Generalize USMT Dash and add a containerized demo mode

Remove all environment-specific data and make the dashboard adoptable
anywhere, then add a demo that runs the real PowerShell services.

- Strip cached device data, internal knowledge-base articles and
  screenshots, server/site names and the old project notes; replace the
  knowledge base with generic sample articles and diagrams
- Move every environment value into Config/usmt-dash.psd1
- Route all infrastructure access in the worker and Get-Software.ps1
  through a provider (Providers/SCCM.ps1), with a config-driven asset
  inventory view instead of a hard-coded custom class
- Add Providers/Demo.ps1: a deterministic simulated fleet whose
  migrations progress in real time, and Demo/New-DemoData.ps1 to seed it
- Server: -Demo makes the API read-only; add get-config and get-logs;
  serve static files only from web/, Documentation/ and an allowlist of
  Data/ files with a path-traversal guard; gzip large responses
- Mirror both services' console output to Data/Logs via a Write-Host
  proxy, and add a terminal panel to the dashboard that streams it
- Demo sandbox (web/demo/demo.js): visitor changes to tags, articles and
  images are kept in the visitor's browser and echoed in the terminals;
  nothing a visitor does reaches the server
- Vendor marked, highlight.js and html2pdf.js instead of loading CDNs
- Dockerfile and compose file for hosting the demo (Coolify-ready)

Documentation/Adobe Acrobat Pro.md

@@ -0,0 +1,26 @@
+[[Blue:Licensed]] [[Gray:Named User]]
+
+# Adobe Acrobat Pro
+
+Acrobat Pro is licensed per user through the Adobe Admin Console. The installer is the same unified package as Acrobat Reader; signing in with a licensed account unlocks Pro features.
+
+## Install
+
+1. Confirm the user is assigned an Acrobat Pro license in the Adobe Admin Console (ask the license owner if not).
+2. On the new device open **Software Center** and install **Adobe Acrobat (64-bit)**.
+   - Manual installer if Software Center is unavailable: [[Copy:\\fileserver\software\AcrobatPro\Setup.exe]]
+3. Launch Acrobat and have the user sign in with their company account.
+4. Verify **Help > About Adobe Acrobat** shows *Acrobat Pro*.
+
+## Common Issues
+
+**Still shows "Acrobat Reader" after sign-in**
+1. Sign out (**Help > Sign Out**), close Acrobat, sign back in.
+2. If it persists, the license assignment hasn't synced yet. Wait 15 minutes and repeat.
+
+**Default PDF handler reverted to Edge**
+- Settings > Apps > Default apps > search `.pdf` > choose **Adobe Acrobat**.
+
+## Migration Notes
+- USMT carries over Acrobat preferences, but **digital signature certificates** stored outside the user profile must be re-imported.
+- Custom stamps live in `%AppData%\Adobe\Acrobat\DC\Stamps`. Confirm they came across.

Documentation/Adobe Creative Cloud.md

@@ -0,0 +1,21 @@
+[[Blue:Licensed]] [[Yellow:Large Install]]
+
+# Adobe Creative Cloud
+
+Creative Cloud apps (Photoshop, Illustrator, InDesign, ...) are installed through the **Creative Cloud Desktop** app after the user signs in.
+
+## Install
+
+1. Install **Adobe Creative Cloud** from Software Center.
+2. Have the user sign in with their company account.
+3. From the **Apps** tab install only what was on the old device. The **All Devices** page in USMT Dash lists them under *Missing Software*.
+
+> Expect 5-20 GB per app. Check free space on the destination before starting.
+
+## Fonts and Presets
+- Synced fonts return automatically after sign-in.
+- Local presets, brushes and swatches are in `%AppData%\Adobe\`. USMT migrates these, but verify on first launch.
+
+## Troubleshooting
+- **"You don't have access to manage apps"**: the user's license isn't assigned. Contact the license owner.
+- **Install stuck at 0%**: sign out of Creative Cloud, delete `%LocalAppData%\Adobe\OOBE`, reboot and retry.

Documentation/Archive/Legacy VPN Client.md

@@ -0,0 +1,7 @@
+[[Gray:Archived]]
+
+# Legacy VPN Client
+
+*Archived: replaced by Cisco Secure Client on all laptops.*
+
+The old VPN client must be **uninstalled** before installing Cisco Secure Client, or the two network filter drivers will conflict.

Documentation/Create Bootable USB.md

@@ -0,0 +1,22 @@
+[[Gray:Reference]]
+
+# Create a Bootable Imaging USB
+
+Use this when PXE isn't available (remote site, isolated network, or a device that won't PXE boot).
+
+## You'll Need
+- A USB drive of **32 GB or more** (it will be erased)
+- Access to the ConfigMgr console
+
+## Steps
+1. In the ConfigMgr console go to **Software Library > Operating Systems > Task Sequences**.
+2. Right-click the deployment task sequence > **Create Task Sequence Media**.
+3. Choose **Bootable media** > **Dynamic media**.
+4. Select **Removable USB drive** and pick the drive.
+5. Leave the media unprotected or set a password per team policy.
+6. Select the current production **boot image** and distribution point.
+7. Finish the wizard. Writing the media takes about 5-10 minutes.
+
+## Booting From It
+- Press the vendor boot-menu key (**F9** HP, **F12** Dell/Lenovo) and choose the USB device (UEFI).
+- If Secure Boot blocks the USB, confirm it was built from a signed boot image.

Documentation/Device Storage Remediation.md

@@ -0,0 +1,31 @@
+[[Yellow:Remediation]]
+
+# Device Storage Remediation
+
+USMT needs free space on the source device for its working files. Devices under about **15 GB free** often fail the backup. USMT Dash shows free space in the **USMT Status** table.
+
+## 1. Remove stale profiles
+1. Press **Win**, type *About your PC*, open **Advanced system settings**.
+2. Under **User Profiles** click **Settings**.
+3. Delete profiles named *Account Unknown* and profiles of users who no longer use the device. **Never** delete the current user's profile.
+
+## 2. Clear temp folders
+```powershell
+Remove-Item "$env:WinDir\Temp\*" -Recurse -Force -ErrorAction SilentlyContinue
+Remove-Item "C:\Temp\*" -Recurse -Force -ErrorAction SilentlyContinue
+```
+
+## 3. Clear the ConfigMgr cache
+Control Panel > **Configuration Manager** > *Cache* tab > **Configure Settings** > **Delete Files** > *Delete persisted content*.
+
+## 4. Rebuild the search index (if Windows.edb is huge)
+```powershell
+Stop-Service WSearch -Force
+Remove-Item "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb" -Force
+Start-Service WSearch
+```
+
+## 5. Disk Cleanup
+Run `cleanmgr /sageset:1` once to tick every category, then `cleanmgr /sagerun:1`.
+
+After cleanup, use **Force Update** in USMT Dash (click the status button in the top bar) to refresh the free-space reading.

Documentation/Diskpart Steps.md

@@ -0,0 +1,26 @@
+[[Red:Destructive]]
+
+# Diskpart: Wipe and Re-partition a Disk (UEFI/GPT)
+
+> **This erases the disk.** Only use it on a device whose backup is complete, or on new hardware.
+
+1. Boot into WinPE or the task sequence wizard and press **F8** for a command prompt.
+2. Type `diskpart`.
+3. Enter each line and press Enter after each:
+
+```
+list disk
+select disk 0
+clean
+convert gpt
+create partition efi size=300
+format quick fs=fat32 label="System"
+assign letter=S
+create partition msr size=128
+create partition primary
+format quick fs=ntfs label="Windows"
+assign letter=C
+exit
+```
+
+4. Close the prompt and restart the task sequence.

Documentation/Manually Start USMT Backup.md

@@ -0,0 +1,16 @@
+[[Yellow:Remediation]]
+
+# Manually Start a USMT Backup
+
+Use this when a device in USMT Dash sits at **Not Started** while its replacement is ready.
+
+1. Find the device (the **Tracked Devices** or **USMT Status** page shows its last ping state).
+2. Restart it. The USMT backup won't start while another user is signed in. Then sign in.
+3. Open **Software Center**.
+   - Blank page or "failed to load"? Run [[Copy:C:\Windows\CCM\ccmrepair.exe]], wait for it to finish, then reopen Software Center.
+   - Still broken? Tag the device in USMT Dash (e.g. `Broken WMI`) and move on. See [WMI Namespace Fix](?doc=WMI%20Namespace%20Fix).
+4. Run **USMT Backup** from the *Operating Systems* tab.
+   - Fails immediately? Run `gpupdate /force`, then Software Center > Options > **Sync Policy**. Wait a few minutes and retry.
+5. When the button turns grey and shows *Installing...* the backup is running. You can sign out and move to the next device.
+
+In USMT Dash the row changes to **Backup In Progress** within one worker cycle, and the scanstate line shows progress.

Documentation/Microsoft Office.md

@@ -0,0 +1,25 @@
+[[Green:Baseline]]
+
+# Microsoft Office (Microsoft 365 Apps)
+
+Microsoft 365 Apps for enterprise is part of the standard image and is on every device. It's in the app blacklist, so it never shows up as missing software.
+
+## After a Migration
+1. Open **Outlook** and confirm the mailbox loads. A new profile is created on first launch.
+2. Open **Word** > **File > Account** and confirm *Product Activated* with the user's account.
+3. Check **OneDrive** is signed in and syncing (blue cloud in the system tray).
+
+## Common Fixes
+
+**Activation errors / "Unlicensed Product"**
+1. Close all Office apps.
+2. Run [[Copy:Microsoft Support and Recovery Assistant|https://aka.ms/SaRA-officeUninstallFromPC]] or sign out of every account under **File > Account** and sign back in.
+
+**Outlook signatures missing**
+- Signatures are stored in `%AppData%\Microsoft\Signatures`. USMT migrates the folder; if they're missing, copy it from the migration store.
+
+**Quick repair**
+- Settings > Apps > Installed apps > Microsoft 365 Apps > Modify > **Quick Repair**.
+
+## Visio and Project
+Visio and Project are licensed separately. See [Microsoft Visio](?doc=Microsoft%20Visio) and [Microsoft Project](?doc=Microsoft%20Project).

Documentation/Microsoft Power BI.md

@@ -0,0 +1,12 @@
+[[Gray:Optional]]
+
+# Microsoft Power BI
+
+## Install
+- Software Center > **Microsoft Power BI Desktop (x64)**.
+- Sign in with the user's company account to publish to the Power BI service.
+
+## Notes
+- `.pbix` reports are usually in OneDrive or SharePoint, so nothing to migrate locally.
+- **Power Pivot for Excel** is grouped with Power BI in the software view. It's enabled from Excel > File > Options > Add-ins > COM Add-ins.
+- Gateways (on-premises data gateway) are installed on servers, **never** on user workstations.

Documentation/Microsoft Project.md

@@ -0,0 +1,12 @@
+[[Blue:Licensed]]
+
+# Microsoft Project
+
+## Install
+1. Confirm the user has a Project license (Project Plan 3 or 5).
+2. Software Center > **Microsoft Project - en-us**.
+3. Launch and verify activation under **File > Account**.
+
+## Notes
+- Like Visio, Project must match the installed Microsoft 365 Apps channel.
+- Global template customizations live in `%AppData%\Microsoft\MS Project\` (Global.MPT). Confirm it came across if the user relies on custom views.

Documentation/Microsoft Teams.md

@@ -0,0 +1,21 @@
+[[Green:Baseline]]
+
+# Microsoft Teams
+
+The new Teams client is provisioned per user. It installs automatically the first time a user signs in to a device built from the standard image.
+
+## Checks After Migration
+1. Teams launches and signs in without prompting for a password (SSO).
+2. **Settings > Devices**: the correct headset/camera is selected.
+3. The **Teams Meeting Add-in** appears in Outlook's ribbon.
+
+## Meeting Add-in Missing in Outlook
+1. Close Outlook and Teams.
+2. Start Teams, wait for it to fully load, then start Outlook.
+3. If still missing: Outlook > File > Options > Add-ins > Manage **COM Add-ins** > Go > enable *Microsoft Teams Meeting Add-in*.
+
+## Clear the Teams Cache
+```powershell
+Get-Process ms-teams -ErrorAction SilentlyContinue | Stop-Process -Force
+Remove-Item "$env:LocalAppData\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams" -Recurse -Force
+```

Documentation/Microsoft Visio.md

@@ -0,0 +1,14 @@
+[[Blue:Licensed]]
+
+# Microsoft Visio
+
+Visio Plan 2 is licensed per user in Microsoft 365.
+
+## Install
+1. Confirm the user has a Visio license assigned (Microsoft 365 admin center).
+2. Software Center > **Microsoft Visio - en-us**.
+3. Open Visio > **File > Account** and confirm the product is activated.
+
+## Notes
+- Visio installs alongside Microsoft 365 Apps and must use the same channel (Current/Monthly Enterprise) or the install will fail.
+- Custom stencils: `Documents\My Shapes`. USMT migrates these with the Documents folder.

Documentation/Notepad++.md

@@ -0,0 +1,9 @@
+[[Gray:Optional]]
+
+# Notepad++
+
+Free text and code editor, mostly requested by IT and Engineering.
+
+- Software Center > **Notepad++ (64-bit x64)**
+- Plugins live in `C:\Program Files\Notepad++\plugins` and are **not** migrated by USMT. Reinstall them from **Plugins > Plugins Admin**.
+- Settings and sessions are in `%AppData%\Notepad++`, which USMT migrates.

Documentation/QuickBooks.md

@@ -0,0 +1,23 @@
+[[Blue:Licensed]] [[Red:Finance Approval]]
+
+# QuickBooks
+
+QuickBooks Desktop is installed for Accounting and Finance users only. Each install needs a **license and product number** from the Finance team. Never reuse one from another device without approval.
+
+The software scan shows three entries that USMT Dash groups as one *QuickBooks* suite:
+- QuickBooks Desktop Pro
+- QuickBooks Database Server Manager
+- Intuit Data Protect
+
+## Install
+1. Get the license and product number from the Finance team's request ticket.
+2. Run the installer: [[Copy:\\fileserver\software\QuickBooks\Setup_QuickBooks.exe]]
+3. Choose **Custom and Network Options** > *I'll be using QuickBooks on this computer*.
+4. Launch, register, and apply all updates (**Help > Update QuickBooks Desktop**).
+
+## Company Files
+- Company files (`.QBW`) live on the finance share, **not** on the local device: [[Copy:\\fileserver\finance\QuickBooks]]
+- If the user had a local company file, move it to the share. Don't open it from a USB drive.
+
+## Multi-user Mode
+The file server runs **Database Server Manager**. Workstations don't need it unless the user hosts files locally.

Documentation/Salesforce.md

@@ -0,0 +1,23 @@
+[[Blue:Licensed]]
+
+# Salesforce
+
+Salesforce itself is web based. Desktop components are only needed by some Sales and Support users.
+
+| Component | Who needs it |
+|---|---|
+| Salesforce for Outlook / Outlook integration | Sales reps who log email to Salesforce |
+| Salesforce Data Loader | Sales Ops / admins doing bulk imports |
+
+## Install
+1. Install the components that were on the old device (check *Missing Software* on the **All Devices** page).
+2. Installer share: [[Copy:\\fileserver\software\Salesforce\]]
+3. **Data Loader** needs a Java runtime. The installer bundles one; accept the defaults.
+
+## Outlook Integration
+The modern integration is an Outlook add-in deployed from the Microsoft 365 admin center. After migration:
+1. Open Outlook and look for the **Salesforce** button on the ribbon.
+2. If it's missing, wait for add-in sync (up to 24 hours) or ask the M365 admins to confirm the assignment.
+
+## Single Sign-On
+Users sign in with **Use Custom Domain** > `company` > SSO. They shouldn't need a separate password.

Documentation/Slack.md

@@ -0,0 +1,11 @@
+[[Gray:Optional]]
+
+# Slack
+
+## Install
+1. Software Center > **Slack (Machine - MSI)**. The machine-wide installer keeps Slack updated for all users on shared devices.
+2. Sign in to the company workspace with SSO.
+
+## Notes
+- Slack data is cloud based. Nothing needs to be migrated.
+- If the user had the **per-user** Slack installed (from slack.com), uninstall it first so two copies don't fight over the protocol handler.

Documentation/Tableau.md

@@ -0,0 +1,13 @@
+[[Blue:Licensed]]
+
+# Tableau Desktop
+
+## Install
+1. Installer: [[Copy:\\fileserver\software\Tableau\]]
+2. Activate with the user's license key (from the Analytics team) or sign in to Tableau Cloud if using login-based licensing.
+
+## Before Wiping the Old Device
+Licenses activated with a product key must be **deactivated** first (Help > Manage Product Keys > Deactivate), or the key stays consumed.
+
+## Drivers
+Database drivers (SQL Server, Oracle, ...) aren't included. Reinstall the ones the user had. Check *Missing Software* on the **All Devices** page.

Documentation/Using USMT Dash.md

@@ -0,0 +1,36 @@
+[[Blue:Start Here]]
+
+# Using USMT Dash
+
+USMT Dash tracks a Windows device-refresh project: which old (**source**) device is being replaced by which new (**destination**) device, and how far each migration has got.
+
+![How USMT Dash works](images/USMT%20Dash%20Architecture.png)
+
+## The Pages
+| Page | What it's for |
+|---|---|
+| **Tracked Devices** | Register devices under a *tag* (your name, a date batch, a department...). The worker only watches tagged devices. |
+| **My Workbench** | Personal stacks: paste the devices on your cart and see just those. Saved in your browser. |
+| **USMT Status** | Every tracked migration, grouped by status, with ping, free space and USMT log lines. |
+| **All Devices** | Compares source and destination software and lists *specialty* apps missing from the new device. |
+| **Custom View** | Build your own table: add, remove, resize, drag and filter any column. |
+| **Documentation** | This knowledge base. Articles named after an app are linked from that app in the software view. |
+
+## Migration Status
+![Migration lifecycle](images/Migration%20Lifecycle.png)
+
+| Status | Meaning |
+|---|---|
+| Not Started | Association exists, no backup yet |
+| Backup In Progress | Scanstate log on the source is actively being written |
+| Backup Completed | Backup finished, waiting for the new device |
+| Restore In Progress | Loadstate log on the destination is active |
+| Completed | Restore finished successfully |
+| Not Associated | No computer association in ConfigMgr |
+| Skipped | The device's tag has **Skip USMT** ticked (inventory only) |
+
+## Tips
+- Pair devices manually with `SOURCE, DESTINATION` on one line when there's no ConfigMgr association.
+- Click any device name for full details: location, users, hardware, AD groups.
+- **Copy Location Info** builds a ready-to-paste table for facilities or asset tickets.
+- In articles, `[[Copy:text]]` creates a click-to-copy link, and `[[Yellow:Label]]` adds a badge.

Documentation/WMI Namespace Fix.md

@@ -0,0 +1,31 @@
+[[Yellow:Remediation]] [[Red:Admin Required]]
+
+# WMI Namespace Fix
+
+Symptoms: Software Center is blank, the ConfigMgr client shows *Inactive*, or the backup task sequence fails with WMI errors (`0x80041003`, `0x8004100e`).
+
+## 1. Verify the repository
+Open an **elevated** PowerShell:
+```powershell
+winmgmt /verifyrepository
+```
+- `WMI repository is consistent`: skip to step 3.
+- `inconsistent`: continue.
+
+## 2. Salvage the repository
+```powershell
+winmgmt /salvagerepository
+```
+Run `/verifyrepository` again. If it's still inconsistent, as a **last resort**:
+```powershell
+winmgmt /resetrepository
+```
+
+## 3. Repair the ConfigMgr client
+```powershell
+& "$env:WinDir\CCM\ccmrepair.exe"
+```
+Wait 10-15 minutes, then confirm **Configuration Manager** in Control Panel lists its actions.
+
+## 4. Re-check in USMT Dash
+The client status in the device details should return to *Installed / Active* after the next hardware inventory cycle.

Documentation/Zoom.md

@@ -0,0 +1,12 @@
+[[Gray:Optional]]
+
+# Zoom
+
+## Install
+- Software Center > **Zoom Workplace (64-bit)**.
+- Users sign in with **SSO** using the company domain `company`.
+
+## Common Issues
+- **Camera or microphone not detected**: Windows Settings > Privacy & security > Camera / Microphone > allow desktop apps.
+- **Outlook plugin**: the Zoom add-in for Outlook is deployed centrally. No local install needed.
+- **Old version prompts to update**: Software Center installs are updated automatically. Have the user dismiss the in-app prompt.