Full disclosure, this is our blog (Insight Recon).

Saw a bunch of threads this week about Wi-Fi and VPN breaking after the October update, so I wrote down what we found. If you’ve got PEAP-MSCHAPv2 set to use the user’s Windows login automatically, it’s getting blocked now on Win 11 24H2+ and Server 2025 unless Credential Guard is on. Typed creds still work. Look for 4025 in the NTLM operational log.

There’s also a script in there that pulls your wireless/wired GPOs out of AD and lists which profiles are still PEAP-MSCHAPv2 with Windows creds, so you can see what’s going to break before users start calling.

https://insightrecon.com/ntlmv1-sso-blocked/

If Active Directory, Entra ID, or identity security is part of your day job, the r/ActiveDirectory community is running two free events over the next few weeks. Nothing sold, nothing pitched, just identity engineers and sysadmins sharing and talking.

Tomorrow: Community Q&A

Drop into the Discord, ask whatever's on your mind, or just lurk. No registration needed.

When: October 16, 2026 @ 10:00 CT (UTC-5) / 15:00 UTC - 60 minutes

Where: Horizon Secured Discord - https://discord.gg/mVFquFqpsW

November Active Directory Community Virtual Meetup - November 3rd

The more structured one. Panelists lead a discussion on a few prepared topics, then it opens up for questions.

When: Tuesday, November 3, 2026 @ 10:00 CT (UTC-6) / 16:00 UTC - 90 minutes

Register (free): https://events.humanitix.com/active-directory-community-virtual-meetup-4-november-2026

Missed it? Recordings go up on YouTube: https://youtube.com/@ActiveDirectoryCommunity

Some fellow IT people were struggling with forcing systemd into Docker and to use Incus, so I showed them nspawn. For a small environment (5-10 containters) it's sufficient and easy to automate. Here is a short wrap-up post about the technology.

Starting November 4, users without an admin role can create agent identity blueprints. Whoever creates one becomes the owner, manages its credentials and can spin up agent identities from it.

Your user consent settings are the only thing deciding what those agents can reach.

Is that a default you want? I wrote up how to turn it off and find existing blueprints.

https://lazyadmin.nl/office-365/microsoft-entra-lets-users-create-agent-blueprints-by-default/

Windows kiosk mode lets IT admins limit a Windows device to one app or a small set of approved apps instead of giving users access to the full desktop.

It is commonly used for self-service terminals, digital signage, visitor check-in systems, POS devices, and shared workstations.

How does Windows kiosk mode work?

Windows has a built-in feature called Assigned Access that can be used to create a limited user experience.

A basic setup usually involves:

1. Choosing the app or website the device needs to run.
2. Setting up a dedicated user account.
3. Configuring the device to open the required app.
4. Testing app restarts, updates, and device recovery.
5. Restricting access to unnecessary apps and settings.

When do you need kiosk management software?

Windows' built-in settings may be enough for a few devices. But when managing kiosks across multiple stores, offices, or locations, IT teams may need centralized configuration, app updates, device monitoring, and remote troubleshooting.

The right setup depends on how many devices you manage and what users need to do on them.

https://scalefusion.com/windows-kiosk-mode/?utm_campaign=Scalefusion%20Promotion&utm_source=Reddit&utm_medium=social&utm_term=KD

For interest: My favorite thing to do these days with extra tokens is comparative performance benchmarking that I'm too lazy and error-prone to do. Below are some results from the common free space analysis tools. Any requests on what to do next?

Performance Benchmark Comparison

This benchmark evaluates the latest production releases of WinDirStat (v2.9.3 x64), WizTree (v4.33 x64), SpaceSniffer (v2.2.0.27 x64), and TreeSize Free (v4.8.1.610 x64) across both Privileged (Elevated Admin) and Unprivileged (Standard User) execution. Results reflect an average of 3 measured runs following a discarded warmup run.

Filesystem Traversal & MFT Architecture Note: WinDirStat and WizTree feature dedicated NTFS Master File Table (MFT) parsers capable of directly indexing raw volume metadata when elevated, reading millions of files in seconds. SpaceSniffer and TreeSize Free lack MFT readers in their free releases and rely entirely on standard recursive Win32 directory traversal. Because Win32 traversal over 6.3 million items on the primary C: volume requires more than 15 minutes, full-volume C: comparisons focus on the two MFT-capable engines.

For each workload scan, the Privileged and Unprivileged runs are placed directly adjacent. Best result in each metric is bolded.

Test Methodology:
To eliminate cold-start and disk-cache skew, every tool executed an initial discarded warmup run followed by three measured passes whose results were averaged. Scans were automated headless across both elevated administrator and standard user contexts, comparing direct NTFS Master File Table (MFT) indexing against recursive Win32 directory traversal. Total scan times were measured using high-resolution timers, while working set memory was sampled continuously from OS kernel counters (PSAPI) every 25 ms to capture true peak and average memory usage.

i have a raspberry pi set up in a construction site trailer to check a few VMs used for job tracking and inventory. it runs a small python script that checks whether a few services are up and shows the results on a local webpage

the environment isn't exactly ideal for this. there's dust, the wifi drops sometimes, and power can be unreliable when we're running on a generator. the pi is in a 3d-printed case, and the whole setup is pretty bare-bones

right now, it does what i need, but i haven't settled on a good way to handle alerts. email might be enough, though i'm not sure how reliable that would be with the connection dropping.

for those who've used raspberry pis or similar low-cost devices for monitoring, what did you use for alerts? i'd rather keep it simple than add a bunch of extra services to maintain

Teams will start generating memory files from meetings so Copilot and Facilitator can use them for grounding. It's on by default, the files are kept for five years, and they aren't deleted when the transcript or recording expires. Users can't open them either.

Useful feature, but is that a default you want? I looked at who can access them and how to control it.

https://lazyadmin.nl/office-365/teams-meeting-files/

Disclosure: I work at Icinga, so I’m not neutral on this one. This is meant to both be a discussion and half-an-ad for a free webinar we’re hosting.
I asked the r/sysadmin mods first, and they pointed me here.

A lot of monitoring advice, especially on the observability side, assumes you can install something: an agent, a collector, an SDK. Most environments have a layer where you can’t. Switches, UPS and PDUs, storage arrays, the ESXi hosts underneath everything, and the vendor appliance nobody is allowed to touch. That layer still takes production down.

My impression is that the agentless options all work, more or less, and each one comes with a “but”. SNMP, but MIB files and OIDs that move with firmware updates. Vendor APIs, but every vendor has its own. Email alerts from the device itself, but nobody reads that mailbox. Is that a fair picture, or am I missing something?

I’m trying to understand how others handle this, both for building better tools and for educational content like the webinar we’re hosting soon.

So my questions for the thread:

• What in your environment can’t run an agent, and what’s watching it today?
• When one of those boxes dies, who notices first: your monitoring, a user, or facilities?
• If your org is moving toward an observability stack, does this layer have a plan?

Which brings me to the half-an-ad part: coverage for exactly this layer is one of the topics in a free webinar we’re hosting on Oct 27 at 3 PM CET (14:00 UTC / 10 AM EDT). Kris Buytaert from Percona and Blerim Sheqa from Icinga look at what monitoring and observability each take to run, where each one’s coverage ends, and why a lot of shops run both:

Running Monitoring and Observability at Scale | Webinar

jMount is Visuality Systems’ new modular Java connector suite.

Whether your Java platform needs to talk to traditional network file shares, cloud object stores, or collaboration platforms, jMount puts them all behind one unified API.

⚙️ What is jMount?
Integrating multiple storage backends usually means juggling conflicting libraries, different authentication models (Kerberos/NTLM vs. Cloud OAuth/IAM), and heavy dependency bloat.

jMount mitigates these protocol fragmentation challenges so development teams can focus on real-world performance:

• File Protocols (SMB, NFS, FTP/FTPS): 100% pure Java stacks built with zero third-party JAR dependencies - keeping your build lightweight and secure.
• Cloud Object Stores (Amazon S3, Azure Blob, Google Cloud Storage): Integrated via official vendor SDKs.
• Cloud Collaboration (SharePoint Online, OneDrive, Google Drive, Azure Files): Native API access behind a single credential model.

🎥 See jMount in Action (47-Sec Video): https://youtu.be/oXw0xkHtyX0

📄 Product page[1]: https://visualitynq.com/products/jmount/

[1] Technical White Paper (PDF) available for download.

Homelab corner — the reality of AI-assisted ops rarely gets written up, so here's this month:

• Media server moved hosts twice, landed on a dedicated box
• 4 production VMs cut to NVMe in one afternoon — copies made server-side, verified byte-exact BEFORE any restart; largest move ~14 min downtime
• Mounts re-pointed off the LAN onto the 10-gig storage net — NFS version chosen deliberately, because the client silently pins to its first socket and would have ridden the slow path (105 → 612 MB/s, same bytes)
• 1.66 TiB / 44,857 files library escaped single-copy
• 5.90 TiB reclaimed after reading the ZFS snapshot docs instead of trusting memory (deleted 5.56 TiB, freed zero, until the snapshots went)
• 2 files recovered in an afternoon: diff → copy → sha256 → count. 31 = 31.

The honest part: every move surfaced something that was already broken — a commented-out fstab line, a rotated token, dead SSH keys. The tool that was supposed to be the alarm was the thing that was broken. Zero scheduled maintenance windows for all of it.

Full write-up: https://atkatana.com/blog/stack-shift.html (ad-free, no signup) Stack reference: https://atkatana.com/blog/self-hosted-ai-stack-reference.html

UniFi Network 11 is one of the biggest UniFi releases in a while. You can now use your phone’s hotspot as backup internet, see Matter and Thread devices in your topology, load network lists from a URL, watch live traffic flows, and create custom icons from a photo. I upgraded my UCG Max and went through everything.

https://lazyadmin.nl/home-network/unifi-network-11-heres-what-actually-changed/

Choose the best Windows MDM solution by evaluating supported Windows versions, enrollment options, application deployment, patch management, security policies, compliance reporting, remote troubleshooting, automation, integrations, scalability, and pricing. The platform should support your ownership models, including corporate, shared, kiosk, and BYOD devices, while fitting your existing identity and IT infrastructure.
https://scalefusion.com/windows-mdm-solution/?utm_campaign=Scalefusion%20Promotion&utm_source=Reddit&utm_medium=social&utm_term=KD

This azure runbook send an email notification for the application owner informing them about their owned application certificate or secret expiration

If the application has no owner, then a configurable admin can be used to receive emails notification.