With increasing discussions around digital sovereignty at my workplace, I'm wondering whether fellow EU sysadmins have ever attempted a PoC for an IT environment that avoids US technology altogether.

Has anyone successfully identified viable alternatives for components such as:

• Endpoint operating systems (e.g. Windows)
• Endpoint management (e.g. Intune, SCCM)
• Identity and access management (e.g. Active Directory, Entra ID)
• Endpoint security (e.g. Defender)
• Productivity and collaboration suites (e.g. Microsoft 365)

What did your architecture look like, and where did you run into challenges?

I'm particularly interested in real-world experiences, lessons learned, and whether you felt such an environment could realistically move beyond the PoC stage.

What's the motivation with the sysadmin who argues against best practices?

The guy who argues with other people against buying enterprise class hardware and he claims its cheaper to get computers at Best Buy.

The guy who is so proud of himself for buying IT supplies at Walmart.

The guy who argues a 3 year replacement cycle is totally unnecessary and argues it should be 5 years.

The guys who builds servers himself and keeps them under his desk and argues this is actually better and cheaper.

The guy who puts 96 gigs of RAM in the receptionist's computer since he argues then it won't have to be replaced for 20 years and is cheaper this way.

They're here and on every other forum and randomly rear their ugly heads. These guys are a small business owner's wet dream. They're so damn proud of their ideas and believe in them so strongly.

User said they forgot their password.

I offered them to change it.

They accepted.

I told them to note their new password.

They said it's done.

I am now waiting for them to change it.

Few minutes later, another user messaged me saying that the password I gave (they wrote it plain to me, meaning they now know the password of another user) is not working.

They sent me the password they tried. The user noted the password without noting the uppercases and mixed the numbers.

I love my blue collar users.

And there was much rejoicing (yaaaaaaaay)

https://www.xda-developers.com/as-microsoft-kills-off-publisher-libreoffice-steps-in-with-free-support-for-your-pub-files/?link_source=ta_first_comment&taid=6acfd14a02c21c0001a241d6

We have encountered cases where users who have installed the October 2026 update fail to connect to our company Wi-Fi, which uses Aruba access points.

So far, our workaround has been to forget the company Wi-Fi network and reconnect by entering the user credentials again.

According to our vendor, there is an issue with authentication to the RADIUS server after the latest Microsoft security update is installed.

Is anyone else experiencing this issue?

The specific update is October 13, 2026—KB5127648 (OS Builds 26300.9711, 26200.9711, and 26100.9711)

Lately it's felt like every technical problem is so hard and I never have a straight answer for anyone. Maybe I just need to get better at communicating how IT works, but it feels like half the time I don't know why something happened or how to fix it. I've been in IT for 5 years and my current job has fewer easy wins (onboarding, tasks I've done before, etc). I'm migrating a client to 365 and it's been effortless because I've done it before, but when it comes to making our SharePoint site look better (how the hell did they make modern SharePoint *worse* than the 2010 version?), fixing intermittent printer issues, solving issues with other apps, Intune, etc. I just feel lost.

I know part of the solution is studying and I am getting a cert and doing a self study course for one of the softwares we use. But it just feels like there is no time and everything takes me forever. I end up asking my coworkers for help, making reddit and spice works posts, calling vendors for help, etc. I feel like I'm not doing enough work to justify my role and I feel behind on certs (this is my first one, I tried studying for the ccna but eventually gave up).

I'm honestly considering transitioning to something non technical or less technical, but my people skills aren't good enough for a lot of other roles (and trying to improve on that front hasn't worked).

Anyway, advice or commiseration is appreciated!

I'm in the middle of a hypervisor migration, like seriously who isn't right now. I don't have the smallest environment, but I'm also not a huge shop, roughly around 4,500 VMware Cores. We are making the move to Hyper-V and for the most part it's going really well. However the problem(s) are getting bigger, and the skill gap(s) are getting larger between me, and the other team members

• They cannot read/write PowerShell
• They cannot read/write Ansible/Yaml
• They have no experience with Hyper-V
• They do not make a effort to learn
• They do not attend meetings with the best foot forward
• They do only the bare minimal, and pass it back to me
• They skip meetings with MSFT, and do not get the same chance to learn as I took
• They do not setup Nested Virtualization Labs to experiment, test, learn after being asked to several times
• They send me AI code and ask if its okay to run or if it needs to be fixed

I cannot hand anything off, as most of the build processes are scripted, and require some knowledge of BASIC PowerShell to function. Along with not being able to hand items off, they do not know how to use VS Code/Git ; and I'm talking about BASIC functionality here

I cannot pass off Hyper-V anything as they don't know how, and I'm being told to sit on meetings with them, and have them shadow me as I work so that they are learning. This is physically impossible for me... I cannot sit on a call for 6 hours, and let them watch my screen the entire time, I am deploying hosts in parallel, troubleshooting deployments, deploying more Failover Clusters, writing/refactoring scripts all while doing other items.

On top of this, my personal life is struggling. My wife is frustrated (frustrated isn't the right word. Taking her emotions out on me would be better maybe) that my work schedule has imploded into 50/60/70 hour weeks; trying to make sure everything gets completed before the next round of migrations. I'm talking the frustration levels where she will not talk, and goes out of her way to make me feel her frustration and no matter what I do to fix it, nothings good enough. I am trying my best, for all area's of life, but as my therapist said "right now, you are going to drop items, and that's okay, but you have to be okay with dropping items and work on what is needed in that moment"

Also ontop of this, I suffer from depression with persistent depressive disorder, and my medicine and therapy helps a ton; but my life is roll out of bed work, eat lunch while working, eat dinner, play with our toddler after dinner, put to bed if im lucky, go back to work until 11/Midnight repeat. its unsustainable, and my wife is rightfully frustrated however she's also not doing anything to help me . We live with my parents right now, while our house is getting constructed; my parents cook, clean, laundry, help with the Kiddo. Then i get told how I'm not doing enough to help her; and I'm like what the heck is going on. I am trying my absolutely hardest and its still not good enough.

Sorry for ranting, but I figured someone here could at least relate to what I'm going through somehow

EDIT - I saw a couple questions so here are the answers

• They are FTE's; not contractors
• I am not a manager, i have no authority over them. They are direct peers
• I'm trying to set boundaries but it's not working
• My manager is a new manager, and this is his first manager job

SECOND EDIT

• i am on day 10 without a day off
• I have worked every Saturday since October started
• I have worked 3 overnight red eye shifts with expectations to work the next day (5PM-4AM sleep until 9 then back at it)

This is just a warning incase you guys haven't seen it yet:

https://techcommunity.microsoft.com/blog/exchange/released-october-2026-exchange-server-security-updates/4563014

Update October 15, 2026: We have received reports indicating that installation of October 2026 updates for Windows Server - KB5126646 (Windows Server 2025), KB5126655 (Windows Server 2022) or KB5126651 (Windows Server 2019) - can cause Exchange Server OWA to fail with an error MapiExceptionMdbOffline: Unable to make connection to the server. (hr=0x80004005, ec=1142) with event ID 1006 logged in the Application Log, as well as growing email queues. Installation of October 2026 Exchange updates is not required for issues to occur. We are investigating this with our Windows partners.

The scariest part of this is the note: "Installation of October 2026 Exchange updates is not required for issues to occur. We are investigating this with our Windows partners." Good luck, have fun.

Rebooting the mailbox server in our case restored mail flow and OWA but I am guessing that is a temporary fix.

This is kind of a terrible issue because Outlook was acting like everything was perfectly normal and you didn't get the normal "user screaming at your because outlook doesnt work".

We bough several new servers last month. Today I racked over $60 grand (USD) worth of hardware. Probably closer to $70 Grand... It was only 3 servers.... 5 years ago, it was only around 20k. It's crazy....

Now to throw down with the boss on not putting VMWare on them. As much as I can anyway

I have used tools to get recommendations for AD hardening, but not as clear cut for Entra. What have you used for that that have been helpful beyond Entras built in advisor?

My employer has recently decided to hire a new IT support person for our helpdesk; I found the position on indeed and was surprised to see the top of the pay range is about $10k more than I am currently making.

I have taken every challenge on headfirst and really grown our current IT department. However, I do not know how to bring up the subject of a raise/increase. Should I send an email to my boss or have an in-person conversation? They have me reviewing resumes for this position that could potentially pay more than mine, and its rubbing me the wrong way.

Hey guys, I’ve recently taken over the role of sys admin in the company I’ve been working for as an operations admin for the past year. I’m implementing a series of changes, processes, policies and trying to structure our Microsoft environment, our domains, back up solutions, company and vendor accounts, etcc

It’s been a bit of a journey and honestly I’m also learning things on the go especially when it comes to documenting changes and getting our employees to understand what’s to be implemented before pushing it ahead (this has saved me from a lot of trouble but at the same time has delayed things a lot because apparently people hate changes and having to make minimal effort)

But at the same time I’m still having to run the daily operations in the company which includes embedded generation applications, approvals, quoting some small service work calls, looking after the service jobs with our subcontractors, monitoring portals, liaising with the engineers and site managers before attending site, solving solar troubleshooting enquires etccc

So like im taking a new title as sys admin (still going to get this updated on my contract) but I still take to take care of the daily operations and often I don’t have time to do the sys admin stuff properly which means im doing that at home where I also don’t have a lot of time. And when trying to implement my changes in person our electricians and my manager etc are very impatient and if something doesn’t work straight away they just don’t want to spend the time on it. We have a new company CRM one of our employees is vibecoding and my manager and the CEOs wants to replace all of our paid software with that (for like scheduling, hse forms, worker register, claims, inductions, daily prestarts etc) and today my manager told me that the priority is to test the new vibe coded system (and by this he means tweaking it so it replicates what the other software do) as he would rather get this done first and is less worried about passwords, insinuating that all the IT stuff I am doing in this take over is just password resets 😭😭 This was shocking to me because after all the changes I’m implementing there’s no way this is the only thing that comes up on his mind, like if this was all IT did then the company wouldn’t have spent hundreds of dollars weekly on an external IT support vendor before I took over

Anyways, if anyone here is or has been in the same situation and has some advice for me/words of encouragement I’d really appreciate it

For context I’ve just turned 23 and like my job but I’m worried that im having to disregard our internal IT needs because if I cease to do the daily operation stuff this will affect the flow of the business. As a result, this makes me anxious because I know our necessities but don’t have the time to commit the way I desire . (We are still doing better than when the company was on the hands of the external IT vendor though so I guess that’s something to consider hehe

Forgive me if this is a stupid question and feel free to flame me. I have been aware of MS trying to get rid of NTLM for some time. But I got thrown into Radius recently and I'm still learning it. I'm trying to figure if this update will kill my use case.

We use Absolute Secure Access with Radius. The machine authentication is done via certificate. No issues there. For user authenication we use the EAP type of Microsoft Protected EAP (PEAP) which indicates in the properties Secured Password (EAP-MSCHAP v2). I'm not clear on the Redit chatter that I have read if that is affected at the moment.

Before someone suggests EAP-TLS for user authentication, we would love to use EAP-TLS, but that will not work. The user needs the user cert to authenticate with EAP-TLS. Since the VPN will not pass traffic until it sees the user cert, the machine cannot get group policy to pull the user cert. The only suggestion the vendor had was let everyone pull the user cert then engage EAP-TLS. The users may use various shared computers logging in with their AD credentials. Then you have the issues of new users. Not going to work. SAML is an option but the user friction will be an issue. That requires a user to log in with their AD credentials. Then a SAML box pops up to type in the credentials again. This may be the way we have to go eventually or move to another product.

Any input is appreciated

My boss got the email from Verizon yesterday afternoon that makes it official, they're shutting down vtext totally on 3/31/27 and they say that "some senders may lose access to legacy email-to-text prior to that date."

We use their email to text for a lot of our notifications and alerts.

Does anyone have an actual replacement for vtext that you're actually using and works the same way? We definitely want email to text, not push notifications from an app. Thanks.

So, I‘m part of a small MSP and I had a client call about phone (voip) issues. I go out and checked the one AD/DNS server and see it says it’s unlicensed, troubleshooter doesn’t work and can’t change key; I get it working finally giving Network service access to some registry folders. I keep looking for phone issues and see that the dns forwarders are wrong in DNS so I correct them. I'm looking at firewall traffic and QOS and everything coming back good so I head out.

I get a call that users can’t reach internet so I hop in again. Server nslookup; has no idea who the server is. GPO couldn’t open; says can’t find domain. Same for AD trusts. DNS server is not starting giving error 1067 saying its looking for 127.0.0.1 (tried setting 127.0.0.1 or the internal IP of the server for server DNS) for the interface (the servers internal IPv4 was checked in interfaces when I could last see it) in event view and to change it in DNS server manager but I can’t open that. I tried to remove the DNS service from the server after reconfiguring ISP DNS to the firewall dhcp scope for internal (firewall handles dhcp but server does/did dns) but that also errors about windows remote management service (again network service account staple) isn't started.

I keep running into the same thing time and time again; it’s like the network service is being restricted as I keep getting access denied or services that depend on it aren’t working. The only other thing I have a theory about is SentinelOne was deployed to this server but it’s not in the portal. On 10/3 in the logs; I see this device was pushed a decommission automatically at 8pm when we aren’t working. When I check the server, it has sentinelone installed but I can’t remove it because it just loops.

I’m thinking SentinelOne hosed my server because the network service user seems to be highly restricted and SentinelOne has only been in play for about 3 months. I’m going to start with a cleanup of it with support when I get in tomorrow. Has anyone seen this before and any idea what to do about my DNS/Server problem? I’m really at the end of my rope and not sure what to do except a disaster recovery with my backup vendor and then move over data; but sentinelone will still be on the backup and not in the portal for removal so I’m still stuck I bet.

edit: I found what fried the system because after hosting the backup image in HyperV; it again crashed and lost how to function with the domain and dns. When troubleshooting dcdiag stuff and why users were getting no internet icons but had internet and the server having an exclamation point for its Ethernet; one of the steps was to reset winsock and that immediately broke it again.

other things I had to do; the local service and network service users are completely borked. any services using them have to be switched to system to get running again. This involved the software protection service (windows activation problem) not starting because access denied and I had to add network service to the software protection and WPA registry again; this doesn’t mess anything up. It also involves the dns client service the windows time service, and a few others. I worked with another tech and he followed the steps i took from backup restore to it dying again and agreed this server has demons.

Next steps are rehost the backup I had that isn’t fried, fix the things I can fix and dont reset winsock. I'm spinning up a new server 2019 and doing a migration of roles and data.

We just hired a new guy to manage the VMware environment. I’ve done some basic Horizon View work 7 years ago so I’m not a VMware SME.

I heard him taking about deleting snapshots older than xx hours.
Don’t know why since we are using less than 10% of the cluster storage.

Today the Horizon pool broke because he deleted the snapshot the linked clones were using.

Of course the excuse is “this isn’t setup right”.

I'm about to accept an offer to join the IT team at a law firm.

Having spent my career so far working exclusively in engineering and technology companies, I'm expecting the move into the legal sector to be quite a change of environment.

I'd be interested to hear from anyone who's worked both within and outside the legal industry. What were the biggest differences you noticed in terms of workplace culture, expectations, day-to-day operations, and the way IT is treated within the business?

Were there any particular challenges or surprises you weren't expecting?

For context, boss says he needs two backups of all data prior to a certain date and post a certain date. We are on premium.

Tried to explain that I’m not sure this is possible.

We currently don’t even pay for a backup tool! (Requested multiple times)

Don’t even know how to begin approaching this.

Is anyone else having issues with Printix today? The sign in portal seems to be down and no one can print.

We have a number of third party companies that need to semi-regularly upload files for us.
We don't REALLY want to manage third party identities in entra, so not sure if onedrive is an option for us.

We do have an FTP, but we're working on retiring it, so while this may work for awhile, ultimately not great.

Dropbox is $21/user/month, which seems a bit much.

Does anyone have any decent, inexpensive suggestions for this?

I have some machines getting routine NETLOGON 5719 errors. It's the " This computer was not able to set up a secure session with a domain controller... an internal error occurred".

I notice them going back to August, but my logs truncate after that time.

The trust relationship resumes shortly afterwards, so this is very transient.

I did some debugging with nltest, specifically when one of the devices was having an issue and received:

NlSessionSetup: Denied access as we could not authenticate with Kerberos 0xC002002E

NlSessionSetup: Denied access as we could not authenticate with Kerberos (translated status) 0xC00000E5

NlSetStatusClientSession: Set connection status to c00000e5

I saw some people mentioning this has to do with credential guard, which I am running, and it happened after the August updates for them. We are running a 2022/2025 mixed environment.

Not sure if anyone has a fix. It doesn't seem to be super critical, but domain trust issues make me a little uneasy..

EDIT: This was a device guard/credential guard/virtualization based security issue. Here is what I wrote in another post below

Basically, you have to turn off Machine Identity protection in Device Guard/Credential Guard.

I did it by downloading the latest group policy templates, and in the GPO where I set my other device guard settings (Admin Templates->System->Device guard->Turn on Virtualization based security), and turned machine identity protection to disabled. That seems to have done the trick. (note: there are registry settings for this as well)

I've inherited environments where the ERP is basically the center of a spider web, with everything connected to everything else. Integrations are obviously useful, but every connection is another thing to monitor, troubleshoot and potentially break. We've been using Priority and I've found it useful having the ERP handle more of the core business processes while still being able to integrate with other systems where needed. Curious how other IT teams think about this. Do you try to minimize integrations, or just accept them as part of modern ERP architecture?

I recenty joined this org and we have 20+ employess, using systems with win 11 home, my manger wants me upgrade them to pro and add admin accounts in them. We have Volume license upgrade key, we don't have intune as part of our licensing (Basic Tier), so I would like advice on the best approach to manage this transition:

1.Upgrade Windows 11 Home to Pro using our volume licensing key.

2.Create work accounts or profiles for employees on their devices.

3.setup admin accounts

4.Migrate existing user profiles and data to the new work accounts while preserving their files, settings, and applications where possible.

TIA

Did anyone else get burned this morning by last night's update, where the certificate presented by an NPS policy defaulted back to the cert at the top of the list instead of the one you selected, preventing users from authenticating? This happened on both of my NPS servers, which triggered the dreaded 8 am panic call. The fix was to set the certificate back, but before then, RADIUS clients for Wi-Fi were down in my case.

The security log for the user: Reason: An internal error occurred. Check the system event log for additional information.

The system event log: The TLS server credential's certificate does not have a private key information property attached to it. This most often occurs when a certificate is backed up incorrectly and then later restored. This message can also indicate a certificate enrollment failure.

Got a question that I need cleared up. We don't have either SMS or voice enabled as authentication methods on our tenant so that isn't what I am worried about. The vast majority of our users use push notifications via the Microsoft authenticator app, with a handful using passkeys.

Come Feb 1st, are all my users going to be prompted to set up passkeys? The reason I am questioning this is because obviously push notifications are not phishing resistant, however the Microsoft doc states that:

"Users in scope for the February 1 retirement whose only available MFA method is SMS or voice are required to register a passkey during sign-in to continue accessing their account. This prompt is blocking. Users must register a passkey before they can continue to sign in to their account."

The "whose only available method is SMS or voice" section makes me think that this might not be the case?

It isn't rolling out passkeys to my users that I am worried about, it is more so how janky and awkward they work with the authenticator app. I have been using push notifications for years and had minimal issues. I have been using passkeys for 6 months and have a couple of users who just can't add a passkey with no reason or error explaining why (support case which is still open with Microsoft) and I have some who have had their passkey randomly disappear so it had to be set up again.