Hey, bit of a rant post but mainly in asking for help/guidance/advice on how I can best learn to simply 'not give a shit' and switch off and not care or get angry/upset/defensive when I let things fail and inevitably get blamed for other people's lack of knowledge etc.

Context. Aka Rant.

My team has 18 staff members. 7 of which (me included) are seniors.

We have dedicated "apps" team and a dedicated network team, plus service desk and 2nd line. Incident, change and problem management etc.

So we have bums in seats but not enough to cover the work load

However, I'm getting so exhausted being the one that all the tough projects, tickets, questions, meetings get passed too.

I write my documentation, try to talk and explain my processes and demo / share screen daily when going over stuff.

Yet it's always the same things, people don't learn, end users are not being trained correctly on SPO or MS stuff in general.

I'm building SPO sites and doing automation etc to help myself and others, and even then people are going in and renaming columns, deleting/changing views. Not understanding the impact. And not wanting to support the stuff I build because "they don't get it".

No one's updating their documentation despite me and a few others, also I built a whole knowledge system and made it all as dummy proof as possible, with training sessions, videos and documentation which everyone attended. Yet they still can't grasp it. And I'm fed up teaching them or having to fix other ppls issues.

If technical people can't understand basic SharePoint then my org is truly fucked.

Ppl in my team, Inc other seniors are throwing their hands up when something requires a bit of code or thought.

Management is non existent in my team as they are also technical staff who are essentially doing multiple roles and as such the "management" side is gone out the window.

Yet daily I'm getting more tickets, tasks, projects etc and all these things are all over the place (teams msgs, channels, meetings, verbal, multiple todo lists, spo lists, planners, project meeting notes, copilot summaries, itsm tickets, emails, alert systems)

I'm just lost on a daily basis and always reacting to stuff and other peoples stupid questions or mistakes

Yet when I step back and let things fail, I'm the one that gets blamed. Not all the other people.

I have lost my calm on alot of meetings and been venting and calling people out to the point in expecting my manager to have a word.

I've considered looking elsewhere for work, but salaries are not as good as what in on for what I know/do and I guess lack of confidence/ imposter syndrome (?) is preventing me from taking the leap.

Sorry for rant. Just needed to vent this out.

We just hired a new guy to manage the VMware environment. I’ve done some basic Horizon View work 7 years ago so I’m not a VMware SME.

I heard him taking about deleting snapshots older than xx hours.
Don’t know why since we are using less than 10% of the cluster storage.

Today the Horizon pool broke because he deleted the snapshot the linked clones were using.

Of course the excuse is “this isn’t setup right”.

I have some machines getting routine NETLOGON 5719 errors. It's the " This computer was not able to set up a secure session with a domain controller... an internal error occurred".

I notice them going back to August, but my logs truncate after that time.

The trust relationship resumes shortly afterwards, so this is very transient.

I did some debugging with nltest, specifically when one of the devices was having an issue and received:

NlSessionSetup: Denied access as we could not authenticate with Kerberos 0xC002002E

NlSessionSetup: Denied access as we could not authenticate with Kerberos (translated status) 0xC00000E5

NlSetStatusClientSession: Set connection status to c00000e5

I saw some people mentioning this has to do with credential guard, which I am running, and it happened after the August updates for them. We are running a 2022/2025 mixed environment.

Not sure if anyone has a fix. It doesn't seem to be super critical, but domain trust issues make me a little uneasy..

EDIT: This was a device guard/credential guard/virtualization based security issue. Here is what I wrote in another post below

Basically, you have to turn off Machine Identity protection in Device Guard/Credential Guard.

I did it by downloading the latest group policy templates, and in the GPO where I set my other device guard settings (Admin Templates->System->Device guard->Turn on Virtualization based security), and turned machine identity protection to disabled. That seems to have done the trick. (note: there are registry settings for this as well)

Got a question that I need cleared up. We don't have either SMS or voice enabled as authentication methods on our tenant so that isn't what I am worried about. The vast majority of our users use push notifications via the Microsoft authenticator app, with a handful using passkeys.

Come Feb 1st, are all my users going to be prompted to set up passkeys? The reason I am questioning this is because obviously push notifications are not phishing resistant, however the Microsoft doc states that:

"Users in scope for the February 1 retirement whose only available MFA method is SMS or voice are required to register a passkey during sign-in to continue accessing their account. This prompt is blocking. Users must register a passkey before they can continue to sign in to their account."

The "whose only available method is SMS or voice" section makes me think that this might not be the case?

It isn't rolling out passkeys to my users that I am worried about, it is more so how janky and awkward they work with the authenticator app. I have been using push notifications for years and had minimal issues. I have been using passkeys for 6 months and have a couple of users who just can't add a passkey with no reason or error explaining why (support case which is still open with Microsoft) and I have some who have had their passkey randomly disappear so it had to be set up again.

I'm trying to figure out what is the best combination of licensing E3 plus what to get as close to business premium as possible.

I understand it won't be an exact match, but I know that business premium has a few extra bells and whistles that aren't included with just the base E3 license. What would I need to add-on to my E3 to make sure everything is at least as good as what comes with business premium?

I've already looked at the M365 maps and the license guides, but I can't really make heads or tails of those. this P1, that P2, it doesn't make sense. This is easily a problem someone else has already solved, and hoping to understand how others have solved this.

We happened to catch it before Accounting issued a check, but I guarantee you, watch for this double charge.

I’m just curious how common Mitel is globally these days. What is the real-world usage looking like for OpenScape Business X8 and OpenScape 4000 servers? Are people still running these, or has the market completely moved on? How about Tetronik DAKS (OScAR) alarm systems which are used alongside them? How about setups that are still mixing traditional digital trunks with modern IP/SIP trunks? Also, what about Alcatel-Lucent Enterprise?

I’ve read a huge majority of negativity towards ivanti. We probably won’t have full admin permissions as it is owned by one of the larger hospitals, that in itself gives me concern.

Howdy, /r/sysadmin!

It's that time of the week, Thickheaded Thursday! This is a safe (mostly) judgement-free environment for all of your questions and stories, no matter how silly you think they are. Anybody can answer questions! My name is AutoModerator and I've taken over responsibility for posting these weekly threads so you don't have to worry about anything except your comments!

I'm about to accept an offer to join the IT team at a law firm.

Having spent my career so far working exclusively in engineering and technology companies, I'm expecting the move into the legal sector to be quite a change of environment.

I'd be interested to hear from anyone who's worked both within and outside the legal industry. What were the biggest differences you noticed in terms of workplace culture, expectations, day-to-day operations, and the way IT is treated within the business?

Were there any particular challenges or surprises you weren't expecting?

I've inherited environments where the ERP is basically the center of a spider web, with everything connected to everything else. Integrations are obviously useful, but every connection is another thing to monitor, troubleshoot and potentially break. We've been using Priority and I've found it useful having the ERP handle more of the core business processes while still being able to integrate with other systems where needed. Curious how other IT teams think about this. Do you try to minimize integrations, or just accept them as part of modern ERP architecture?

Hey y'all,

I'm in charge of managing usage and licensing of my orgs chatgpt service, in the last 3 days all items regarding users usage under admin console > analytics > usage are being marked as unavailable stating they have not used it, no matter what timeframe is chosen for querying. I was wondering if y'all have seen this too and know of a workaround for getting current user "milage".

Thanks, and take care.

Since last week we are facing issues with Teams. After opening the Teams Desktop app and completing MFA (doesn't matter if it's done in Teams, Outlook, or somewhere else), Teams keeps showing a red exclamation mark next to the taskbar icon. For now it seems to only happen on Windows devices.

We keep getting tickets from Users since last week because they can neither call others nor receive calls. Messaging works.

The only thing that works for now is to completely close Teams (either via the Tray icon or via Task Manager), then start it again.

Another user on MS Learn seems to have the same problem: https://learn.microsoft.com/en-us/answers/questions/6035415/teams-red-exclamation-mark-issue-again-multiple-us

I'm not seeing any posts regarding it in the message center / service health dashboard in the admin center.

Is anyone facing similar issues?

Lately it feels like I don’t have enough time to finish anything. I just keep getting saddled with project after project. Trying to get DKIM aligned, iPad migration to JAMF and MacBooks, General IT tickets, and Proofpoint setups. Trying to get our fleets setup on JAMF now. Already built it out for iOS but now I have to build out our Mac side on top of this migration of 600 iPads with half being on iOS 26 and the rest still waiting to be updated by the uses. I am stressed and tired. I can’t rely on my teammates either because they’re busy too! Our team is stretched thin and our director doesn’t want to hire more people. Also this is just a fraction of what I’m doing. How do you guys do it? I feel helpless. I used to relax by going home and playing video games/ smoking a bit to relax but now I just feel stressed and anxious all the time. How do you guys do it? I feel helpless.

So yea this is on the Patch Tuesday thread and we got stung by it on test devices.

https://support.microsoft.com/en-us/servicing/os/windows/docs/2025/08/upcoming-changes-to-ntlmv1-in-windows-11-version-24h2-and-windows-server-2025

The reg key on clients resolves it but I don't know enough about what that reg key does to be sure if it's the right thing to do (long term probably not but short term it fixes the wifi issue).

I'm gonna guess we'll see a few more people hit by it as I don't know how well it was documented compared to stuff like the Kerberos hardening changes.

Started seeing this in tenants today.

When you browse to Entra > User settings > Default User role permissions

Users can register agent identity blueprints = On by default

We chose to disable this to keep control. Saw some posts floating around that Microsoft was gonna enable this by November but it already popped up in a few environments today.

I've spent the last few months aggregating public blocklists and DNSBLs for a reputation lookup tool. A few things surprised me, and they matter if you run your own blocklist checks:

1. A frozen mirror can look fresh. One well-known traplist has a mirror whose own header says it was generated in September 2025, yet its HTTP Last-Modified header moves every hour. Judge freshness by the timestamp inside the file, not the HTTP headers.
2. Several "different" lists are the same data. One provider's main DNSBL zone is exactly the union of its "netscan" and "spam" zones. Another's Tor zone is just the Tor category of its main RBL. A third publishes the same Tor exit list over DNS and over HTTP. Count them separately and one Tor exit collects about six detections from two or three real sources.
3. "Tor" lists aren't all exit lists. One popular zone lists every Tor relay, including non-exit relays. Those never send user traffic to the internet, so treating them as Tor exits is a false positive.
4. Public resolvers end up on spam lists. A commercial anti-spam list carries 8.8.8.8, with a spam rate of zero. Resolver addresses turn up in form-spam data from everyone's traffic. Exclude the well-known resolvers before trusting a hit.
5. Dead lists read as clean forever. Plenty of lists that tools still show have name servers that never answer, or feeds that return 404. They report "not listed" on every lookup.
6. Some zones are wildcarded. A zone that answers 127.0.0.2 for every query flags the whole internet. Test each zone with the RFC 5782 test entries first: 127.0.0.2 should be listed and 127.0.0.1 should not.
7. Check the licence before you ship a list. Several "free" lists forbid commercial use or redistribution, and one explicitly bans reselling its data "as part of a larger package".

Disclosure: I build Senapati (senapati.io), an IP, domain, URL and email reputation API, which is where I ran into all of this. Happy to go into detail on any of these.

That's putting it audit mode, so it's working again.

But what are the negatives? That's legacy, right? Was it still being used with an enterprise PEAP wifi set up? There's the BlockNtlmv1SSO 0 registry fix but what's that leaving vulnerable by doing that?

And KB5127648 is putting that in enforced mode? Is that correct? But it's breaking something with PEAP?

I would think Microsoft will have some fix coming out soon.

That's thinking more on the client/user side. BlockNtlmv1SSO is 0, and it works again. Is there anything on the server side (and which server, domain?, or maybe something more like a WAP?) that needs or eventually is going to get an update to really fix the situation, like clients and server can do the same PEAP authentication without anything with BlockNtlmv1SSO needed?

I have created and tested two scripts for intune ,in our envriroment it went live .

The detection script is :

$RegistryPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0"
$ValueName = "BlockNtlmv1SSO"
$RequiredValue = 0

try {
    $CurrentValue = Get-ItemPropertyValue `
        -Path $RegistryPath `
        -Name $ValueName `
        -ErrorAction Stop

    if ($CurrentValue -eq $RequiredValue) {
        Write-Output "$ValueName is correctly configured as $RequiredValue."
        exit 0
    }

    Write-Output "$ValueName is configured as $CurrentValue instead of $RequiredValue."
    exit 1
}
catch {
    Write-Output "$ValueName is missing or cannot be read."
    exit 1
}

and the remedetion script is :

$RegistryPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0"
$ValueName = "BlockNtlmv1SSO"
$RequiredValue = 0

try {
    if (-not (Test-Path -Path $RegistryPath)) {
        New-Item `
            -Path $RegistryPath `
            -Force `
            -ErrorAction Stop | Out-Null
    }

    New-ItemProperty `
        -Path $RegistryPath `
        -Name $ValueName `
        -PropertyType DWord `
        -Value $RequiredValue `
        -Force `
        -ErrorAction Stop | Out-Null

    $VerifiedValue = Get-ItemPropertyValue `
        -Path $RegistryPath `
        -Name $ValueName `
        -ErrorAction Stop

    if ($VerifiedValue -eq $RequiredValue) {
        Write-Output "Successfully configured $RegistryPath\$ValueName as $RequiredValue."
        exit 0
    }

    Write-Error "Registry value verification failed."
    exit 1
}
catch {
    Write-Error "Failed to configure the registry value: $($_.Exception.Message)"
    exit 1
}

Firefox Enterprise combines the browser with a management console for IT admins with advanced security controls. The pitch is that it’s one of the few browsers that doesn’t run on an engine developed by Google or Apple. It’s rolling out in Europe first, and a Thunderbird Enterprise email client is also in the works.

https://www.firefox.com/en-US/enterprise/

Has anyone else run into this?

Troubleshooting a Windows 11 26H2 domain-joined workstation where admin sign-in fails after a reboot. We narrowed it down to:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\TypeOfAdminApprovalMode

• Set to 2, admin sign-in fails after reboot.
• Set to 1, sign-in works again.

The MSFT Windows 11 25H2 - Computer baseline GPO is enforcing 2.

Our DC runs Server 2022, and its Group Policy editor doesn’t show User Account Control: Configure type of Admin Approval Mode under Security Options.

I’m mainly trying to figure out why Administrator Protection is causing this. Changing the value gets us past the issue, but doesn’t explain what’s actually failing.

Has anyone seen similar behavior? Any particular event logs or known compatibility issues worth checking?

Also, would updating the ADMX/ADML files expose this setting in Server 2022’s editor, or is its visibility tied to the Security Settings extension on the OS running GPMC?

I’m not looking to modify the baseline GPO at this point. Just trying to understand the underlying issue and why the setting isn’t visible.

For those older, more experienced souls out there. If out job hunting, one tip…

I’m a little older (55) and recently discovered that the job I’ve had for 6 + years came down to me and a man much younger than me.

The only reason I got the job was one simple thing… if everything went to crap, who would you rather have on the job?

I was very fortunate to have someone point that out in my hiring process.

Don’t underestimate the value of that when interviewing.

Anyone a CrowdStrike identity protection customer start seeing a large number of these RPC detections? I believe it's a sensor issue as we're seeing this across a number of disjointed networks, so a large scale attack would seem very unlikely. Unless the CS tenant was compromised.

Update: Falcon Complete team confirmed this was part of the enablement of the RPC-over-SMB inspection policy for our environment.

Following the policy change Falcon Identity Threat Protection must establish an updated behavioral baseline. So any newly observed activity may be flagged as suspicious. Expectations are that the alerts will decrease after several hours.

Edit because I keep getting the same answer: Due to the client configuration and our limited access to the client infrastructure, SSO is not an option.

Looking to pick someone’s brain about this, right now one client has 60+ accounts for each site and all require a unique login and MFA code. Those MFA codes all go to one of 3 people, and are random based on site. This is incredibly inefficient because sometimes if an after hours emergency happens we can’t get into the account without someone else sending the code. We also have our own accounts for multiple clients so setting our own phones to forward codes also won’t work.

I’ve tried google voice and whatsapp, both don’t work. Vonage is super strict about no VoIP MFA, do not allow authentication apps nor email authentication. Purely SMS only.

Specifically for Vonage if possible, has anyone done this and have a solution? We’ve looked into yakchat but concerned about the VoIP restriction, and getting a spare phone with a number is a less than ideal option but that’s where we are at right now.

We have been testing deployment of the "universal app" version of Dell Command Update, and we have run into issues with it. Specifically, it works for the user who installed it, but it breaks for any other user who logs into the system.

So we went back to the classic version of Dell Command Update, and we are not seeing this issue.

Is the classic version more stable for shared-computer environments?

It seems like the universal-app version is the "future" version, but we are just having more issues with it.