My motto for the last 10 years has been "why can't the packets just get there. Why can't they get where I want them to go so I can move on with my life?!"

My network skills are at passable for a technician level and just below engineer level, depending on the brand, because I simply do not care about networking.

So I got sent out to an MSP customer's office for the 2nd day in a row to solve an IP phone problem; my other favorite field of IT. They were getting voice drops and cut outs. Probably the coiled up 85 feet of ethernet that looks like it was in a war, clamped together with bread twist ties. I AM NOT KIDDING. I put in a brand new 10 footer and do a test call and leave.

Same problem 2 hours later. So I'm there this morning. Replace the phone entirely. Didn't work. Phone on a different ethernet port - nope. Put my laptop to the ethernet and I get 90% bandwidth and 19ms pings. We do a test call, phone never rings but does immediately tell us there's a missed call and a voicemail about 1ms after hanging up.

The Firewall was patched from 7.2 to 7.6 family firmware a few weeks ago and AI is telling me it's probably UDP packet routing. That makes sense. I change a few settings that it suggests that vaguely sound right to me like not allowing UDP port changes within a stream, verified timeout was an hour, verified there was no packet inspection on that port, etc. Still can't get it. I find out they never told me but other people are having similar but not identical phone problems. Her phone is now showing that 5 lines that don't exist are all ringing and they perpetually ring indefinitely. I report it to our more networking guy as a firewall problem and tell them go onsite and call support.

He gets onsite today to take a look. He plugs the phone into the firewall directly and it gets calls, makes calls, etc. Their switch is taking UDP packets and just rolling a D20 and anything under the difficulty class check gets thrown into another universe via quantum tunneling leprechaun magic. If you're about to say "that's probably not what it's doing," fucking prove it. You can't. I can't either. You don't know there's not leprechauns inside the switch. All I know is we're requesting approval for a new switch. No idea what model, age, or brand it is btw but based on that customer, it's probably older than I am.

I fucking hate networking so damn much. Why can't the damn packets just go where they're supposed to?! This office location has about 6 computers and 4 phones. For fuck's sake, what kind of switch can't handle that?!

Hi all,

I'm the only IT person at a small manufacturing company in Sri Lanka (~40 devices max, mostly Windows workstations/laptops/tablets, single office). Right now we have no centralised management and everything is basically standalone machines and local accounts.

Management wants two things:

1. **Control over internal users with RBAC** - different departments/roles should only have access to what they need (apps, shared folders, admin rights, USB, etc.).

2. **Visibility into what users are doing on their devices** – logins, apps used, file access, websites, that kind of thing.

My current plan is to implement an on-prem Active Directory.

I've reached out to a couple of Microsoft partners for quotes and still waiting for replies from them, but I want a sanity check from people who've done this before.

Questions:

1. **Is on-prem AD still the right call at this size**, or should I be looking at Entra ID + Intune (Business Premium) instead? Management prefers on-prem, but I'm open to arguments either way depends on the cost.

2. **Rough costing** - what's a realistic budget for hardware + licensing + implementation for ~40 devices? Anything vendors typically overcharge for or try to upsell?

3. **RBAC** - any best practices for structuring OUs, security groups and GPOs so it doesn't become a mess as a one-person team? Things like tiered admin, removing local admin rights, LAPS, etc.

4. **User activity monitoring** - what are people using? Is AD auditing + Event Log forwarding enough, or do I need a dedicated tool? Any affordable/free options that work well for ~40 endpoints?

5. Anything you wish you'd known before rolling out AD as a solo admin?

6. Also i saw something like Samba AD which is an open source, didnt do any research yet. Is something like that managable for this requirement instead of microsoft AD.

Any advice or lessons learned would be really appreciated. Thanks!

I'm trying to figure out what is the best combination of licensing E3 plus what to get as close to business premium as possible.

I understand it won't be an exact match, but I know that business premium has a few extra bells and whistles that aren't included with just the base E3 license. What would I need to add-on to my E3 to make sure everything is at least as good as what comes with business premium?

I've already looked at the M365 maps and the license guides, but I can't really make heads or tails of those. this P1, that P2, it doesn't make sense. This is easily a problem someone else has already solved, and hoping to understand how others have solved this.

Got a question that I need cleared up. We don't have either SMS or voice enabled as authentication methods on our tenant so that isn't what I am worried about. The vast majority of our users use push notifications via the Microsoft authenticator app, with a handful using passkeys.

Come Feb 1st, are all my users going to be prompted to set up passkeys? The reason I am questioning this is because obviously push notifications are not phishing resistant, however the Microsoft doc states that:

"Users in scope for the February 1 retirement whose only available MFA method is SMS or voice are required to register a passkey during sign-in to continue accessing their account. This prompt is blocking. Users must register a passkey before they can continue to sign in to their account."

The "whose only available method is SMS or voice" section makes me think that this might not be the case?

It isn't rolling out passkeys to my users that I am worried about, it is more so how janky and awkward they work with the authenticator app. I have been using push notifications for years and had minimal issues. I have been using passkeys for 6 months and have a couple of users who just can't add a passkey with no reason or error explaining why (support case which is still open with Microsoft) and I have some who have had their passkey randomly disappear so it had to be set up again.

I'm assuming Google Drive creates and deletes some temporary files, which could cause issues. Is there a way to work around this?

Curious to hear other people's experiences

I'm at a point in my career where the compensation is decent, and I have enough experience that I wouldn't want to move somewhere just for the sake of moving. However, I'm starting to question whether staying in my current position is the best long-term decision.

The role has gradually evolved, and I've gained experience with many different things. At the same time, I'm not entirely sure the direction I'm heading in is where I want to be a few years from now.

I've casually explored the job market, but most opportunities I've found seem to involve a trade-off: lower pay, less interesting work, less responsibility, or a move that doesn't necessarily feel like career progression.

It's hard to tell whether I'm too comfortable where I am or whether leaving would be a bad move in the current market.

For those who have been in a similar position:

How do you know when you've outgrown a role versus when you're just going through a frustrating period?

Would you stay somewhere that pays well but has questionable long-term prospects?

At what point would you prioritize career growth over compensation?

If external opportunities aren't particularly appealing, would you stay put and keep looking, or take a calculated risk on a different role?

Interested in hearing from people who've dealt with this, particularly experienced sysadmins and infrastructure professionals. How did things turn out for you?

Did anyone else get burned this morning by last night's update, where the certificate presented by an NPS policy defaulted back to the cert at the top of the list instead of the one you selected, preventing users from authenticating? This happened on both of my NPS servers, which triggered the dreaded 8 am panic call. The fix was to set the certificate back, but before then, RADIUS clients for Wi-Fi were down in my case.

The security log for the user: Reason: An internal error occurred. Check the system event log for additional information.

The system event log: The TLS server credential's certificate does not have a private key information property attached to it. This most often occurs when a certificate is backed up incorrectly and then later restored. This message can also indicate a certificate enrollment failure.

I've spent the last few months aggregating public blocklists and DNSBLs for a reputation lookup tool. A few things surprised me, and they matter if you run your own blocklist checks:

1. A frozen mirror can look fresh. One well-known traplist has a mirror whose own header says it was generated in September 2025, yet its HTTP Last-Modified header moves every hour. Judge freshness by the timestamp inside the file, not the HTTP headers.
2. Several "different" lists are the same data. One provider's main DNSBL zone is exactly the union of its "netscan" and "spam" zones. Another's Tor zone is just the Tor category of its main RBL. A third publishes the same Tor exit list over DNS and over HTTP. Count them separately and one Tor exit collects about six detections from two or three real sources.
3. "Tor" lists aren't all exit lists. One popular zone lists every Tor relay, including non-exit relays. Those never send user traffic to the internet, so treating them as Tor exits is a false positive.
4. Public resolvers end up on spam lists. A commercial anti-spam list carries 8.8.8.8, with a spam rate of zero. Resolver addresses turn up in form-spam data from everyone's traffic. Exclude the well-known resolvers before trusting a hit.
5. Dead lists read as clean forever. Plenty of lists that tools still show have name servers that never answer, or feeds that return 404. They report "not listed" on every lookup.
6. Some zones are wildcarded. A zone that answers 127.0.0.2 for every query flags the whole internet. Test each zone with the RFC 5782 test entries first: 127.0.0.2 should be listed and 127.0.0.1 should not.
7. Check the licence before you ship a list. Several "free" lists forbid commercial use or redistribution, and one explicitly bans reselling its data "as part of a larger package".

Disclosure: I build Senapati (senapati.io), an IP, domain, URL and email reputation API, which is where I ran into all of this. Happy to go into detail on any of these.

For context, boss says he needs two backups of all data prior to a certain date and post a certain date. We are on premium.

Tried to explain that I’m not sure this is possible.

We currently don’t even pay for a backup tool! (Requested multiple times)

Don’t even know how to begin approaching this.

We have multiple Teams rooms that are an hour off. Currently it is 8:33 and our Teams rooms are showing 7:33. We are located in Manitoba who recently decided to no longer do the time changes.

I have been working with a specific Teams room to resolve this issue. The steps that have been completed is to set the underlying Win 11 IOT install to Bogota as per the Microsoft article. We have also toggled the time zone in OWA away from Central to a different time zone and then back choosing the option to update the calendar appointments after the change, and then switching back to central.

Checking Teams on the web shows the correct time zone and there is no way to flip that time zone to a different one and then back as it opens the local time zone settings.

One thing to note is that a different Teams device configured for the same room is showing the correct time.

Are we looking at needing to reset our Teams rooms or are there any other steps that we can take before resorting to a reset?

Hey guys looking for suggestions.

Our users connect in via VPN, authentication with their Entra account and then mfa using Duo.

They also have their own mobile devices which they access email / OneDrive / SharePoint etc on - we lock these down with app protection policies so they can't screenshot / copy data out etc.

Business wants to prevent people connecting and spoofing their location, using commercial vpn's like Nord.

I've tried using defender for cloud apps, but on my first attempt using Proton VPN, it did not tag the IP as an anonymiser / VPN, so the solution doesn't give me much hope.

I can sign up to a service that gives us commercial VPN ranges, and add those to named locations in Entra, but the limit is 2000 addresses, which isn't feasible. Plus the addresses change all the time.

Anybody got any other suggestions?

Does anyone know the support line for ProofPoint? They are blocking my clients emails and I’ve contacted the people my client is trying to email but no one will help me get to support.

Please, anyone help me. When I'm sending attachments greater than 5MB while encrypted, for whatever reason it strips the attachment from the other end's email.
I have no idea why this is happening, and logs show it is attached when it goes out, but the actual sent message is 113kb.
What in tarnation could be causing this?
Using Exchange with Purview's encryption

I recenty joined this org and we have 20+ employess, using systems with win 11 home, my manger wants me upgrade them to pro and add admin accounts in them. We have Volume license upgrade key, we don't have intune as part of our licensing (Basic Tier), so I would like advice on the best approach to manage this transition:

1.Upgrade Windows 11 Home to Pro using our volume licensing key.

2.Create work accounts or profiles for employees on their devices.

3.setup admin accounts

4.Migrate existing user profiles and data to the new work accounts while preserving their files, settings, and applications where possible.

TIA

Hello.

I had 3 servers with MS Windows Server 2016 standard with Microsoft Edge.

I migrated these 3 servers to Windows Server 2019 with in-place upgrade: the 3 servers are working perfectly after the upgrade.

Only an issue: Windows Server 2019 is not able to upgrade Microsoft Edge via WSUS (error 0x80070643).

So I uninstall Microsoft Edge, but I'm unable to reinstall it with MicrosoftEdgeEnterpriseX64.msi installer: I have the error 1722 on all the 3 servers.

Error 1722. There is a problem with this Windows Installer package. A program run as part of the setup did not finish as expected. Contact your support personnel or package vendor.  Action DoInstall, location: C:\Windows\Installer\MSI26E9.tmp, command: /silent /install “appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}&appname=Microsoft Edge&needsAdmin=True&usagestats=0&ap=stable-arch_x64” /installsource enterprisemsi /appargs “appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}&installerdata=B%22distribution%22%3A%7B%22msi%22%3Atrue%2C%22system_level%22%3Atrue%2C%22verbose_logging%22%3Atrue%2C%22msi_product_id%22%3A%2257A2E6D4-100B-30FC-A094-7C46B43D6D68%22%2C%22allow_downgrade%22%3Afalse%2C%22do_not_create_desktop_shortcut%22%3Afalse%2C%22do_not_create_taskbar_shortcut%22%3Afalse

So, you knew I was going to ask some crazy questions.

Basically, a computer could no longer contact the domain controller, and the usual fixes weren’t working. What eventually worked is we connected to the VPN, and THEN it joined the domain.

Probably the most important detail that I’m sketchy on is the other sysadmin did something in Powershell - Set-DNS something to the primary DNS server.

Upon restart, there was no network connection.

I logged in as local admin, and connected to the VPN. Then I logged in successfully as the main computer user.

But I can no longer connect to the work network, and it is a straight Ethernet connection, except by connecting to the VPN.

My suspicion is the other sysadmin fiddled with the DNS settings, but I can’t be sure.

Has anyone ever heard of this? If only I had paid attention to the command he used. Should I be looking at something simple like network connection properties. I enabled IPv6, and it didn’t help.

I'm helping a colleague research and I don't want to rely on AI for this, and now that includes Google a fair bit. Anyways, we're dealing with 192 TB, looking to do a full backup and then follow it up with incremental. I'm looking at chrono sync, free file sync and carbon copy cloner. But if there's a better option, I'd be glad to hear of your experience with it.

I'm having a hard time finding any videos, or even documentation that's up to date for these options.so I thought I'd ask. Any insight or experience would be awesome.

Seeing more people build little internal tools with Claude, Cursor, Lovable and share them via links. Is this showing up at your org too? Do you know which ones exist, who owns them, or what data they touch? How are you handling it? Tbh it feels like everyone is building apps now and not able to keep up with it😭 It’s so annoying

Hey guys, I’ve recently taken over the role of sys admin in the company I’ve been working for as an operations admin for the past year. I’m implementing a series of changes, processes, policies and trying to structure our Microsoft environment, our domains, back up solutions, company and vendor accounts, etcc

It’s been a bit of a journey and honestly I’m also learning things on the go especially when it comes to documenting changes and getting our employees to understand what’s to be implemented before pushing it ahead (this has saved me from a lot of trouble but at the same time has delayed things a lot because apparently people hate changes and having to make minimal effort)

But at the same time I’m still having to run the daily operations in the company which includes embedded generation applications, approvals, quoting some small service work calls, looking after the service jobs with our subcontractors, monitoring portals, liaising with the engineers and site managers before attending site, solving solar troubleshooting enquires etccc

So like im taking a new title as sys admin (still going to get this updated on my contract) but I still take to take care of the daily operations and often I don’t have time to do the sys admin stuff properly which means im doing that at home where I also don’t have a lot of time. And when trying to implement my changes in person our electricians and my manager etc are very impatient and if something doesn’t work straight away they just don’t want to spend the time on it. We have a new company CRM one of our employees is vibecoding and my manager and the CEOs wants to replace all of our paid software with that (for like scheduling, hse forms, worker register, claims, inductions, daily prestarts etc) and today my manager told me that the priority is to test the new vibe coded system (and by this he means tweaking it so it replicates what the other software do) as he would rather get this done first and is less worried about passwords, insinuating that all the IT stuff I am doing in this take over is just password resets 😭😭 This was shocking to me because after all the changes I’m implementing there’s no way this is the only thing that comes up on his mind, like if this was all IT did then the company wouldn’t have spent hundreds of dollars weekly on an external IT support vendor before I took over

Anyways, if anyone here is or has been in the same situation and has some advice for me/words of encouragement I’d really appreciate it

For context I’ve just turned 23 and like my job but I’m worried that im having to disregard our internal IT needs because if I cease to do the daily operation stuff this will affect the flow of the business. As a result, this makes me anxious because I know our necessities but don’t have the time to commit the way I desire . (We are still doing better than when the company was on the hands of the external IT vendor though so I guess that’s something to consider hehe

With increasing discussions around digital sovereignty at my workplace, I'm wondering whether fellow EU sysadmins have ever attempted a PoC for an IT environment that avoids US technology altogether.

Has anyone successfully identified viable alternatives for components such as:

• Endpoint operating systems (e.g. Windows)
• Endpoint management (e.g. Intune, SCCM)
• Identity and access management (e.g. Active Directory, Entra ID)
• Endpoint security (e.g. Defender)
• Productivity and collaboration suites (e.g. Microsoft 365)

What did your architecture look like, and where did you run into challenges?

I'm particularly interested in real-world experiences, lessons learned, and whether you felt such an environment could realistically move beyond the PoC stage.

I have created and tested two scripts for intune ,in our envriroment it went live .

The detection script is :

$RegistryPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0"
$ValueName = "BlockNtlmv1SSO"
$RequiredValue = 0

try {
    $CurrentValue = Get-ItemPropertyValue `
        -Path $RegistryPath `
        -Name $ValueName `
        -ErrorAction Stop

    if ($CurrentValue -eq $RequiredValue) {
        Write-Output "$ValueName is correctly configured as $RequiredValue."
        exit 0
    }

    Write-Output "$ValueName is configured as $CurrentValue instead of $RequiredValue."
    exit 1
}
catch {
    Write-Output "$ValueName is missing or cannot be read."
    exit 1
}

and the remedetion script is :

$RegistryPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0"
$ValueName = "BlockNtlmv1SSO"
$RequiredValue = 0

try {
    if (-not (Test-Path -Path $RegistryPath)) {
        New-Item `
            -Path $RegistryPath `
            -Force `
            -ErrorAction Stop | Out-Null
    }

    New-ItemProperty `
        -Path $RegistryPath `
        -Name $ValueName `
        -PropertyType DWord `
        -Value $RequiredValue `
        -Force `
        -ErrorAction Stop | Out-Null

    $VerifiedValue = Get-ItemPropertyValue `
        -Path $RegistryPath `
        -Name $ValueName `
        -ErrorAction Stop

    if ($VerifiedValue -eq $RequiredValue) {
        Write-Output "Successfully configured $RegistryPath\$ValueName as $RequiredValue."
        exit 0
    }

    Write-Error "Registry value verification failed."
    exit 1
}
catch {
    Write-Error "Failed to configure the registry value: $($_.Exception.Message)"
    exit 1
}

And there was much rejoicing (yaaaaaaaay)

https://www.xda-developers.com/as-microsoft-kills-off-publisher-libreoffice-steps-in-with-free-support-for-your-pub-files/?link_source=ta_first_comment&taid=6acfd14a02c21c0001a241d6

During failover of a MS SQL Failover Cluster I got this message in the event log. The failover itself completed but in the logfile i found this error which occured during failover:

ERR [RES] File Share <SQL Server FILESTREAM share (MSSQLSERVER)>: Error removing share 'MSSQLSERVER'. Error 2310.

The share in the failover cluster manager looks like that:

Name, Path, Protocol, Continous Availability, Remarks

MSSQLSERVER, \\?\GLOBALROOT\Deive\RsFx0700\<localmachine>\MSSQLSERVER,SMB,No,SQL Server FILESTREAM share

Does anyone know if this error is serious? Iam trying to reduce failover time.

Forgive me if this is a stupid question and feel free to flame me. I have been aware of MS trying to get rid of NTLM for some time. But I got thrown into Radius recently and I'm still learning it. I'm trying to figure if this update will kill my use case.

We use Absolute Secure Access with Radius. The machine authentication is done via certificate. No issues there. For user authenication we use the EAP type of Microsoft Protected EAP (PEAP) which indicates in the properties Secured Password (EAP-MSCHAP v2). I'm not clear on the Redit chatter that I have read if that is affected at the moment.

Before someone suggests EAP-TLS for user authentication, we would love to use EAP-TLS, but that will not work. The user needs the user cert to authenticate with EAP-TLS. Since the VPN will not pass traffic until it sees the user cert, the machine cannot get group policy to pull the user cert. The only suggestion the vendor had was let everyone pull the user cert then engage EAP-TLS. The users may use various shared computers logging in with their AD credentials. Then you have the issues of new users. Not going to work. SAML is an option but the user friction will be an issue. That requires a user to log in with their AD credentials. Then a SAML box pops up to type in the credentials again. This may be the way we have to go eventually or move to another product.

Any input is appreciated

Hello guys and gals,

I want to change the standard setup for my company.

Now: 3x 1080p@60Hz, baseus docking station, Lenovo laptop

Future: 3x 1440@60Hz, Lenovo docking station, Lenovo laptop

Is the Universal USB-C Docking suitable for that or do I need the Universal Thunderbolt 4 Dockingstation?

I cannot find a 100% accurat anwer.

I could just order one but maybe someone has this setup.

Thanks a lot.