Right out of college I started working at a major insurance company helping them prep for Y2K and worked my way up as high as one could go without being in management. I loved digging into the details and figuring things out. I worked overtime and volunteered for any project. As the years went by and we were sold and then sold again to private investors, my interest waned and management progressively got worse. Now it’s the age of AI and I am staunchly anti-AI. We were mandated to use it for our job duties and mgmt tracked our usage. Scolded or written up if we didn’t use it enough.

Due to my seniority I was able to work remote for several years prior to COVID and then during COVID everyone got to work remote. You know where this is going - now it’s return to the office time as well as mandating the specific days for in-person days. Unrealistic deadlines for complex projects are set by out of touch upper mgmt with no concept of the scope.

I’ve saved money and have nice investments as well as passive income. It was time to go. Years ago I told myself I’d love to retire at the age of 50 and I’ve finally realized my dream. Zero notice given and zero regrets. I feel so good. Goodbye to IT.

Advice to young people just starting out: word hard, save your money and make good investments. Retire early and enjoy your life.

Not unique to our field, but I genuinely really enjoyed this job. It was fully remote, paid well, my boss was a true sysadmin in that as long as I got my work done he didn’t care how I spent my time. I had near full autonomy. Minimal meetings. It was 14 months of the IT job I’d always dreamed of.

My boss resigned earlier this week; the company was going in a direction he didn’t agree with and they were expecting him to fudge the attestation of some compliance reports. With him gone, upper management decided to include our department in the wave of layoffs rather than find a replacement for my boss.

So today I got the calendar invite for a five minute meeting. Exec read the script in 60 seconds flat and sent me on my way. Currently waiting on a follow up email to see if I get a severance or not (please god). Spent the afternoon updating my resume and filling out applications.

I’m bummed. But life goes on. Hopefully I’ll find a similar job (and soon)!

We bough several new servers last month. Today I racked over $60 grand (USD) worth of hardware. Probably closer to $70 Grand... It was only 3 servers.... 5 years ago, it was only around 20k. It's crazy....

Now to throw down with the boss on not putting VMWare on them. As much as I can anyway

User said they forgot their password.

I offered them to change it.

They accepted.

I told them to note their new password.

They said it's done.

I am now waiting for them to change it.

Few minutes later, another user messaged me saying that the password I gave (they wrote it plain to me, meaning they now know the password of another user) is not working.

They sent me the password they tried. The user noted the password without noting the uppercases and mixed the numbers.

I love my blue collar users.

My employer has recently decided to hire a new IT support person for our helpdesk; I found the position on indeed and was surprised to see the top of the pay range is about $10k more than I am currently making.

I have taken every challenge on headfirst and really grown our current IT department. However, I do not know how to bring up the subject of a raise/increase. Should I send an email to my boss or have an in-person conversation? They have me reviewing resumes for this position that could potentially pay more than mine, and its rubbing me the wrong way.

OK. That's not entirely true.

We allow Salesforce's ~13,000 users to send emails out of Exchange Online. We also temporarily allowed some accounting software used by three people at a company we acquired, while we wait for them to onboarded onto SAP. And we allow Power Automate to send emails through Exchange Online.

We also have some internal IT automation that has permission, but scoped through ExO RBAC to dedicated mailboxes, and we have mail flow rules to prevent those mailboxes from sending emails to externals.

For everything else, we have published policies that state that requests for Mail.Send permissions have a 100% rejection rate.

If an internally hosted application needs to send emails, we provide an internal SMTP relay. If a cloud application needs to send emails, and it cannot do so natively, we provide a cloud SMTP relay. Many internal applications and every cloud application gets its own dedicated sending subdomain so we know which application sent the mail. In the case of larger cloud applications, they get dedicated IPs to help with sender reputation isolation.

Our reasoning for this policy, I think, it quite varied:

• We have limited monitoring of Exchange activities performed by external applications; we have our OfficeActivity logs passed through Sentinel and into Log Analytics, but we lack the resource or in-house knowledge to actively review these logs, or develop monitoring and detection systems to identify and alert for abnormal sending patterns.
  
• Because of this, in the event of a misconfiguration o the cloud application, or third-party application compromise, we are not sure we would be able to detect and respond to it in a reasonable time frame.
  
• The policies and controls we have in place help us identify which emails came from which application, and provide sender reputation isolation; sending through Exchange Online using our internal mail domains bypasses these controls.
  
• Emails sent through these systems would also bypass our inbound mail-security stack. Incoming emails are checked by our secure email gateway, while a second API-based tool checks emails in mailboxes post-delivery, but this tool does not have automatic remediation active for internal domains.
  
• From a compliance and audit perspective, at least where application permissions are granted, it can cause challenges in identifying who actually triggered the sending of the email from the third-party application.
  
• We have employees in over 100 countries and, with quite a decentralised IT operation model. If we permit Mail.Send permissions for one local application, it makes it harder to reject similar requests elsewhere. We could effectively find ourselves opening pandora's box.

And that last point is why we basically have a zero-exception policy in place and have put time and effort into providing alternatives. We don't prevent cloud applications from sending emails. We just don't allow it to happen through Exchange Online.

How do the rest of you handle this? Do you allow cloud applications to have Mail.Send permissions in your environment? And, if you do, would you prefer it if you didn't?

This is just a warning incase you guys haven't seen it yet:

https://techcommunity.microsoft.com/blog/exchange/released-october-2026-exchange-server-security-updates/4563014

Update October 15, 2026: We have received reports indicating that installation of October 2026 updates for Windows Server - KB5126646 (Windows Server 2025), KB5126655 (Windows Server 2022) or KB5126651 (Windows Server 2019) - can cause Exchange Server OWA to fail with an error MapiExceptionMdbOffline: Unable to make connection to the server. (hr=0x80004005, ec=1142) with event ID 1006 logged in the Application Log, as well as growing email queues. Installation of October 2026 Exchange updates is not required for issues to occur. We are investigating this with our Windows partners.

The scariest part of this is the note: "Installation of October 2026 Exchange updates is not required for issues to occur. We are investigating this with our Windows partners." Good luck, have fun.

Rebooting the mailbox server in our case restored mail flow and OWA but I am guessing that is a temporary fix.

This is kind of a terrible issue because Outlook was acting like everything was perfectly normal and you didn't get the normal "user screaming at your because outlook doesnt work".

And there was much rejoicing (yaaaaaaaay)

https://www.xda-developers.com/as-microsoft-kills-off-publisher-libreoffice-steps-in-with-free-support-for-your-pub-files/?link_source=ta_first_comment&taid=6acfd14a02c21c0001a241d6

For context, boss says he needs two backups of all data prior to a certain date and post a certain date. We are on premium.

Tried to explain that I’m not sure this is possible.

We currently don’t even pay for a backup tool! (Requested multiple times)

Don’t even know how to begin approaching this.

I have used tools to get recommendations for AD hardening, but not as clear cut for Entra. What have you used for that that have been helpful beyond Entras built in advisor?

I've searched high and low, and just cannot figure this out. I have an email address (in /etc/aliases which is read by EXIM4) that I used at a DNS registrar that published all of my account information. So, of course, the 87 million spammers out there now have this email address. I've removed it from /etc/aliases, commented it out, put it back and then changed forwarding to another account as well as /dev/null. If I do ANY of these things to ANY other account in that aliases file, mail no longer gets delivered. Does anybody have any idea why this ONE email alias that all the goddamn SPAMMERs have will not just go the hell away? Almost half of the spam I get is to this one email address, and that's in the tens of thousands of messages every year.

EDIT SOLVED:
OMFG!!! I had a *second* alias with half of the name spelled with CaPiTaL letters (e.g. GODaddy***, instead of godaddy). Thank gods I used grep -i instead of just grep!! This has been niggling my soul for YEARS! Thanks to everyone who pushed me to finally resolve this idiocy. (mine, in this case! :-p )

Thank you, kind sysadmins! Sometimes just asking the question, and getting some positive feedback is all it takes to solve a DECADES old problem. :-) <3

There are going to be a LOT of evil spammers crying in their milk for the next several months. I hope they suffer from the FLOOD of bouncing spam. hehehehe

***I am convinced that Bob, the diehard Christian founder of GODaddy, deliberately spelled it that way because he wanted to be the GOD of all addresses on the Internet, but spoke it as GOdaddy, so as not to alienate non-God people. ¯_(ツ)_/¯ I may be wrong, but I'm sticking with that theory...but NOT spelling anything with CAps again in a config file!

With increasing discussions around digital sovereignty at my workplace, I'm wondering whether fellow EU sysadmins have ever attempted a PoC for an IT environment that avoids US technology altogether.

Has anyone successfully identified viable alternatives for components such as:

• Endpoint operating systems (e.g. Windows)
• Endpoint management (e.g. Intune, SCCM)
• Identity and access management (e.g. Active Directory, Entra ID)
• Endpoint security (e.g. Defender)
• Productivity and collaboration suites (e.g. Microsoft 365)

What did your architecture look like, and where did you run into challenges?

I'm particularly interested in real-world experiences, lessons learned, and whether you felt such an environment could realistically move beyond the PoC stage.

My boss got the email from Verizon yesterday afternoon that makes it official, they're shutting down vtext totally on 3/31/27 and they say that "some senders may lose access to legacy email-to-text prior to that date."

We use their email to text for a lot of our notifications and alerts.

Does anyone have an actual replacement for vtext that you're actually using and works the same way? We definitely want email to text, not push notifications from an app. Thanks.

Hybrid join devices - we removed all office related settings from GPOs and configured those via config.office.com. I can see cloud policies entries in registry but they don’t seem to apply or they apply only when I remove office keys from registry but then will stop applying when I do a gpupdate. Things like macro, active x settings are not grayed out like they were with GPOs. I’ve ran rsop and manually looking at policies keys in registry, I don’t see any office related settings from GPOs, seems like office is ignoring cloud policies. I was going to import admx templates in intune and configure intune policies but the office admx is too big and intune won’t import it. Am I doing something wrong ? We still manage windows settings via GPOs since we’re still in process to migrate all settings in intune but nothing related to office. We plan on moving to entra join soon which is why we want all policies in intune or config office.
What’s the best practice with m365 office to enforce specific settings so users can’t change things like macros, protected view, etc nowadays ?

Hey everyone,

Running into a frustrating issue with the Akamai Guardicore Platform Agent (GPA / EAA client) on macOS.

Whenever I authenticate via our IdP (whr.login.go.akamai-access.com), the client authenticates successfully, but the Quick Test in Diagnostics fails at the Configuration Check stage with this exact error:

"Access - No configuration found for Device Posture - User needs to login to a Device Posture enabled IdP"

Because of this, my application list remains blank and internal routing to specific subnets fails. I've tried resetting authentication, force-syncing client config, checking macOS local network permissions, and switching the default browser to Chrome, but the posture token/profile still won't seed.

Has anyone run into this specific device posture block on macOS? Is this strictly an MDM/EPMS policy assignment issue on the Akamai control center side, or is there a local cache file I need to clear?

Any tips would be greatly appreciated!

Forgive me if this is a stupid question and feel free to flame me. I have been aware of MS trying to get rid of NTLM for some time. But I got thrown into Radius recently and I'm still learning it. I'm trying to figure if this update will kill my use case.

We use Absolute Secure Access with Radius. The machine authentication is done via certificate. No issues there. For user authenication we use the EAP type of Microsoft Protected EAP (PEAP) which indicates in the properties Secured Password (EAP-MSCHAP v2). I'm not clear on the Redit chatter that I have read if that is affected at the moment.

Before someone suggests EAP-TLS for user authentication, we would love to use EAP-TLS, but that will not work. The user needs the user cert to authenticate with EAP-TLS. Since the VPN will not pass traffic until it sees the user cert, the machine cannot get group policy to pull the user cert. The only suggestion the vendor had was let everyone pull the user cert then engage EAP-TLS. The users may use various shared computers logging in with their AD credentials. Then you have the issues of new users. Not going to work. SAML is an option but the user friction will be an issue. That requires a user to log in with their AD credentials. Then a SAML box pops up to type in the credentials again. This may be the way we have to go eventually or move to another product.

Any input is appreciated

Title pretty much says it all. Spiceworks cloud is awful, and i'm looking for a free, modern alternative to what Spiceworks Desktop has.

My main problem is that even though i managed to save the executable, Spiceworks Desktop makes connections to a now shut down server, as well as calls to their spiceworks accounts.

This means that changing my email address associated with the spiceworks desktop installations i've got appear to be impossible, so now an outdated email address is being looped in on every ticket and i can't seem to figure out how to update that address without desktop being able to connect to the internet.

I use the inventory system a lot. like, a LOT. so any replacements would have to be able to handle obtaining the kind of info that Spiceworks Agents relayed to Desktop.

if no one has a modern alternative, i imagine my only real choice would be to try to utilize AI to examine the possibility of modifying my installations to fit my needs.

i really dislike the idea of doing that, so here's hoping some of you sysadmins have some recommendations.

End goal will be to update at least 1 desktop instance with something feature equivalent to allow me to change my email address and stop requirements for connecting to spiceworks servers, and to also allow a fresh install locally for my own use.

thanks in advance!

We have encountered cases where users who have installed the October 2026 update fail to connect to our company Wi-Fi, which uses Aruba access points.

So far, our workaround has been to forget the company Wi-Fi network and reconnect by entering the user credentials again.

According to our vendor, there is an issue with authentication to the RADIUS server after the latest Microsoft security update is installed.

Is anyone else experiencing this issue?

The specific update is October 13, 2026—KB5127648 (OS Builds 26300.9711, 26200.9711, and 26100.9711)

Curious to hear other people's experiences

I'm at a point in my career where the compensation is decent, and I have enough experience that I wouldn't want to move somewhere just for the sake of moving. However, I'm starting to question whether staying in my current position is the best long-term decision.

The role has gradually evolved, and I've gained experience with many different things. At the same time, I'm not entirely sure the direction I'm heading in is where I want to be a few years from now.

I've casually explored the job market, but most opportunities I've found seem to involve a trade-off: lower pay, less interesting work, less responsibility, or a move that doesn't necessarily feel like career progression.

It's hard to tell whether I'm too comfortable where I am or whether leaving would be a bad move in the current market.

For those who have been in a similar position:

How do you know when you've outgrown a role versus when you're just going through a frustrating period?

Would you stay somewhere that pays well but has questionable long-term prospects?

At what point would you prioritize career growth over compensation?

If external opportunities aren't particularly appealing, would you stay put and keep looking, or take a calculated risk on a different role?

Interested in hearing from people who've dealt with this, particularly experienced sysadmins and infrastructure professionals. How did things turn out for you?

Hey guys, I’ve recently taken over the role of sys admin in the company I’ve been working for as an operations admin for the past year. I’m implementing a series of changes, processes, policies and trying to structure our Microsoft environment, our domains, back up solutions, company and vendor accounts, etcc

It’s been a bit of a journey and honestly I’m also learning things on the go especially when it comes to documenting changes and getting our employees to understand what’s to be implemented before pushing it ahead (this has saved me from a lot of trouble but at the same time has delayed things a lot because apparently people hate changes and having to make minimal effort)

But at the same time I’m still having to run the daily operations in the company which includes embedded generation applications, approvals, quoting some small service work calls, looking after the service jobs with our subcontractors, monitoring portals, liaising with the engineers and site managers before attending site, solving solar troubleshooting enquires etccc

So like im taking a new title as sys admin (still going to get this updated on my contract) but I still take to take care of the daily operations and often I don’t have time to do the sys admin stuff properly which means im doing that at home where I also don’t have a lot of time. And when trying to implement my changes in person our electricians and my manager etc are very impatient and if something doesn’t work straight away they just don’t want to spend the time on it. We have a new company CRM one of our employees is vibecoding and my manager and the CEOs wants to replace all of our paid software with that (for like scheduling, hse forms, worker register, claims, inductions, daily prestarts etc) and today my manager told me that the priority is to test the new vibe coded system (and by this he means tweaking it so it replicates what the other software do) as he would rather get this done first and is less worried about passwords, insinuating that all the IT stuff I am doing in this take over is just password resets 😭😭 This was shocking to me because after all the changes I’m implementing there’s no way this is the only thing that comes up on his mind, like if this was all IT did then the company wouldn’t have spent hundreds of dollars weekly on an external IT support vendor before I took over

Anyways, if anyone here is or has been in the same situation and has some advice for me/words of encouragement I’d really appreciate it

For context I’ve just turned 23 and like my job but I’m worried that im having to disregard our internal IT needs because if I cease to do the daily operation stuff this will affect the flow of the business. As a result, this makes me anxious because I know our necessities but don’t have the time to commit the way I desire . (We are still doing better than when the company was on the hands of the external IT vendor though so I guess that’s something to consider hehe

My team is currently looking for a replacement for GoPrint. All of IT and most of staff are tired of it. A team member found and started looking into WEPA Print Away. I guess their system consists of print kiosks. Students would sign in via computer, mobile app, etc and release print jobs kind of like PaperCut or any other secure print service. WEPA sounds a little on the pricey side but they take care of all maintenance and consumables except paper and monitor their kiosks 24/7 they said.

Does anyone have experience with them? What do you guys use as a print solution?

Edit: I should probably specify that we do use Papercut for Staff but GoPrint for students as I'm thinking at the time, it was probably the best solution for charging students.

Hello All

I'm installing a program for my controls department. The program is "KMC Connect", with it comes a sub-program utility that comes bundled with the software.

The sub-program utility in this case is , "Configure BACstat". The program only shows up when logged into as a local admin but when I'm logged into a standard user account (the technician who will be using this account). The program is not available.

I don't want to give the user local admin rights to run the program.

Is the only solution to make the user a local admin?

What's the motivation with the sysadmin who argues against best practices?

The guy who argues with other people against buying enterprise class hardware and he claims its cheaper to get computers at Best Buy.

The guy who is so proud of himself for buying IT supplies at Walmart.

The guy who argues a 3 year replacement cycle is totally unnecessary and argues it should be 5 years.

The guys who builds servers himself and keeps them under his desk and argues this is actually better and cheaper.

The guy who puts 96 gigs of RAM in the receptionist's computer since he argues then it won't have to be replaced for 20 years and is cheaper this way.

They're here and on every other forum and randomly rear their ugly heads. These guys are a small business owner's wet dream. They're so damn proud of their ideas and believe in them so strongly.

https://arstechnica.com/information-technology/2026/10/topgolf-saved-over-11-3-million-after-leaving-vmware/

A successful migration from VmWare. I hope it gives some hopes for those still stuck with them.