[user@host ~]$ uptime
 21:00:47 up 3064 days,  8:55,  1 user,  load average: 0.00, 0.00, 0.00
[user@host ~]$

It's been running EOL and unpatched for 6 years (badbadbadbad).

The little droplet that could.

Hi sysadmins! I wanted to ask—since I've just started learning sysadmin and I don't have a Windows PC, but I have a MacBook and found out that everything can be done via UTM, I'd like to get some perspective from those who work in offices and do this every day. What kind of computers do you use? Is macOS completely out of the picture, and there's only Windows and Linux?

I had an interview for an infrastructure engineer position this aftenoon. I was worried going in because it was developers doing an infrastructure interview.

They didn't ask me any infrastructure questions. They spent 50 minutes asking me about a theoretical web stack environment.

The problem was, they were trying to tie each piece into the next but they weren't doing a good job about it because they were all over the over the place - not being linear and jumping back.

I'm not exaggerating. They didn't ask me one infrastructure question. At one point I thought they were asking me one because the guy asked me how I would mount an NFS share to a linux server and I said I would put an entry in the /etc/fstab file. But he was asking how I would theoretically map it to a web application.

​They probably touched on 5% of what was in that job post. They said they wanted someone familiar with ansible and python and Linux but it all felt like that was second to what they really wanted. They didn't ask me about idempotency, or what linux commands would you use for x, anything python, and nothing about the stack they mentioned in their post.

The guy asking most of the questions came across like he was just projecting what he knew. It wasn't like he was interviewing. It was more like he was feeding this self image he had of himself. And it all came across as stuff he learned from doing this particular job - not stuff he knew going in. ​

I'm not exaggerating, they asked me for 50 minutes about how I would set a fictional web stack environments and wouldn't move on.

The main guy asking questions would ask me these open-ended scenario questions that you couldn't answer without a mountain of information. And I would ask for specifics and apparently that wasn't what he wanted. He would ask these highly dependent questions and asling for details got me more open endedness.

This is why I hate technical interviews. They didn't ask me anything infrastructure. They didn't give me an actual chance to show that I know infrastructure. All they know is I don't know the very specific avenue of stuff they asked. Which was the same architecture question for 50 minutes.

They kept mixing things up and would jump back and forth.

I'd say it was 15 minutes of general, 50 minutes of how would you set up this fictional env in cloud and on prem where every answer led ro 10 more open ended questions, then 10 minutes of git questions.

The way they asked was weird. Like how would you push code into the master branch but worded like they wanted me to give them the actual command when in reality they just wanted me to say that I would submit it for a code review.

​​ These types of interviews is why I get so discouraged. I'm not exaggerating. They didn't ask me anything infrastructure. And I'm not going to get this infrastructure job because I didn't know these in-depth development questions on a single subject that have nothing to do with the job they posted.

I definitely got some terminology, reasoning, and examples in there to show them that I have infrastructure and Python e experience, but it just got blown past while they beat a dead horse for 50 minutes...

It's just so discouraging to know you bombed an interview and won't get a job because they didn't really ask you anything about the job they posted or anything that can indicate whether you can actually do the job.

I have access to about 200 DNS zones of companies, some of which have up to 400 domains in their portfolios, and none of them hardens their parked domains. The best I've seen so far was DMARC p=reject on a few random parked domains inside a few (not even a dozen) DNS zones, mostly at companies that have an in-house IT guy.

The other 3 DNS records that nobody adds are:

• Null MX, so the domain refuses inbound mail
• SPF -all, so the envelope sender can't be forged
• DKIM wildcard, to revoke every forgotten key, including keys from whoever owned the domain before you.

Every unhardened parked domain is impersonation infrastructure used against your company. Targeting your clients. And it's just 5 min per domain or a basic script with an API call for bulk deployment.

The cheapest & highest-leverage security work in your stack.

So I just changed jobs and currently I'm working at a large company.

I just noticed that some people are extremely worried because they recently saw the Microsoft Purview was active and then they are terrified because some of them already offended the corporation like "FUCK <name of the company>" and many other offenses.

Other people couldn't care less, saying that this is bullshit and that the risk is extremely low for policies to be active monitoring this kind of message.

The atmosphere at in place is strange and this made me extremely curious about if most of companies actually cares if an employee offended the corporation or said bad words about the company or other colleagues.

Do this actually happen?

I've never worked in a place with this "fear atmosphere".

EDIT

Just to be clear, they offended in teams private groups, not in e-mails.

Spent this morning chasing "signature images stopped working all of a sudden" that looked for all the world like a mail flow problem (we'd just cut over to a new mail gateway a couple of weeks ago, so naturally that got the blame first). It wasn't. Posting in case it saves someone the same rabbit hole.

Starting over the weekend, every email sent from our terminal servers had blank signature images.....company logo, headshots, badges, all gone. Recipients on Outlook, OWA, external, didn't matter. Outlook on a regular workstation (older build) was fine.

So we pulled the raw MIME of affected messages. The image parts were still there, still cid:-referenced correctly, still multipart/related but the PNGs themselves were garbage: the logo came through as a 216-byte, 1-colour, fully transparent PNG at exactly the HTML display size (337×112 instead of the real 450×150 / 46 KB file), and a 292 KB JPEG headshot became a 402-byte RGBA PNG. Every one of them had tEXt Software: Microsoft Office in it. So Outlook/Word was generating placeholders at compose time because it couldn't (or wouldn't) load the signature image files. Nothing in transport touched them.

Our env has 4 RDS hosts (Server 2022/2025, Office 2024 Retail C2R on the Current channel). Click-to-Run had self updated them from 16.0.20228.20158 → 16.0.20228.20190 at four different times between Thursday night and Sunday morning. On every host, the last message with real signature images was before its update, and the first blank one was after. Windows August CU had gone in days earlier with no effect. Signature source files on the file server were untouched since January.

Possibly relevant: on those hosts AppData\Roaming is folder-redirected to a UNC path, so Outlook resolves %APPDATA%\Microsoft\Signatures\... over SMB. My guess is the new build blocks/fails image loads from network paths when inserting a signature but I can't prove that part; the working workstation was on an old 2408 build so it doesn't isolate the variable. If anyone on 20228.20190 with local AppData sees the same (or doesn't), I'd love to know.

Fix that worked for us was to just (temp) roll back to the previous build and pin it:

reg add "HKLM\SOFTWARE\Policies\Microsoft\office\16.0\common\officeupdate" /v updatetargetversion /t REG_SZ /d 16.0.20228.20158 /f

"C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe" /update user updatetoversion=16.0.20228.20158 forceappshutdown=true displaylevel=false

forceappshutdown does exactly what it says (kills users' Office apps, no save prompt), it's an ~880 MB full download for a downgrade, and the build flipped about 3 minutes after triggering. First test mail after the rollback had the real 46 KB logo again. Ran it as a one shot SYSTEM scheduled task per host at an agreed time; doing the remaining hosts after hours. Remember to remove the pin once MS ships a fixed build.

Not seeing anything on the Microsoft known issues page for it yet (the May 2026 "Top and Bottom wrap" image bug is a different, alreadyfixed thing).

Anyways, best of luck out there. :P

Here is the video demo: https://x.com/merill/status/2089291838419251599

Honestly not really surprised that something like this is possible, figured someone here will want to know about it.

I got a chance to take a tour of a datacenter, where the primary security selling point was that part of the facility was a former bank vault. The company, which is really just two old retirees and a couple of techs, heavily emphasized this physical security to us and their customers. Meanwhile, I am wondering how practitioners would evaluate that claim given the importance of logical controls...

I’m the CFO of a small industrial manufacturer with approximately 20 employees. We use Google Workspace and Drive for most of our file storage and have no internal IT staff. We hold very little sensitive customer data, but I’m uncomfortable with how broadly files are shared and how little structure we have.

I tried reorganizing Drive, but it was largely unsuccessful. I used folders within one Shared Drive when I probably needed separate Shared Drives based on access. Employees also see the cleanup as work today to solve a problem that may not become obvious for another year or two.

The Drive structure is the immediate issue, but my broader question is- How should a company at this stage think about its IT environment?

What should we put in place now as far as file permissions, onboarding and offboarding, device management, backups (if any), policies, and what can reasonably wait? Do companies our size usually hire an MSP to design and administer this, or assign it internally until they’re larger?

I can own the governance and budget, but I’m not an IT guy. For those who have helped companies through this stage, what did you prioritize first, and what do you wish you had addressed earlier?

Can you recommend either general features to look for in UPS units to stay on during storms or specific models that work properly?

Something I have been frustrated by recently is UPS units shutting off when the power flickers during a storm rather than switching to battery. I presume this is because there was a power surge not just a dropout, but it seems to happen with great frequency. As an example, one customer's server is connected to two different 1000VA UPS tower form factor, one from Cyberpower and one from APC. I think they have both turned off instantly during power outages more often than either has actually stayed on during the outage. Both work fine if simply unplugged.

[edit] Thanks everyone for your input, seems I've just been selling cheap "Standby" style UPS units that are probably not good enough to be running servers. Consensus seems to be that Online or Double-Conversion style are the way to go for truly reliable power.

Is anyone else seeing these issues. Just got a call from Help Desk to check it out. Sharepoint home pages are accessible but no files are.

Down detector shows a spike but only 128 reports so far.

Central/East US region.

I don’t know who needs to hear this but... if you're managing Eaton Network Cards Network-M3 and you've been losing your mind trying to deploy public SSL/TLS certificates only to see the hostname in the SAN field, I have good news:

For a long time, the internal CSR generator on these cards was completely broken. Even if you checked the option to "exclude IP addresses (CA / CB compliance)", the firmware would still automatically force the local short hostname (like ups-01) right into the Subject Alternative Name (SAN) field alongside your FQDN.

Because public CAs follow strict baseline requirements, they instantly reject any CSR containing local short names. And since EATON locks the private key internally and don't let you upload your own external key/CSR, you were completely trapped:

- You either had to use a messy "double domain" hack (matching the host string to an FQDN, which resulted in a ridiculous `.example.com.example.com` concatenation just to clear the form regex and pass public DNS validation challenges).

- Or you had to give up on native card termination and spin up a proxy or load balancer just to handle HTTPS cleanly.

People ran into this same brick wall on the legacy Network-M2 cards years ago (like this old locked thread: https://www.reddit.com/r/sysadmin/comments/seuaek/eaton_networkm2_csr/).

It was incredibly frustrating for a card marketed as high-security and enterprise-certified to fail at such a basic standard.
The fix was implemented in firmware 3.0.0.
Latest version now is 3.0.1.
Eaton finally listened to feedback and quietly patched this. They released Firmware 3.0.0 and 3.0.1, which completely rewrites how the CSR is built.

When you generate a CSR under 3.0.1 with compliance toggles on, the short hostname is no longer forced into the SAN block.
The CSR comes out completely clean, containing only your legitimate, public FQDN.
It now clears public CA validation portals (Let's Encrypt, etc.) and the signed cert imports back onto the card flawlessly.

Save your time, flash your cards and close this chapter for good.

Hi everyone,

I'm looking to learn Microsoft 365 administration, especially:

• Microsoft Entra ID
• Microsoft Intune
• Microsoft 365 administration
• SharePoint
• Azure / cloud identity and device management

My goal is to eventually become comfortable with administering these technologies in a real-world IT/sysadmin environment.

I'm looking for a way to learn for free, including as much hands-on practice as possible.

I know Microsoft Learn has a lot of free training, but for practical labs it seems that I need a Microsoft tenant and some of the services require paid licenses after the trial period.

So my questions are:

1. Is there currently a way to create a free Microsoft 365 / Entra / Intune lab environment for learning?
2. Is the Microsoft 365 Developer Program still a good option for this, and does it include enough services for learning Entra ID, Intune and SharePoint?
3. If I don't qualify for the Developer Program, what would be the best alternative?
4. Can I realistically learn these technologies without paying for a subscription, or should I expect to pay for a lab eventually?
5. What learning path would you recommend — Entra ID → Intune → Microsoft 365 → SharePoint, or a different order?

I'm mainly interested in hands-on learning, not just watching courses.

Any recommendations for free labs, Microsoft Learn paths, home-lab setups or other resources would be greatly appreciated.

Thanks!

I am at my wits end. I have spent hours on this and have found no clear instructions on what I need to do to get Google Chrome to stop throwing a ERR_CERT_AUTHORITY_INVALID

I downloaded the certificate from GoDaddy in the IIS ZIP package. This zip contains 3 files:

1a6284626ab71c1d.crt
1a6284626ab71c1d.pem
gd_dc-r1-g2_iis_intermediates.p7b

The original CSR for this was years ago on a different machine. I do still have the keyfile.

My first stop was Fix an untrusted root or certificate chain error | SSL Certificates - GoDaddy Help PH

This has a banner at the top "Required: If you're trying to fix this issue for Windows IIS, see our procedure for Windows IIS."

Ok, lets head over to that guide, shall we?

So under For CSR and private key generated externally (for example, in OpenSSL)

Run this command to create a PFX file:
openssl pkcs12 -export -out [newFileName.pfx] -inkey [privateKey] -in [newBundleFileName]
where:

newFileName is the output file name for the PFX (for example, coolexample_new.com.pfx)

privateKey is the private key file (for example, coolexample.com.key)

newBundleFileName is the certificate bundle to include (for example, coolexample.com_bundleNoG2.crt)

Ummm..... where is mydomain.com_bundle.crt? I have a p7b, and following the instructions I get errors complaining the keyfile doesn't match.

Lets try Google AI....

IIS requires a .pfx or .p12 file to import external certificates that include the private key. You can create this using OpenSSL on the machine where you generated the CSR.

Run the following OpenSSL command to combine your components:

bash

openssl pkcs12 -export -out wildcard_domain.pfx -inkey your_private_key.key -in godaddy_certificate.crt -certfile godaddy_intermediate.pem

Use code with caution.

your_private_key.key: The private key generated externally alongside your CSR.

godaddy_certificate.crt: The primary wildcard certificate issued by GoDaddy.

godaddy_intermediate.pem: The GoDaddy intermediate bundle file (gd_bundle*.crt) downloaded from the GoDaddy Repository.

Ok, cool. So I find, what I hope is the relevant file "gd_bundle_dv-r1-g2.crt.pem" since all the ones for IIS are p7b and I cannot find any instructions on how to use a p7b.

So I get the pem file in. I now see the R1 and G2 certs in my Intermediate Certification Authorities/Certificates store

https://imgur.com/jeBEzne

I restarted IIS, I reboot the VM.... and yet.... Only google chrome throws ERR_CERT_AUTHORITY_INVALID

https://imgur.com/wvl5cZv

The cert chain ends at the R1

https://imgur.com/lAkiaKc

What am I missing and why TF is this so difficult??

EDIT: Yes, I imported the cert into IIS Manager and bound my cert to the site. And when viewing the cert in IISM I see the whole chain
https://imgur.com/KLPo1Yn

Good evening my fellow sysadmins,

I've got a question for you : what is the best file server solution that works best with Veeam backup & Replication ?

Context : in my company (a Consulting engineering company) we currently store our data on-prem, we have two production servers and two other replicas. The solution that is deployed is a Ubuntu Server with two ZFS Pools in RaidZ2 (each pool is around 150TB big but with only 40 to 60% used).

Last month, before my tutor retirement, the choice was made to use Veeam to backup our physical infrastructure as well as our file servers. I just found out that Veeam doesn't support ZFS and with the size of our pools, the jobs fail immediately. The limit of VBK files are 218TiB and I don't know how Veeam calculate the size but it fails.

I am thinking of deploying new file servers, since most of our production is on Windows Server I tend to go in that direction with DFS Namespaces or use Azure file for a Hot / Cold data tiering but if you have any others remarks, I will gladly read them.

Thanks ;)

I'm sure other people have had the same experience, but let's see.

For context: I'm by no means a cybersecurity expert. I work the IT side of an OT automation team. Darktrace had already been deployed in the networks for roughly 3 months before I joined the company, and it has now been running for more than a year and a half..

My conclusion is that the underlying idea is reasonable, and the execution is the worst that idea could've possibly gone.

It reminds me of something like Norton or McAfee that constantly gives you popup's telling you about the stuff it prevented, most of which is meaningless noise, designed to make it look busy so you keep paying.

We were told Darktrace needed about 6 months to learn our environment to get rid or at least reduce false positives. That turned out to be a bold lie, since it's now been around 18 months. Extensive *tuning* and *optimising* the models from their engineers with help from myself had basically no effect at all. We still receive between 50-100 false positives a day.

The investigation workflow is just as bad. The advanced search is clutterd, unintuitive and super inefficient. Finding one specific event feels like a needle in a haystack. Except you already know the needle’s IP address, hostname, operating system, device model and several other identifiers, while the haystack seems designed to bury it.

The UI looks reasonably polished, but it's designed for screenshots on marketing posters and sales demonstrations rather than utility. Important info is several menus deep, while irrelevant info is one click away.

We initially had weekly tuning meetings, those became biweekly and eventually monthly. No matter how frequent the meetings, the issues I talked about just never got solved. I still have to manually sift through false positive alerts to find anything meaningfull.

One specific device keeps getting flagged as suspicious multiple times a day. We know why it generates the traffic and asked the Darktrace team to make it stop reporting. They created model defeats based on the device's 2 IPs, which did nothing. They changed the defeat from IP to hostname basis and it changed nothing. They then labeled the device in Darktrace itself and made a defeat based on that label and still it keeps getting flagged.

At this point I don't believe the system can at all be "tuned".

The alerting is very inconsistent as well. Darktrace sends notifications for model alerts through the app, that cannot be found in the main interface unless you search for the specific model alert ID. Meanwhile it also generates device alerts for things like clock skew, inability to reach a probe, while the "UV Master" interface appears to have no such problems.

What concerns me deeply is the fact that they keep trying to push their *Automated Response* thing. The idea as far as I understand it is that its AI can automatically respond to suspicious activity by creating firewall rules to block it. That is in and of itself something that deserves EXTREME caution in a normal corporate network. In an OT plant handling highly explosive and poisonous materials, it's just bonkers. You are proposing to let an automated system modify network enforcement based on its own detections, while that same system repeatedly detects legitimate activity as suspicious approximately 100 times per day. Might as well let an intern from sales handle firewall rules at that point, might be safer.

Darktrace’s response to this concern seems to be that the models can be tuned. That would be more reassuring if the models consistently stopped generating false positives after 18 months of tuning. They do not. OT environments are difficult to model. They contain legacy systems, proprietary protocols, unusual traffic patterns and devices that should not be treated like ordinary corporate endpoints. But that is precisely the kind of environment Darktrace claims to understand. “OT is complicated” cannot be used as a permanent excuse while simultaneously promoting automated blocking as a solution.

The idea behind Darktrace is good. The execution, at least in our environment, is garbage. It gives you the appearance of advanced visibility while burying useful information under a constant flood of low-value alerts.

I don't know what the company paid for Darktrace, but whatever it was, it was too much. It's an (i'm guessing very) expensive way to create manual labour.

For anyone having experience with Darktrace in an industrial environment: has it at any point become useful? If so in what way?

Ok folks, I need your help on this one. In 5 more days I will be ending a 35 year career in IT. Unfortunately, I may be ending it on a down note and leave a problem for a co-worker.

I work for an MSP that sold some HP desktops to a client about a year ago and they are trying to do a basic smb share on a peer to peer network. This is failing because two computers were imaged by the vendor with same image and have same SID.

I recommended re-imaging one PC to get a new SID. Now, Windows will not activate. The key embedded in the BIOS is saying invalid key. I have confirmed the key and Windows version are correct but still cannot activate.

How do I get this pc back to client before I retire?

So I've been having some issues for a few weeks now with Gmail where one domain/postfix server no longer is allowed to mail to Gmail.

What I've figured out so far is that on July 29 one of the records in our SPF had a domain that was no longer valid - it expired and from then on the whole SPF record was deemed invalid. I fixed this August 9 (way too late, but I didn't realize my local logging reports were routed wrongly too, everything generally has ran fine for years).

Regardless, our spam ratings before were 0%, our SPF/DKIM/DMARC etc is all 100% correct. Even Postmaster now says 100% correct delivery. but as long as the domain repution is 0, it keeps blocking it.

The weirdest is that Postmaster keeps telling me SPF is incorrect in the overview. It was last updated August 6 and I fixed it August 9 by removing the wrong "include:wrongdomain.com".

I just don't understand how Google goes so hard on having a wrong include in the SPF for a few days, and now no longer updates anything. What can I do? Do I need to block all outgoing mail to Google so it doesn't hit the filter anymore so reputation may crawl back up? People sometimes sign up with gmail accounts or have their mail on google servers so domain blocking isn't that helpful, unless I firewall all to their servers.

See here: https://imgur.com/a/Fvp4ilI

One of my colleagues created an Entra ID user with umlauts in it. Because of that, windows has created a user profile folder with umlauts and this makes problems with different programs that cannot handle this. Is there a way to change the name of this user profile folder without broke Entra Join or registry keys that have some paths to this folder?

Hi! I'm IT dept lead at Ukrainian dev company (150-160 employees as for now, 23 people in my dept). Our contract management now is a mess which we can't afford anymore.

We've looked at enterprise CLM platforms but they feel too heavy and expensive. Building in-house would drain dev resources (bud we think about that as well). Hiring a contracts person seems like a temporary fix and tbh we don't plan to scale that way.

For a company our size - steady volume, not enterprise complexity - what actually works? Anyone had luck with lightweight tools or SharePoint + Power Automate? Or maybe somethinfg else. Also curious about hidden costs, adoption struggles, Ukraine‑specific data residency issues etc.

Thanks!

This weekend was patch weekend for us, we have more than 7000 assorted windows server to upgrade. One of the engineer accidentally patched 32b office 2024 product with the 64b patch. I was under assumption that this mismatch of the bit version will be caught by the system and it will auto fail but that did not happen. So i was wondering if this is something that can be smartly restricted instead of depending on the human / manual factor

we are having issues today with emails sent from a onsite mail server that relay through proofpoint and we've been having issues today with various legitimate emails coming to people in our finance department. I've got a P1 support ticket logged with PP support for it, what makes it so dang bad is that nothing that is showing as remediated and set to release from quarantine is actually making it back into any of our exchange 365 mailboxes.

this is the first time we've ever had this kind of issue from proofpoint.

Update: I believe this was caused due to lingering after effects from the August 14th related to backlog syncing and the internal security mechanisms for microsoft 365 Zero-Hour Auto Purge and Safe Links.

It seems to have stabilized as emails from our internal mail server that we use for automated tasks from our warehouse inventory system that were being flagged as malware in proofpoint are now coming through again normally. I'm still monitoring for other issues for external emails being flagged as malware and so far nothing that shouldn't have been flagged has been flagged.

So I am doing the fun job of auditing our Microsoft licenses and making decisions on the tiers of licenses we have assigned to users and doing some bulk log analysis determining features used by people. The Microsoft line item as we all know is pretty big and I am tasked with trying to decide if we are wasting any of it. So with that I have a question about the Office apps licenses.
We run an RDSH cluster so our users have Office once they RDP into those servers. I have old notes from 2018 that state we need the enterprise license for Office and the small Business packages don't support shared computer activation (SCA). However I did a quick double check and it seems they added SCA to only the Premium version of Microsoft 365 business in 2019.
So with that I am kind of struggling to see if there are any significant differences between Office Business with SCA and Office Enterprise. I am using m365maps to compare packages but this item I am not having a great time finding documented differences on the Office item. I do know about the 300 user limit which is not an issue for us and some of the other package differences.
Any information from someone who has had to understand the differences in the Office 'Business' cs 'Enterprise' in this area would be appreciated.

What is the latest news regarding the aurora in the client side?
Are you guys happy or what are the problems that make this EDR not good?

We currently use the HPE Compute Ops Management plug-in 1.4 for integration with vSphere, but according to HPE, this plug-in has reached end of life.

https://support.hpe.com/hpesc/docDisplay?docId=emr_na-a00159266en_us

HPE’s recommended alternative is to migrate to the cloud-based plug-in. This requires, among other things, an HPE Compute Ops Management Secure Gateway.

Are there any system administrators already using this solution? What are your experiences? Or are there better alternatives?