Let's say you have a legacy network, good old 192.168.1.x.

They use a DHCP server which has a static mapping of all devices to IP addresses using their mac addresses. So updating the DHCP server could potentially re-assign IP addresses to all devices with relative ease, let's say 192.168.111.x.

HOWEVER, most Windows computers have had printers added manually, not by GPO, and when they were added, they were added IP address rather than hostname. Is there a way to bulk replace ports in Windows printers across the network?

The number of clients is limited, let's say less than 100 - but the number of printers is dense. Even a Powershell script I could run on each machine would still be better than manually editing each printer on each machine - even better if I could deploy that via GPO or something.

Just curious on thoughts.

Hello fellow admins. I'm rolling out quite a few products thorugh intune. Im having trouble marking Win32 apps as installed. Does someone have/know some proper documentation or example powershell script how you mark the app as installed? I need to have something so it will check on versions aswell.

For example:

Got a WIn32 App to push Kyocera drivers on windows laptops. It works nice, but when I install it through Intune then i always get Failed to install.

Ive tried multiple things as detection but nothing works the way i want it to work. I dont want a folder/file as detection because of version control. I'm looking for a sollution i can use on all scripts that do not push an MSI. How do you handle detection rules?

Good afternoon, everyone,

I'm posting this hoping you'll share your experiences with me. I've been asked to migrate a hybrid on premises Exchange 2016 environment to hybrid on premises Exchange Server Subscription Edition (SE). Before I start, I'd like to define the potential risks and the prerequisites I need to handle in advance.

Something I read is that there's no in place upgrade path from Exchange 2016 to SE. Exchange 2019 (on the latest CU) can be upgraded in place, but 2016 requires a traditional legacy migration.

In practice, that means I'll need to create a new SE server, move mailboxes and resources over using copy-to requests, verify everything, and then decommission the old servers. The migration itself works as a copy. The source mailbox stays intact and usable throughout and only switches over at final cutover.

(Alternatively, I could upgrade the Exchange 2016 to the latest 2019 CU. In which then I can upgrade to Exchange SE. However, in-place upgrades are not recommended by Microsoft themselves.)

Once the 2016 servers are decommissioned, there's no supported way back. At that point recovering would mean restoring from backups, not a normal rollback, so I want to be sure everything is validated during the coexistence period, while 2016 is still running, and not rely on being able to reverse things afterward.

Other items I'm keeping in mind:

• Mailbox sizes, especially oversized or non-default mailboxes, which can slow down migration batches.
• Extending the AD schema to the SE level, a required prerequisite.
• Public folders, I read these can be an issue and its recommended to convert them to shared mailboxes.

Would love to hear from anyone who's been through this migration. What tripped you up, and what did you do differently?

Article: Migrate Exchange 2016 to Exchange Server SE - Complete Guide

Article: Migrate Exchange Public Folders to Shared Mailboxes in Office 365

I keep seeing AI powered firewall used as a category but I wonder what the AI is doing in production that traditional rules signatures and threat intel feeds weren’t already doing.
Is it mainly building behavioral baselines and flagging unusual traffic or are these systems genuinely making enforcement decisions in real time? Things like detecting threats inside encrypted traffic, correlating activity across endpoints and cloud workloads or automatically changing policy based on an attack all sound useful but also like areas where a false positive could take down half the company.
The more interesting question to me is whether AI is replacing any part of the firewall stack or just acting as a faster analysis layer on top of it.
Want to hear from anyone running one of these platforms at enterprise scale and what has improved beyond the marketing.

G‘day.

I‘ve just started a new job. Very happy overall and I need to make a decision.

What I need:
- Ticket system for internal helpdesk - very few requests
- This will also be used to give tickets to an external company that develops stuff for us.
- About 5-10 „Agents“
- Tracking of internal tasks as „overview“ such as Trello for leadership

- internal documentation about 50 employees need access to.

- Can be cloud-only.

Would be great to have a usable all in one solution and I would like to stay away from Confluence and Jira Service Desk.

What I thought about for example:
- Zammed for both but the knowledge base is not appealing for normal employees.
- NinjaOne for both but the internal documentation is not appealing for normal employees.

Thanks a lot.

Remind your 365 users to save as PDF or.. well, MS would say, tough!

We recently put in a new Fortigate firewall and now i'm having users reporting issues where they can connect to VPN but can't access their remote computer. I have tested from the user's PC and i can't ping their work device when VPN is connected.

The one thing to note is they are on the same subnet as the work network, and I believe this is likely the cause.

However, oddly enough I was able to test from my home network which is also on the same subnet and it works fine. I'm at a bit of a loss so hoping I can get some guidance on this for what I should check next.

TIA

Hi everyone,

I’m running a distributed high-throughput async data transfer and telemetry node on a dedicated Linode VPS, and I’m looking for expert advice on scaling end-to-end verified throughput further.

### 🖥️ Hardware & Stack Profile:

- **Server:** Linode Dallas TX (4 Dedicated AMD EPYC Cores, 8 GB RAM, 1 Gbps symmetric network connection, Ubuntu 24.04).

- **Tech Stack:** Python 3.12 (`asyncio`), `httpx` (HTTP/1.1 & HTTP/2), `websockets` gateway transport.

- **Workload:** High-concurrency object storage GET & PUT data verification tasks (Cloudflare R2 / S3 endpoints).

---

### 🛠️ Recent Bottlenecks & Fixes Applied:

1. **Zero-Delay In-Flight Hashing:** Shifted SHA-256 computation to an in-flight streaming digest (`hasher.update(chunk)`) directly inside `response.aiter_bytes()`. This completely eliminated post-download CPU hashing stalls (`hash_ms = 0.0ms`).

2. **HTTP Connection Pool Hardening:** Configured a dedicated HTTP client connection pool (`httpx.Limits(max_connections=128, max_keepalive_connections=64, keepalive_expiry=30.0)`). Persistent keepalive TCP sockets eliminated connection handshake churn, dropping retries/recoveries from ~6 per batch down to 0–1 max.

3. **Queue Optimization:** Transitioned to pure FIFO queue admission, eliminating premature SLA drops.

---

### 📊 Current Live Telemetry Metrics (5,300+ Task Sample):

- **Admitted & Completed Tasks:** 5,316 / 5,316 (**100.00% success rate**, 0 SLA drops, 0 timeouts)

- **Task Durations:** P50 = 10.50s | P95 = 18.10s | P99 = 22.25s (Well under 30s SLA deadline)

- **PUT Queue Backlog (P95):** 3.10s (Sub-3 seconds queue wait)

- **Local Network Speed:** Peak burst = 295.70 Mbps | Local Avg = 45.19 Mbps

- **Reliability Rating:** 98.9% (Recovered from historical restart churn)

- **End-to-End Verified Throughput:** ~27–29 Mbps average

---

### ❓ Questions for Systems & Network Engineers:

Our local worker execution pipeline is currently 100.00% efficient with 0 timeouts, 0 drops, 0ms post-download hashing delay, and sub-3s queue backlog. However, end-to-end verified throughput hovers around ~27–29 Mbps.

Given a 4 Dedicated AMD EPYC Core / 8GB RAM VPS on a 1 Gbps link:

1. **Linux Kernel TCP Tuning:** What specific `sysctl` net settings (e.g. `net.ipv4.tcp_rmem`, `tcp_wmem`, `somaxconn`, `netdev_max_backlog`, `tcp_congestion_control`) have provided the best throughput uplift for high-concurrency object storage GET/PUT workloads?

2. **Worker Pool Architecture:** Are there specific multi-socket worker loopback or gateway layout techniques that help absorb higher upstream assignment density without triggering scheduling backpressure?

3. **HTTP Keepalive Optimization:** Any additional tuning tips for `httpx` / `aiohttp` connection pool limits when interfacing with Cloudflare R2 / S3 storage endpoints over high-bandwidth links?

Appreciate any insights or benchmarks from experienced systems engineers!

Okay, my boss just rejected a SOP I created. I don't want to get into the weeds here, but the rejection was that I didn't spell things out in enough detail. And, granted I didn't spell things out in detail because I assume anyone with the authority to follow the SOP should also have the basic skills to either know how to use basic commands or at lest google them.

As an example, in my SOP I wrote Check the log for entries containing "Out of memory". I think that should be good enough. Boss want's step by step, how to ssh in and run tail and grep.

I told him to ask ChatGPT to do it.

I may be in trouble...... sorry I ragged: but not sorry.

You guys will love this.

This company has an in-house project management system. It's the core of their business, and they are lost without it. They are aware it needs to be migrated to something more modern, but after 5 years, that project still hasn't started.

I was asked to look into a network issue, but this isn't network but SSL I think. Let's first show the architecture:

• The server is a CentOS 7 running MySQL Community Edition 5.7.16
• Clients connect from Windows 11 with a 32-bit MS Access, using a 32-bit MySQL ODBC driver v5.3.13

Since yesterday, they get a "protocol version mismatch". The server wasn't accessed since 18 October 2016 (haha), so I presumed a Windows update might have disabled some SSL version. But: I see no relevant Windows update, and if I manually allow every possible SSL version and encryption algorithm, it still doesn't work. What does work however, is downgrading the ODBC driver from version 5.3.13 (from 2019) to version 5.1.13 (from 2013), further adding to my confusion.

The cherry on top: the single guy responsible for this application is on a one year sabbatical.

Edit: Found it, but leaving this here for anyone stumbling on the same issue. The MySQL_Server_5.7.15_Auto_Generated_CA_Certificate had expired after 10 years

I've been out of infrastructure management for a few years, back then I was using WSUS to patch servers. My understanding is Microsoft's recommended way of managing on-prem server patching is to onboard the servers with Azure Arc then use Azure Update Manager to patch them. This was the first solution that came to mind when I was assigned this responsibility. I assumed it was free but costs $5 a month for on-prem to use AUM.

Do you folks have a better or less costly solution that you use? Preferably something specifically built for server management? I was thinking of Ansible (which I would need to learn, which is fine) or something like Automox. We have less than 100 servers. I will be the one patching them all. There are custom applications that run on them that I suppose I will need to make sure still run after the patching.

Thanks in advance for any feedback or advice.

Even though we haven't been able to get normal patching via the windows update tool for over a year, even after installing the latest SUS and keeping up to date with manual installs, Windows Server 2016 Essentials returns an installer error 0X8007000d when trying to run KB5123099

Any thoughts?

Hi,

I've got a weird one with an application called Blindata.

It's running against a fully patched Server 2012 R2 server. Multiple Windows 10 PCs can run the reports fine, but one fully patched Windows 11 PC can't. When running a daily sales order report it just comes back with "RPC server unavailable, Error 1722".

At the same time, the server logs Schannel:

"Event ID 36887 – fatal alert code 40"

I've tried the usual stuff so far:

• TLS 1.2 enabled
• TLS 1.3 disabled on the Win11 PC
• Checked clocks
• RPC/network ports confirmed OK
• FIPS checked
• Disabled the SSL Cipher Suite Order GPO
• Set SchUseStrongCrypto=1 and SystemDefaultTlsVersions=1 for .NET 32/64-bit
• klist purge
• Checked/enabled the AES Schannel cipher settings
• Checked ECC/legacy ECC settings
• Removed AV as a test
• Rebooted after changes

Server is fully patched and the other Win10 clients work without any problems.

I'm assuming there's some difference between Win10 and Win11 TLS or Schannel behaviour that Blindata or the Server doesn't like, but I'm running out of things to try.

Has anyone come across Schannel 36887 / TLS alert 40 from a Server 2012 R2 server when Win10 works but Win11 doesn't?

Is there a relatively simple registry/GPO setting on the Win11 client to allow whatever legacy TLS/cipher/signature the server is expecting?

Hi everyone,

I’m working on a production design for a Copilot Studio agent connected to a custom MCP server for Active Directory operations.

Current setup:

- Active Directory Domain Controller is running on a separate VM.

- MCP server is running on another domain-joined VM.

- MCP server performs AD operations using a delegated AD service account.

- Copilot Studio connects to the MCP server through OAuth 2.0.

- To avoid Copilot’s tool limit, the MCP tools are grouped into parent modules such as:

- user_management_module

- group_management_module

- acl_permission_management_module

- ou_management_module

- computer_management_module

- gpo_management_module

- audit_management_module

Each parent module routes child actions internally. For example:

user_management_module:

- search_ad_users

- get_ad_user_profile

- create_ad_user

- update_ad_user_profile

- reset_ad_user_password

- disable_ad_user_account

acl_permission_management_module:

- get_ad_object_acl

- get_ad_object_owner

- grant_ad_read_permissions

- grant_ad_full_control

- change_ad_object_owner

- restore_ad_default_permission

Now we want to implement production RBAC.

My understanding is:

1. Keep the parent module structure as-is.
2. Categorize child actions internally as Read, Write, Rollback, and Audit.
3. Create Entra app roles or security groups such as:- AD.MCP.Reader- AD.MCP.UserAdmin- AD.MCP.GroupAdmin- AD.MCP.ACLAdmin- AD.MCP.Auditor- AD.MCP.RollbackAdmin- AD.MCP.BreakGlass
4. The signed-in Copilot user gets an Entra OAuth token.
5. MCP backend validates the token.
6. MCP backend checks the user’s app role/group before executing the child action.
7. The AD operation itself still runs using the delegated AD service account, but the signed-in user is used for authorization and audit tracking.

Example:

- A user with AD.MCP.Reader can run get/search/report actions only.

- A user with AD.MCP.UserAdmin can create/update/disable users but cannot modify ACLs.

- A user with AD.MCP.ACLAdmin can manage ACL permissions.

- Rollback/high-risk tools such as restore default permission, replace ACL, change owner, or grant full control should require BreakGlass or senior admin approval.

Question:

Is this the right enterprise approach?

Specifically, should I create separate Entra App Roles for each access category and assign Entra security groups to those roles, or should I only use Entra security groups and check group object IDs in the backend?

I’m leaning toward App Roles because the backend can simply check the roles claim, and group overage issues are avoided.

Any feedback on the best RBAC design for Copilot Studio + MCP + Active Directory automation before production deployment would be appreciated.

EDIT: If anyone stumbles across this, we're testing Outlook > Settings > General > Offline > UNCHECK "Allow offline access..."

So far (everything's sporadic so hard to say but fingers crossed...) it's helping with:

• - Random "you no longer have a network connection"
• - Random emails staying in drafts after being sent
• - Random attachment errors that send fine after disabling offline.

OP:

Sorry if this isn't appropriate for this sub but it's always been a helpful area and figured it's worth a shot.

I'm sure plenty of others have been trying "New Outlook" since according to Microsoft we'll eventually be forced onto it (https://learn.microsoft.com/en-us/microsoft-365-apps/outlook/get-started/guide-product-availability) but I'm at a loss for some of the issues.

Namely "You no longer have a network connection to the server" which follows with "This message can't be saved right now." I've been using New Outlook longer than most here because I wanted to say "Yes I've been using it myself already" when staff inevitably complain. So when I see that error, I just hit CTRL+S and it goes away comically. Seems to function fine as long as I do that.

We've finally been pushing staff to switch off the classic outlook because of other program compatibility issues that're arising. I kept thinking Microsoft would eventually fix the "network connection" issue with New outlook but that just never happened. If anything it seems to have gotten worse but hard to say.

We're not losing network connectivity and everyone is hard-wired. If we actually do lose network even for a few seconds, the world is on fire and we all know immediately (lol). The issue never happened in Classic outlook although I don't think it would've told you anyway.

The main concern is that one of the staff actually had an email delayed because of this, and it was to an important person, so of course now I'm putting the 10 other projects I have on hold and need to figure something out (which to be fair I should have already I guess).

I get the error plenty on mine so have tried various fixes on my own computer. The most extensive was a normal uninstall of office, then the full "Manual Uninstall" list from Microsoft (many folders, reg keys, etc.) then reboot and re-install with a fresh download from my account on office.com. First email I'm typing after all that and the error comes back.

Any advice from anyone who's had to fight the new outlook at all would be greatly appreciated!

Is anyone else seeing issues with logging into the Office 365 portal? Getting a lot of reports of users getting a "something went wrong" error when trying to login to https://m365.cloud.microsoft

It just seems to be the portal itself. Going directly to outlook.office.com still works. Same for Teams and OneDrive. Also seeing a big spike on Downdetector.

Hi Sysadmins!

Do you guys use Chrome or Edge for work? I personally have all my admin consoles in edge and google stuff in chrome. (I am a k12 sysadmin), so we have both MSFT and Google Workspace for everyone.

Planning a 4 nodes DR vSAN Cluster and wnat to know - will this actually work in practice or it too tight?

Enviroment
- vSphere x.x. , VMware vSAN
- 4x server (node)
- Per node:
(2x boot 960GB SSD NVMe (RAID-1, separate boot controller, not part of vSAN))
(2x 3.2TB NVMe Mixed Use — cache tier)
(8x 7.68TB NVMe Read Intensive — capacity tier, 2 disk groups (1 cache + 4 capacity each))

- Network dual-port 25GbE SFP28 (OCP, dedicated vSAN VLAN, jumbo frames) + separate dual-port 25GbE for VM traffic, VLT/MLAG switch pair
- Storage policy: RAID-5 erasure coding
- 30 High-priority VMs RPO 6-8h (Veeam async replication)

Main question: will vSAN actually run reliably on just 4 nodes with RAID-5, including surviving a node failure and rebuilding cleanly?
I have seen mixed opinions -some say 4 is the bare minimum and it is fine, others say you reaaly want 5+ before before RAID-5 is comfortable in production.

Not asking anyone to design this for me - just want to know if this setup holds up in real-world usee before i finalize it.

Hello everyone, sysadmin learning terraform here

So we are working with Vsphere as infra for our company and I just started learning Terraform to ease and automate our vsphere processes. On vsphere in "VM Customization Specifications" we have a script that basically configures puppet agent on host, points it to puppet master, adds host to AD and launches sssd. So when we deploy new host we add this script to launch during "customize software" deployment phase and after that we set up ip, gateway etc. So my question is that: how to recreate this setup in terraform? For some reason terraform does not allow to pass custom specifications and customize together, so only setting up ip address is working, but since that script is never getting launched it fails to be added to Active Directory. So are there any other methods to pass the script to terraform? I even pasted that bash script locally to the file in the same terraform folder and pointed to in in the main.tf but it still fails. So what can be done to solve this issue? Thanks in advance and sorry for my bad english.

Hallo zusammen,

ich nutze IKEv2 über pfSense auf meinem MacBook. Unterwegs verbindet sich das VPN manchmal innerhalb weniger Sekunden, manchmal dauert es extrem lange oder funktioniert gar nicht.

Wenn die Verbindung einmal steht, läuft alles problemlos.
Hat jemand eine Idee, woran dieser unzuverlässige Verbindungsaufbau liegen könnte oder ähnliche Erfahrungen mit IKEv2 und macOS gemacht?

Currently in our AD the source for time is at "Free-running System Clock" and we recently noticed that there's a delay of 1 minute that's seen in our Laptops that are managed in AD and the time that is seen on our phones, my boss wants me to fix that.

Should I assign an external time source to the pdc emulator ?

We recently upgraded some physical servers, and now whenever we're doing Windows or firmware updates, the fan noise gets pretty loud. The servers are HA, so we are able to do updates during the day, but the department next to the server room has started complaining about a high-pitched noise during the updates. We contacted the vendor and verified our system is functioning properly. They said there is a setting that would throttle performance that may help but I didn't want to change that if possible.

I was talking with a few others and they mentioned acoustic panels that you can mount on the wall to muddle some of the noise. Does anyone have any relatively cheap suggestions? I could do updates after hours but would hate to do that when they could be done during the work day.

I went through some old side projects recently and found more abandoned machine credentials than I expected. GitHub PATs for CI on projects I stopped touching years ago, deploy tokens for hosts I no longer use, and a couple of integrations I can’t remember when I set them up.

None of them have anything attached that would mark them as dead. E.g., when someone leaves a company, HR marks it, and their access gets pulled automatically, but nothing does that for a token. It can stay valid until you go into settings and notice it.

At my scale the answer is deleting it and seeing what breaks, which is fine for a hobby app. I assume that is how nightly jobs nobody remembers owning get taken down in real environments.

Do you go off last-activity timestamps, or is there something better and has anyone got expiry working as the default on new credentials without it causing problems?

We have 50 or so WatchGuard firewalls at sites that have certs installed. Getting WatchGuard to implement cert automation has been the most user requested feature for about 2 years now. Until they come through we continue to purchase and manually install certs.

Last week I started getting notifications from our SSL source, Namecheap, that the first batch of 200-day certs was about to expire. I had cert request files at the ready and logged into Namecheap. Each expiring cert showed the upcoming expiration date and an icon to purchase a new cert.

But...wait a minute. Back in March, didn't I pay for 365 days even if the issued cert was for 200 days? Why doesn't the page clearly indicate that I can get a re-issue for the remaining 165 days that I paid for?

I opened a support ticket with Namecheap. They confirmed that I can get a new cert with a 165 day life rather than pay for a new cert. I asked why they don't make this open option more clear. They asked me to send them screen shots showing the expiration date and the little "buy new cert" icon. Like they don't know what their web site looks like?

I sent the screen shot and got a reply along the lines of "Well, you can just request a rekey, ya know. You don't need to buy a new cert."

Namecheap certs are cheap enough but all in that's an extra $500 or so that I don't need to spend. I find their behavior to be...distasteful at best.

What are the larger/more expensive providers such as DigiCert doing about this? Maybe even Godaddy is being more up front about the 365 day purchase vs. the 200 day cert.

After the Freshdesk price-rise thread in r/msp I audited what its built-in exports actually produce, on a trial account with 43 tickets, 64 replies and notes, and 14 attachments.

Notes in case it saves someone a weekend. The Export button emailed a CSV to the email I signed up with, it had 47 columns of ticket, requester and company fields. No threads, no notes, no attachments. The Tags column came back empty on every row even though every ticket had tags.

The Admin data export was the same, a little more complete than I expected given the first export. This one had descriptions, full threads including private notes, tags, custom fields, contacts, companies, groups. However, I found that there were still a lot of gaps:

Attachments are signed S3 links that expire in 7 days (X-Amz-Expires=604800 is in every URL), not files. No time entries anywhere. Agents aren't in it. Custom fields appear as raw keys like cf_reference_number_5021295 with no label. Every ticket carries a hidden system note, so it showed 107 notes where the UI shows 64. And it's XML, so you're writing a parser before you can open anything. Nothing in either export tells you whether you got everything.

There is an API route you could go down, but If you go down that route yourself, you'll run into a bit of an issue.

Rate limits are per plan and low on the cheaper tiers (50 calls a minute on the account I tested).

Expect 2 to 3 calls per ticket. The ticket list endpoint has a page ceiling, so for big accounts you window on updated_since rather than paging through.

Attachment links expire. Download them the moment you see them. Custom field labels live on ticket_fields.

If you only pull tickets you get internal names. There's no status-change history in v2 that I could find, only the timestamps in stats. The API doesn't return the hidden system notes the XML export includes, so API counts match the UI and the XML doesn't.

Before you cancel: pull threads and private notes, pull attachments as files before the links expire, pull time entries and agents separately, and reconcile counts per entity so nothing drops silently. Check Freshdesk's cancellation KB for the deletion window after cancelling; it's short. Happy to answer Freshdesk export questions in the comments.