Hey everyone,

Running into a frustrating issue with the Akamai Guardicore Platform Agent (GPA / EAA client) on macOS.

Whenever I authenticate via our IdP (whr.login.go.akamai-access.com), the client authenticates successfully, but the Quick Test in Diagnostics fails at the Configuration Check stage with this exact error:

"Access - No configuration found for Device Posture - User needs to login to a Device Posture enabled IdP"

Because of this, my application list remains blank and internal routing to specific subnets fails. I've tried resetting authentication, force-syncing client config, checking macOS local network permissions, and switching the default browser to Chrome, but the posture token/profile still won't seed.

Has anyone run into this specific device posture block on macOS? Is this strictly an MDM/EPMS policy assignment issue on the Akamai control center side, or is there a local cache file I need to clear?

Any tips would be greatly appreciated!

Not unique to our field, but I genuinely really enjoyed this job. It was fully remote, paid well, my boss was a true sysadmin in that as long as I got my work done he didn’t care how I spent my time. I had near full autonomy. Minimal meetings. It was 14 months of the IT job I’d always dreamed of.

My boss resigned earlier this week; the company was going in a direction he didn’t agree with and they were expecting him to fudge the attestation of some compliance reports. With him gone, upper management decided to include our department in the wave of layoffs rather than find a replacement for my boss.

So today I got the calendar invite for a five minute meeting. Exec read the script in 60 seconds flat and sent me on my way. Currently waiting on a follow up email to see if I get a severance or not (please god). Spent the afternoon updating my resume and filling out applications.

I’m bummed. But life goes on. Hopefully I’ll find a similar job (and soon)!

Hi guys, I got a bit frustated with mRemoteNG and Terminals 4.0.1 and decide to build my own tool.

Do we have any good tool in the market now to replace these both?

Hybrid join devices - we removed all office related settings from GPOs and configured those via config.office.com. I can see cloud policies entries in registry but they don’t seem to apply or they apply only when I remove office keys from registry but then will stop applying when I do a gpupdate. Things like macro, active x settings are not grayed out like they were with GPOs. I’ve ran rsop and manually looking at policies keys in registry, I don’t see any office related settings from GPOs, seems like office is ignoring cloud policies. I was going to import admx templates in intune and configure intune policies but the office admx is too big and intune won’t import it. Am I doing something wrong ? We still manage windows settings via GPOs since we’re still in process to migrate all settings in intune but nothing related to office. We plan on moving to entra join soon which is why we want all policies in intune or config office.
What’s the best practice with m365 office to enforce specific settings so users can’t change things like macros, protected view, etc nowadays ?

OK. That's not entirely true.

We allow Salesforce's ~13,000 users to send emails out of Exchange Online. We also temporarily allowed some accounting software used by three people at a company we acquired, while we wait for them to onboarded onto SAP. And we allow Power Automate to send emails through Exchange Online.

We also have some internal IT automation that has permission, but scoped through ExO RBAC to dedicated mailboxes, and we have mail flow rules to prevent those mailboxes from sending emails to externals.

For everything else, we have published policies that state that requests for Mail.Send permissions have a 100% rejection rate.

If an internally hosted application needs to send emails, we provide an internal SMTP relay. If a cloud application needs to send emails, and it cannot do so natively, we provide a cloud SMTP relay. Many internal applications and every cloud application gets its own dedicated sending subdomain so we know which application sent the mail. In the case of larger cloud applications, they get dedicated IPs to help with sender reputation isolation.

Our reasoning for this policy, I think, it quite varied:

• We have limited monitoring of Exchange activities performed by external applications; we have our OfficeActivity logs passed through Sentinel and into Log Analytics, but we lack the resource or in-house knowledge to actively review these logs, or develop monitoring and detection systems to identify and alert for abnormal sending patterns.
  
• Because of this, in the event of a misconfiguration o the cloud application, or third-party application compromise, we are not sure we would be able to detect and respond to it in a reasonable time frame.
  
• The policies and controls we have in place help us identify which emails came from which application, and provide sender reputation isolation; sending through Exchange Online using our internal mail domains bypasses these controls.
  
• Emails sent through these systems would also bypass our inbound mail-security stack. Incoming emails are checked by our secure email gateway, while a second API-based tool checks emails in mailboxes post-delivery, but this tool does not have automatic remediation active for internal domains.
  
• From a compliance and audit perspective, at least where application permissions are granted, it can cause challenges in identifying who actually triggered the sending of the email from the third-party application.
  
• We have employees in over 100 countries and, with quite a decentralised IT operation model. If we permit Mail.Send permissions for one local application, it makes it harder to reject similar requests elsewhere. We could effectively find ourselves opening pandora's box.

And that last point is why we basically have a zero-exception policy in place and have put time and effort into providing alternatives. We don't prevent cloud applications from sending emails. We just don't allow it to happen through Exchange Online.

How do the rest of you handle this? Do you allow cloud applications to have Mail.Send permissions in your environment? And, if you do, would you prefer it if you didn't?

Title pretty much says it all. Spiceworks cloud is awful, and i'm looking for a free, modern alternative to what Spiceworks Desktop has.

My main problem is that even though i managed to save the executable, Spiceworks Desktop makes connections to a now shut down server, as well as calls to their spiceworks accounts.

This means that changing my email address associated with the spiceworks desktop installations i've got appear to be impossible, so now an outdated email address is being looped in on every ticket and i can't seem to figure out how to update that address without desktop being able to connect to the internet.

I use the inventory system a lot. like, a LOT. so any replacements would have to be able to handle obtaining the kind of info that Spiceworks Agents relayed to Desktop.

if no one has a modern alternative, i imagine my only real choice would be to try to utilize AI to examine the possibility of modifying my installations to fit my needs.

i really dislike the idea of doing that, so here's hoping some of you sysadmins have some recommendations.

End goal will be to update at least 1 desktop instance with something feature equivalent to allow me to change my email address and stop requirements for connecting to spiceworks servers, and to also allow a fresh install locally for my own use.

thanks in advance!

With BC getting rid of daylight savings time, there is a new time zone just for BC called "Pacific Time" which is UTC-07:00.
After switching several different Windows computers to this new time zone though, GMail is showing incorrect time stamps by an entire hour on all sent/received email despite Windows showing the correct time. The problem is present in both Chrome and Firefox.
The problem is also present in both Google Workspace and regular plain personal Gmail accounts.
Switching the computers back to UTC-08:00 with DST turned on fixes it, but in a couple of weeks that will result in the computers showing the wrong time.
Is anyone else seeing this with the new BC time zone?

I've searched high and low, and just cannot figure this out. I have an email address (in /etc/aliases which is read by EXIM4) that I used at a DNS registrar that published all of my account information. So, of course, the 87 million spammers out there now have this email address. I've removed it from /etc/aliases, commented it out, put it back and then changed forwarding to another account as well as /dev/null. If I do ANY of these things to ANY other account in that aliases file, mail no longer gets delivered. Does anybody have any idea why this ONE email alias that all the goddamn SPAMMERs have will not just go the hell away? Almost half of the spam I get is to this one email address, and that's in the tens of thousands of messages every year.

EDIT SOLVED:
OMFG!!! I had a *second* alias with half of the name spelled with CaPiTaL letters (e.g. GODaddy***, instead of godaddy). Thank gods I used grep -i instead of just grep!! This has been niggling my soul for YEARS! Thanks to everyone who pushed me to finally resolve this idiocy. (mine, in this case! :-p )

Thank you, kind sysadmins! Sometimes just asking the question, and getting some positive feedback is all it takes to solve a DECADES old problem. :-) <3

There are going to be a LOT of evil spammers crying in their milk for the next several months. I hope they suffer from the FLOOD of bouncing spam. hehehehe

***I am convinced that Bob, the diehard Christian founder of GODaddy, deliberately spelled it that way because he wanted to be the GOD of all addresses on the Internet, but spoke it as GOdaddy, so as not to alienate non-God people. ¯_(ツ)_/¯ I may be wrong, but I'm sticking with that theory...but NOT spelling anything with CAps again in a config file!

My team is currently looking for a replacement for GoPrint. All of IT and most of staff are tired of it. A team member found and started looking into WEPA Print Away. I guess their system consists of print kiosks. Students would sign in via computer, mobile app, etc and release print jobs kind of like PaperCut or any other secure print service. WEPA sounds a little on the pricey side but they take care of all maintenance and consumables except paper and monitor their kiosks 24/7 they said.

Does anyone have experience with them? What do you guys use as a print solution?

Edit: I should probably specify that we do use Papercut for Staff but GoPrint for students as I'm thinking at the time, it was probably the best solution for charging students.

Right out of college I started working at a major insurance company helping them prep for Y2K and worked my way up as high as one could go without being in management. I loved digging into the details and figuring things out. I worked overtime and volunteered for any project. As the years went by and we were sold and then sold again to private investors, my interest waned and management progressively got worse. Now it’s the age of AI and I am staunchly anti-AI. We were mandated to use it for our job duties and mgmt tracked our usage. Scolded or written up if we didn’t use it enough.

Due to my seniority I was able to work remote for several years prior to COVID and then during COVID everyone got to work remote. You know where this is going - now it’s return to the office time as well as mandating the specific days for in-person days. Unrealistic deadlines for complex projects are set by out of touch upper mgmt with no concept of the scope.

I’ve saved money and have nice investments as well as passive income. It was time to go. Years ago I told myself I’d love to retire at the age of 50 and I’ve finally realized my dream. Zero notice given and zero regrets. I feel so good. Goodbye to IT.

Advice to young people just starting out: word hard, save your money and make good investments. Retire early and enjoy your life.

So, you knew I was going to ask some crazy questions.

Basically, a computer could no longer contact the domain controller, and the usual fixes weren’t working. What eventually worked is we connected to the VPN, and THEN it joined the domain.

Probably the most important detail that I’m sketchy on is the other sysadmin did something in Powershell - Set-DNS something to the primary DNS server.

Upon restart, there was no network connection.

I logged in as local admin, and connected to the VPN. Then I logged in successfully as the main computer user.

But I can no longer connect to the work network, and it is a straight Ethernet connection, except by connecting to the VPN.

My suspicion is the other sysadmin fiddled with the DNS settings, but I can’t be sure.

Has anyone ever heard of this? If only I had paid attention to the command he used. Should I be looking at something simple like network connection properties. I enabled IPv6, and it didn’t help.

Seeing more people build little internal tools with Claude, Cursor, Lovable and share them via links. Is this showing up at your org too? Do you know which ones exist, who owns them, or what data they touch? How are you handling it? Tbh it feels like everyone is building apps now and not able to keep up with it😭 It’s so annoying

Hello All

I'm installing a program for my controls department. The program is "KMC Connect", with it comes a sub-program utility that comes bundled with the software.

The sub-program utility in this case is , "Configure BACstat". The program only shows up when logged into as a local admin but when I'm logged into a standard user account (the technician who will be using this account). The program is not available.

I don't want to give the user local admin rights to run the program.

Is the only solution to make the user a local admin?

I've been banging my head against this all day. Granted, it's been a few months since I've last created a VM as we've been relatively stable, but today a request came in for 1. Upon adding the template and setting the unattend configs, the job starts. The template uploads successfully, but as soon as it tries to upload the iso file with the unattend file contained, it errors out, and ultimately, the BITS service throws a 500 error every time the host's agent tries to connect to download the file.

After updating SCVMM 2025 to latest, ensuring TLS 1.2 was enabled, rebooting the host and VMM server, I'm at a loss. Event logs show:

Id          : 61


Message     : BITS stopped transferring the 51c104ca66f02c7cc1d873ffa057a14a383ffefe transfer job that is associated


              with the https://(redacted)/51c104ca66f02c7cc1d873ffa057a14a383ffefe/C:A5cPr


              ogramDataA5cMicrosoftA5cVirtual Machine ManagerA5c346465d9-6559-4aed-b8fa-1bb242450905A5cAA01-MD-MCP.iso/


              C:A5cClusterStorageA5cvm_dataA5cAA01-MD-MCP-4A5cAA01-MD-MCP.iso URL. The status code is 0x801901F4.

8 hours later, AI has given me no better advice than to "open a Microsoft Case" but before I go down that rabbit hole, has anyone seen any issues like this recently?

EDIT: I uninstalled the October 2026 windows updates and the issue resolved. Of course windows updates broke it.

We bough several new servers last month. Today I racked over $60 grand (USD) worth of hardware. Probably closer to $70 Grand... It was only 3 servers.... 5 years ago, it was only around 20k. It's crazy....

Now to throw down with the boss on not putting VMWare on them. As much as I can anyway

During failover of a MS SQL Failover Cluster I got this message in the event log. The failover itself completed but in the logfile i found this error which occured during failover:

ERR [RES] File Share <SQL Server FILESTREAM share (MSSQLSERVER)>: Error removing share 'MSSQLSERVER'. Error 2310.

The share in the failover cluster manager looks like that:

Name, Path, Protocol, Continous Availability, Remarks

MSSQLSERVER, \\?\GLOBALROOT\Deive\RsFx0700\<localmachine>\MSSQLSERVER,SMB,No,SQL Server FILESTREAM share

Does anyone know if this error is serious? Iam trying to reduce failover time.

If Active Directory, Entra ID, or identity security is part of your day job, the r/ActiveDirectory community is running two free events over the next few weeks. Nothing sold, nothing pitched, just identity engineers and sysadmins sharing and talking.

Tomorrow: Community Q&A

Drop into the Discord, ask whatever's on your mind, or just lurk. No registration needed.

When: October 16, 2026 @ 10:00 CT (UTC-5) / 15:00 UTC - 60 minutes

Where: Horizon Secured Discord - https://discord.gg/mVFquFqpsW

November Active Directory Community Virtual Meetup - November 3rd

The more structured one. Panelists lead a discussion on a few prepared topics, then it opens up for questions.

When: Tuesday, November 3, 2026 @ 10:00 CT (UTC-6) / 16:00 UTC - 90 minutes

Register (free): https://events.humanitix.com/active-directory-community-virtual-meetup-4-november-2026

Can't make it? Recordings go up on YouTube: https://youtube.com/@ActiveDirectoryCommunity

I recenty joined this org and we have 20+ employess, using systems with win 11 home, my manger wants me upgrade them to pro and add admin accounts in them. We have Volume license upgrade key, we don't have intune as part of our licensing (Basic Tier), so I would like advice on the best approach to manage this transition:

1.Upgrade Windows 11 Home to Pro using our volume licensing key.

2.Create work accounts or profiles for employees on their devices.

3.setup admin accounts

4.Migrate existing user profiles and data to the new work accounts while preserving their files, settings, and applications where possible.

TIA

Curious to hear other people's experiences

I'm at a point in my career where the compensation is decent, and I have enough experience that I wouldn't want to move somewhere just for the sake of moving. However, I'm starting to question whether staying in my current position is the best long-term decision.

The role has gradually evolved, and I've gained experience with many different things. At the same time, I'm not entirely sure the direction I'm heading in is where I want to be a few years from now.

I've casually explored the job market, but most opportunities I've found seem to involve a trade-off: lower pay, less interesting work, less responsibility, or a move that doesn't necessarily feel like career progression.

It's hard to tell whether I'm too comfortable where I am or whether leaving would be a bad move in the current market.

For those who have been in a similar position:

How do you know when you've outgrown a role versus when you're just going through a frustrating period?

Would you stay somewhere that pays well but has questionable long-term prospects?

At what point would you prioritize career growth over compensation?

If external opportunities aren't particularly appealing, would you stay put and keep looking, or take a calculated risk on a different role?

Interested in hearing from people who've dealt with this, particularly experienced sysadmins and infrastructure professionals. How did things turn out for you?

My employer has recently decided to hire a new IT support person for our helpdesk; I found the position on indeed and was surprised to see the top of the pay range is about $10k more than I am currently making.

I have taken every challenge on headfirst and really grown our current IT department. However, I do not know how to bring up the subject of a raise/increase. Should I send an email to my boss or have an in-person conversation? They have me reviewing resumes for this position that could potentially pay more than mine, and its rubbing me the wrong way.

My motto for the last 10 years has been "why can't the packets just get there. Why can't they get where I want them to go so I can move on with my life?!"

My network skills are at passable for a technician level and just below engineer level, depending on the brand, because I simply do not care about networking.

So I got sent out to an MSP customer's office for the 2nd day in a row to solve an IP phone problem; my other favorite field of IT. They were getting voice drops and cut outs. Probably the coiled up 85 feet of ethernet that looks like it was in a war, clamped together with bread twist ties. I AM NOT KIDDING. I put in a brand new 10 footer and do a test call and leave.

Same problem 2 hours later. So I'm there this morning. Replace the phone entirely. Didn't work. Phone on a different ethernet port - nope. Put my laptop to the ethernet and I get 90% bandwidth and 19ms pings. We do a test call, phone never rings but does immediately tell us there's a missed call and a voicemail about 1ms after hanging up.

The Firewall was patched from 7.2 to 7.6 family firmware a few weeks ago and AI is telling me it's probably UDP packet routing. That makes sense. I change a few settings that it suggests that vaguely sound right to me like not allowing UDP port changes within a stream, verified timeout was an hour, verified there was no packet inspection on that port, etc. Still can't get it. I find out they never told me but other people are having similar but not identical phone problems. Her phone is now showing that 5 lines that don't exist are all ringing and they perpetually ring indefinitely. I report it to our more networking guy as a firewall problem and tell them go onsite and call support.

He gets onsite today to take a look. He plugs the phone into the firewall directly and it gets calls, makes calls, etc. Their switch is taking UDP packets and just rolling a D20 and anything under the difficulty class check gets thrown into another universe via quantum tunneling leprechaun magic. If you're about to say "that's probably not what it's doing," fucking prove it. You can't. I can't either. You don't know there's not leprechauns inside the switch. All I know is we're requesting approval for a new switch. No idea what model, age, or brand it is btw but based on that customer, it's probably older than I am.

I fucking hate networking so damn much. Why can't the damn packets just go where they're supposed to?! This office location has about 6 computers and 4 phones. For fuck's sake, what kind of switch can't handle that?!

For context, boss says he needs two backups of all data prior to a certain date and post a certain date. We are on premium.

Tried to explain that I’m not sure this is possible.

We currently don’t even pay for a backup tool! (Requested multiple times)

Don’t even know how to begin approaching this.

I have a few PCs that are used 24/7 in our org. I would say maybe 5-10 users a day on the PCs. They are always having issues with RAM because users just lock the PC and don't sign out.

Prev sysadmin would just scold them for not signing out, but I'm tired of the amount of people emailing me about how the pc is slow and their apps are crashing.

I'm wondering if there is a policy that makes it so if a user logs out, and is logged out for x amt of time, it will fully sign them out. And if that would have any effect on the next user who is currently using the PC, they wouldn't be signed out, correct?

The prev sysadmin did not enable Shared PC mode on these devices too, which is causing a lot of issues with storage. I'm not sure if this is something we can even implement in our org because we use JumpCloud and not AD/Intune and everyone syncs their files via OneDrive.

Any other little QOL policies or registries I can implement would be great. I've enabled a few things like Storage Sense to free up actual storage on the device. And by default to save things to OneDrive.

Hey guys,

Like many of us here, we’re currently looking at our options with the whole Broadcom/VMware situation, and OpenStack is high on our list. Right now, we’re running a fairly heavy VMware setup including NSX for networking/microsegmentation.
Before we start ripping things out and planning the architecture, I’d love to hear from anyone who has actually made this exact leap—or even tried and backed out during a PoC.

How was the transition on the networking side moving from NSX to OVN/Neutron? Did you end up missing features like NSX’s distributed firewalling or advanced routing, or does OVN cover most of the day-to-day needs without too much friction?

Also, how did you handle the actual VM migration? Did you rely on automated tools for warm migrations, or was it easier to just rebuild workloads natively in OpenStack?

Operationally, how brutal was the learning curve for your team, and what were the biggest unexpected gotchas or regrets along the way?

Would really appreciate any insights, tool recommendations, or war stories you guys can share.

Thanks!