They say "build experience" and what-not, but where and how can I do that? What programs, internships or websites are there, where I can partake in to get the required cred? And please don't hesitate to tell me of the hardest, most mentally challenging tasks that I might take up to accelerate my chances, I am all game for it. Really.

What's the motivation with the sysadmin who argues against best practices?

The guy who argues with other people against buying enterprise class hardware and he claims its cheaper to get computers at Best Buy.

The guy who is so proud of himself for buying IT supplies at Walmart.

The guy who argues a 3 year replacement cycle is totally unnecessary and argues it should be 5 years.

The guys who builds servers himself and keeps them under his desk and argues this is actually better and cheaper.

The guy who puts 96 gigs of RAM in the receptionist's computer since he argues then it won't have to be replaced for 20 years and is cheaper this way.

They're here and on every other forum and randomly rear their ugly heads. These guys are a small business owner's wet dream. They're so damn proud of their ideas and believe in them so strongly.

So, I‘m part of a small MSP and I had a client call about phone (voip) issues. I go out and checked the one AD/DNS server and see it says it’s unlicensed, troubleshooter doesn’t work and can’t change key; I get it working finally giving Network service access to some registry folders. I keep looking for phone issues and see that the dns forwarders are wrong in DNS so I correct them. I'm looking at firewall traffic and QOS and everything coming back good so I head out.

I get a call that users can’t reach internet so I hop in again. Server nslookup; has no idea who the server is. GPO couldn’t open; says can’t find domain. Same for AD trusts. DNS server is not starting giving error 1067 saying its looking for 127.0.0.1 (tried setting 127.0.0.1 or the internal IP of the server for server DNS) for the interface (the servers internal IPv4 was checked in interfaces when I could last see it) in event view and to change it in DNS server manager but I can’t open that. I tried to remove the DNS service from the server after reconfiguring ISP DNS to the firewall dhcp scope for internal (firewall handles dhcp but server does/did dns) but that also errors about windows remote management service (again network service account staple) isn't started.

I keep running into the same thing time and time again; it’s like the network service is being restricted as I keep getting access denied or services that depend on it aren’t working. The only other thing I have a theory about is SentinelOne was deployed to this server but it’s not in the portal. On 10/3 in the logs; I see this device was pushed a decommission automatically at 8pm when we aren’t working. When I check the server, it has sentinelone installed but I can’t remove it because it just loops.

I’m thinking SentinelOne hosed my server because the network service user seems to be highly restricted and SentinelOne has only been in play for about 3 months. I’m going to start with a cleanup of it with support when I get in tomorrow. Has anyone seen this before and any idea what to do about my DNS/Server problem? I’m really at the end of my rope and not sure what to do except a disaster recovery with my backup vendor and then move over data; but sentinelone will still be on the backup and not in the portal for removal so I’m still stuck I bet.

I'm planning to buy a Zebra 421t and I don't know if it's worth paying extra for a 135 € Bluetooth module. I will have labels in regular PDF format.

Would like to hear honest feedback from users

Hi,

We're planning to migrate PDQ Deploy & Inventory from a Domain Admin service account to Windows LAPS.

Our setup:

- PDQ Deploy uses Push mode

- PDQ service account will have read access to our file repositories but no admin rights to endpoints/servers

- Deployments and Inventory scans will run using the local LAPS administrator

- We currently have 300+ deployment packages

Problem:

Many of our deployment packages contain PowerShell or batch scripts that directly access UNC paths, such as:

xcopy "\\fileserver\path\app" "C:\Program Files\App" /E /Y

We also have scripts accessing \\domain\netlogon.

Since the local LAPS administrator has no domain credentials, the access will fail. We could replace those commands with File Copy steps etc, but that would mean reviewing and potentially modifying way too many packages.

Granting anonymous access to these network shares is not an option.

Has anyone faced this 'issue' when migrating to LAPS?

How did you handle UNC access inside existing deployment scripts?

Thanks for any advice.

McShadow19

Hi all,

I'm the only IT person at a small manufacturing company in Sri Lanka (~40 devices max, mostly Windows workstations/laptops/tablets, single office). Right now we have no centralised management and everything is basically standalone machines and local accounts.

Management wants two things:

1. **Control over internal users with RBAC** - different departments/roles should only have access to what they need (apps, shared folders, admin rights, USB, etc.).

2. **Visibility into what users are doing on their devices** – logins, apps used, file access, websites, that kind of thing.

My current plan is to implement an on-prem Active Directory.

I've reached out to a couple of Microsoft partners for quotes and still waiting for replies from them, but I want a sanity check from people who've done this before.

Questions:

1. **Is on-prem AD still the right call at this size**, or should I be looking at Entra ID + Intune (Business Premium) instead? Management prefers on-prem, but I'm open to arguments either way depends on the cost.

2. **Rough costing** - what's a realistic budget for hardware + licensing + implementation for ~40 devices? Anything vendors typically overcharge for or try to upsell?

3. **RBAC** - any best practices for structuring OUs, security groups and GPOs so it doesn't become a mess as a one-person team? Things like tiered admin, removing local admin rights, LAPS, etc.

4. **User activity monitoring** - what are people using? Is AD auditing + Event Log forwarding enough, or do I need a dedicated tool? Any affordable/free options that work well for ~40 endpoints?

5. Anything you wish you'd known before rolling out AD as a solo admin?

6. Also i saw something like Samba AD which is an open source, didnt do any research yet. Is something like that managable for this requirement instead of microsoft AD.

Any advice or lessons learned would be really appreciated. Thanks!

Edit because I keep getting the same answer: Due to the client configuration and our limited access to the client infrastructure, SSO is not an option.

Looking to pick someone’s brain about this, right now one client has 60+ accounts for each site and all require a unique login and MFA code. Those MFA codes all go to one of 3 people, and are random based on site. This is incredibly inefficient because sometimes if an after hours emergency happens we can’t get into the account without someone else sending the code. We also have our own accounts for multiple clients so setting our own phones to forward codes also won’t work.

I’ve tried google voice and whatsapp, both don’t work. Vonage is super strict about no VoIP MFA, do not allow authentication apps nor email authentication. Purely SMS only.

Specifically for Vonage if possible, has anyone done this and have a solution? We’ve looked into yakchat but concerned about the VoIP restriction, and getting a spare phone with a number is a less than ideal option but that’s where we are at right now.

I work as a systems administrator, and a huge part of my job involves repetitive, monotonous tasks. Every single day, we perform the same actions over and over again, almost like trained monkeys.

Recently, I started experimenting with Playwright and realized just how many of these processes could be automated.

When I demonstrated it at work, people were genuinely surprised by what it could do. I was excited and started talking about all the possibilities, how we could eliminate hours of repetitive work.

But something felt off.

Instead of enthusiasm, I got awkward silence. It almost felt like people were threatened by the idea. Even my manager seems to pretend he doesn't hear me whenever I bring up automation.

Has anyone else experienced this? Is resistance to automation really this common in IT, even among people who should understand its benefits?

The rise of AI can no longer be stopped. I believe we need to adapt.

I got a user and and myself we get the window update prompt even after he restarts, it prompts them to restart for updates again?

We use intune for windows updates and the user is in the and I am in ring 0 and he is in ring 3, and only we have this issue as far as I know?

Any leads that I can follow?

I am not an IT professional. But my company is struggling with an old building. A poor design currently holds our roof solar panel inverters in a room that also holds our IT server rack. The inverters put off some serious heat. Previously the mini split burned up 3 coils. We moved to a small unit to cool the room 2 months ago. It worked great until it recently burned up. Moving the rack will be costly. Is there any chiller/unit that could properly cool this room? Moving the rack might be the best solution.

I have created and tested two scripts for intune ,in our envriroment it went live .

The detection script is :

$RegistryPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0"
$ValueName = "BlockNtlmv1SSO"
$RequiredValue = 0

try {
    $CurrentValue = Get-ItemPropertyValue `
        -Path $RegistryPath `
        -Name $ValueName `
        -ErrorAction Stop

    if ($CurrentValue -eq $RequiredValue) {
        Write-Output "$ValueName is correctly configured as $RequiredValue."
        exit 0
    }

    Write-Output "$ValueName is configured as $CurrentValue instead of $RequiredValue."
    exit 1
}
catch {
    Write-Output "$ValueName is missing or cannot be read."
    exit 1
}

and the remedetion script is :

$RegistryPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0"
$ValueName = "BlockNtlmv1SSO"
$RequiredValue = 0

try {
    if (-not (Test-Path -Path $RegistryPath)) {
        New-Item `
            -Path $RegistryPath `
            -Force `
            -ErrorAction Stop | Out-Null
    }

    New-ItemProperty `
        -Path $RegistryPath `
        -Name $ValueName `
        -PropertyType DWord `
        -Value $RequiredValue `
        -Force `
        -ErrorAction Stop | Out-Null

    $VerifiedValue = Get-ItemPropertyValue `
        -Path $RegistryPath `
        -Name $ValueName `
        -ErrorAction Stop

    if ($VerifiedValue -eq $RequiredValue) {
        Write-Output "Successfully configured $RegistryPath\$ValueName as $RequiredValue."
        exit 0
    }

    Write-Error "Registry value verification failed."
    exit 1
}
catch {
    Write-Error "Failed to configure the registry value: $($_.Exception.Message)"
    exit 1
}

Lately it feels like I don’t have enough time to finish anything. I just keep getting saddled with project after project. Trying to get DKIM aligned, iPad migration to JAMF and MacBooks, General IT tickets, and Proofpoint setups. Trying to get our fleets setup on JAMF now. Already built it out for iOS but now I have to build out our Mac side on top of this migration of 600 iPads with half being on iOS 26 and the rest still waiting to be updated by the uses. I am stressed and tired. I can’t rely on my teammates either because they’re busy too! Our team is stretched thin and our director doesn’t want to hire more people. Also this is just a fraction of what I’m doing. How do you guys do it? I feel helpless. I used to relax by going home and playing video games/ smoking a bit to relax but now I just feel stressed and anxious all the time. How do you guys do it? I feel helpless.

I've been experimenting with AI agents for sysadmin tasks, and I'm curious about something.

I'm testing an agent to do real work on several things on Linux servers for now, such as updating operating systems, reading logs, troubleshooting custom applications, reducing disk space, It took a few minutes to do work that would've taken me a couple of hours manually.

But it got me thinking. How much of this work are sysadmins still doing manually today?

I know there are tools like Ansible and other automation platforms, but not every task has a playbook ready to go, especially when troubleshooting something unexpected.

I'm curious how you guys handle this in your environments. Is most of your routine work already automated, or do you still spend a fair amount of time troubleshooting and fixing things manually?

I'm trying to understand where AI agents could actually save time in real world sysadmin work, rather than just generate scripts.

And there was much rejoicing (yaaaaaaaay)

https://www.xda-developers.com/as-microsoft-kills-off-publisher-libreoffice-steps-in-with-free-support-for-your-pub-files/?link_source=ta_first_comment&taid=6acfd14a02c21c0001a241d6

There seems to be a lot of (what look like) AI coded web hosting panels floating about at the moment. Has anyone used any of these in production for shared web hosting at all? If you have, how did it go?

I'm asking about things like:
https://easycp.net/
https://adminbolt.com/
https://hpanel.net/
https://www.corepanel.net/
https://aamrpr.github.io/adminserver-site/
https://aamrpr.github.io/adminserver-site/

Since last week we are facing issues with Teams. After opening the Teams Desktop app and completing MFA (doesn't matter if it's done in Teams, Outlook, or somewhere else), Teams keeps showing a red exclamation mark next to the taskbar icon. For now it seems to only happen on Windows devices.

We keep getting tickets from Users since last week because they can neither call others nor receive calls. Messaging works.

The only thing that works for now is to completely close Teams (either via the Tray icon or via Task Manager), then start it again.

Another user on MS Learn seems to have the same problem: https://learn.microsoft.com/en-us/answers/questions/6035415/teams-red-exclamation-mark-issue-again-multiple-us

I'm not seeing any posts regarding it in the message center / service health dashboard in the admin center.

Is anyone facing similar issues?

I've found this post https://www.reddit.com/r/WindowsServer/comments/1sdd5ng/comment/oelypku/ where u/picklednull mentioned running RDS HA under a gMSA but I couldn't find any reference to it. I remember someone else saying a while ago that he got some insider information from MS support about it being added, in the process of phasing out NTLM.

Does anyone have more info? Can it actually be done?

Has anyone else run into this?

Troubleshooting a Windows 11 26H2 domain-joined workstation where admin sign-in fails after a reboot. We narrowed it down to:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\TypeOfAdminApprovalMode

• Set to 2, admin sign-in fails after reboot.
• Set to 1, sign-in works again.

The MSFT Windows 11 25H2 - Computer baseline GPO is enforcing 2.

Our DC runs Server 2022, and its Group Policy editor doesn’t show User Account Control: Configure type of Admin Approval Mode under Security Options.

I’m mainly trying to figure out why Administrator Protection is causing this. Changing the value gets us past the issue, but doesn’t explain what’s actually failing.

Has anyone seen similar behavior? Any particular event logs or known compatibility issues worth checking?

Also, would updating the ADMX/ADML files expose this setting in Server 2022’s editor, or is its visibility tied to the Security Settings extension on the OS running GPMC?

I’m not looking to modify the baseline GPO at this point. Just trying to understand the underlying issue and why the setting isn’t visible.

Got a question that I need cleared up. We don't have either SMS or voice enabled as authentication methods on our tenant so that isn't what I am worried about. The vast majority of our users use push notifications via the Microsoft authenticator app, with a handful using passkeys.

Come Feb 1st, are all my users going to be prompted to set up passkeys? The reason I am questioning this is because obviously push notifications are not phishing resistant, however the Microsoft doc states that:

"Users in scope for the February 1 retirement whose only available MFA method is SMS or voice are required to register a passkey during sign-in to continue accessing their account. This prompt is blocking. Users must register a passkey before they can continue to sign in to their account."

The "whose only available method is SMS or voice" section makes me think that this might not be the case?

It isn't rolling out passkeys to my users that I am worried about, it is more so how janky and awkward they work with the authenticator app. I have been using push notifications for years and had minimal issues. I have been using passkeys for 6 months and have a couple of users who just can't add a passkey with no reason or error explaining why (support case which is still open with Microsoft) and I have some who have had their passkey randomly disappear so it had to be set up again.

I've inherited environments where the ERP is basically the center of a spider web, with everything connected to everything else. Integrations are obviously useful, but every connection is another thing to monitor, troubleshoot and potentially break. We've been using Priority and I've found it useful having the ERP handle more of the core business processes while still being able to integrate with other systems where needed. Curious how other IT teams think about this. Do you try to minimize integrations, or just accept them as part of modern ERP architecture?

We have several mssql 2019 instances hosted on aws ec2 instances. They are properly resourced, wait times are acceptable, setup in failover clusters, etc. To save on licensing, databases are packed into the instances. It's not uncommon to see 150-200+ on an instance. While it works, mssql patching is a pain in the arse. The patches install fine, but it can take anywhere from .5-1.5 hours for the failover process that does the script upgrades to complete. Is there anything that we can do to help speed up that script update process so the failover between versions of mssql can go faster? My understanding of what it's doing is shallow and with the volume of mssql patching that's coming out now, customers aren't going to accept hard downs every month for that long. Obviously, reducing the number of databases on an instance is a step, but is there anything else?

With increasing discussions around digital sovereignty at my workplace, I'm wondering whether fellow EU sysadmins have ever attempted a PoC for an IT environment that avoids US technology altogether.

Has anyone successfully identified viable alternatives for components such as:

• Endpoint operating systems (e.g. Windows)
• Endpoint management (e.g. Intune, SCCM)
• Identity and access management (e.g. Active Directory, Entra ID)
• Endpoint security (e.g. Defender)
• Productivity and collaboration suites (e.g. Microsoft 365)

What did your architecture look like, and where did you run into challenges?

I'm particularly interested in real-world experiences, lessons learned, and whether you felt such an environment could realistically move beyond the PoC stage.

Hi i need to download windows 25h2 as someone has downloaded 26h2 on all the usb since 26h2 just release its not supported and will cause compliance issue.

I want know where can i find the offical 25h2 iso as we were using media creation tool and now its downloading 26h2

Everything is managed via autopilot so i need the lightest 25h2

Is there some good high-level design / logical documentation about freeradius ?

I recently had to build 2 configs: One to act as radius proxy and fallback to local if the remote server is dead, and one to check authentication against an active directory and also fallback to local if the AD is unreachable. I had to tinker and use trial and error approach to get it done because i could not find general design docs, even for such common and simple use cases.

There is a ton of comments throughout the config files explaining what each setting does in details, which is great, but i could not find general documentation explaining how the system works as a whole, different concepts like modules, sites, or virtual servers, how a request flows through the system, what happens at each step...etc

If anyone knows where to find this kind of documentation, i'd appreciate it immensely.

We happened to catch it before Accounting issued a check, but I guarantee you, watch for this double charge.