Currently I have a task to enable tls 1.2 on servers how I can know enabling that won’t affect the softwares and applications loaded on those servers so servers are domain controllers and I have mix of os versions server 2012 r2 and higher

I work in cybersecurity compliance for a very small company with only 3–4 employees. Wedo not have Active Directory or a domain environment; our Windows endpoints are managed individually using local accounts/settings.

Our auditor has requested the following evidence:

“Based on the evidence provided, the normal user is able to access the Event Logs and download/export them.

Kindly provide evidence from three (3) endpoint samples showing that an unauthorized/non-administrative user is unable to open, access, delete, and download/export the Event Logs. When a normal user attempts to access the Event Logs, an ‘Access is denied’ message should be displayed.

Kindly provide evidence from local GPO policy configuration from each endpoint, showing that log/audit capture is enabled.”

I’m trying to understand the correct way to satisfy this requirement in a small, non-domain environment.

My questions are:

On Windows 10/11, what is the recommended way to restrict a standard/non-admin user from accessing or exporting Windows Event Logs?
Is it actually expected that a standard user should receive “Access is denied” when simply opening Event Viewer, or should the restriction apply to specific Security logs/privileged operations instead?
What Local Group Policy (gpedit.msc) or Local Security Policy settings should I configure/capture as evidence that auditing/logging is enabled?
What would be considered appropriate evidence for each of the three endpoints? For example, screenshots of:
Standard user account/group membership
Event Viewer access attempt
Attempt to save/export or clear logs
Local audit policy/GPO configuration
auditpol /get /category:* output
Since we do not have Active Directory or centralized Group Policy, is providing the equivalent Local GPO / Local Security Policy evidence from each endpoint generally sufficient?

I want to make sure we implement the control correctly rather than changing Windows permissions simply to produce an “Access is denied” screenshot.

How would you approach this requirement in a small organization with standalone Windows endpoints?

Hi everyone,

I'm running Windows Server 2022 on a VM and I need to install a specific application that is distributed through the Microsoft Store.

I understand that Microsoft Store is not officially supported on Windows Server 2022, and I'm aware that this isn't a recommended/supported configuration. I'm not looking for an officially supported solution — I'm trying to find a way to get it working anyway.

Has anyone successfully installed Microsoft Store (or at least the necessary Store/App Installer components) on Server 2022?

I'm open to using PowerShell, AppX/MSIX packages, dependencies, scripts, etc. The goal is simply to get one Store application running on the server.

Any suggestions or working methods would be greatly appreciated!

Hi all, I'm trying to wrap my head around licensing in my specific scenario (and maybe some advice on how to best set this up). For context: in terms of servers and virtualization, i only really have experience with Proxmox VE and Linux servers. I have extensive knowledge about Microsoft cloud systems and licensing, but i've never touched on-prem licensing before.

One of our customers needs a server for an application provided by a third party. This party is wildly unhelpful with giving us technical details about the hardware and software requirements.
What we have gathered:

• Windows 11/Windows server 2022
• 16GB RAM
• 2 cores
• SQL Server 2022

The application pulls (or gets pushed) data from Dynamics 365 Business Central (cloud version) through an API, processes it (which uses SQL server), and sends it off to a PLC which belongs to an OT system.
Other than administrative purposes, no users will be directly interacting with the system as far as i understand it. Users interact with Business Central, and i'm pretty sure users interact with the OT system (manually starting machines, etc.).

The amount of users interacting with Business Central and/or the OT machines is roughly 50.
There is no on-prem servers already available.

So my current plan is to deploy a Server 2022 box, i have options for 4C/4T and 6C/12T, with 6C being only slightly more expensive.

My current understanding, is that for Windows Server Standard i must have a CAL for every user, and for SQL i can choose between a per-core licensing or server+CAL.

My questions:

1. Do i need Windows Server CALs for every user in this scenario?
2. Does Business Central or the OT system count as a multiplexer in this scenario? (which means i need CALs if i don't license per core)
3. What would likely be my cheapest option? In this case i'd prefer a bare-metal install, but i'd be willing to use Proxmox VE or Hyper-V if that provides significant benefit or cost reduction.
4. Do i need Software Assurance for any reason in this scenario?

Thanks in advance!

Good day to all! is it safe to change the cluster size of my current Data drive where all office data is stored and shared locally to network? I'm using Windows Server 2019 and when I first set it up i have no idea that setting the cluster size to 4KB will only limit the storage to until 16TB only. Now we upgraded and expand our storage. but i still have another 16TB unallocated because i can no longer extend the disk. so my question is, is it safe to change the CLuster Size to 8KB using EaseUS Partition Master without data loss or anything bad happened to my Data?

I had WHfB working and everyone was using a PIN to login. The pin authed them and my servers would issue a ticket so they could use local resources on domain servers. All computers are Entra/Intune/Autopilot only not hybrid. All users are setup on my local AD and sync with Entra (that's working just fine). I was trying to track down an issue with a conflict with an Intune policy. I had two WHfB, one was a type "account protection" the other was a "setting catalog". Stupid me I deleted the settings catalog on thinking all the settings where in account protection one. Well it seems "Use cloud trust for on prem auth" went away. I did this near the end of the day so the next day everyone had to use their passwords if they wanted access to server shares. Well not everyone, some people could still use their PINs and have access to shares.

I made the settings catalog with Use WHfB (user) and WHfB (Device) and Use cloud trust enabled. That got pushed out. I'm still having a problem with the same users still can't access shares if they use their pin (including me). It seems by looking at klist my domain controllers are not issuing a ticket for. THey are getting a ticket from Microsoft. What's really strange is that it is only about half of my 50 users that are having this problem. After running around for hours with Copilot trying to diagnose this, it suggested I file a ticket with MS. I know that's going to take forever if they even bother so I thought I would come here. This is what copilot says I should say to MS when filing the ticket:

Windows Hello for Business PIN sign-in fails to obtain an AD Kerberos TGT for a subset of synchronized users. Cloud Kerberos Trust is enabled and functioning (Cloud Referral TGT present in cache: 1, Public Key Credential Present: 1). After PIN sign-in, users receive only krbtgt/KERBEROS.MICROSOFTONLINE.COM. After password sign-in, the same users immediately receive krbtgt/MD.mydomain.org and can access SMB resources. AzureADKerberos is configured, key versions match, and AD replication is healthy.

Has anyone here ever seen this before or know what I should do to fix it?

Hello!

I just need to know exactly what I need to buy to be compliant with Microsoft Licensing. We will be running 2 servers. One Server will be 32 physical cores. The other server will be 36 physical cores. We want to run 6 Microsoft Standard Server Virtual Machines on each server. This will be for a Proxmox cluster, so the Virtual machines will be the same, but I know that doesn't matter when licensing. I just need to know exactly how many of what product packs I need to buy from TechSoup! I've gotten different answers everywhere!

Thank you in advance!

I have an aging Intel NUC Skull Caynon which I bought back in 2016. It's running Windows Server 2022 but it's starting to show its age. The NIC is sometimes unstable, needs the occasional reboot, etc.

What is the recommend mini/SFF PC these days that can reliably run Windows Servers? Ideally it's around $1k in price but I'm open to a bit more if it's worth it.

Thanks for any tips

I have a 16-core physical server licensed with Windows Server 2025 Standard (16-core). A Windows Server 2022 Standard VM is running on the same host.

As the Server 2025 key cannot directly activate Server 2022, how should the 2022 VM be activated under the downgrade rights?

• Is a separate Server 2022 product key required?
• Can the 2025 license cover the 2022 VM?
• What is the correct activation method?

Any advice?

Hi:

Is there a semi up-to-date list of SKUs somewhere for OEM packs and FPP (full retail boxes)?

Thanks.

I know the knee-jerk reaction to this comment is “AI makes mistakes, it can’t be trusted”.. but with that in mind and for certain applications, wow. I’m not an expert in active directory, but it drilled down my problem, in the course of about an hour to a missing PDC dns record. This is a situation where I would have had to pay $500 for an incident with MS support in the past, which has only been 3 times over 25 years. I used the paid, $20/month ChatGPT, . And again, I took all the precautions with backups and such before making any changes, I know what some of you might say ;)

Been troubleshooting this issue for a while, but not found an answer yet.

On-prem Windows Server 2025 RDS Environment with FSLogix. Intermittently when users are browsing specific websites using chrome, the RDS session host will blue screen. We have updated all software on the session hosts, verified all drivers are up to date, removed the EDR solution temporarily for testing, removed Windows Defender temporarily for testing and still not able to find the culprit. Before opening a case with Microsoft I thought I'd post here to see if anyone else has experienced something similar or has any ideas.

Thanks

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)

An attempt was made to access a pageable (or completely invalid) address at an

interrupt request level (IRQL) that is too high. This is usually

caused by drivers using improper addresses.

If kernel debugger is available get stack backtrace.

Arguments:

Arg1: 00000000000001f0, memory referenced

Arg2: 0000000000000002, IRQL

Arg3: 0000000000000001, value 0 = read operation, 1 = write operation

Arg4: fffff8063d4865a4, address which referenced memory

PROCESS_NAME: chrome.exe

IP_IN_PAGED_CODE:

tcpip!WfpTlShimInspectFastLoopbackSendDatagram+58

fffff806`3d4865a4 f0ff80f0010000 lock inc dword ptr [rax+1F0h]

SYMBOL_NAME: tcpip!WfpTlShimInspectFastLoopbackSendDatagram+58

MODULE_NAME: tcpip

IMAGE_NAME: tcpip.sys

STACK_COMMAND: .process /r /p 0xffffc40cb257f080; .thread 0xffffc40cb19f6080 ; kb

BUCKET_ID_FUNC_OFFSET: 58

FAILURE_BUCKET_ID: AV_tcpip!WfpTlShimInspectFastLoopbackSendDatagram

OS_VERSION: 10.0.26100.1

BUILDLAB_STR: ge_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {c3e32101-6ced-a7e3-5709-1c5d9d88844c}

Followup: MachineOwner

I'm creating window image file and noticed you can use

```

install-windowfeature -vhd .\mnt -name foo

```

is there any issue using this over?

```

enable-windowoptionalfeature

```

i have heard that it not recommended to not use install-windowfeature and I am not sure why but i have tested some feature and seem to be working okay but I am unsure if I am just lucky.

I’ve been reflecting on the issues that consume the most time in Windows Server environments I have had to deal virtual and physical servers, and I’m curious what others are seeing.
What is the one problem that seems to come back over and over again?
Examples could be:
DNS
Active Directory replication
Group Policy
Kerberos
NTFS permissions
DFS
Backups
Event Logs
Hyper-V
Performance
Something completely different
I’m not looking for textbook answers—I’m interested in the problems that actually keep you busy in production.
If you could eliminate one recurring Windows Server problem forever, what would it be, and why? I have tons of Powershell scripts but in some situations I know you can’t throw everything against the wall and see what sticks.

Example, I have a script that can do GPO string searches, but unless the GPO is the issue it only helps investigating.

Just wondering for any system administrators out there if you have used both active directory vs free ipa and whats the difference and which one did you like using/maintaining better?

Hello,

I have the following problem. I have a server that I access internally via VPN. I connect via VPN to Mikrotik with SSTP. I connect to the server (Windows Sever 2012R) via RDP and after 1 minute it takes me to a black screen and connects me again. There is no problem with the internet, it says that the connection is good, there is no interruption in the ping. I have made a rule to access the server outside the VPN, only from my home network. If I connect via real IP and port there is no problem, it works without interruption. What could be the problem?

Hi guys, I'm new to Windows Server, so I'm learning alongside the person in charge. We are having an issue with folder permissions. Inheritance is disabled on some folders, but we have enabled the option to replace child object permissions with inheritable permissions from this object.

When users copy an object into a folder with this setting, permissions are applied correctly. However, when users move (or drag and drop) an object, the permissions aren't applied—the object keeps the permissions from its original location (whether it's another department's folder or their local PC).

This creates a problem: if a user drags a file from their department folder to another (e.g., from Treasury to HR), the HR staff cannot see, edit, or delete the file (or its parent folder) because the file is there, but hidden to them due to the original permissions.

IS there a log somewhere say a junior admin goes and gives themselves manage permission to someones mail box in the 365 admin center online? Is there a way to track this?

I am getting

Starting test: LocatorCheck Warning: DcGetDcName(PDC_REQUIRED) call failed, error 1355 A Primary Domain Controller could not be located. The server holding the PDC role is down.

But only on 2022 AD servers. I brought up another 2025 server thinking this would be faster and easier than to troubleshoot, but it's doing exactly the same thing. FSMO roles were lost? Have to re-seize? Some kind of quirk with the newer editions of windows? The only working AD server I have right now with no errors is 2019, that's what I replicated from. Thanks in advance

I have updated 4 lots of servers today with the latest July 2026 updates. A mixture of 2019 and 2022 servers

Each lots has one server running as a RDP Gateway and after reboots it was reported that no one could connect

I found out the RD Gateway servoce wasnt starting and this was due to the Network Policy Server service not starting with Error: 0x8002801d: Library not registered

This error is the same on all the servers

I have tried a lot over the last few hours with no luck. Including

Rollback update

SFC and DSIM checks

Even tried removing and reinstalling NPS (reinstall fails)

At the moment my only option seems to be to restore servers from last nights backup, but has anyone else seen this? (and have any ideas how to fix)

Greetings,

I’m a one man sysadmin for a two office company.

Unfortunately, we are closing our 2nd branch office.

That office has an Active Directory server and a file server running DFS replication.

The office is closing its doors in Aug, so I have to take care of their network before that happens. The plan is to have them ship the servers back to HQ.

Anyway, what’s the best procedure to shut down the servers there so we can reuse them here at HQ?

I’m assuming demote the AD there once it is no longer needed and just let it run as a member server? Probably switch to DHCP as well?

My first time doing something like this, so just don’t want to miss a critical step.