontenotjeremy71-hub/jeremyfontenot, for the retained older public storage limitation artifact</li>\n</ul>\n<h2>Source commit</h2>\n<ul>\n<li>Operations source: fb6c286873285778d88d6d5cfde0b9bd00b96f36</li>\n<li>Website retained public evidence source: 5813445f3cc828e2146773299c47967292da7fd5</li>\n</ul>\n<h2>Source path</h2>\n<ul>\n<li><code>inventories/proxmox-inventory-20260626-010601.json</code></li>\n<li><code>evidence/home-lab-backup-restore-validation-20260629.txt</code></li>\n<li><code>evidence-library/projects/on-prem-home-lab/validated-2026-06-21/text/proxmox-storage-validation.txt</code></li>\n</ul>\n<h2>Source file SHA-256</h2>\n<ul>\n<li><code>inventories/proxmox-inventory-20260626-010601.json</code>: D652D1EF753E14242C07F84F19FBF09F642F07C3B09CFE2E98AA7F2B176ADE3D</li>\n<li><code>evidence/home-lab-backup-restore-validation-20260629.txt</code>: 4637E848C9B318B8C74BB9C6E4569B3CC03E6686CE64FA367CF6DEC05FA52E13</li>\n<li><code>evidence-library/projects/on-prem-home-lab/validated-2026-06-21/text/proxmox-storage-validation.txt</code>: 7F069AA31390D90D99F0000D6F6236A2B60F5D28F061668C0BBD5054FA93741F</li>\n</ul>\n<h2>Public artifact SHA-256</h2>\n<p>Recorded in <code>evidence-library/integrity/evidence-hashes.json</code> for this artifact path. The self-hash is recorded outside this file so the digest does not invalidate itself.</p>\n<h2>Sanitization performed</h2>\n<p>Removed PIDs, unrelated filesystems, device identifiers not needed for the claim, snapshot parent names, raw command history, and backup archive filenames. Retained the backup storage path because it is the public claim being validated.</p>\n<h2>Limitations</h2>\n<ul>\n<li>Personal nonproduction home lab only.</li>\n<li>Captured-state evidence only.</li>\n<li>Backup archive count does not prove backup integrity.</li>\n<li>No claim is made that all recent backup tasks succeeded.</li>\n<li>The thin-pool warning is an operational limitation and is not framed as a failed backup or failed restore.</li>\n<li>No RTO, RPO, production disaster-recovery readiness, or recurring restore assurance is claimed.</li>\n</ul>\n<h2>Validation date</h2>\n<p>2026-06-30</p>\n<h2>Classification</h2>\n<p>Documented / Limitation</p></article>",
    "active": "Projects"
  },
  "documentation/05a0e7fbeefa": {
    "title": "Proxmox Platform Inventory",
    "description": "Retained technical documentation: Proxmox Platform Inventory",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Proxmox Platform Inventory</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/on-prem-home-lab/current-validated-state/direct-evidence/proxmox-platform-inventory.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Proxmox Platform Inventory</h2>\n<h2>Claim supported</h2>\n<p>Direct Proxmox inventory supports the personal nonproduction lab platform claim for Proxmox VE, primary VM IDs, VM names, running state, allocated vCPU, memory, disk, bridge placement, guest-agent state, and Linux01 VLAN tag where captured.</p>\n<h2>Directly observed values</h2>\n<ul>\n<li>Proxmox VE version: 9.2.3.</li>\n<li>Proxmox kernel: Linux 7.0.12-1-pve.</li>\n<li>VM 100: pfsense-fw, running, 2 vCPU, 4 GB memory, 32 GB disk, bridges vmbr0 and vmbr1, guest agent not configured and not responding.</li>\n<li>VM 200: dc01, running, 2 vCPU, 4 GB memory, 80 GB disk, bridge vmbr1, guest agent not configured and not responding.</li>\n<li>VM 300: ws01, running, 2 vCPU, 4 GB memory, 80 GB disk, bridge vmbr1, guest agent not configured and not responding.</li>\n<li>VM 400: linux01, running, 2 vCPU, 2 GB memory, 40 GB disk, bridge vmbr1, guest agent configured and responding.</li>\n<li>Linux01 VLAN tag: 30, from the retained source reconciliation record.</li>\n</ul>\n<h2>Source command or source object</h2>\n<ul>\n<li>Proxmox read-only inventory object: <code>version</code>, <code>node.kernel</code>, <code>virtualMachines[]</code>, and <code>storage[]</code>.</li>\n<li>Source reconciliation object: current command/API evidence row for Linux01 Proxmox VM tag.</li>\n</ul>\n<h2>Source repository</h2>\n<p>fontenotjeremy71-hub/jeremy-homelab-ops</p>\n<h2>Source commit</h2>\n<p>fb6c286873285778d88d6d5cfde0b9bd00b96f36</p>\n<h2>Source path</h2>\n<ul>\n<li><code>inventories/proxmox-inventory-20260626-010601.json</code></li>\n<li><code>evidence/home-lab-source-reconciliation-20260626-012606.md</code></li>\n</ul>\n<h2>Source file SHA-256</h2>\n<ul>\n<li><code>inventories/proxmox-inventory-20260626-010601.json</code>: D652D1EF753E14242C07F84F19FBF09F642F07C3B09CFE2E98AA7F2B176ADE3D</li>\n<li><code>evidence/home-lab-source-reconciliation-20260626-012606.md</code>: 2D377A7A6703F8C3C5FBB77AA093569806DDB7939CFA88FD6A0ECF801484C3EE</li>\n</ul>\n<h2>Public artifact SHA-256</h2>\n<p>Recorded in <code>evidence-library/integrity/evidence-hashes.json</code> for this artifact path. The self-hash is recorded outside this file so the digest does not invalidate itself.</p>\n<h2>Sanitization performed</h2>\n<p>Removed node uptime, repository ID, host resource details not needed for the public claim, snapshot parent names, raw paths unrelated to the platform claim, and any fields not required to prove the listed inventory values.</p>\n<h2>Limitations</h2>\n<ul>\n<li>Personal nonproduction home lab only.</li>\n<li>Captured-state evidence only; this does not prove ongoing availability.</li>\n<li>Proxmox inventory does not prove guest operating-system health, pfSense firewall policy, Active Directory health, backup restore integrity, or Windows service state.</li>\n<li>Linux01 VLAN tag is supported by the reconciliation source, not by the VM list object alone.</li>\n</ul>\n<h2>Validation date</h2>\n<p>2026-06-30</p>\n<h2>Classification</h2>\n<p>Validated</p></article>",
    "active": "Projects"
  },
  "documentation/9f8e98caeacd": {
    "title": "Proxmox Restore Validation",
    "description": "Retained technical documentation: Proxmox Restore Validation",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Proxmox Restore Validation</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/on-prem-home-lab/current-validated-state/direct-evidence/proxmox-restore-validation.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Proxmox Restore Validation</h2>\n<h2>Claim supported</h2>\n<p>Direct restore validation evidence supports one isolated Linux01 restore drill from source VM 400 to temporary VM 401.</p>\n<h2>Directly observed values</h2>\n<ul>\n<li>Source VM: 400.</li>\n<li>Temporary restore VM: 401.</li>\n<li>Restored disk size boundary: VM 400 boot disk shown as 40 GB in the retained restore validation source.</li>\n<li>Temporary VM network isolation: temporary VM network isolated before boot.</li>\n<li>Guest validation: Ubuntu 26.04 LTS boot and QEMU Guest Agent response were validated in the retained restore evidence.</li>\n<li>Cleanup: temporary VM 401 was shut down and purged successfully.</li>\n<li>The source set inspected for this publication does not include a retained per-command restore transcript with archive filename, progress percentage, or literal final <code>TASK OK</code> line; those details are therefore not claimed here.</li>\n<li>Operational limitation retained: Proxmox thin-pool risk remains visible and is not framed as a failed restore.</li>\n</ul>\n<h2>Source command or source object</h2>\n<p>Backup and restore validation text: VM state and restore drill sections.</p>\n<h2>Source repository</h2>\n<p>fontenotjeremy71-hub/jeremy-homelab-ops</p>\n<h2>Source commit</h2>\n<p>fb6c286873285778d88d6d5cfde0b9bd00b96f36</p>\n<h2>Source path</h2>\n<p><code>evidence/home-lab-backup-restore-validation-20260629.txt</code></p>\n<h2>Source file SHA-256</h2>\n<p><code>evidence/home-lab-backup-restore-validation-20260629.txt</code>: 4637E848C9B318B8C74BB9C6E4569B3CC03E6686CE64FA367CF6DEC05FA52E13</p>\n<h2>Public artifact SHA-256</h2>\n<p>Recorded in <code>evidence-library/integrity/evidence-hashes.json</code> for this artifact path. The self-hash is recorded outside this file so the digest does not invalidate itself.</p>\n<h2>Sanitization performed</h2>\n<p>Removed PIDs and retained only the VM IDs, restore scope, network isolation, guest identity, guest-agent response, and cleanup outcome needed to support the public claim.</p>\n<h2>Limitations</h2>\n<ul>\n<li>Personal nonproduction home lab only.</li>\n<li>Captured-state evidence only.</li>\n<li>One isolated Linux01 restore drill only.</li>\n<li>No recurring restore assurance.</li>\n<li>No RTO or RPO claim.</li>\n<li>No disaster-recovery readiness, SLA, production, or employer-system claim.</li>\n<li>Thin-pool warnings are operational limitations and are not evidence of a failed restore.</li>\n</ul>\n<h2>Validation date</h2>\n<p>2026-06-30</p>\n<h2>Classification</h2>\n<p>Tested</p></article>",
    "active": "Projects"
  },
  "documentation/34b581f1eabe": {
    "title": "WS01 System and Domain Validation",
    "description": "Retained technical documentation: WS01 System and Domain Validation",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>WS01 System and Domain Validation</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/on-prem-home-lab/current-validated-state/direct-evidence/ws01-system-and-domain-validation.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>WS01 System and Domain Validation</h2>\n<h2>Claim supported</h2>\n<p>Direct WS01 inventory and Proxmox inventory support the WS01 system, VM association, domain membership, and network-state claims for the personal nonproduction lab.</p>\n<h2>Directly observed values</h2>\n<ul>\n<li>Proxmox VM association: VM 300 name ws01, running.</li>\n<li>Windows edition: Microsoft Windows 10 Pro.</li>\n<li>Windows version: 10.0.19045.</li>\n<li>Windows build: 19045.</li>\n<li>Domain membership: WS01 is part of domain ad.jeremyfontenot.online.</li>\n<li>Secure channel result: true.</li>\n<li>Network interface: Ethernet.</li>\n<li>IPv4 address: 10.10.20.100.</li>\n<li>Default gateway: 10.10.20.1.</li>\n<li>DNS server: 10.10.20.10.</li>\n<li>DHCP enabled: true.</li>\n<li>DHCP server: 10.10.20.10.</li>\n<li>Current supported OS reconciliation: Windows 10 Pro 10.0.19045 is the supported current value in the retained WS01 inventory.</li>\n</ul>\n<h2>Source command or source object</h2>\n<ul>\n<li>Authenticated WS01 target-local inventory result objects: OperatingSystem, NetworkConfiguration, DomainMembership, and SecureChannel.</li>\n<li>Proxmox read-only inventory object: <code>virtualMachines[]</code> entry for VM 300.</li>\n</ul>\n<h2>Source repository</h2>\n<p>fontenotjeremy71-hub/jeremy-homelab-ops</p>\n<h2>Source commit</h2>\n<p>fb6c286873285778d88d6d5cfde0b9bd00b96f36</p>\n<h2>Source path</h2>\n<ul>\n<li><code>inventories/ws01-inventory-20260626-012952.json</code></li>\n<li><code>inventories/proxmox-inventory-20260626-010601.json</code></li>\n</ul>\n<h2>Source file SHA-256</h2>\n<ul>\n<li><code>inventories/ws01-inventory-20260626-012952.json</code>: 1438FA0F72F241E2613C5D35B797492FFC754B0E818A74154DE38DD74082A6B1</li>\n<li><code>inventories/proxmox-inventory-20260626-010601.json</code>: D652D1EF753E14242C07F84F19FBF09F642F07C3B09CFE2E98AA7F2B176ADE3D</li>\n</ul>\n<h2>Public artifact SHA-256</h2>\n<p>Recorded in <code>evidence-library/integrity/evidence-hashes.json</code> for this artifact path. The self-hash is recorded outside this file so the digest does not invalidate itself.</p>\n<h2>Sanitization performed</h2>\n<p>Removed executing account, local administrator membership, SIDs, GUIDs, group policy raw details, software inventory, unrelated services, event data, and local profile or path information.</p>\n<h2>Limitations</h2>\n<ul>\n<li>Personal nonproduction home lab only.</li>\n<li>Captured-state evidence only.</li>\n<li>This artifact validates WS01 inventory values and domain membership state only.</li>\n<li>It does not claim production support, employer-system administration, complete endpoint hardening, or complete application/service validation.</li>\n</ul>\n<h2>Validation date</h2>\n<p>2026-06-30</p>\n<h2>Classification</h2>\n<p>Validated</p></article>",
    "active": "Projects"
  },
  "documentation/78e82a05f0f8": {
    "title": "Redaction Log",
    "description": "Retained technical documentation: Redaction Log",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Redaction Log</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/on-prem-home-lab/current-validated-state/redaction-log.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Redaction Log</h2>\n<p>No credentials, private keys, tokens, cookies, or secrets were copied. Public summaries avoid private repository links and retain only reviewer-safe claim context.</p>\n<p>For the direct evidence artifacts, usernames, executing accounts, MAC addresses, UUIDs, VM generation IDs, UPIDs, PIDs, SIDs, internal object GUIDs, absolute local Windows user paths, unnecessary root paths, unrelated installed features, unrelated command history, unnecessary timestamps, and snapshot parent names were removed or omitted where they were not required to support the stated public claim.</p>\n<p>The Proxmox thin-pool warning is retained as an operational limitation. It is not framed as a failed restore or infrastructure failure.</p></article>",
    "active": "Projects"
  },
  "documentation/5b8e4cc34ba2": {
    "title": "Backup and Restore Validation",
    "description": "Retained technical documentation: Backup and Restore Validation",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Backup and Restore Validation</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/on-prem-home-lab/current-validated-state/source-summaries/backup-and-restore-validation.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Backup and Restore Validation</h2>\n<h2>Status</h2>\n<p>Partially validated by retained June 24 documentation. No restore test was repeated during the 2026-06-26 read-only operations run.</p>\n<h2>Current Evidence</h2>\n<p>Read-only Proxmox inventory observed an enabled scheduled backup job:</p>\n<ul>\n<li>Job ID: <code>backup-critical-lab-vms</code></li>\n<li>VMs: <code>100,200,300,400</code></li>\n<li>Storage: <code>backup-hdd</code></li>\n<li>Schedule: <code>sun 02:00</code></li>\n<li>Mode: <code>snapshot</code></li>\n<li>Compression: <code>zstd</code></li>\n</ul>\n<p>Storage inventory observed backup storage named <code>backup-hdd</code> at <code>/mnt/pve/backup-hdd</code>.</p>\n<p>The June 24 IP-address-documented portfolio documentation records isolated startup restore checks for:</p>\n<ul>\n<li>WS01 restored temporarily as VM 500, with the NIC link down before startup.</li>\n<li>Linux01 restored temporarily as VM 600, with the NIC link down before startup.</li>\n</ul>\n<p>The current Proxmox inventory no longer shows VM 500 or VM 600, which is consistent with the documentation stating both temporary restore VMs were removed after validation.</p>\n<h2>Required Future Validation</h2>\n<p>Before claiming recurring restore assurance, perform an approved fresh restore validation that documents:</p>\n<ul>\n<li>Exact VM or test restore target</li>\n<li>Backup file selected</li>\n<li>Restore command or UI action</li>\n<li>Network isolation approach</li>\n<li>Validation checks</li>\n<li>Cleanup steps</li>\n<li>Rollback procedure</li>\n<li>Evidence proving successful boot or file-level recovery</li>\n</ul>\n<h2>Claim Boundary</h2>\n<p>The current operations repository validates backup job configuration visibility and retains documentation of June 24 isolated startup restore checks. It does not validate current backup archive integrity, recurring restore success, RTO, RPO, or disaster-recovery readiness.</p></article>",
    "active": "Projects"
  },
  "documentation/f9d38f44ed30": {
    "title": "Centralized Logging Expansion Change Plan",
    "description": "Retained technical documentation: Centralized Logging Expansion Change Plan",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Centralized Logging Expansion Change Plan</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/on-prem-home-lab/current-validated-state/source-summaries/centralized-logging-expansion.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Centralized Logging Expansion Change Plan</h2>\n<h2>Status</h2>\n<p>Planned. Approval required before implementation.</p>\n<h2>Current State</h2>\n<p>June 24 documentation records pfSense forwarding selected system, firewall, authentication, VPN, and gateway events to Linux01 at <code>10.10.30.20:514</code>, with Linux01 rsyslog listeners and alert-match logging. Current Proxmox metadata validates Linux01 is running on VLAN 30 and QEMU guest agent is responding.</p>\n<p>The June 26 authenticated Linux01 target-local inventory validates rsyslog runtime state from inside the guest. Linux01 reports rsyslog active, TCP and UDP 514 listening on <code>10.10.30.20</code>, remote collector configuration under <code>/etc/rsyslog.d/10-remote-collector.conf</code>, pfSense alert file configuration under <code>/etc/rsyslog.d/05-pfsense-alerts.conf</code>, and rsyslog logrotate configuration under <code>/etc/logrotate.d/rsyslog</code>.</p>\n<h2>Evidence</h2>\n<ul>\n<li>Proxmox current API: Linux01 VM 400 running, <code>tag=30</code>, guest agent responding.</li>\n<li>DNS current command: <code>linux01.ad.jeremyfontenot.online</code> resolves to <code>10.10.30.20</code>.</li>\n<li>June 24 IP-address-documented documentation: pfSense-to-Linux01 rsyslog forwarding and alert logging documented.</li>\n<li>Current reachability check: TCP 514 from the current client path timed out and is not treated as rsyslog service failure.</li>\n<li><code>inventories/linux01-inventory-20260626-020257.json</code>: SSH from the management execution path timed out; guest-side rsyslog state was <code>NOT TESTED</code>.</li>\n<li><code>inventories/linux01-inventory-20260626-084312.json</code>: authenticated target-local Linux01 inventory validates rsyslog service/listener state, route/DNS state, AD integration indicators, disk capacity, and logrotate summary.</li>\n<li><code>evidence/linux01-local-inventory-validation-20260626-035220.md</code>: sanitized evidence for Linux01 target-local inventory import and validation.</li>\n</ul>\n<h2>Target State</h2>\n<p>Expand centralized logging beyond pfSense by adding documented, least-privilege log forwarding or collection for Windows and Proxmox sources without weakening existing firewall policy.</p>\n<p>Candidate target design, pending implementation approval:</p>\n<ul>\n<li>Keep Linux01 as the primary syslog receiver because target-local evidence now confirms available root filesystem capacity, active rsyslog listeners on <code>10.10.30.20:514</code> for TCP and UDP, and rsyslog log rotation. UFW source restrictions still require a clearer privileged summary before any new source is added.</li>\n<li>Evaluate Windows Event Forwarding for DC01 and WS01 with DC01 as the likely Windows Event Collector only if existing domain policy and firewall posture support it safely. Do not make DC01 a collector until a separate change plan covers subscription type, source computers, event channels, retention, and rollback.</li>\n<li>Evaluate Proxmox remote syslog forwarding to Linux01 or another approved receiver only after documenting source IP, destination IP, protocol, port, and retention.</li>\n<li>Keep Linux local logs on Linux01 in local journald/rsyslog paths unless an approved monitoring platform is introduced.</li>\n</ul>\n<h2>Exact Systems</h2>\n<ul>\n<li>Linux01 VM 400</li>\n<li>DC01 VM 200</li>\n<li>WS01 VM 300</li>\n<li>Proxmox host <code>192.168.0.242</code></li>\n<li>pfSense VM 100</li>\n</ul>\n<h2>Exact Commands</h2>\n<p>Discovery and planning only until approved:</p>\n<pre><code class=\"language-powershell\">pwsh -NoProfile -File .\\scripts\\linux\\Get-LinuxReadOnlyInventory.ps1\npwsh -NoProfile -File .\\scripts\\active-directory\\Invoke-DC01LocalReadOnlyCollection.ps1\npwsh -NoProfile -File .\\scripts\\windows-server\\Invoke-WS01LocalReadOnlyCollection.ps1\n</code></pre>\n<p>Implementation commands are intentionally not authorized in this change plan. Linux01 rsyslog state has been validated, but Windows Event Forwarding, Proxmox logging state, pfSense sender configuration, and any firewall or GPO requirements still need a dedicated approved implementation plan.</p>\n<p>Target-local validation commands prepared for the next inventory pass:</p>\n<pre><code class=\"language-bash\">run_id=\"$(date -u +%Y%m%d-%H%M%S)\"\nbash ./Invoke-Linux01LocalReadOnlyCollection.sh \"/tmp/linux01-inventory-${run_id}.json\"\n</code></pre>\n<h2>Required Privileges</h2>\n<ul>\n<li>Read-only collection: existing approved sessions.</li>\n<li>Any logging configuration change: administrative privileges on the target system and explicit approval.</li>\n</ul>\n<h2>Network Requirements</h2>\n<p>No firewall openings are approved by this plan. Any proposed log path must identify source, destination, protocol, port, and existing firewall state before implementation.</p>\n<p>Expected network review before implementation:</p>\n<ul>\n<li>pfSense to Linux01 syslog path: verify existing source restriction, protocol, and port from configuration evidence before changing anything.</li>\n<li>DC01 and WS01 to collector: identify whether Windows Event Forwarding uses existing domain/Kerberos paths or requires new firewall scope. Any firewall or GPO change requires a dedicated approved plan.</li>\n<li>Proxmox to Linux01 syslog: document management-network source, Linux VLAN destination, routing path, and firewall requirements before implementation.</li>\n</ul>\n<h2>Security Impact</h2>\n<p>Positive if implemented carefully: stronger audit trail and troubleshooting visibility. Risk if overbroad: excessive log exposure, sensitive log retention, or unnecessary inter-network access.</p>\n<p>Security controls required in the implementation plan:</p>\n<ul>\n<li>Exclude credentials, private keys, Kerberos tickets, certificate private material, and sensitive raw log excerpts from repository evidence.</li>\n<li>Prefer source-restricted firewall rules over broad subnet acceptance if any new rules are approved.</li>\n<li>Document whether logs are unauthenticated syslog, authenticated Windows Event Forwarding, or locally collected files.</li>\n<li>Define integrity expectations honestly; plain syslog improves visibility but does not provide strong transport integrity by itself.</li>\n</ul>\n<h2>Service-Impact Risk</h2>\n<p>Low for discovery. Medium for configuration changes because logging service reloads or firewall changes could disrupt visibility or access if done incorrectly.</p>\n<p>Implementation must avoid service restarts unless the approved plan explicitly requires them. Prefer configuration validation and reload-only workflows where technically appropriate.</p>\n<h2>Retention, Rotation, and Capacity</h2>\n<p>Linux01 authenticated inventory currently supports:</p>\n<ul>\n<li>Root filesystem capacity: 19 GiB total, 13 GiB available, 29 percent used.</li>\n<li>Current rsyslog listener state: TCP and UDP 514 listening on <code>10.10.30.20</code>.</li>\n<li>Current rsyslog destination templates/configuration: <code>/var/log/remote/%FROMHOST-IP%/messages.log</code> and <code>/var/log/remote/pfsense-alerts.log</code> are configured.</li>\n<li>Current logrotate policy for rsyslog-managed files: weekly rotation, four rotations, compression, missing files tolerated, empty files skipped.</li>\n<li>Disk-use alert threshold. Initial planning threshold: warning at 80 percent used, critical at 90 percent used, pending Jeremy approval.</li>\n<li>Failure behavior if Linux01 is unavailable: sources should continue local logging and must not block authentication, DNS, DHCP, routing, or VM operation.</li>\n</ul>\n<h2>Alerting</h2>\n<p>Alerting remains planned. Candidate non-invasive alerts after receiver validation:</p>\n<ul>\n<li>Linux01 log filesystem above threshold.</li>\n<li>rsyslog service inactive.</li>\n<li>No pfSense log receipt within an expected interval.</li>\n<li>Proxmox backup job failure or missing latest backup.</li>\n<li>Windows Event Forwarding subscription source inactive, if WEF is later approved.</li>\n</ul>\n<h2>Validation</h2>\n<ul>\n<li>Confirm log sender service state.</li>\n<li>Confirm listener state on Linux01.</li>\n<li>Send one controlled non-sensitive test event.</li>\n<li>Confirm event arrives in the expected file or index.</li>\n<li>Confirm no credentials or private data are written to repository evidence.</li>\n</ul>\n<h2>Rollback</h2>\n<ul>\n<li>Revert only the logging configuration added by the approved implementation.</li>\n<li>Restore any exported pre-change configuration where applicable.</li>\n<li>Restart/reload only affected logging services if required and approved.</li>\n</ul>\n<h2>Evidence Capture</h2>\n<ul>\n<li>Timestamped pre-change inventory.</li>\n<li>Sanitized configuration diff or export.</li>\n<li>Exact command transcript with secrets omitted.</li>\n<li>Controlled test-event result.</li>\n<li>Rollback verification.</li>\n</ul>\n<h2>Approval Requirement</h2>\n<p>Explicit Jeremy approval is required before any logging configuration, firewall, service, package, or scheduled-task change.</p>\n<h2>Claim Boundary</h2>\n<p>This plan is implementation-ready documentation only. It does not implement centralized logging expansion, change firewall policy, install software, restart services, or modify any infrastructure system. Linux01 rsyslog receiver state is now validated by target-local inventory; additional sources and alerting remain planned until separately approved and implemented.</p></article>",
    "active": "Projects"
  },
  "documentation/509dde796a34": {
    "title": "Home Lab Inventory and Validation Evidence",
    "description": "Retained technical documentation: Home Lab Inventory and Validation Evidence",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Home Lab Inventory and Validation Evidence</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/on-prem-home-lab/current-validated-state/source-summaries/home-lab-inventory-validation.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Home Lab Inventory and Validation Evidence</h2>\n<ul>\n<li>Timestamp: <code>2026-06-26T01:06:01.2273166-05:00</code></li>\n<li>Source workstation: <code>DESKTOP-MR3F9A1</code></li>\n<li>Repository: <code>C:\\Users\\jeremy\\Documents\\projects\\jeremy-homelab-ops</code></li>\n<li>Execution mode: read-only discovery, inventory, and validation</li>\n<li>Infrastructure configuration changes: <code>0</code></li>\n</ul>\n<h2>Commands and Access Paths</h2>\n<ul>\n<li>Proxmox inventory: <code>mcp__home_lab</code> read-only Proxmox tools.</li>\n<li>Repository validation: <code>pwsh -NoProfile -File .\\tests\\Test-RepositoryStructure.ps1 -WriteEvidence</code></li>\n<li>Connectivity validation: <code>pwsh -NoProfile -File .\\scripts\\monitoring\\Test-HomeLabConnectivity.ps1 -TimeoutMilliseconds 1000</code></li>\n<li>DNS validation: <code>Resolve-DnsName ad.jeremyfontenot.online -Server 10.10.20.10</code></li>\n<li>Route validation: <code>route.exe print -4</code></li>\n<li>Domain discovery: <code>nltest /dsgetdc:ad.jeremyfontenot.online</code>, <code>nltest /dclist:ad.jeremyfontenot.online</code>, <code>nltest /sc_query:JFAD</code></li>\n<li>Module availability: <code>Get-Command Get-ADDomain</code>, <code>Get-Command Get-GPO</code>, <code>Get-Command Get-DhcpServerv4Scope</code>, <code>Get-Command Get-DnsServerZone</code></li>\n</ul>\n<h2>Validated Results</h2>\n<div class=\"table-scroll\"><table>\n<thead>\n<tr>\n<th>Check</th>\n<th>Status</th>\n<th>Observed result</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td>Proxmox API inventory</td>\n<td>PASS</td>\n<td>Version <code>9.2.3</code>, node <code>proxmox</code> online, VMs <code>100</code>, <code>200</code>, <code>300</code>, and <code>400</code> running.</td>\n</tr>\n<tr>\n<td>Proxmox storage inventory</td>\n<td>PASS</td>\n<td><code>local-lvm</code>, <code>backup-hdd</code>, and <code>local</code> reported capacity and usage.</td>\n</tr>\n<tr>\n<td>Proxmox backup job inventory</td>\n<td>PASS</td>\n<td>Job <code>backup-critical-lab-vms</code> enabled for VMs <code>100,200,300,400</code>, storage <code>backup-hdd</code>, schedule <code>sun 02:00</code>.</td>\n</tr>\n<tr>\n<td>Proxmox management TCP</td>\n<td>PASS</td>\n<td><code>192.168.0.242:8006</code> connected in <code>67 ms</code>.</td>\n</tr>\n<tr>\n<td>DC01 DNS TCP</td>\n<td>PASS</td>\n<td><code>10.10.20.10:53</code> connected in <code>6 ms</code>.</td>\n</tr>\n<tr>\n<td>Domain DNS resolution</td>\n<td>PASS</td>\n<td><code>ad.jeremyfontenot.online</code> resolved to <code>10.10.20.10</code> using server <code>10.10.20.10</code>.</td>\n</tr>\n<tr>\n<td>VPN route</td>\n<td>PASS</td>\n<td>Route table includes <code>10.10.20.0/24</code> via <code>10.10.40.1</code> from <code>10.10.40.2</code>.</td>\n</tr>\n<tr>\n<td>Repository validation</td>\n<td>PASS</td>\n<td>Repository validation completed with no failing checks.</td>\n</tr>\n</tbody>\n</table></div>\n<h2>Warnings and Inconclusive Results</h2>\n<div class=\"table-scroll\"><table>\n<thead>\n<tr>\n<th>Check</th>\n<th>Status</th>\n<th>Observed result</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td>pfSense LAN HTTPS TCP</td>\n<td>WARNING</td>\n<td><code>10.10.20.1:443</code> timed out after <code>1000 ms</code>.</td>\n</tr>\n<tr>\n<td>DC01 Kerberos TCP</td>\n<td>WARNING</td>\n<td><code>10.10.20.10:88</code> timed out after <code>1000 ms</code>.</td>\n</tr>\n<tr>\n<td>DC01 LDAP TCP</td>\n<td>WARNING</td>\n<td><code>10.10.20.10:389</code> timed out after <code>1000 ms</code>.</td>\n</tr>\n<tr>\n<td>DC01 SMB TCP</td>\n<td>WARNING</td>\n<td><code>10.10.20.10:445</code> timed out after <code>1000 ms</code>.</td>\n</tr>\n<tr>\n<td>DC01 WinRM TCP</td>\n<td>WARNING</td>\n<td><code>10.10.20.10:5985</code> timed out after <code>1000 ms</code>.</td>\n</tr>\n<tr>\n<td>Domain controller discovery</td>\n<td>INCONCLUSIVE</td>\n<td><code>nltest /dsgetdc:ad.jeremyfontenot.online</code> returned <code>ERROR_NO_SUCH_DOMAIN</code> from the current workstation context.</td>\n</tr>\n<tr>\n<td>Secure channel query</td>\n<td>INCONCLUSIVE</td>\n<td><code>nltest /sc_query:JFAD</code> returned <code>RPC_S_SERVER_UNAVAILABLE</code> from the current workstation context.</td>\n</tr>\n<tr>\n<td>DNS Server module inventory</td>\n<td>NOT TESTED</td>\n<td><code>Get-DnsServerZone</code> is not installed on the management workstation.</td>\n</tr>\n<tr>\n<td>DHCP Server module inventory</td>\n<td>NOT TESTED</td>\n<td><code>Get-DhcpServerv4Scope</code> is not installed on the management workstation.</td>\n</tr>\n<tr>\n<td>Group Policy inventory</td>\n<td>NOT TESTED</td>\n<td><code>Get-GPO</code> is not installed on the management workstation.</td>\n</tr>\n<tr>\n<td>WS01 guest inventory</td>\n<td>NOT TESTED</td>\n<td>No verified WS01 management IP or guest-agent response was available in this run.</td>\n</tr>\n</tbody>\n</table></div>\n<h2>Claim Boundary</h2>\n<p>This evidence records read-only repository validation, Proxmox connector inventory, local route inspection, DNS resolution, and bounded TCP reachability checks. It does not validate pfSense configuration, firewall policy, NAT policy, VPN configuration correctness, Active Directory health, DNS zone health, DHCP scope health, Group Policy processing, WS01 domain relationship, backup restore integrity, or administrative access to Windows guests.</p>\n<p>Timeouts, module absence, and <code>nltest</code> failures are recorded observations only. They are not proof that the corresponding infrastructure components are offline, misconfigured, or unavailable.</p></article>",
    "active": "Projects"
  },
  "documentation/d4b3c3e6c035": {
    "title": "Home Lab Source of Truth",
    "description": "Retained technical documentation: Home Lab Source of Truth",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Home Lab Source of Truth</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/on-prem-home-lab/current-validated-state/source-summaries/home-lab-source-of-truth.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Home Lab Source of Truth</h2>\n<h2>Status</h2>\n<p>Current as of the 2026-06-26 read-only reconciliation run.</p>\n<h2>Source Precedence</h2>\n<ol>\n<li>Current command output, API output, guest-agent output, or authenticated system query.</li>\n<li>New timestamped evidence collected during this run.</li>\n<li>Current <code>jeremy-homelab-ops</code> inventories and evidence.</li>\n<li>Current <code>main</code> branch of <code>fontenotjeremy71-hub/jeremyfontenot</code>.</li>\n<li>June 24, 2026 IP-address-documented portfolio documentation.</li>\n<li>June 21, 2026 curated historical evidence.</li>\n<li>Currently deployed website content.</li>\n<li>Old prompts, summaries, assumptions, or undocumented memory.</li>\n</ol>\n<h2>Current Supported Architecture</h2>\n<div class=\"table-scroll\"><table>\n<thead>\n<tr>\n<th>Component</th>\n<th>Current supported value</th>\n<th>Classification</th>\n<th>Evidence</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td>Physical host</td>\n<td>Dell PowerEdge R710</td>\n<td>Current documentation</td>\n<td>Portfolio and operations docs</td>\n</tr>\n<tr>\n<td>Hypervisor</td>\n<td>Proxmox VE <code>9.2.3</code></td>\n<td>Current</td>\n<td>Proxmox API</td>\n</tr>\n<tr>\n<td>Proxmox management</td>\n<td><code>192.168.0.242/24</code>, gateway <code>192.168.0.1</code></td>\n<td>Current</td>\n<td>Proxmox API and TCP validation</td>\n</tr>\n<tr>\n<td>pfSense</td>\n<td>VM 100 <code>pfsense-fw</code></td>\n<td>Current</td>\n<td>Proxmox API</td>\n</tr>\n<tr>\n<td>pfSense WAN</td>\n<td><code>192.168.0.205/24</code></td>\n<td>Current documentation, not re-queried from pfSense</td>\n<td>June 24 DOCX</td>\n</tr>\n<tr>\n<td>pfSense LAN</td>\n<td><code>10.10.20.1/24</code></td>\n<td>Current documentation</td>\n<td>June 24 DOCX and topology</td>\n</tr>\n<tr>\n<td>Linux VLAN gateway</td>\n<td><code>10.10.30.1/24</code></td>\n<td>Current documentation</td>\n<td>June 24 DOCX</td>\n</tr>\n<tr>\n<td>OpenVPN network</td>\n<td><code>10.10.40.0/24</code></td>\n<td>Current documentation plus route evidence</td>\n<td>June 24 DOCX and local route</td>\n</tr>\n<tr>\n<td>DC01</td>\n<td>VM 200, <code>10.10.20.10/24</code>, Windows Server 2022 domain controller</td>\n<td>Current authenticated guest inventory</td>\n<td>Proxmox API, DNS/RDP validation, <code>inventories/dc01-inventory-20260626-022543.json</code></td>\n</tr>\n<tr>\n<td>WS01</td>\n<td>VM 300, <code>10.10.20.100/24</code>, Windows domain workstation</td>\n<td>Current authenticated guest inventory</td>\n<td>Proxmox API, <code>inventories/ws01-inventory-20260626-012952.json</code></td>\n</tr>\n<tr>\n<td>Linux01</td>\n<td>VM 400, <code>10.10.30.20/24</code>, VLAN 30, Ubuntu 26.04 LTS domain member</td>\n<td>Current authenticated guest inventory</td>\n<td>Proxmox API, DNS validation, <code>inventories/linux01-inventory-20260626-084312.json</code></td>\n</tr>\n<tr>\n<td>AD domain</td>\n<td><code>ad.jeremyfontenot.online</code></td>\n<td>Current authenticated guest inventory</td>\n<td>DC01 target-local inventory, 2026-06-26</td>\n</tr>\n<tr>\n<td>NetBIOS domain</td>\n<td><code>JFAD</code></td>\n<td>Current authenticated guest inventory</td>\n<td>DC01 target-local inventory, 2026-06-26</td>\n</tr>\n<tr>\n<td>Backup storage</td>\n<td><code>backup-hdd</code> at <code>/mnt/pve/backup-hdd</code></td>\n<td>Current</td>\n<td>Proxmox API</td>\n</tr>\n<tr>\n<td>Backup job</td>\n<td><code>backup-critical-lab-vms</code>, Sunday 02:00, snapshot, zstd, VMs 100/200/300/400</td>\n<td>Current</td>\n<td>Proxmox API</td>\n</tr>\n</tbody>\n</table></div>\n<h2>Historical or Stale Values</h2>\n<div class=\"table-scroll\"><table>\n<thead>\n<tr>\n<th>Value</th>\n<th>Classification</th>\n<th>Current handling</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td>Linux01 <code>10.10.20.20/24</code></td>\n<td>Historical</td>\n<td>Retained as pre-VLAN 30 address only</td>\n</tr>\n<tr>\n<td>Linux01 DHCP <code>10.10.20.101</code></td>\n<td>Historical</td>\n<td>Retained as initial setup address only</td>\n</tr>\n<tr>\n<td><code>backup-nvme</code> or <code>/mnt/pve/backup-nvme</code></td>\n<td>Stale or inconclusive</td>\n<td>Not current unless future evidence proves rename/replacement</td>\n</tr>\n<tr>\n<td>Direct WAN-side RDP forwarding</td>\n<td>Historical</td>\n<td>Current design uses OpenVPN-only RDP path</td>\n</tr>\n<tr>\n<td>June 21 restore outstanding limitation</td>\n<td>Historical</td>\n<td>Superseded by June 24 isolated restore documentation, not re-run during this ops pass</td>\n</tr>\n</tbody>\n</table></div>\n<h2>Claim Boundary</h2>\n<p>This file corrects explanatory documentation using current evidence. It does not modify historical evidence and does not claim live guest OS internals unless current command output or explicitly cited retained evidence supports the claim.</p>\n<p>The June 26 target-local workflow imported authenticated DC01 evidence in <code>inventories/dc01-inventory-20260626-022543.json</code> and <code>evidence/dc01-local-inventory-validation-20260626-022811.md</code>. It imported authenticated WS01 evidence in <code>inventories/ws01-inventory-20260626-012952.json</code> and <code>evidence/ws01-local-inventory-validation-20260626-033405.md</code>. It also imported authenticated Linux01 evidence in <code>inventories/linux01-inventory-20260626-084312.json</code> and <code>evidence/linux01-local-inventory-validation-20260626-035220.md</code>.</p></article>",
    "active": "Projects"
  },
  "documentation/759c75076daf": {
    "title": "Home Lab Source Reconciliation Evidence",
    "description": "Retained technical documentation: Home Lab Source Reconciliation Evidence",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Home Lab Source Reconciliation Evidence</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/on-prem-home-lab/current-validated-state/source-summaries/home-lab-source-reconciliation.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Home Lab Source Reconciliation Evidence</h2>\n<ul>\n<li>Timestamp: <code>2026-06-26T01:26:06.6980689-05:00</code></li>\n<li>Source workstation: <code>DESKTOP-MR3F9A1</code></li>\n<li>Operations repository: <code>C:\\Users\\jeremy\\Documents\\projects\\jeremy-homelab-ops</code></li>\n<li>Portfolio repository: <code>C:\\Users\\jeremy\\Documents\\projects\\jeremyfontenot</code></li>\n<li>Deployed page inspected: <code>https://jeremyfontenot.online/on-prem-home-lab.html</code></li>\n<li>Infrastructure changes made: <code>0</code></li>\n</ul>\n<h2>Current Command/API Evidence</h2>\n<div class=\"table-scroll\"><table>\n<thead>\n<tr>\n<th>Component</th>\n<th>Result</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td>Proxmox version</td>\n<td><code>9.2.3</code></td>\n</tr>\n<tr>\n<td>VM 100</td>\n<td><code>pfsense-fw</code>, running, vmbr0 and vmbr1</td>\n</tr>\n<tr>\n<td>VM 200</td>\n<td><code>dc01</code>, running, vmbr1</td>\n</tr>\n<tr>\n<td>VM 300</td>\n<td><code>ws01</code>, running, vmbr1, guest agent disabled</td>\n</tr>\n<tr>\n<td>VM 400</td>\n<td><code>linux01</code>, running, vmbr1, <code>tag=30</code>, QEMU guest agent responding</td>\n</tr>\n<tr>\n<td>Backup storage</td>\n<td><code>backup-hdd</code>, path <code>/mnt/pve/backup-hdd</code>, active</td>\n</tr>\n<tr>\n<td>Backup job</td>\n<td><code>backup-critical-lab-vms</code>, enabled, <code>sun 02:00</code>, snapshot, zstd, VMs <code>100,200,300,400</code></td>\n</tr>\n<tr>\n<td>Linux01 DNS</td>\n<td><code>linux01.ad.jeremyfontenot.online</code> resolves to <code>10.10.30.20</code></td>\n</tr>\n<tr>\n<td>Linux01 PTR</td>\n<td><code>10.10.30.20</code> resolves to <code>linux01.ad.jeremyfontenot.online</code></td>\n</tr>\n<tr>\n<td>VPN path</td>\n<td>DC01 DNS TCP 53 and RDP TCP 3389 reachable</td>\n</tr>\n<tr>\n<td>Expected block</td>\n<td>DC01 SMB TCP 445 and pfSense WAN direct RDP TCP 3389 timed out</td>\n</tr>\n</tbody>\n</table></div>\n<h2>Conflicts</h2>\n<div class=\"table-scroll\"><table>\n<thead>\n<tr>\n<th>Component</th>\n<th>Higher-precedence current value</th>\n<th>Lower-precedence conflicting value</th>\n<th>Classification</th>\n<th>Action</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td>Linux01 IP</td>\n<td><code>10.10.30.20/24</code></td>\n<td>Deployed website and June 21 evidence show <code>10.10.20.20/24</code></td>\n<td>Stale deployed/historical value</td>\n<td>Operations docs now treat <code>10.10.20.20</code> as historical</td>\n</tr>\n<tr>\n<td>Linux01 VLAN</td>\n<td>Proxmox config has <code>tag=30</code></td>\n<td>Deployed website omits VLAN 30 current state</td>\n<td>Stale deployed value</td>\n<td>Operations docs use current Proxmox metadata</td>\n</tr>\n<tr>\n<td>Restore status</td>\n<td>June 24 DOCX records isolated restore checks for VM 500 and 600</td>\n<td>June 21 redaction log says restore outstanding</td>\n<td>Historical difference</td>\n<td>Recovery docs distinguish June 21 historical limitation from June 24 documentation</td>\n</tr>\n<tr>\n<td>Backup storage</td>\n<td>Proxmox API shows <code>backup-hdd</code> at <code>/mnt/pve/backup-hdd</code></td>\n<td>Older prompt/doc values mention <code>backup-nvme</code></td>\n<td>Stale or inconclusive historical value</td>\n<td>Operations docs use <code>backup-hdd</code> and flag <code>backup-nvme</code> as stale unless rename evidence is found</td>\n</tr>\n</tbody>\n</table></div>\n<h2>Claim Boundary</h2>\n<p>Current Proxmox API output and current DNS/RDP checks are treated as current observed state. Portfolio and DOCX records are retained as documentation evidence where live command output cannot validate guest internals from this client path. Historical evidence is not rewritten.</p></article>",
    "active": "Projects"
  },
  "documentation/8f2473febe02": {
    "title": "Linux01 SSSD Remediation",
    "description": "Retained technical documentation: Linux01 SSSD Remediation",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Linux01 SSSD Remediation</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/on-prem-home-lab/current-validated-state/source-summaries/linux01-sssd-remediation.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Linux01 SSSD Remediation</h2>\n<h2>Summary</h2>\n<ul>\n<li>Target: Linux01</li>\n<li>Date: June 26, 2026</li>\n<li>Domain: ad.jeremyfontenot.online</li>\n<li>Classification: SSSD responder activation conflict</li>\n<li>Result: Remediated and validated</li>\n</ul>\n<h2>Initial Condition</h2>\n<ul>\n<li>sssd-nss.socket, sssd-pam.socket, and sssd-pac.socket were enabled and failed.</li>\n<li>/etc/sssd/sssd.conf used direct responder activation with services = nss, pam.</li>\n<li>config_file_version = 2 was rejected by SSSD 2.12 configuration validation.</li>\n<li>Initial diagnostic: artifacts/target-local-collection/Linux01/linux01-sssd-diagnostic-20260626-094322.json</li>\n<li>Initial SHA-256: 3CAD0FB73202D777D41DEE40D6F4D19D4019B9AD30552B37970B55A5CA5AB3BB</li>\n</ul>\n<h2>Backup</h2>\n<ul>\n<li>Backup: /root/sssd.conf.pre-remediation-20260626-095429.bak</li>\n<li>Original and backup SHA-256: 23ace1beca5ff6f7d58200efe054ea8e5a938e02f37fce25b1ca1b5d2f05bd14</li>\n</ul>\n<h2>Remediation</h2>\n<ol>\n<li>Removed the rejected config_file_version directive.</li>\n<li>Confirmed sssctl config-check completed with zero issues.</li>\n<li>Disabled the NSS, PAM, and PAC SSSD socket units.</li>\n<li>Restarted sssd.service.</li>\n<li>Cleared the historical failed-unit state.</li>\n</ol>\n<h2>Validation</h2>\n<ul>\n<li>sssd.service is enabled, active, and running.</li>\n<li>No failed systemd units remain.</li>\n<li>All three responder sockets report disabled.</li>\n<li>AD identity lookup succeeded.</li>\n<li>A new AD-authenticated SSH session succeeded.</li>\n<li>Post-remediation diagnostic: artifacts/target-local-collection/Linux01/linux01-sssd-diagnostic-20260626-110159.json</li>\n<li>Post-remediation SHA-256: FD55604BFB94487B86FBF631703FA995B9726471689385CCB2D277492AA7CBEE</li>\n</ul>\n<h2>Final Status</h2>\n<p>Linux01 is operating normally using direct SSSD responder activation.</p></article>",
    "active": "Projects"
  },
  "documentation/3e1c261a4805": {
    "title": "MACVM01 Home Lab Evidence",
    "description": "Retained technical documentation: MACVM01 Home Lab Evidence",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>MACVM01 Home Lab Evidence</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/on-prem-home-lab/macos-active-directory-integration/README.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>MACVM01 Home Lab Evidence</h2>\n<h2>Validated claim</h2>\n<p>Deployed and administered a macOS 12.7.6 virtual machine on Proxmox, connected it to the pfSense-managed LAN, integrated it with Windows Server Active Directory and DNS, enabled mobile domain accounts, and validated remote administration through SSH and VNC from DC01.</p>\n<h2>Environment</h2>\n<ul>\n<li>Host platform: Proxmox VE</li>\n<li>Virtual machine: MACVM01</li>\n<li>Operating system: macOS 12.7.6</li>\n<li>Network: pfSense-managed LAN</li>\n<li>Active Directory domain: ad.jeremyfontenot.online</li>\n<li>DNS server and domain controller: DC01</li>\n<li>Remote administration: SSH and VNC</li>\n</ul>\n<h2>Evidence index</h2>\n<ul>\n<li><code>macvm01-proxmox-config-public.txt</code> — Redacted Proxmox VM configuration</li>\n<li><code>macvm01-system-identity-public.txt</code> — macOS version, hostname, and domain-user identity</li>\n<li><code>macvm01-ad-binding-public.txt</code> — Active Directory binding configuration</li>\n<li><code>MACVM01-AD-computer-object-public.txt</code> — Enabled computer object recorded in Active Directory</li>\n<li><code>macvm01-network-configuration-public.txt</code> — IP address, gateway, and DNS configuration</li>\n<li><code>MACVM01-DNS-resolution-public.txt</code> — Forward DNS resolution</li>\n<li><code>MACVM01-reverse-DNS-public.txt</code> — Reverse DNS resolution</li>\n<li><code>MACVM01-remote-access-public.txt</code> — Successful SSH and VNC TCP validation from DC01</li>\n<li><code>macvm01-time-configuration-public.txt</code> — Corrected timezone and network-time configuration</li>\n<li><code>SHA256SUMS.csv</code> — SHA-256 integrity manifest</li>\n</ul>\n<h2>Validation results</h2>\n<ul>\n<li>MACVM01 reported macOS 12.7.6</li>\n<li>Domain-qualified hostname was configured</li>\n<li>Active Directory binding was present</li>\n<li>Domain-user identity resolved successfully</li>\n<li>Mobile account creation was enabled</li>\n<li>AD computer account was enabled</li>\n<li>Forward and reverse DNS resolution succeeded</li>\n<li>SSH port 22 was reachable from DC01</li>\n<li>VNC port 5900 was reachable from DC01</li>\n<li>The VM used the pfSense LAN gateway and DC01 DNS</li>\n<li>Configured timezone and network time were enabled</li>\n</ul>\n<h2>Limitations</h2>\n<p>This evidence represents a personal home-lab implementation. It does not prove production readiness, enterprise scale, Apple fleet administration, mobile-device management, Apple Business Manager integration, high availability, disaster recovery, compliance certification, or end-to-end security assurance.</p>\n<p>The remote-access tests prove TCP reachability at collection time. They do not independently prove continuous availability or the security of every remote-access configuration.</p>\n<p>The system-identity and Active Directory binding records were collected before the host timezone was corrected. The current timezone and network-time settings are documented separately.</p>\n<p>Detailed directory identifiers, group memberships, hardware identifiers, UUIDs, MAC addresses, and sensitive Proxmox configuration values were removed from the public evidence. The unredacted source records remain private.</p>\n<h2>Integrity</h2>\n<p>Validate the published files against <code>SHA256SUMS.csv</code>. Any later file modification will produce a different SHA-256 hash.</p></article>",
    "active": "Projects"
  },
  "documentation/218358a9ae10": {
    "title": "On-Prem Home Lab Screenshots for Repository",
    "description": "Retained technical documentation: On-Prem Home Lab Screenshots for Repository",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>On-Prem Home Lab Screenshots for Repository</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/on-prem-home-lab/screenshots/README.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>On-Prem Home Lab Screenshots for Repository</h2>\n<p>This package contains the screenshot evidence used in the APA home lab proof documentation. Files are named with clean figure numbers and proof-focused headings so they can be added directly to the repository.</p>\n<p>Recommended repo folder:</p>\n<pre><code class=\"language-text\">evidence-library/projects/on-prem-home-lab/screenshots\n</code></pre>\n<h2>Screenshot Index</h2>\n<h3>Figure 1: Initial RDP Connection Failure</h3>\n<ul>\n<li>File: <code>screenshots/figure-01-initial-rdp-connection-failure.png</code></li>\n<li>Section: <code>ws01-troubleshooting</code></li>\n<li>Proof: Initial RDP connection failure observed during client access troubleshooting.</li>\n<li>SHA256: <code>65D5ED79F841CB51F044F1A05185C05AC1271842B0676BC1900B125E84E309DD</code></li>\n</ul>\n<h3>Figure 2: NLA Failure During Windows 11 Client Troubleshooting</h3>\n<ul>\n<li>File: <code>screenshots/figure-02-nla-failure-windows11-client-troubleshooting.png</code></li>\n<li>Section: <code>ws01-troubleshooting</code></li>\n<li>Proof: NLA failure observed during Windows 11 client troubleshooting.</li>\n<li>SHA256: <code>94F27327B1BF2E0C30EDA831B38B7F49160939403D02BA6E2DEB2E23A5DCF3D4</code></li>\n</ul>\n<h3>Figure 3: WS01 System Identity and Hardware State</h3>\n<ul>\n<li>File: <code>screenshots/figure-03-ws01-system-about-identity-hardware.png</code></li>\n<li>Section: <code>ws01-baseline</code></li>\n<li>Proof: Cropped WS01 System &gt; About proof showing workstation identity and hardware state after installation.</li>\n<li>SHA256: <code>26A4A69E33CCA925EEC46064307A14D5C02D1A2CB3E9508705242806F049E63E</code></li>\n</ul>\n<h3>Figure 4: WS01 DNS and DHCP Validation</h3>\n<ul>\n<li>File: <code>screenshots/figure-04-ws01-dns-dhcp-validation.png</code></li>\n<li>Section: <code>ws01-baseline</code></li>\n<li>Proof: Cropped DNS and DHCP validation output from WS01 after domain join and DNS registration.</li>\n<li>SHA256: <code>080AAAB4B0A905A92C651911571655E86D2224344BF069AAB5D9FC0476629F1C</code></li>\n</ul>\n<h3>Figure 5: Active Directory WS01 OU Placement</h3>\n<ul>\n<li>File: <code>screenshots/figure-05-active-directory-ws01-ou-placement.png</code></li>\n<li>Section: <code>active-directory</code></li>\n<li>Proof: Active Directory validation showing WS01 location after OU movement.</li>\n<li>SHA256: <code>390E466B485DE1BF4CA85F8214F7111FE9D41FECD206CCAC33555333FF45679C</code></li>\n</ul>\n<h3>Figure 6: WS01 RDP Enablement and Firewall Rules</h3>\n<ul>\n<li>File: <code>screenshots/figure-06-ws01-rdp-enable-firewall-network.png</code></li>\n<li>Section: <code>rdp-validation</code></li>\n<li>Proof: Cropped WS01 output showing local RDP enablement, Remote Desktop firewall rules, and network state.</li>\n<li>SHA256: <code>C8846CCC29D972D61D92D4C55E5F664D1E3CA3A0E9A489D4CE66B2327CF4AD04</code></li>\n</ul>\n<h3>Figure 7: DC01 to WS01 RDP and DNS Validation</h3>\n<ul>\n<li>File: <code>screenshots/figure-07-dc01-to-ws01-rdp-dns-validation.png</code></li>\n<li>Section: <code>rdp-validation</code></li>\n<li>Proof: Cropped final RDP validation from DC01 showing TCP 3389 succeeds and DNS resolves WS01.</li>\n<li>SHA256: <code>52EDDD8DFD47C594E444A1DD2875BD40947747128D5093862B93E13972015DF8</code></li>\n</ul>\n<h3>Figure 8: WS01 Proxmox Boot Cleanup</h3>\n<ul>\n<li>File: <code>screenshots/figure-08-ws01-proxmox-boot-cleanup.png</code></li>\n<li>Section: <code>proxmox</code></li>\n<li>Proof: Cropped Proxmox output showing WS01 boot cleanup and running status.</li>\n<li>SHA256: <code>FF85B2D61E149607EA8B4EFF5AB842EA6EF2459985472F418C291219FDE46A7C</code></li>\n</ul>\n<h3>Figure 9: WS01 Baseline Snapshot Validation</h3>\n<ul>\n<li>File: <code>screenshots/figure-09-ws01-baseline-snapshot-validation.png</code></li>\n<li>Section: <code>backup-snapshot</code></li>\n<li>Proof: Cropped Proxmox output showing WS01 baseline snapshot creation and validation.</li>\n<li>SHA256: <code>8C3C8CD225B3133FF92B3DD9C607BCD55F189B6DA8834BBC719A2FACD7DB840D</code></li>\n</ul>\n<h3>Figure 10: WS01 Backup Archive Evidence</h3>\n<ul>\n<li>File: <code>screenshots/figure-10-ws01-backup-archive-evidence.png</code></li>\n<li>Section: <code>backup-snapshot</code></li>\n<li>Proof: Cropped evidence note excerpt showing the WS01 backup file and 8.9 GB archive.</li>\n<li>SHA256: <code>43A66DC24E7E1682B07508ADBC6C274C9867AE9C7975DAE139A8AD1DB4137A50</code></li>\n</ul>\n<h3>Figure 11: Scheduled Backup Job Includes WS01</h3>\n<ul>\n<li>File: <code>screenshots/figure-11-scheduled-backup-job-includes-ws01.png</code></li>\n<li>Section: <code>backup-snapshot</code></li>\n<li>Proof: Cropped Proxmox output showing scheduled backup job updated to include VM 300.</li>\n<li>SHA256: <code>3889A475A9A1E26380B97BD87A52A0AF76B17DE4ECEC57BCF6954E4A9882D810</code></li>\n</ul>\n<h3>Figure 12: WS01 Snapshot and Backup Evidence Note</h3>\n<ul>\n<li>File: <code>screenshots/figure-12-ws01-snapshot-backup-evidence-note.png</code></li>\n<li>Section: <code>backup-snapshot</code></li>\n<li>Proof: Cropped Proxmox evidence note documenting WS01 snapshot, backup file, scheduled job, VM inventory, and storage status.</li>\n<li>SHA256: <code>AFCF76FDB5580A7D7E42BB1BADD6EA6007BEAD9E32BA09FCD7C8A41D890F3A7D</code></li>\n</ul>\n<h3>Figure 13: sd.tech IT Share Read Write Validation</h3>\n<ul>\n<li>File: <code>screenshots/figure-13-sdtech-it-share-read-write-validation.png</code></li>\n<li>Section: <code>file-services-gpo-drive-map</code></li>\n<li>Proof: WS01 sd.tech validation showing applied GPO, I: mapped drive to \\DC01\\IT, and read/write test success.</li>\n<li>SHA256: <code>339A49CC0F07F37E030F11AEFD7D0009EADF7022910490814D7968B7BC2C6BAD</code></li>\n</ul>\n<h3>Figure 14: standard.user IT Share Read Only and Write Denial Validation</h3>\n<ul>\n<li>File: <code>screenshots/figure-14-standard-user-it-share-read-only-write-denial.png</code></li>\n<li>Section: <code>file-services-gpo-drive-map</code></li>\n<li>Proof: WS01 standard.user validation showing applied GPO, I: mapped drive to \\DC01\\IT, read access success, and write denial success.</li>\n<li>SHA256: <code>27F7745FF4230E41B1B946531246870D5CF56F81E7320727CBD91E5BE283F611</code></li>\n</ul>\n<h3>Figure 15: DC01 Central Evidence Export Validation</h3>\n<ul>\n<li>File: <code>screenshots/figure-15-dc01-central-evidence-export-validation.png</code></li>\n<li>Section: <code>evidence-export</code></li>\n<li>Proof: DC01 evidence export validation showing copied folders and exported file counts for the central evidence package.</li>\n<li>SHA256: <code>6F04AD70226BB9F16D5850FED88CC6B27067DE3C7EA4F6EAC8A1E90CE6F6242C</code></li>\n</ul>\n<h3>Figure 16: Final Evidence ZIP Manifest and SHA256 Validation</h3>\n<ul>\n<li>File: <code>screenshots/figure-16-final-evidence-zip-manifest-sha256-validation.png</code></li>\n<li>Section: <code>evidence-export</code></li>\n<li>Proof: Final evidence ZIP validation showing manifest counts and SHA256 hash for the exported evidence package.</li>\n<li>SHA256: <code>D96222651F09ECAE33F45B6280F2F6197E38F5DDD7ABF6278A091AC66C7071D3</code></li>\n</ul>\n<h3>Figure 17: Documentation Source Hash Validation</h3>\n<ul>\n<li>File: <code>screenshots/figure-17-documentation-source-hash-validation.png</code></li>\n<li>Section: <code>documentation-source</code></li>\n<li>Proof: Documentation source staging validation showing proof summary, manifest files, and final ZIP SHA256 verification.</li>\n<li>SHA256: <code>CE77AD3C0ED5F63DC28492391BDBE7AD99C75F6D79469DBCE4DAEB696997EA98</code></li>\n</ul>\n<h2>Publication note</h2>\n<p>These screenshots remain as the reviewed June 12 historical proof set. The June 21 validation evidence is indexed separately in <code>../validated-2026-06-21/</code> and is the current primary review path.</p></article>",
    "active": "Projects"
  },
  "documentation/585bb6d02d73": {
    "title": "Validated On-Premises Home Lab Evidence — June 21, 2026",
    "description": "Retained technical documentation: Validated On-Premises Home Lab Evidence — June 21, 2026",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Validated On-Premises Home Lab Evidence — June 21, 2026</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/on-prem-home-lab/validated-2026-06-21/README.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Validated On-Premises Home Lab Evidence — June 21, 2026</h2>\n<p>This historical public set supports the <a data-route=\"projects/on-prem-home-lab\" href=\"#projects/on-prem-home-lab\">On-Prem Home Lab case study</a> with reviewed command output, screenshots, integrity records, and an earlier Word validation document. Current reviewers should use the current professional documentation linked below.</p>\n<h2>Current document</h2>\n<ul>\n<li>Current title: Jeremy Fontenot’s On-Premises Home Lab Documentation</li>\n<li>Current file: <a href=\"https://jeremyfontenot.online/evidence-library/projects/on-prem-home-lab/Jeremy-Fontenot-On-Premises-Home-Lab-Documentation.docx\" rel=\"noopener noreferrer\" target=\"_blank\"><code>Jeremy-Fontenot-On-Premises-Home-Lab-Documentation.docx</code></a></li>\n<li>Current public download: <a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/assets/documents/Jeremy-Fontenot-On-Premises-Home-Lab-Documentation.docx\" rel=\"noopener noreferrer\" target=\"_blank\"><code>./assets/documents/Jeremy-Fontenot-On-Premises-Home-Lab-Documentation.docx</code></a></li>\n</ul>\n<h2>Validation status</h2>\n<ul>\n<li>Status: validated within the limits documented below</li>\n<li>Collection and validation date: June 21, 2026</li>\n<li>Environment: personal nonproduction home lab</li>\n<li>Physical host: one Dell PowerEdge R710</li>\n<li>Hypervisor: Proxmox VE</li>\n<li>Primary VMs: pfSense VM 100, DC01 VM 200, WS01 VM 300, and Linux01 VM 400</li>\n</ul>\n<h2>Historical document</h2>\n<ul>\n<li>Title: On-Premises Home Lab Infrastructure Validation</li>\n<li>Public file: <code>../jeremy-fontenot-on-premises-home-lab-validation-2026-06-21.docx</code></li>\n<li>Status: historical compatibility copy; use the current document above for public review.</li>\n<li>Size: 1,400,031 bytes</li>\n<li>SHA-256: <code>03a605517e2a6ebeb805b7e0f74bd1ec06c664debbdb39b99e09aecc62e4845a</code></li>\n</ul>\n<h2>Archive integrity</h2>\n<ul>\n<li>Complete evidence archive SHA-256: <code>e8a5a40a6960557383ccb152af2da71053e50382d8287d632b9ed5ad85cb7060</code></li>\n<li>Embedded Linux01 archive SHA-256: <code>5c1eff369a0055338808a93c025847cc5997db4f04614a56ede33b43f9e9b8db</code></li>\n</ul>\n<h2>Evidence categories</h2>\n<ul>\n<li>Proxmox host, storage, bridge, VM, all-four-VM snapshot, and scheduled-backup validation</li>\n<li>Windows Server 2022, Active Directory, DNS, DHCP, and Group Policy screenshots</li>\n<li>Linux01 system, DNS, SSSD, Kerberos, SSH, UFW, sudo, guest-agent, and backup records</li>\n<li>Evidence packaging, SCP transfer, and SHA-256 verification</li>\n</ul>\n<p>The machine-readable <code>manifest.json</code>, reviewer-oriented <code>manifest.csv</code>, sanitized text files, and captioned screenshots provide the public review path.</p>\n<h2>Limitations</h2>\n<ul>\n<li>Archive presence does not prove a successful application-level restore.</li>\n<li>Snapshot presence is not an independent backup.</li>\n<li>Exclusive firewall-source restriction was not independently tested.</li>\n<li>The lab uses one domain controller and is not designed for production availability.</li>\n</ul>\n<p>See <a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/on-prem-home-lab/validated-2026-06-21/redaction-log.md\" rel=\"noopener noreferrer\" target=\"_blank\">redaction-log.md</a> for exclusions and privacy decisions.</p></article>",
    "active": "Projects"
  },
  "documentation/1845f2189c16": {
    "title": "Public evidence review log",
    "description": "Retained technical documentation: Public evidence review log",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Public evidence review log</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/on-prem-home-lab/validated-2026-06-21/redaction-log.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Public evidence review log</h2>\n<p>Reviewed on June 21, 2026. The raw source archives remain outside the repository.</p>\n<h2>Published with redaction</h2>\n<ul>\n<li>DHCP screenshot: virtual NIC client identifiers derived from MAC addresses were covered; IP, hostname, lease state, and scope configuration remain visible.</li>\n<li>Linux01 SHA-256 screenshot: the local home-directory path was covered; the archive filename, command context, and SHA-256 digest remain visible.</li>\n<li>Kerberos text: the temporary ticket-cache identifier was replaced with a redaction marker.</li>\n<li>Network excerpt: link-local IPv6 addresses, interface hardware addresses, and unrelated command output were omitted.</li>\n<li>VM summary: virtual MAC addresses, SMBIOS UUIDs, VM generation identifiers, and creation timestamps were omitted.</li>\n<li>pfSense snapshot listing: the upstream administrative-source address was omitted; the snapshot name, timestamp, forwarding target, and validation boundary remain visible.</li>\n</ul>\n<h2>Excluded</h2>\n<ul>\n<li>Raw chat-image ZIP.</li>\n<li>Raw complete evidence archive.</li>\n<li>Embedded Linux network screenshot containing an unnecessary virtual MAC address.</li>\n<li>Screenshots containing unrelated browser, desktop, or contact content.</li>\n<li>Raw VM configuration exports containing MAC addresses and UUIDs.</li>\n<li>Raw Kerberos output containing a temporary ticket-cache identifier.</li>\n<li>Full Proxmox network dump because it included substantially more interface detail than needed for the public claim.</li>\n</ul>\n<h2>Retained technical context</h2>\n<ul>\n<li>The generic <code>C:\\Users\\Administrator</code> PowerShell prompt visible in the supplied validation document and selected DC01 screenshots was retained because it provides command context and does not expose the portfolio workstation path, repository checkout, or a personal Windows profile.</li>\n<li>Domain-qualified Linux account and home-directory values were retained where they directly support Active Directory integration and command provenance.</li>\n</ul>\n<h2>Claim boundaries</h2>\n<ul>\n<li>Backup files and scheduled-job membership are validated; an isolated restore test is outstanding.</li>\n<li>Snapshot presence is validated; snapshots are not represented as independent backups.</li>\n<li>Firewall configuration intent and the isolated bridge are documented; exclusive source restriction was not independently tested in this evidence set.</li>\n<li>The environment has one domain controller and is a personal nonproduction lab.</li>\n</ul></article>",
    "active": "Projects"
  },
  "documentation/8fe996d578b5": {
    "title": "Home Lab Operations Validation - June 26, 2026",
    "description": "Retained technical documentation: Home Lab Operations Validation - June 26, 2026",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Home Lab Operations Validation - June 26, 2026</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/on-prem-home-lab/validated-2026-06-26/README.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Home Lab Operations Validation - June 26, 2026</h2>\n<h2>Scope</h2>\n<p>This public evidence summary describes Jeremy Fontenot's personal, nonproduction on-premises home lab. It is a sanitized portfolio artifact derived from the separate private operations repository <code>jeremy-homelab-ops</code>.</p>\n<p>The source operations repository remained private because it contains target-local inventories, operational diagnostics, and environment-specific collection details. This public summary intentionally excludes raw inventories, raw event logs, full service configuration files, local workstation paths, authentication attempts, ticket-cache identifiers, secrets, keys, tokens, cookies, and private user details.</p>\n<h2>Current Supported Architecture</h2>\n<div class=\"table-scroll\"><table>\n<thead>\n<tr>\n<th>Component</th>\n<th>Supported public state</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td>Physical host</td>\n<td>Dell PowerEdge R710</td>\n</tr>\n<tr>\n<td>Hypervisor</td>\n<td>Proxmox VE 9.2.3</td>\n</tr>\n<tr>\n<td>pfSense</td>\n<td>VM 100</td>\n</tr>\n<tr>\n<td>Core LAN gateway</td>\n<td>10.10.20.1/24</td>\n</tr>\n<tr>\n<td>Linux VLAN gateway</td>\n<td>10.10.30.1/24</td>\n</tr>\n<tr>\n<td>OpenVPN network</td>\n<td>10.10.40.0/24</td>\n</tr>\n<tr>\n<td>DC01</td>\n<td>VM 200, Windows Server 2022, 10.10.20.10/24</td>\n</tr>\n<tr>\n<td>AD domain</td>\n<td>ad.jeremyfontenot.online</td>\n</tr>\n<tr>\n<td>NetBIOS domain</td>\n<td>JFAD</td>\n</tr>\n<tr>\n<td>WS01</td>\n<td>VM 300, Windows 10 Pro 10.0.19045 build 19045, 10.10.20.100/24</td>\n</tr>\n<tr>\n<td>Linux01</td>\n<td>VM 400, Ubuntu 26.04 LTS, kernel 7.0.0-22-generic, 10.10.30.20/24, VLAN tag 30</td>\n</tr>\n</tbody>\n</table></div>\n<p>Linux01 is supported as a VLAN 30 Ubuntu domain member with gateway 10.10.30.1, DNS 10.10.20.10, SSH active and listening, rsyslog active with TCP and UDP 514 listening on 10.10.30.20, QEMU guest agent configured and responding, and AD identity resolution validated.</p>\n<p>The scheduled Proxmox backup job includes VMs 100, 200, 300, and 400. Retained June 24 documentation records isolated WS01 and Linux01 startup restore checks. Those checks do not establish recurring disaster-recovery assurance, RTO, or RPO.</p>\n<h2>Authenticated Inventory Validation</h2>\n<p>The private operations repository contains authenticated target-local inventory validation for:</p>\n<ul>\n<li>DC01 guest operating system, AD domain, NetBIOS domain, DNS/DHCP/GPO inventory, critical service state, and summary event health.</li>\n<li>WS01 Windows 10 Pro guest state, domain membership, secure channel, addressing, gateway, DNS, critical service state, and summary event health.</li>\n<li>Linux01 Ubuntu guest state, VLAN 30 addressing, gateway, DNS, time sync, SSH, rsyslog, QEMU guest agent, realmd/SSSD/Kerberos indicators, AD identity resolution, AppArmor, automatic updates, and security-update status.</li>\n</ul>\n<p>Only summarized, recruiter-readable claims are published here. Raw target-local JSON inventories remain excluded from the public website.</p>\n<h2>Read-Only Operations Framework</h2>\n<p>The validated operations repository demonstrates:</p>\n<ul>\n<li>Git-based change tracking.</li>\n<li>Architecture documentation.</li>\n<li>Change plans.</li>\n<li>Recovery documentation.</li>\n<li>Runbooks.</li>\n<li>Read-only inventory collectors.</li>\n<li>Target-local collection packages.</li>\n<li>Monitoring scripts.</li>\n<li>Structured inventories.</li>\n<li>Timestamped evidence.</li>\n<li>Repository validation.</li>\n<li>Portfolio drift validation.</li>\n<li>Policy-aware connectivity validation.</li>\n<li>PowerShell parser validation.</li>\n<li>JSON parse validation.</li>\n<li>Bash syntax validation.</li>\n<li>Explicit claim boundaries.</li>\n<li>Rollback documentation.</li>\n</ul>\n<h2>Validation Results</h2>\n<p>The source operations repository was validated at commit <code>3d42a4808a6a0607d78f4f4e7fd1e71783729a6b</code>.</p>\n<p>Required operations validation scripts passed:</p>\n<pre><code class=\"language-powershell\">pwsh -NoProfile -File .\\tests\\Test-RepositoryStructure.ps1\npwsh -NoProfile -File .\\tests\\Test-HomeLabBaselineFramework.ps1\npwsh -NoProfile -File .\\tests\\Test-PortfolioHomeLabDrift.ps1\n</code></pre>\n<p>The public website update was built from those validated results and from the Linux01 remediation commit <code>f2a8802</code>.</p>\n<h2>Linux01 SSSD Remediation</h2>\n<p>Initial classification: SSSD responder activation conflict.</p>\n<p>Initial condition:</p>\n<ul>\n<li>Direct responders were configured.</li>\n<li><code>sssd-nss.socket</code>, <code>sssd-pam.socket</code>, and <code>sssd-pac.socket</code> were enabled and failed.</li>\n<li><code>config_file_version = 2</code> was rejected by SSSD 2.12 validation.</li>\n</ul>\n<p>Controlled remediation:</p>\n<ul>\n<li>A preserved backup and rollback path were created first.</li>\n<li>Only the rejected directive was removed.</li>\n<li>Conflicting responder sockets were disabled.</li>\n<li>SSSD was restarted.</li>\n<li>Historical failed-unit state was cleared.</li>\n</ul>\n<p>Post-remediation validation:</p>\n<ul>\n<li><code>sssd.service</code> enabled.</li>\n<li><code>sssd.service</code> active.</li>\n<li>Zero failed systemd units.</li>\n<li>NSS, PAM, and PAC responder sockets disabled as intended.</li>\n<li>SSSD configuration validation passed.</li>\n<li>AD identity lookup passed.</li>\n<li>A completely new AD-authenticated SSH session passed.</li>\n</ul>\n<p>Diagnostic hashes:</p>\n<div class=\"table-scroll\"><table>\n<thead>\n<tr>\n<th>Phase</th>\n<th>SHA-256</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td>Pre-remediation</td>\n<td>3CAD0FB73202D777D41DEE40D6F4D19D4019B9AD30552B37970B55A5CA5AB3BB</td>\n</tr>\n<tr>\n<td>Post-remediation</td>\n<td>FD55604BFB94487B86FBF631703FA995B9726471689385CCB2D277492AA7CBEE</td>\n</tr>\n</tbody>\n</table></div>\n<p>The public site does not publish the root backup path, raw diagnostic JSON, complete SSSD configuration, private ticket-cache data, or authentication attempt details.</p>\n<h2>Commit Traceability</h2>\n<ul>\n<li>Operations repository validated endpoint: <code>3d42a4808a6a0607d78f4f4e7fd1e71783729a6b</code></li>\n<li>Linux01 SSSD remediation commit: <code>f2a8802</code></li>\n</ul>\n<h2>Limitations</h2>\n<ul>\n<li>This is a personal lab only, not a client, employer, production, business, or enterprise-scale claim.</li>\n<li>Raw private inventories and raw event logs are not public.</li>\n<li>TCP reachability is not complete service validation.</li>\n<li>The read-only baseline does not authenticate to remote systems or prove administrative access.</li>\n<li>Retained isolated restore startup checks do not prove recurring disaster-recovery assurance, RTO, or RPO.</li>\n<li>Historical June 21 evidence and retained June 24 documentation remain separate evidence layers from this Current operations validation.</li>\n</ul></article>",
    "active": "Projects"
  },
  "documentation/92f2a52c40fd": {
    "title": "Provisioning Change Log 2026",
    "description": "Retained technical documentation: Provisioning Change Log 2026",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Provisioning Change Log 2026</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/powershell-automation/provisioning-change-log-2026.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><hr/>\n<p>title: Provisioning Change Log — 2026\ntype: notes\ntags: [provisioning, change-log, powershell]</p>\n<hr/>\n<p>This change log records reviewed changes to the provisioning automation used in lab and test contexts. Entries include scope, author, validation approach, evidence required, and rollback guidance.</p>\n<h2>2026-04-12 — Draft v1.0</h2>\n<ul>\n<li>Author: Jeremy Fontenot</li>\n<li>Objective: Build a repeatable user provisioning workflow that can be reviewed before execution.</li>\n<li>Technical areas: PowerShell, Windows administration, Active Directory-style OU planning, group assignment, logging, dry-run review, and rollback preparation.</li>\n<li>Changes: Added parameterization for OU placement, group assignment, and license SKU mapping. Introduced idempotent checks for existing accounts.</li>\n<li>Validation approach: Run in dry-run mode first, review proposed changes, create sanitized lab test accounts only when authorized, verify expected group membership, and capture logs without secrets.</li>\n<li>Rollback: Remove lab-created test accounts only after confirming scope, then restore previous group membership from the exported CSV if a change was applied.</li>\n</ul>\n<h2>2026-05-02 — Patch v1.1</h2>\n<ul>\n<li>Author: Jeremy Fontenot</li>\n<li>Objective: Harden script logging and error handling before broader reuse.</li>\n<li>Technical areas: PowerShell error handling, structured logs, exit codes, safe-mode execution, and change review.</li>\n<li>Changes: Added structured log output, exit codes, and safe-mode dry-run flag for review before changes.</li>\n<li>Validation approach: Run dry-run against a lab OU, inspect structured logs, verify that no unexpected write actions occur in safe mode, and record reviewer notes before any controlled execution.</li>\n<li>Rollback: No stateful database changes are assumed. If lab accounts or groups are changed during controlled execution, reverse only the recorded objects and preserve the rollback log.</li>\n</ul>\n<h2>Notes</h2>\n<ul>\n<li>Execute only from an authorized lab administration context.</li>\n<li>Store sanitized logs with the run date and remove private identifiers before public portfolio use.</li>\n<li>Do not represent a dry-run, planned run, or script artifact as a completed live onboarding workflow.</li>\n</ul></article>",
    "active": "Projects"
  },
  "documentation/43fa760bea3a": {
    "title": "DNS Authentication Playbook — 2026",
    "description": "Retained technical documentation: DNS Authentication Playbook — 2026",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>DNS Authentication Playbook — 2026</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/troubleshooting-rca/dns-authentication-playbook-2026.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>DNS Authentication Playbook — 2026</h2>\n<h2>Purpose</h2>\n<p>This playbook documents validated steps for diagnosing and resolving DNS-related authentication issues that affect domain-joined clients and Entra ID synchronization points.</p>\n<ul>\n<li>\n<h2>Pre-checks</h2>\n</li>\n<li>\n<p>Confirm authoritative DNS server reachability (timeout &lt; 250ms) from affected host.</p>\n</li>\n<li>Verify time sync on domain controllers and clients (NTP).</li>\n</ul>\n<h2>Steps</h2>\n<ol>\n<li>Verify basic DNS resolution from the client: <code>nslookup &lt;fqdn&gt;</code> and <code>ping -n 1 &lt;fqdn&gt;</code>.</li>\n<li>Confirm SRV records for LDAP/GC and Kerberos exist: <code>_ldap._tcp.dc._msdcs.&lt;domain&gt;</code>.</li>\n<li>Check DNS scavenging or replication issues on DNS servers; review event logs for DNS-related errors.</li>\n<li>For split-brain DNS, confirm the internal zone contains correct A and CNAME records for domain controllers and services.</li>\n<li>Validate conditional access and identity provider endpoints reachable from client network segments.</li>\n</ol>\n<h2>Validation</h2>\n<ul>\n<li>After remediation, re-run authentication flows and capture <code>nltest /sc_verify:&lt;domain&gt;</code> and <code>klist</code> outputs.</li>\n<li>\n<p>Record timestamped validation notes and attach DNS query traces to the incident log.</p>\n</li>\n<li>\n<h2>References</h2>\n</li>\n<li>\n<p>RFC 1035 — DNS Basics</p>\n</li>\n<li>Internal lab notes: network validation checklist and pfSense segmentation documentation.</li>\n</ul></article>",
    "active": "Projects"
  },
  "documentation/4acef18e6f81": {
    "title": "Troubleshooting RCA Incident Summary",
    "description": "Retained technical documentation: Troubleshooting RCA Incident Summary",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Troubleshooting RCA Incident Summary</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/troubleshooting-rca/incident-summary.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Troubleshooting RCA Incident Summary</h2>\n<p>Status: Sanitized portfolio evidence\nScope: Mail flow triage and root cause analysis for a controlled service desk scenario\nEvidence type: Incident summary</p>\n<h2>Objective</h2>\n<p>Document the operational handling of a sanitized mail-flow delay from intake through scope review, corrective action, validation, and follow-up.</p>\n<h2>Technical Areas Demonstrated</h2>\n<ul>\n<li>Ticket triage and impact classification.</li>\n<li>Mail queue and transport rule review.</li>\n<li>Controlled test submission.</li>\n<li>Remediation planning and rollback awareness.</li>\n<li>Validation and post-incident documentation.</li>\n</ul>\n<h2>Issue Summary</h2>\n<p>On 2025-02-10, outbound mail delivery experienced a short delay in a controlled portfolio scenario. The issue was recorded as sanitized evidence only. No customer names, ticket numbers, email addresses, IPs, or credentials are included in this document.</p>\n<h2>Scope</h2>\n<ul>\n<li>One mail transport path was affected.</li>\n<li>The issue was limited to a short investigation window.</li>\n<li>No directory outage or authentication failure was observed.</li>\n<li>No broad infrastructure incident was identified.</li>\n</ul>\n<h2>Symptoms</h2>\n<ul>\n<li>Messages remained in queue longer than expected.</li>\n<li>Delivery timing was inconsistent during the incident window.</li>\n<li>Transport rules required review before the path normalized.</li>\n</ul>\n<h2>Impact</h2>\n<ul>\n<li>End users experienced delayed message delivery.</li>\n<li>No evidence of message loss was found.</li>\n<li>The impact remained limited to one service path.</li>\n</ul>\n<h2>Timeline</h2>\n<ul>\n<li>09:15 UTC: Service desk received the initial delay report.</li>\n<li>09:18 UTC: Queue depth was reviewed and showed a backlog.</li>\n<li>09:22 UTC: Transport rule order and recent changes were checked.</li>\n<li>09:31 UTC: Connector health was confirmed on the primary path.</li>\n<li>09:44 UTC: A test message was submitted to isolate the delay.</li>\n<li>10:03 UTC: Rule precedence was adjusted in the test workflow.</li>\n<li>10:18 UTC: Queue backlog began to drain after validation.</li>\n<li>10:41 UTC: Delivery timing returned to normal.</li>\n</ul>\n<h2>Triage Steps</h2>\n<ul>\n<li>Reviewed the reported symptom and confirmed the scope.</li>\n<li>Checked queue behavior before making any changes.</li>\n<li>Compared rule order with the expected transport flow.</li>\n<li>Validated connector health and delivery behavior.</li>\n<li>Submitted a controlled test message to verify recovery.</li>\n</ul>\n<h2>Root Cause</h2>\n<p>A transport rule precedence issue combined with a temporary delivery delay in the mail path. The rule sequence caused messages to wait longer than expected before final transport processing completed.</p>\n<h2>Corrective Actions</h2>\n<ul>\n<li>Reviewed and corrected the transport rule order used in the test workflow.</li>\n<li>Verified the affected path delivered a test message successfully.</li>\n<li>Documented the event for future change review.</li>\n</ul>\n<h2>Validation Performed</h2>\n<ul>\n<li>Confirmed queue backlog was draining.</li>\n<li>Confirmed the test message completed delivery.</li>\n<li>Confirmed normal timing returned during the verification window.</li>\n</ul>\n<h2>Prevention Steps</h2>\n<ul>\n<li>Review transport rule changes before release.</li>\n<li>Capture a rollback checkpoint for mail-flow changes.</li>\n<li>Add post-change validation to the standard checklist.</li>\n</ul>\n<h2>Lessons Learned</h2>\n<ul>\n<li>Short mail delays can be caused by rule precedence, not only service outages.</li>\n<li>Queue review should happen before any remedial changes.</li>\n<li>A controlled test message helps confirm recovery without exposing sensitive data.</li>\n</ul></article>",
    "active": "Projects"
  },
  "documentation/32798e8dc2d1": {
    "title": "Post-Incident Review",
    "description": "Retained technical documentation: Post-Incident Review",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Post-Incident Review</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/troubleshooting-rca/post-incident-review.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Post-Incident Review</h2>\n<p>Status: Sanitized portfolio evidence\nScope: Review of the mail flow delay incident and follow-up actions\nEvidence type: Post-incident review</p>\n<h2>Issue Summary</h2>\n<p>This review summarizes a sanitized mail flow delay incident for portfolio use. It is intended to show the troubleshooting method, not any private operational detail.</p>\n<h2>Scope</h2>\n<ul>\n<li>One mail transport path.</li>\n<li>One short service desk incident.</li>\n<li>One corrective change and validation pass.</li>\n</ul>\n<h2>Symptoms</h2>\n<ul>\n<li>Mail delivery was slower than expected.</li>\n<li>Queue depth increased during the incident window.</li>\n</ul>\n<h2>Impact</h2>\n<ul>\n<li>Delivery delays affected the user experience.</li>\n<li>The issue was contained and reversible.</li>\n</ul>\n<h2>Timeline</h2>\n<ul>\n<li>09:15 UTC: Delay reported.</li>\n<li>09:22 UTC: Transport review started.</li>\n<li>10:03 UTC: Corrective adjustment applied.</li>\n<li>10:41 UTC: Delivery timing normalized.</li>\n</ul>\n<h2>Triage Steps</h2>\n<ul>\n<li>Reviewed the queue and transport path.</li>\n<li>Checked the rule sequence before changing anything.</li>\n<li>Tested recovery with a controlled message.</li>\n</ul>\n<h2>Root Cause</h2>\n<p>The root cause was a transport rule precedence issue that added an unnecessary wait in the mail path.</p>\n<h2>Corrective Actions</h2>\n<ul>\n<li>Reordered the rule logic in the controlled workflow.</li>\n<li>Confirmed delivery with a test message.</li>\n<li>Documented the event for future change review.</li>\n</ul>\n<h2>Validation Performed</h2>\n<ul>\n<li>Verified queue drainage after the change.</li>\n<li>Verified that delivery timing returned to normal.</li>\n<li>Verified no broader outage was present.</li>\n</ul>\n<h2>Prevention Steps</h2>\n<ul>\n<li>Add transport rule review to change approval.</li>\n<li>Keep a post-change validation window.</li>\n<li>Retain sanitized evidence for future review.</li>\n</ul>\n<h2>Lessons Learned</h2>\n<ul>\n<li>Stable recovery is as important as the original fix.</li>\n<li>Post-incident reviews should capture what to repeat and what to improve.</li>\n<li>Sanitized evidence can still preserve strong troubleshooting discipline.</li>\n</ul></article>",
    "active": "Projects"
  },
  "documentation/0418c3d0091e": {
    "title": "Troubleshooting RCA Report",
    "description": "Retained technical documentation: Troubleshooting RCA Report",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Troubleshooting RCA Report</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/troubleshooting-rca/rca-report.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Troubleshooting RCA Report</h2>\n<p>Status: Sanitized portfolio evidence\nScope: Mail transport delay investigation and remediation summary\nEvidence type: RCA report</p>\n<h2>Issue Summary</h2>\n<p>This report documents a sanitized root cause analysis for a short outbound mail delay observed in a portfolio scenario. The record is intentionally free of customer names, ticket numbers, private system names, IPs, and credentials.</p>\n<h2>Objective</h2>\n<p>Preserve the troubleshooting method used to move from symptom report to rule review, corrective action, validation, and prevention notes without exposing private environment details.</p>\n<h2>Technical Areas Demonstrated</h2>\n<ul>\n<li>Service desk intake and impact scoping.</li>\n<li>Mail transport workflow triage.</li>\n<li>Queue state review and controlled test submission.</li>\n<li>Change review for transport rule precedence.</li>\n<li>Remediation sequencing and rollback awareness.</li>\n<li>Post-change validation and RCA documentation.</li>\n</ul>\n<h2>Scope</h2>\n<ul>\n<li>One mail transport workflow.</li>\n<li>One limited incident window.</li>\n<li>One validation cycle after corrective action.</li>\n</ul>\n<h2>Symptoms</h2>\n<ul>\n<li>Mail items queued before final delivery.</li>\n<li>The queue backlog increased during the incident window.</li>\n<li>Delivery timing returned to normal after rule review.</li>\n</ul>\n<h2>Impact</h2>\n<ul>\n<li>Users saw delayed delivery rather than a total outage.</li>\n<li>The issue was operational, not security-related.</li>\n<li>No evidence of message corruption or data loss was observed.</li>\n</ul>\n<h2>Timeline</h2>\n<ul>\n<li>09:15 UTC: Initial report entered the service desk workflow.</li>\n<li>09:22 UTC: Transport rule review began.</li>\n<li>09:31 UTC: Connector health and queue state were confirmed.</li>\n<li>09:44 UTC: Controlled test submission isolated the delay.</li>\n<li>10:03 UTC: Rule precedence was corrected in the test workflow.</li>\n<li>10:41 UTC: Delivery timing returned to baseline.</li>\n</ul>\n<h2>Triage Steps</h2>\n<ul>\n<li>Confirmed the delay was repeatable under controlled test conditions.</li>\n<li>Checked queue depth before and after the review.</li>\n<li>Reviewed recent rule changes and their order of execution.</li>\n<li>Validated that the mail path itself remained available.</li>\n<li>Separated service availability from rule-processing delay so the incident was not misclassified as a full outage.</li>\n<li>Preserved the timeline and validation notes as sanitized evidence for future review.</li>\n</ul>\n<h2>Root Cause</h2>\n<p>The delay was caused by a transport rule precedence issue that created an unnecessary wait in the mail flow. Once the rule order was reviewed and aligned with the intended processing path, the backlog cleared and delivery normalized.</p>\n<h2>Corrective Actions</h2>\n<ul>\n<li>Reordered the test workflow rules.</li>\n<li>Revalidated mail delivery with a clean test message.</li>\n<li>Documented the incident pattern for future change review.</li>\n</ul>\n<h2>Validation Performed</h2>\n<ul>\n<li>Queue backlog was observed to drain after remediation.</li>\n<li>Delivery timing returned to expected behavior.</li>\n<li>No secondary symptoms were found during the verification window.</li>\n</ul>\n<h2>Prevention Steps</h2>\n<ul>\n<li>Require rule-order review before transport changes.</li>\n<li>Add a queue-health check to post-change validation.</li>\n<li>Keep a short rollback window for mail-flow updates.</li>\n</ul>\n<h2>Lessons Learned</h2>\n<ul>\n<li>Rule precedence can create a user-visible delay without a hard outage.</li>\n<li>A focused RCA should confirm both the symptom and the recovery path.</li>\n<li>Sanitized evidence can still preserve the troubleshooting method clearly.</li>\n</ul></article>",
    "active": "Projects"
  },
  "documentation/c80825d410b9": {
    "title": "Remediation Plan",
    "description": "Retained technical documentation: Remediation Plan",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Remediation Plan</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/troubleshooting-rca/remediation-plan.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Remediation Plan</h2>\n<p>Status: Sanitized portfolio evidence\nScope: Mail transport remediation and prevention planning\nEvidence type: Remediation plan</p>\n<h2>Objective</h2>\n<p>Define the corrective action sequence for a sanitized transport rule precedence issue while preserving rollback checkpoints, validation steps, and follow-up documentation.</p>\n<h2>Technical Areas Demonstrated</h2>\n<ul>\n<li>Change sequencing and controlled remediation.</li>\n<li>Mail transport rule review.</li>\n<li>Queue health validation.</li>\n<li>Rollback planning.</li>\n<li>Post-change documentation and prevention controls.</li>\n</ul>\n<h2>Issue Summary</h2>\n<p>This plan documents the corrective approach for a sanitized mail flow delay case. It is written in enterprise service desk language and avoids private identifiers, ticket numbers, and credentials.</p>\n<h2>Scope</h2>\n<ul>\n<li>Transport rule order.</li>\n<li>Queue behavior.</li>\n<li>Post-change verification.</li>\n</ul>\n<h2>Symptoms</h2>\n<ul>\n<li>Delayed mail delivery.</li>\n<li>Temporary queue growth.</li>\n<li>Recovery after rule review.</li>\n</ul>\n<h2>Impact</h2>\n<ul>\n<li>Delays were user-visible but short-lived.</li>\n<li>The event stayed within a single mail path.</li>\n</ul>\n<h2>Timeline</h2>\n<ul>\n<li>09:15 UTC: Incident reported.</li>\n<li>09:22 UTC: Transport review started.</li>\n<li>10:03 UTC: Corrective rule order was applied in the test workflow.</li>\n<li>10:41 UTC: Normal delivery timing returned.</li>\n</ul>\n<h2>Triage Steps</h2>\n<ul>\n<li>Confirmed the issue before making changes.</li>\n<li>Isolated the transport path.</li>\n<li>Verified the backlog was not caused by a wider outage.</li>\n</ul>\n<h2>Root Cause</h2>\n<p>A rule precedence problem created a delay in the mail transport sequence. The transport path was functional, but the processing order caused messages to wait too long before completion.</p>\n<h2>Corrective Actions</h2>\n<ul>\n<li>Reorder the transport rules in the approved workflow.</li>\n<li>Revalidate message delivery after the change.</li>\n<li>Save a rollback point before future transport edits.</li>\n</ul>\n<h2>Validation Performed</h2>\n<ul>\n<li>Confirmed a test message delivered successfully.</li>\n<li>Confirmed queue depth returned to expected levels.</li>\n<li>Confirmed the mail path remained stable after the correction.</li>\n</ul>\n<h2>Prevention Steps</h2>\n<ul>\n<li>Review transport rule order during any change window.</li>\n<li>Add a queue-depth check to the standard validation set.</li>\n<li>Document a rollback option before transport updates.</li>\n</ul>\n<h2>Lessons Learned</h2>\n<ul>\n<li>A small precedence change can have noticeable user impact.</li>\n<li>Remediation plans should always include verification steps.</li>\n<li>Clear recovery notes help future reviewers understand the decision path.</li>\n</ul></article>",
    "active": "Projects"
  },
  "documentation/b04f285c1042": {
    "title": "Troubleshooting Notes",
    "description": "Retained technical documentation: Troubleshooting Notes",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Troubleshooting Notes</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/troubleshooting-rca/troubleshooting-notes.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Troubleshooting Notes</h2>\n<p>Status: Sanitized portfolio evidence\nScope: Service desk triage notes for a mail flow delay scenario\nEvidence type: Troubleshooting notes</p>\n<h2>Issue Summary</h2>\n<p>Service desk triage was performed for a short mail delivery delay. The notes are sanitized and do not include private customer data, ticket numbers, or sensitive system identifiers.</p>\n<h2>Scope</h2>\n<ul>\n<li>Mail flow only.</li>\n<li>Limited incident window.</li>\n<li>No unrelated infrastructure changes.</li>\n</ul>\n<h2>Symptoms</h2>\n<ul>\n<li>Queue backlog increased.</li>\n<li>Delivery timing was inconsistent.</li>\n<li>Transport processing appeared slower than baseline.</li>\n</ul>\n<h2>Impact</h2>\n<ul>\n<li>Users experienced delayed delivery.</li>\n<li>The issue stayed within one transport path.</li>\n</ul>\n<h2>Timeline</h2>\n<ul>\n<li>09:15 UTC: Delay report logged.</li>\n<li>09:22 UTC: Rule review started.</li>\n<li>09:31 UTC: Connector health checked.</li>\n<li>09:44 UTC: Test message submitted.</li>\n<li>10:03 UTC: Rule precedence adjusted in the test workflow.</li>\n</ul>\n<h2>Triage Steps</h2>\n<ul>\n<li>Verified the report with queue and path checks.</li>\n<li>Reviewed recent transport changes before applying remediation.</li>\n<li>Compared the affected path with a known-good control message.</li>\n<li>Confirmed the backlog was tied to one transport sequence.</li>\n</ul>\n<h2>Root Cause</h2>\n<p>The investigation pointed to rule precedence in the transport workflow. The order of processing created a temporary wait condition that slowed message delivery.</p>\n<h2>Corrective Actions</h2>\n<ul>\n<li>Adjusted the rule sequence in the controlled workflow.</li>\n<li>Retested with a single message submission.</li>\n<li>Monitored queue drainage after the change.</li>\n</ul>\n<h2>Validation Performed</h2>\n<ul>\n<li>Confirmed the control message delivered successfully.</li>\n<li>Confirmed queue depth returned toward normal.</li>\n<li>Confirmed the incident did not expand to other services.</li>\n</ul>\n<h2>Prevention Steps</h2>\n<ul>\n<li>Review rule changes during change planning.</li>\n<li>Record a baseline before and after transport updates.</li>\n<li>Keep a short validation checklist for future incidents.</li>\n</ul>\n<h2>Lessons Learned</h2>\n<ul>\n<li>Queue behavior is a useful early indicator of transport issues.</li>\n<li>A structured triage path reduces guesswork.</li>\n<li>Clean notes make portfolio evidence easier to review.</li>\n</ul></article>",
    "active": "Projects"
  },
  "documentation/8d2f8f3864b3": {
    "title": "Validation Checklist",
    "description": "Retained technical documentation: Validation Checklist",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Validation Checklist</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/evidence-library/projects/troubleshooting-rca/validation-checklist.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Validation Checklist</h2>\n<p>Status: Sanitized portfolio evidence\nScope: Mail flow post-change verification\nEvidence type: Validation checklist</p>\n<h2>Objective</h2>\n<p>Confirm that corrective action restored expected mail-flow behavior and did not introduce secondary symptoms.</p>\n<h2>Technical Areas Demonstrated</h2>\n<ul>\n<li>Post-change validation.</li>\n<li>Queue health review.</li>\n<li>Controlled test message verification.</li>\n<li>Stability observation window.</li>\n<li>Evidence capture for RCA closure.</li>\n</ul>\n<h2>Issue Summary</h2>\n<p>This checklist captures the validation phase for a sanitized troubleshooting RCA scenario. No customer names, ticket numbers, IPs, or credentials are included.</p>\n<h2>Scope</h2>\n<ul>\n<li>Mail transport path.</li>\n<li>Queue behavior.</li>\n<li>Test-message delivery.</li>\n</ul>\n<h2>Symptoms</h2>\n<ul>\n<li>Delivery delay observed before remediation.</li>\n<li>Queue backlog present during triage.</li>\n</ul>\n<h2>Impact</h2>\n<ul>\n<li>Delayed delivery for a limited period.</li>\n</ul>\n<h2>Timeline</h2>\n<ul>\n<li>09:44 UTC: Test message submitted.</li>\n<li>10:03 UTC: Rule order correction applied in the test workflow.</li>\n<li>10:18 UTC: Queue backlog began to drain.</li>\n<li>10:41 UTC: Timing returned to normal.</li>\n</ul>\n<h2>Triage Steps</h2>\n<ul>\n<li>Reviewed queue state before the change.</li>\n<li>Confirmed the issue was isolated.</li>\n<li>Rechecked the same path after remediation.</li>\n</ul>\n<h2>Root Cause</h2>\n<p>Transport rule precedence created an unnecessary delay in message processing.</p>\n<h2>Corrective Actions</h2>\n<ul>\n<li>Reordered the rules.</li>\n<li>Submitted a control message.</li>\n<li>Observed the recovery path.</li>\n</ul>\n<h2>Validation Performed</h2>\n<ul>\n<li>[x] Confirmed the control message delivered successfully.</li>\n<li>[x] Confirmed queue backlog was reducing.</li>\n<li>[x] Confirmed no new symptoms appeared during monitoring.</li>\n<li>[x] Confirmed normal timing returned within the verification window.</li>\n</ul>\n<h2>Prevention Steps</h2>\n<ul>\n<li>Keep this checklist with future transport changes.</li>\n<li>Review message queue behavior after rule updates.</li>\n<li>Record rollback and verification notes together.</li>\n</ul>\n<h2>Lessons Learned</h2>\n<ul>\n<li>Validation should prove both delivery and stability.</li>\n<li>A checklist keeps the recovery path repeatable.</li>\n</ul></article>",
    "active": "Projects"
  },
  "documentation/175635baeeb5": {
    "title": "Microsoft Entra Hybrid Identity & Cloud Sync",
    "description": "Retained technical documentation: Microsoft Entra Hybrid Identity & Cloud Sync",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Microsoft Entra Hybrid Identity &amp; Cloud Sync</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/entra-cloud-sync/README.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Microsoft Entra Hybrid Identity &amp; Cloud Sync</h2>\n<h2>Project Status</h2>\n<p>COMPLETE</p>\n<h2>Overview</h2>\n<p>This project demonstrates a validated hybrid identity implementation using Microsoft Entra Cloud Sync to synchronize selected Active Directory users and groups from an on-premises Windows Server environment to Microsoft Entra ID.</p>\n<p>The project focuses on controlled identity lifecycle validation, source-of-authority verification, Password Hash Synchronization, security-group synchronization, provisioning-log analysis, and troubleshooting without rebuilding the existing working Cloud Sync deployment.</p>\n<h2>Environment</h2>\n<h3>On-Premises</h3>\n<ul>\n<li>Active Directory domain: <code>ad.jeremyfontenot.online</code></li>\n<li>NetBIOS domain: <code>JFAD</code></li>\n<li>Domain Controller: <code>DC01</code></li>\n<li>DC01 IP: <code>10.10.20.10</code></li>\n<li>Operating System: Windows Server 2022</li>\n<li>Domain functional level: Windows Server 2016</li>\n</ul>\n<h3>Cloud Sync</h3>\n<ul>\n<li>Cloud Sync server: <code>SYNC01</code></li>\n<li>SYNC01 IP: <code>10.10.20.105</code></li>\n<li>Operating System: Windows Server 2022</li>\n<li>Synchronization technology: Microsoft Entra Cloud Sync</li>\n<li>Password Hash Synchronization: Enabled</li>\n</ul>\n<h3>Microsoft Entra</h3>\n<ul>\n<li>Verified domain: <code>jeremyfontenot.online</code></li>\n<li>Synchronization direction: Active Directory → Microsoft Entra ID</li>\n</ul>\n<h2>Cloud Sync Scope</h2>\n<p>Synchronization is intentionally limited to:</p>\n<p><code>OU=Cloud Sync,OU=JFAD,DC=ad,DC=jeremyfontenot,DC=online</code></p>\n<p>This provides a controlled boundary for hybrid identity testing without synchronizing unrelated Active Directory objects.</p>\n<h2>Validated Capabilities</h2>\n<p>The project successfully validated:</p>\n<ul>\n<li>Cloud Sync provisioning-agent health</li>\n<li>Dedicated OU scoping</li>\n<li>New user provisioning from Active Directory to Microsoft Entra ID</li>\n<li>On-premises attribute synchronization</li>\n<li>Password Hash Synchronization</li>\n<li>Cloud authentication after an on-premises password change</li>\n<li>Security-group synchronization</li>\n<li>Group-membership synchronization</li>\n<li>Provisioning logs</li>\n<li>Source-anchor correlation</li>\n<li>Source-of-authority behavior</li>\n<li>Provisioning-failure review</li>\n<li>Cloud Sync troubleshooting</li>\n</ul>\n<h2>Controlled Lifecycle Test</h2>\n<p>The primary test identity was:</p>\n<p><code>cloudsync.test01@jeremyfontenot.online</code></p>\n<p>The lifecycle test validated:</p>\n<ol>\n<li>Creation in on-premises Active Directory</li>\n<li>Placement in the dedicated Cloud Sync OU</li>\n<li>Provisioning to Microsoft Entra ID</li>\n<li>Synchronization of the <code>Department</code> attribute</li>\n<li>Password change on-premises</li>\n<li>Successful Microsoft Entra authentication with the updated password</li>\n<li>Membership in <code>GG-CloudSync-Test</code></li>\n<li>Security-group and membership synchronization</li>\n<li>Provisioning-log confirmation</li>\n<li>Source-anchor and immutable-ID correlation</li>\n</ol>\n<h2>Source of Authority</h2>\n<p>For the synchronized objects tested in this project, on-premises Active Directory remained the authoritative identity source.</p>\n<p>The identity relationship was validated by correlating:</p>\n<ul>\n<li>Active Directory <code>objectGUID</code></li>\n<li>Cloud Sync <code>SourceAnchor</code></li>\n<li>Microsoft Entra on-premises immutable ID</li>\n<li>Provisioning-log source and target identifiers</li>\n</ul>\n<h2>Synchronization Timing</h2>\n<p>Observed Cloud Sync intervals:</p>\n<ul>\n<li>Users and Groups provisioning: 20 minutes</li>\n<li>Password Hash Synchronization: 5 minutes</li>\n</ul>\n<p>These separate intervals were accounted for during validation and troubleshooting.</p>\n<h2>Troubleshooting Highlights</h2>\n<p>During validation, the Cloud Sync agent reported a permissions-related metrics error involving access to the registry key <code>Global</code>.</p>\n<p>The provisioning agent gMSA was added to the local <code>Performance Log Users</code> group on <code>SYNC01</code>.</p>\n<p>After the agent service restarted:</p>\n<ul>\n<li>the registry-access error did not recur</li>\n<li>the metrics agent initialized successfully</li>\n<li>Cloud Sync remained active</li>\n<li>user synchronization succeeded</li>\n<li>group synchronization succeeded</li>\n<li>Password Hash Synchronization succeeded</li>\n</ul>\n<p>The existing Cloud Sync installation was preserved.</p>\n<h2>Project Documentation</h2>\n<ul>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/entra-cloud-sync/architecture.md\" rel=\"noopener noreferrer\" target=\"_blank\">Architecture</a></li>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/entra-cloud-sync/implementation.md\" rel=\"noopener noreferrer\" target=\"_blank\">Implementation</a></li>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/entra-cloud-sync/validation.md\" rel=\"noopener noreferrer\" target=\"_blank\">Validation</a></li>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/entra-cloud-sync/troubleshooting.md\" rel=\"noopener noreferrer\" target=\"_blank\">Troubleshooting</a></li>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/entra-cloud-sync/lessons-learned.md\" rel=\"noopener noreferrer\" target=\"_blank\">Lessons Learned</a></li>\n</ul>\n<h2>Security and Evidence Handling</h2>\n<p>Portfolio evidence is sanitized.</p>\n<p>The project does not publish:</p>\n<ul>\n<li>passwords</li>\n<li>authentication tokens</li>\n<li>session cookies</li>\n<li>private keys</li>\n<li>VPN credentials</li>\n<li>other authentication secrets</li>\n</ul>\n<h2>Technologies Demonstrated</h2>\n<ul>\n<li>Windows Server 2022</li>\n<li>Active Directory Domain Services</li>\n<li>Microsoft Entra ID</li>\n<li>Microsoft Entra Cloud Sync</li>\n<li>Password Hash Synchronization</li>\n<li>Group Managed Service Accounts</li>\n<li>PowerShell</li>\n<li>PowerShell Remoting</li>\n<li>Microsoft Entra provisioning logs</li>\n<li>Hybrid identity troubleshooting</li>\n</ul>\n<h2>Validation Script</h2>\n<p>A reusable PowerShell validation script is included at:</p>\n<p><code>scripts/Test-CloudSyncADState.ps1</code></p>\n<p>The script validates the current on-premises source state for:</p>\n<ul>\n<li><code>cloudsync.test01</code></li>\n<li><code>GG-CloudSync-Test</code></li>\n<li>Direct group membership</li>\n<li>Objects located in the dedicated Cloud Sync OU</li>\n</ul>\n<p>The script is designed to be executed against a domain controller with the Active Directory PowerShell module available.</p>\n<p>Example execution from the administrative workstation:</p>\n<pre><code class=\"language-powershell\">Invoke-Command -Session $dc -FilePath \".\\scripts\\Test-CloudSyncADState.ps1\"\n</code></pre>\n<p>The script provides repeatable evidence of the Active Directory state without modifying directory objects.</p>\n<h2>Interview Explanation</h2>\n<p>I built and validated a hybrid identity lab using Microsoft Entra Cloud Sync between an on-premises Active Directory environment and Microsoft Entra ID.</p>\n<p>The environment uses Windows Server 2022 with a dedicated Cloud Sync server and a scoped synchronization OU. I preserved the existing working Cloud Sync deployment rather than rebuilding it.</p>\n<p>For the validation, I created a controlled Active Directory user and confirmed that it provisioned to Microsoft Entra. I then changed a supported on-premises attribute, verified the cloud update, changed the user password on-premises, and validated Password Hash Synchronization by successfully authenticating to Microsoft Entra with the new password.</p>\n<p>I also created a security group, synchronized the group and its membership, reviewed provisioning logs, and correlated the Active Directory objectGUID with the Cloud Sync source anchor and the Microsoft Entra immutable ID.</p>\n<p>During troubleshooting, I identified a permissions issue affecting Cloud Sync metrics, corrected the gMSA permissions on SYNC01, and validated that the agent remained healthy. I also documented the difference between the 20-minute Users and Groups provisioning interval and the 5-minute Password Hash Sync interval so that normal propagation delay is not mistaken for a failure.</p>\n<p>The project demonstrates hybrid identity administration, Active Directory, Microsoft Entra ID, Cloud Sync, Password Hash Synchronization, group synchronization, PowerShell remoting, provisioning-log analysis, and evidence-based troubleshooting.</p>\n<h2>Resume Bullet</h2>\n<ul>\n<li>Built and validated a Microsoft Entra hybrid identity lab using Windows Server 2022 Active Directory and Microsoft Entra Cloud Sync, including scoped user and security-group synchronization, Password Hash Synchronization, attribute lifecycle testing, source-anchor correlation, provisioning-log analysis, gMSA troubleshooting, and PowerShell-based remote administration.</li>\n</ul>\n<h2>LinkedIn Project Description</h2>\n<p>Built and validated a Microsoft Entra hybrid identity lab integrating Windows Server 2022 Active Directory with Microsoft Entra ID through Microsoft Entra Cloud Sync.</p>\n<p>The project included controlled user provisioning, attribute synchronization, Password Hash Synchronization, security-group and group-membership synchronization, source-anchor correlation, provisioning-log analysis, and PowerShell-based remote administration.</p>\n<p>I also troubleshot Cloud Sync agent permissions using event logs, validated the provisioning agent gMSA configuration, and confirmed the difference between the 20-minute Users and Groups provisioning cycle and the separate 5-minute Password Hash Sync cycle.</p>\n<p>Technologies used: Windows Server 2022, Active Directory Domain Services, Microsoft Entra ID, Microsoft Entra Cloud Sync, Password Hash Synchronization, gMSA, PowerShell, PowerShell Remoting, and Entra provisioning logs.</p></article>",
    "active": "Projects"
  },
  "documentation/4fb28c09432c": {
    "title": "Architecture",
    "description": "Retained technical documentation: Architecture",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Architecture</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/entra-cloud-sync/architecture.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Architecture</h2>\n<h2>Project Status</h2>\n<p>COMPLETE</p>\n<h2>Hybrid Identity Architecture</h2>\n<p>This project uses Microsoft Entra Cloud Sync to synchronize selected identities from on-premises Active Directory to Microsoft Entra ID.</p>\n<h2>Core Components</h2>\n<h3>On-Premises Active Directory</h3>\n<ul>\n<li>Domain: <code>ad.jeremyfontenot.online</code></li>\n<li>NetBIOS: <code>JFAD</code></li>\n<li>Domain Controller: <code>DC01</code></li>\n<li>IP address: <code>10.10.20.10</code></li>\n<li>Operating System: Windows Server 2022</li>\n<li>Domain functional level: Windows Server 2016</li>\n</ul>\n<p>Directory services provided by DC01 include:</p>\n<ul>\n<li>Active Directory Domain Services</li>\n<li>DNS</li>\n<li>DHCP</li>\n<li>Kerberos</li>\n<li>Global Catalog</li>\n<li>Active Directory Web Services</li>\n</ul>\n<h3>Cloud Sync Server</h3>\n<ul>\n<li>Server: <code>SYNC01</code></li>\n<li>IP address: <code>10.10.20.105</code></li>\n<li>Operating System: Windows Server 2022</li>\n<li>Role: Microsoft Entra Cloud Sync provisioning agent host</li>\n</ul>\n<p>The Cloud Sync agent runs under an existing group Managed Service Account.</p>\n<h3>Microsoft Entra ID</h3>\n<ul>\n<li>Verified domain: <code>jeremyfontenot.online</code></li>\n<li>Synchronization direction: Active Directory to Microsoft Entra ID</li>\n<li>Synchronization technology: Microsoft Entra Cloud Sync</li>\n<li>Password Hash Synchronization: Enabled</li>\n</ul>\n<h2>Synchronization Scope</h2>\n<p>Cloud Sync is intentionally limited to:</p>\n<p><code>OU=Cloud Sync,OU=JFAD,DC=ad,DC=jeremyfontenot,DC=online</code></p>\n<p>This dedicated OU provides a controlled boundary for synchronized users and groups without broadly synchronizing unrelated Active Directory objects.</p>\n<h2>Identity Flow</h2>\n<p>The validated identity path is:</p>\n<p><code>DC01 Active Directory</code>\n→ <code>Dedicated Cloud Sync OU</code>\n→ <code>SYNC01 Microsoft Entra Cloud Sync Agent</code>\n→ <code>Microsoft Entra ID</code></p>\n<p>Password changes follow a separate Password Hash Synchronization process through the same Cloud Sync deployment.</p>\n<h2>Validated Object Types</h2>\n<p>The project validated synchronization of:</p>\n<ul>\n<li>User objects</li>\n<li>User attributes</li>\n<li>Security groups</li>\n<li>Group membership</li>\n<li>Password hashes</li>\n</ul>\n<h2>Source of Authority</h2>\n<p>For the identities tested in this project, on-premises Active Directory is the authoritative source.</p>\n<p>Microsoft Entra receives synchronized identity data through Cloud Sync.</p>\n<p>The identity relationship was validated through:</p>\n<ul>\n<li>Active Directory <code>objectGUID</code></li>\n<li>Cloud Sync <code>SourceAnchor</code></li>\n<li>Microsoft Entra on-premises immutable ID</li>\n<li>Provisioning-log source and target identifiers</li>\n</ul>\n<h2>Synchronization Timing</h2>\n<p>Observed configuration intervals:</p>\n<ul>\n<li>Users and Groups provisioning: 20 minutes</li>\n<li>Password Hash Synchronization: 5 minutes</li>\n</ul>\n<p>These are separate processing cycles and should be considered during troubleshooting.</p>\n<h2>Administrative Access Model</h2>\n<p>The administrative laptop is not domain joined.</p>\n<p>Administration is therefore performed primarily through:</p>\n<ul>\n<li>PowerShell Remoting to <code>DC01</code></li>\n<li>PowerShell Remoting to <code>SYNC01</code></li>\n<li>Microsoft Entra admin center</li>\n</ul>\n<p>This avoids relying on laptop Kerberos or domain-integrated RSAT functionality.</p>\n<h2>Design Principle</h2>\n<p>The architecture preserves the existing working Cloud Sync deployment.</p>\n<p>No additional synchronization engine was introduced, and Microsoft Entra Connect Sync was not installed simply to obtain manual delta-sync capability.</p>\n<h2>Cloud Sync vs. Microsoft Entra Connect Sync</h2>\n<p>This lab uses Microsoft Entra Cloud Sync rather than Microsoft Entra Connect Sync.</p>\n<h3>Microsoft Entra Cloud Sync</h3>\n<p>Cloud Sync uses a lightweight provisioning agent installed on <code>SYNC01</code>.</p>\n<p>In this lab it provides:</p>\n<ul>\n<li>Active Directory to Microsoft Entra ID user synchronization</li>\n<li>Security-group synchronization</li>\n<li>Group-membership synchronization</li>\n<li>Password Hash Synchronization</li>\n<li>OU-based scoping</li>\n<li>Cloud-managed provisioning configuration</li>\n<li>Provisioning-log visibility in Microsoft Entra</li>\n</ul>\n<p>The observed Users and Groups provisioning interval is 20 minutes.</p>\n<h3>Microsoft Entra Connect Sync</h3>\n<p>Microsoft Entra Connect Sync uses the traditional synchronization engine installed on a Windows Server.</p>\n<p>A key operational difference relevant to this lab is that Connect Sync supports administrator-triggered synchronization cycles, such as a delta synchronization, whereas the Cloud Sync Users and Groups provisioning job operates on its service-managed schedule.</p>\n<p>Connect Sync was not installed in this project because the existing Cloud Sync deployment was already functioning and introducing another synchronization engine was unnecessary for the project objectives.</p>\n<h3>Design Decision</h3>\n<p>Cloud Sync was retained because it already met the requirements of this controlled hybrid identity implementation.</p>\n<p>The architecture therefore remained:</p>\n<p><code>Active Directory</code>\n→ <code>Microsoft Entra Cloud Sync</code>\n→ <code>Microsoft Entra ID</code></p>\n<p>rather than adding Microsoft Entra Connect Sync solely to obtain manually triggered synchronization cycles.</p>\n<p>This preserves the existing working infrastructure and avoids overlapping synchronization engines for the same test objects.</p></article>",
    "active": "Projects"
  },
  "documentation/824e99df914f": {
    "title": "Evidence Manifest",
    "description": "Retained technical documentation: Evidence Manifest",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Evidence Manifest</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/entra-cloud-sync/evidence/README.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Evidence Manifest</h2>\n<h2>Project Status</h2>\n<p>COMPLETE</p>\n<p>This folder contains sanitized evidence and supporting visuals for the Microsoft Entra Hybrid Identity &amp; Cloud Sync project.</p>\n<h2>Captured Evidence</h2>\n<ol>\n<li><code>02-cloudsync-test01-initial-provisioning.png</code></li>\n<li>\n<p>Initial synchronized user in Microsoft Entra</p>\n</li>\n<li>\n<p><code>03-cloudsync-test01-attribute-sync.png</code></p>\n</li>\n<li>\n<p>Department attribute synchronized to <code>Hybrid Identity Lab</code></p>\n</li>\n<li>\n<p><code>04-cloudsync-test01-password-hash-sync.png</code></p>\n</li>\n<li>\n<p>Successful Microsoft Entra authentication after on-premises password change</p>\n</li>\n<li>\n<p><code>05-cloudsync-group-membership.png</code></p>\n</li>\n<li>\n<p><code>Cloud Sync Test 01</code> synchronized as a member of <code>GG-CloudSync-Test</code></p>\n</li>\n<li>\n<p><code>06-cloudsync-user-provisioning-log.png</code></p>\n</li>\n<li>\n<p>Successful user import, scope evaluation, and provisioning</p>\n</li>\n<li>\n<p><code>07-cloudsync-user-modified-properties.png</code></p>\n</li>\n<li>\n<p>User attribute and source-anchor processing</p>\n</li>\n<li>\n<p><code>08-cloudsync-source-authority.png</code></p>\n</li>\n<li>\n<p>On-premises synchronization and immutable-ID evidence</p>\n</li>\n<li>\n<p><code>09-cloudsync-overview-health.png</code></p>\n</li>\n<li>\n<p>Healthy Cloud Sync configuration and synchronization counts</p>\n</li>\n<li>\n<p><code>10-cloudsync-no-failures.png</code></p>\n</li>\n<li>\n<p>Final provisioning-log failure review with no results</p>\n</li>\n<li>\n<p><code>11-cloudsync-group-provisioning-log.png</code></p>\n<ul>\n<li>Successful group provisioning event</li>\n</ul>\n</li>\n<li>\n<p><code>12-cloudsync-group-modified-properties.png</code></p>\n<ul>\n<li>Group membership/source-anchor processing</li>\n</ul>\n</li>\n<li>\n<p><code>13-cloudsync-group-summary.png</code></p>\n<ul>\n<li>AD-to-Entra group provisioning summary</li>\n</ul>\n</li>\n<li>\n<p><code>14-cloudsync-agent-status.png</code></p>\n<ul>\n<li>SYNC01 Cloud Sync agent shown as Active</li>\n</ul>\n</li>\n<li>\n<p><code>15-cloudsync-ou-scope.png</code></p>\n<ul>\n<li>Dedicated Cloud Sync OU scope</li>\n</ul>\n</li>\n<li>\n<p><code>16-cloudsync-group-attribute-mapping.png</code></p>\n<ul>\n<li>Group attribute mappings</li>\n</ul>\n</li>\n</ol>\n<h2>Supporting Visuals</h2>\n<ul>\n<li><code>01-cloudsync-architecture.png</code></li>\n<li><code>02-identity-lifecycle.png</code></li>\n<li><code>03-source-anchor-correlation.png</code></li>\n<li><code>04-sync-timing.png</code></li>\n<li><code>05-troubleshooting-flow.png</code></li>\n<li><code>06-validation-summary.png</code></li>\n<li><code>07-cloudsync-vs-connect-sync.png</code></li>\n</ul>\n<p>These visuals summarize only validated Project 2 lab architecture, workflow, timing, troubleshooting, and validation results.</p>\n<h2>Evidence Note</h2>\n<p>The original pre-test OU baseline was captured as PowerShell output rather than as a screenshot. No screenshot was fabricated for that step.</p>\n<h2>Sanitization Requirements</h2>\n<p>Before publishing evidence, verify screenshots do not expose:</p>\n<ul>\n<li>passwords</li>\n<li>authentication tokens</li>\n<li>session cookies</li>\n<li>bearer tokens</li>\n<li>private keys</li>\n<li>VPN credentials</li>\n<li>recovery secrets</li>\n<li>other authentication secrets</li>\n</ul>\n<p>Directory object GUIDs, source anchors, lab UPNs, server names, and lab IP addresses may remain where intentionally used as technical evidence.</p></article>",
    "active": "Projects"
  },
  "documentation/23159e4114b3": {
    "title": "Implementation",
    "description": "Retained technical documentation: Implementation",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Implementation</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/entra-cloud-sync/implementation.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Implementation</h2>\n<h2>Project Status</h2>\n<p>COMPLETE</p>\n<h2>Existing Hybrid Identity Architecture</h2>\n<p>This project uses an existing Microsoft Entra Cloud Sync deployment. The synchronization infrastructure was already operational before this validation project and was not rebuilt.</p>\n<h3>On-Premises Active Directory</h3>\n<ul>\n<li>Domain: <code>ad.jeremyfontenot.online</code></li>\n<li>NetBIOS domain: <code>JFAD</code></li>\n<li>Domain Controller: <code>DC01</code></li>\n<li>Domain Controller IP: <code>10.10.20.10</code></li>\n<li>Operating System: Windows Server 2022</li>\n<li>Domain functional level: Windows Server 2016</li>\n</ul>\n<p>DC01 provides:</p>\n<ul>\n<li>Active Directory Domain Services</li>\n<li>DNS</li>\n<li>DHCP</li>\n<li>Kerberos</li>\n<li>Global Catalog</li>\n<li>Active Directory Web Services</li>\n</ul>\n<h3>Microsoft Entra</h3>\n<ul>\n<li>Verified domain: <code>jeremyfontenot.online</code></li>\n<li>Synchronization technology: Microsoft Entra Cloud Sync</li>\n<li>Cloud Sync server: <code>SYNC01</code></li>\n<li>SYNC01 IP: <code>10.10.20.105</code></li>\n<li>Operating System: Windows Server 2022</li>\n</ul>\n<h2>Cloud Sync Scope</h2>\n<p>Synchronization is intentionally limited to the dedicated organizational unit:</p>\n<p><code>OU=Cloud Sync,OU=JFAD,DC=ad,DC=jeremyfontenot,DC=online</code></p>\n<p>The scope was validated in the Microsoft Entra admin center before performing the controlled identity lifecycle test.</p>\n<h2>Controlled Test User</h2>\n<p>A dedicated test identity was created in the Cloud Sync OU:</p>\n<ul>\n<li>Display name: <code>Cloud Sync Test 01</code></li>\n<li>SAM account name: <code>cloudsync.test01</code></li>\n<li>UPN: <code>cloudsync.test01@jeremyfontenot.online</code></li>\n<li>Enabled: Yes</li>\n<li>Password expiration: Disabled for the controlled lab account</li>\n</ul>\n<p>The account was created on-premises and allowed to synchronize through the existing Cloud Sync configuration.</p>\n<h2>Attribute Synchronization Test</h2>\n<p>The on-premises <code>Department</code> attribute was changed to:</p>\n<p><code>Hybrid Identity Lab</code></p>\n<p>The value was first validated in Active Directory and subsequently verified in Microsoft Entra.</p>\n<h2>Password Hash Synchronization Test</h2>\n<p>The controlled user's password was changed on-premises.</p>\n<p>The change was validated by:</p>\n<ol>\n<li>Confirming a new <code>PasswordLastSet</code> timestamp in Active Directory.</li>\n<li>Authenticating successfully to Microsoft Entra using the updated password.</li>\n</ol>\n<p>No password value was recorded in project evidence.</p>\n<h2>Security Group Synchronization Test</h2>\n<p>A controlled Active Directory security group was created:</p>\n<ul>\n<li>Group: <code>GG-CloudSync-Test</code></li>\n<li>Category: Security</li>\n<li>Scope: Global</li>\n<li>Location: Dedicated Cloud Sync OU</li>\n</ul>\n<p><code>cloudsync.test01</code> was added as a direct member.</p>\n<p>After the normal Cloud Sync provisioning cycle, Microsoft Entra showed:</p>\n<ul>\n<li>Source: Windows Server AD</li>\n<li>Type: Security</li>\n<li>One synchronized direct user member</li>\n</ul>\n<h2>Synchronization Intervals Observed</h2>\n<p>The Cloud Sync configuration reports:</p>\n<ul>\n<li>Users and Groups provisioning interval: 20 minutes</li>\n<li>Password Hash Sync interval: 5 minutes</li>\n</ul>\n<p>These separate synchronization schedules were accounted for during validation to distinguish expected propagation delay from actual synchronization failures.</p>\n<h2>Provisioning Agent</h2>\n<p>The existing agent on <code>SYNC01</code> was retained.</p>\n<p>Agent validation confirmed:</p>\n<ul>\n<li>Service: <code>AADConnectProvisioningAgent</code></li>\n<li>Service state: Running</li>\n<li>Startup mode: Automatic</li>\n<li>Microsoft Entra agent status: Active</li>\n</ul>\n<p>The agent runs under its existing group Managed Service Account and was not reinstalled or replaced.</p>\n<h2>Implementation Principle</h2>\n<p>All lifecycle changes originated in on-premises Active Directory. Microsoft Entra was treated as the synchronized target for the tested identities and attributes.</p>\n<p>Existing Cloud Sync infrastructure was preserved throughout the project.</p></article>",
    "active": "Projects"
  },
  "documentation/8d050c4af940": {
    "title": "Lessons Learned",
    "description": "Retained technical documentation: Lessons Learned",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Technical source document</p><h1>Lessons Learned</h1><p class=\"lead\">Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.</p><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/entra-cloud-sync/lessons-learned.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original GitHub document <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation\" data-route=\"documentation\" class=\"\">All documentation</a></div></div><article class=\"document readable\"><h2>Lessons Learned</h2>\n<h2>Project Status</h2>\n<p>COMPLETE</p>\n<h2>Preserve Working Infrastructure</h2>\n<p>The existing Microsoft Entra Cloud Sync deployment was already functioning and did not need to be rebuilt.</p>\n<p>A key operational lesson from this project was to validate the current state before making changes. The working agent, OU scope, Password Hash Synchronization, and existing synchronized users provided a known-good baseline.</p>\n<h2>Understand Cloud Sync Timing</h2>\n<p>Microsoft Entra Cloud Sync uses separate synchronization intervals for different functions.</p>\n<p>Observed in this lab:</p>\n<ul>\n<li>Users and Groups provisioning: 20 minutes</li>\n<li>Password Hash Synchronization: 5 minutes</li>\n</ul>\n<p>A newly created or modified directory object should not be treated as failed until the expected provisioning interval has been considered.</p>\n<p>This distinction prevents unnecessary troubleshooting, restarts, or configuration changes.</p>\n<h2>Source of Authority Matters</h2>\n<p>For synchronized identities, on-premises Active Directory remained the authoritative source for the tested attributes.</p>\n<p>Changes were made in Active Directory first and then validated in Microsoft Entra.</p>\n<p>The source relationship was verified using:</p>\n<ul>\n<li>Active Directory <code>objectGUID</code></li>\n<li>Base64 source-anchor conversion</li>\n<li>Microsoft Entra on-premises immutable ID</li>\n<li>Provisioning log source and target identifiers</li>\n</ul>\n<h2>Source Anchors Provide Strong Identity Correlation</h2>\n<p>The controlled user's Active Directory <code>objectGUID</code> was converted to its Base64 source-anchor representation.</p>\n<p>That value matched the Microsoft Entra on-premises immutable ID and the provisioning-log source anchor.</p>\n<p>This provided direct evidence that the cloud identity was linked to the intended on-premises AD object.</p>\n<h2>Password Hash Synchronization Is Independent of User Provisioning Timing</h2>\n<p>Password Hash Synchronization completed on a shorter cycle than Users and Groups provisioning.</p>\n<p>Successful Microsoft Entra authentication after an on-premises password change provided practical proof that Password Hash Synchronization was functioning.</p>\n<h2>Group Synchronization Includes Membership Relationships</h2>\n<p>Creating a synchronized group is only part of group lifecycle validation.</p>\n<p>This project also confirmed that:</p>\n<ul>\n<li>The security group synchronized to Microsoft Entra</li>\n<li>The user membership synchronized</li>\n<li>Provisioning logs processed the membership relationship</li>\n<li>The group <code>Member</code> property referenced the synchronized user's source anchor</li>\n</ul>\n<h2>Provisioning Logs Are Essential Troubleshooting Evidence</h2>\n<p>Provisioning logs provided visibility into:</p>\n<ul>\n<li>Import from Active Directory</li>\n<li>Scope evaluation</li>\n<li>Provisioning into Microsoft Entra ID</li>\n<li>Modified properties</li>\n<li>Source IDs</li>\n<li>Target IDs</li>\n<li>Success or failure status</li>\n</ul>\n<p>They were more useful for determining actual synchronization behavior than relying only on portal object visibility.</p>\n<h2>Service Running Does Not Mean Every Component Is Healthy</h2>\n<p>The provisioning agent service was Running while the event log still contained performance-counter errors.</p>\n<p>Reviewing the agent event log identified a permissions issue affecting the metrics collector.</p>\n<p>Adding the provisioning gMSA to the local <code>Performance Log Users</code> group resolved the registry-access error without reinstalling Cloud Sync.</p>\n<h2>Validate Commands in Their Correct Context</h2>\n<p><code>Test-ADServiceAccount</code> returned <code>False</code> when executed on DC01 because the Cloud Sync gMSA was assigned for use by SYNC01.</p>\n<p>The result demonstrated the importance of understanding what a validation command actually tests before interpreting its output as a failure.</p>\n<h2>Do Not Troubleshoot Normal Delay as an Outage</h2>\n<p>The group initially appeared missing from Microsoft Entra because a Users and Groups provisioning cycle had not yet completed.</p>\n<p>The object eventually synchronized successfully after the expected Cloud Sync interval.</p>\n<p>The main operational lesson is:</p>\n<blockquote>\n<p>Confirm the synchronization schedule before escalating normal propagation delay into troubleshooting.</p>\n</blockquote>\n<h2>Portfolio Evidence Should Be Sanitized</h2>\n<p>Useful evidence includes:</p>\n<ul>\n<li>AD object properties</li>\n<li>OU scope</li>\n<li>provisioning status</li>\n<li>group membership</li>\n<li>provisioning logs</li>\n<li>source-anchor correlation</li>\n<li>synchronization timestamps</li>\n<li>agent health</li>\n</ul>\n<p>Passwords, tokens, authentication secrets, private keys, and other credentials should never be included in portfolio evidence.</p></article>",
    "active": "Projects"
  }
}