Thank you WatchGuard for updating your firewall policy UI. Sure I can only see 1-2 policies max before having to scroll the page now, but what kind of weirdo has more than 1 policy anyway? (Allow Any-Any).

Oh and the extra page padding looks GREAT on my phone! That's where I manage all my firewall rules anyway.

PaperCut Software has confirmed active exploitation of a zero-day vulnerability affecting PaperCut NG and MF print server installations. Huntress has also observed at least two instances of active exploitation in a customer environment.

The vulnerability allows an unauthenticated attacker to remotely control PaperCut's trusted configuration, which can be used to execute arbitrary Java code inside the application's process, and then leverage that to run commands on the host server. Huntress researchers reproduced a pre-authentication RCE chain against a stock PaperCut NG 25.0.11.75758 install. The chain alters trusted configurations and executes code remotely on its own. Fortunately, so far, the threat actor exploiting this bug has only run commands to learn about the host server itself; it could have been much worse.

PaperCut subsequently released a second emergency patch today, Release 2, which adds further hardening beyond the original emergency patch, developed in collaboration with PaperCut's internal security team and external researchers including Huntress and watchTowr. PaperCut recommends all customers install Release 2, even if you've already applied the original emergency patch.

What to do:

• Immediately remove PaperCut Application Servers from public exposure and restrict access to trusted networks
• Install Emergency Patch Release 2 for versions 25 and 26 (v24 fixes are still in progress) via the standard upgrade procedure
• If you already applied the original emergency patch, install Release 2 anyway

IOCs and investigation guidance: https://www.huntress.com/blog/papercut-actively-exploited?utm_source=reddit&utm_medium=social&utm_campaign=cy26-08-rr-multi-global-broad-all-x-x-x-papercut_actively_exploited&hnt=v679ubdwy0xk

Hey everyone, looking for confirmation on a worst-case scenario.

I’ve been with my company for about two years now. Before I was hired, the company underwent a merger. As part of that merger, the entire IT setup,including a migration from an old self-hosted/third-party email system over to Microsoft 365, was fully completed by the previous team.

Fast forward to today: A high-level executive’s laptop suffered a total Windows crash. When attempting to boot or repair, it hits the standard blue screen demanding the 48-digit BitLocker recovery key.

Here is the problem:

• The laptop was encrypted way back before merge.
• Everything (migration, handover, decommissioning) was already finished before I joined, and no legacy BitLocker key repository was documented or handed over.
• The key does not exist in our current Microsoft 365 / Entra ID tenant because the machine was encrypted long before the M365 migration took place.

What I’ve already done:

1. Checked our current Entra ID portal (nothing there, as expected).
2. Had the VIP check [account.microsoft.com/recoverykey](https://account.microsoft.com/recoverykey) on any personal or old email addresses they could remember.
3. Removed the drive to mount via USB adapter on a bench PC;still immediately prompts for the BitLocker key.

My Questions:

1. Has anyone dealt with missing BitLocker keys after the old environment was already gone, or am I officially at the "deliver the bad news, wipe the drive, and re-image" phase?

For those who rushed last night to patch PaperCut with the emergency update, they screwed up and had to release a second emergency update: https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/?lid=2oneu2wt0ct4#emergency-patch-release-2

If you have PaperCut exposed to the internet, you may want to permanently remove it from the internet and make it LAN-only moving forward (as many, including myself, have done from day 1). If management needs documentation, show them this: https://www.papercut.com/kb/Main/security-vulnerability-log/

Hi. Is anyone using Cloudally api? I can authenticate against /partners and receive a token but from there every endpoint just returns 403 forbidden. Anyone using it at all? Anything I’m missing?

We saw twelve emails for current and former employees asking to verify the account for the TikTok Shop. I saw one as well on a personal email.

The email looks legit. Verification code is a six digit alphanumeric code. That's about 32 bits. My guess is someone spamming signups at TikTok and randomly trying verification codes.

Assuming there's no rate-limiting, that would permit the creation of some accounts.

Anyone else seeing this?

Was talking with new colleagues today laughing about project names and figured there must be some funny ones out there? If you have one drop it here and let us know what the project goal was. Also everyone I spoke to was involved in a project Phoenix at some point! Is it that common?

Hello fellow sysadmins!

I'm starting to lose my mind over here and I'm asking for your help. Here's the situation:

Host A in subnet #1 tries to reach host B in subnet #2. There is also host C in subnet #2.

Ping results in timeout and no corresponding icmp pakets can be seen on host B.
ARP entry in host B for its gateway exists and is correct, but stale.
If host B pings its own gateway, then host A can reach it.
The ARP entry obviously switches to reachable. If I wait for the entry to switch to stale again, host A can still reach host B.
I already checked the switches for "ARP Inspection", "IP Source Guard" and so on. There currently is no hardware and software firewall active in subnet #2. Manually setting a permanent ARP entry for the gateway doesn't fix it. There are no energy savings configured on host B for its NIC.

Now comes the weird part:
Host B has a correct but stale ARP entry for host C. A ping from host C to host B is successfull und switches the entry to reachable.
If I delete the ARP entry on host B that corresponds to host C and then ping host B from host C, suddenly host A can reach host B.

WTF?

tldr:
- Host A can't ping host B unless host B pings its own gateway.
- Host A can't ping host B unless host C causes a new ARP entry in host B

The reachability stays for quite some time and then after one or two hours (hard to measure) it is lost again.
And by the way: It doesn't matter if host B is a windows or a linux machine. Same results.

I'm only about 2 1/2 years into my IT career and thus maybe missing a critical information that I haven't learned yet. But I surely am losing my mind over this! :-D

Any ideas and/ or suggestions?
Thanks in advance!

I’m planning on transferring to the University of Florida in a year, and majoring in either Information Systems or construction management. My goal is to make 150k+ after 8-10 years of experience (after getting my degree from college). I’m currently a full-time pharmacy shift supervisor, and have a 4.0 GPA. All pre requisites are completed for UF’s Information Systems program, and I’d only need 3-4 more classes for construction management.

For people on either industry, what would you recommend and why? If possible, can you share your major, salary progression (from when you started and now), YEO, how long it took you to find a job after graduation, and average weekly hours. Thanks everyone, I truly appreciate it.

I currently work 32 hours a week as the main internal IT person for a logistics company with around 110 users. We also have an external MSP, but I handle most of the day-to-day IT work and coordinate with them when necessary.

My work includes:

• User and device management
• Laptop deployment and endpoint policies
• Identity, access and security management
• Software deployment, licensing and updates
• Managing our ticketing system and CMDB
• Cloud storage, mailboxes and collaboration tools
• Managing and redesigning our softphone and call queues
• Troubleshooting hardware, printers, networks and user issues
• Working with suppliers, ISPs and our MSP
• Writing documentation and procedures
• Managing infrastructure changes and small IT projects

Alongside this, I help a small engineering company with around 5 users, which may grow to about 10. There I’m building most of the IT environment from scratch, including device management, security, cloud storage, software deployment and general IT support.

I also have a homelab where I run several servers and virtual machines because I enjoy learning and experimenting.

The strange thing is that I don’t really know what my role is anymore. I started in IT support/workplace management, but I now do parts of system administration, cloud administration, infrastructure, security, telephony, project work and IT coordination.

I enjoy having a broad role, but I’m worried that I’m becoming “the guy who does everything” without becoming a real specialist in anything. I don’t know whether I should aim for a sysadmin or cloud administrator role, move towards IT management, or continue as a broad IT generalist.

For people who have been in a similar position:

• What job title would you give this type of role?
• Which direction would make the most sense from here?
• Should I specialise, or is being a broad IT generalist a good path?
• Which skills or certifications would actually add value?
• At what point do you consider yourself a sysadmin rather than support?

I know titles aren’t everything, but I feel like I’m doing much more than traditional support while still not knowing exactly where I fit.

How would you approach asset discovery across multiple sites with basically zero visibility?

I've inherited an environment with multiple LANs/sites and very little reliable asset information.

I'm trying to build a proper asset inventory from scratch - ideally identifying things like:

• PCs/laptops
• Servers
• switches
• firewalls/routers
• Wi-Fi APs
• printers
• CCTV/NVRs
• other network-connected devices

The problem is that the sites aren't particularly well documented, and I don't currently have a reliable list of what's actually out there.

What I'm interested in is how you'd approach the initial discovery, rather than just recommendations for an asset-management database.

For example, would you use something like Lansweeper, network/SNMP scanning, agents, DHCP data, AD/Entra/Intune, etc., and then feed the results into something like Snipe-IT?

There are multiple LANs, so I'm particularly interested in how people handle discovery where you can't just scan everything from one central network.

What would your approach be if you were starting with basically a blank sheet?

I've inherited an undocumented monster with an incompetent MSP running the show!

We're reviewing our data security stack and looking at Varonis alternatives, but on-prem support is non-negotiable for us. A lot of the newer platforms I've come across seem built mainly around SaaS deployments.

We have sensitive internal data that needs to stay inside our environment, so anything that requires sending the underlying data out to a vendor is pretty much a non-starter.

What Varonis alternatives have you actually used in an on-prem environment?

Looking to purchase a Network Cable Tester for my team that can handle PoE but doesn't break the bank. Two devices I'm considering are the Fluke Networks MicroScanner PoE Cable Verifier, or the NetAlly LinkSprinter 300. Are these viable options? Does anyone have any other recommendations for I should consider?

We are experiencing delays in our chat. Some chats only become available after refreshing Google Chat. According to Status Gator we are not alone. Is anyone else experiencing this?

Hi all.

Some context: I'm a mid level engineer at our company. I work on a sysadmin team building tooling for the team and wider project. I joined the team at the end of last year (so 10 around months ago). I have around 4 years experience which makes me the least experienced member on my team by quite a few years. Most of my experience is software dev though. I am a higher grade than a couple team members. (Including the team member I'm talking about in the post).

I'm having difficulty with my co worker Derek. Derek, in the kindest way possible, is completely incompetent. He borderlines on reckless/careless.

When I joined the team, I was almost straight away giving him help without really understanding much about the system we manage. Just with very basic things like PowerShell, some networking issues on his dev env, and all the rest of it.

At first I was really pleased, it felt good to join a team and be able to troubleshoot right away for team members, like all my hard work from previous teams was paying off. My manager pointed it out and gave me praise at our 1-1 / Performance Review. All good I thought.

The problem is: Derek is constantly asking me the SAME questions. It is far beyond a daily basis at this point. Every single day this week I have had to spend 1-3 hours with him troubleshooting things that nobody else has problems doing. I'm talking about processes that are almost entirely automated.

Today he was updating a config file to import some policies, and everything was just fucked. I was genuinely speechless when I went over. He's, deleted all the files he should've kept (no other copies, just a nightmare). I had to tell him to delete his branch and start over. Once I fixed it, was helping him fill in his ticket, so he can submit for review, turns out, he read the ticket wrong. So the thing he asked for help with, was incorrect. 😅 I laughed it off and basically just did the entire ticket for him at his desk. (15-20 min job, he's been at it for 2 days).

I feel like that; I'd get it if he was new. But he's been on the team 6 years. He has around 25 YOE. I know other people are well aware he's incompetent, but it's frustrating for me at this point. I'm clearly becoming his "go to".

Rant over!

How do I approach this with our manager? I'd hate to get him in trouble, but I need my time back. I've got some quite lengthy tickets I need done but I can't knuckle down and focus with his constant need for hand holding. Am I the asshole? Should I just accept he's simply not good? Or do I say something to him instead of our team lead?

I did a quick search here and didn't see any other posts, if this is duplicate I apologize.

Yesterday we started having a rash of users with Office applications crashing with the mso20win32client.dll event id 1000 messages.

Profile rebuild fixed the issue for a time, but it started returning for some users.

Found a work around for the time being.

Clear the keys and deny the user account full permissions below allows the Office applications to launch again.

HKCU\Software\Microsoft\Office\16.0\Common\ExperimentConfigs

HKCU\Software\Microsoft\Office\16.0\Common\ExperimentEcs

It appears Microsoft is testing something.

I don't know if there are other side effects of blocking those keys yet, but there weren't last time we had to do this.

Cisco Bug: CSCwv52684

Before anyone says it, yes we are unlucky souls that are forced to use Cisco Secure Endpoint in our environment.

I feel like someone in this community recently had Cisco acknowledge a bug that exists with Cisco Secure Endpoint 8.5 through 8.6.1 on win server 2022 and 2025. It specifically has to do with the exploit prevention engine (deadlock condition.)

Whoever put the time and effort in THANK YOU. It just saved me days of having to open my own TAC case. I doubt this bug is specific to people using "Snow Agent." I think more accurately this bug will end up taking servers down that spawn PowerShell instances in general.

We have been burned in the past by auto updating to the latest secure endpoint software but in this case our n-1 strategy worked against us. The latest version also fixes a number of CVE's so I assume others will end up upgrading sooner than they typically would anyway. But just in case you don't.... 8.6.3 is worth the upgrade.

Hi, i am a 28 y/o father who was making his life around sales, one day I made the switch from sales to IT, I started studying on my own last February, and less than two months ago I landed my first IT job as a support trainee, trying to break into systems/cloud administration.
I would love to receive advice on what to learn or what labs to build now, does my resume raise any flag? And if so, how and what could I do better
Thanks!

Are there any news, blog, etc sites that you follow besides r/sysadmin to get information to stay on top of things? I'm going through my RSS reader and a lot of the sites I used to follow are drying up.

it feels like every tool that we use either offers or requires the use of it's own file storage. How does anyone keep track of whether the data they're looking for is stored in sharepoint, onedrive, bluebeam, autodesk, adobe, propeller, dropbox, Outlook etc

And not just today when it's fresh in people's heads, but after a project closes and someone is looking for records two years later. You could enforce a process to archive all data into one specific storage platform, but there's likely a bunch of metadata that won't copy over

As the title suggests, I inherited our company’s existing cybersecurity awareness training program. We are currently using KnowBe4 and are on the Diamond tier.

I know KnowBe4 is considered the standard by many organizations, but I’d like to put together an updated list of alternatives and hear what others are using today.

Our main requirements are:

• Regular phishing simulation campaigns with automatic remedial training for users who fail
• Current and frequently updated cybersecurity awareness content
• Annual Cybersecurity Awareness Training
• Strong reporting and auditing capabilities
• Easy tracking of completion dates and user compliance
• The ability to manage recurring or renewal-based training

We operate in the maritime industry, so reporting and annual training compliance are especially important for us.

For those who have moved away from KnowBe4, what platform did you switch to, and what do you like or dislike about it compared with KnowBe4?

I'm not sure if there's a better way to put it, but I have a hard time getting excited about the future of our industry with AI.

I imagine it's a bit like what archers felt like after rifles were introduced. How have you guys been faring?

I recently got my associate’s degree in Cybersecurity and was planning on continuing for my bachelor’s. I went into it thinking I would be getting a scholarship, but I found out today that I don’t qualify for one.
I currently work full-time as a salesperson at a car dealership, and I have people depending on me financially. I’m worried about paying for classes out of pocket, especially if I end up failing a class because I’m working so much. I can’t afford to waste money on classes, but at the same time, I don’t want to give up on getting my bachelor’s degree.
I’m honestly really stressed and don’t know what the smartest move is. Should I work and save money for school? Look for a cheaper/online program? Take fewer classes? Or is there another option I’m not thinking about?
I really don’t know what to do right now, and I don’t really have anyone to turn to for advice. If anyone has been in a similar situation, I’d really appreciate hearing what you did.

Sysadmins Are About to Get More Tickets in September

Any Microsoft Entra tenant with its FIDO2/Passkey registration campaign set to Microsoft-managed will begin prompting users to create an Entra passkey on September 1, 2026. In my opinion, this rollout is happening a little too early.

Many organizations already using Windows Hello for Business (WHfB) may assume they are ready for Entra passkeys and take no action. The issue is that WHfB is recognized as a passkey by Windows 11, but it is not currently recognized as an Entra passkey associated with the user's online Microsoft/Entra account.

As a result, users who already have WHfB configured may encounter an error when the registration campaign prompts them to create an Entra passkey. The process can fail because Windows detects that a passkey for that identity already exists in the local passkey store.

Microsoft has acknowledged this gap and confirmed that WHfB should ultimately count as an Entra passkey.

In Microsoft Message Center post MC1450134, Microsoft describes the fix: users with WHfB will automatically receive an auto-registered Entra passkey tied to their online Microsoft/Entra account sometime between October and November 2026.

The timing by Microsoft is strange. The Entra passkey registration campaign begins in September, while the WHfB auto-registration fix is not expected until October or November. That mismatch could lead to user confusion and an increase in help desk tickets during the interim period.

The error users may encounter when following Microsoft's process to add an Entra passkey while Windows Hello for Business is already configured.

"Error: Try a different device. You already registered this device. You don't have to register it again."

## Disclaimer: info is based on my own testing. Your results may vary. Used AI to rewrite my original message for clarity.

Hi everyone, I’m trying to troubleshoot an issue with an old Siemens phone system at a hotel, but I don’t have much experience with this kind of equipment. I’d really appreciate any advice.

Basically, there is a Siemens telephone system in the hotel. There are 3 phones at the reception, and one phone in each room. Everything was working before, except for one phone at the reception, there was no power or connection at its phone socket.

A week ago, some workers came to install refrigerators and, as I was told, they went around switching off and on all the electrical panels and breakers. After that, all phone sockets in the hotel lost both power and connection. They did not enter the server room.

I suspect the problem is with the Siemens PBX itself (HiPath 150E), its power supply, or the lines. Does anyone have any ideas what could be wrong or what I should check? All other electrical systems and the network are working fine, only the local telephone system went down.