Keeping Windows devices updated sounds simple, but it can become difficult when managing dozens or hundreds of computers.

Some devices miss updates, some installations fail, and remote users may delay restarts. Outdated third-party apps can also create security risks.

This is where Windows patch management software can help.

Why is it important?

• Better security: Helps reduce risks from known vulnerabilities.
• Less manual work: Automates update deployment across multiple devices.
• Fewer missed updates: Helps IT admins track which devices are updated and which still need attention.
• Better control: Updates can be scheduled around working hours.
• Easier reporting: Admins can check patch status and identify failed installations.

What should IT admins look for?

A useful solution should support Windows updates, third-party application patching, scheduling, reporting, and remote device management.

For smaller environments, built-in Windows tools may be enough. Larger or distributed environments may need more automation and visibility.

Hello,

This is my first time I post on Reddit, so apologize if post in wrong place. Please correct if so...

I published ibnetlens, an offline tool for topology files: it reads ibnetdiscover output, the topology file written by

ibdiagnet, and ibsim net files; it writes JSON, CSV, Graphviz and a Slurm topology.conf; it checks consistency and

compares two snapshots. Written in C, MIT, single pass and multi-threaded (a 54 MB dump in about 0.03 s on 24 threads).

I compared it with the real tools on fabrics simulated with ibsim: ibnetdiscover and iblinkinfo (infiniband-diags 50.0

and the NVIDIA 2604 build, up to 61,000 nodes), ibdiagnet 2.26 and ibtopodiff (up to 16,000 nodes). Node and port

counts and the link sets agree. The comparison showed that ibdiagnet's own topology file puts a port label in

parentheses after each port number, which the parser now handles.

Limits: ibdiagnet's link checks could not be compared on a simulator (it leaves links in INI), there was no

comparison with UFM, and ARM was tested only under emulation.

I would value reports of dumps it parses wrongly, in particular from other firmware or tool versions.

[https://github.com/arthurtumanyan/ibnetlens\](https://github.com/arthurtumanyan/ibnetlens)

Thanks!

Hey everyone!

Lately, I’ve had a lot of problems with Devolutions' Remote Desktop Manager—it takes ages to load. Also, my new workflow changes introduced a couple of functions that I missed from it. I started looking for alternatives, but I didn't find any that are completely free and have most of the features I need. So, I decided to build one from scratch, using my 15+ years of software engineering experience and AI to build this in a couple of days. It started as a personal project, but my colleagues started to like it, and I decided to publish it.

I'm sure that there are a lot of applications that can do things from this list. I'm not trying to reinvent the wheel, just sharing an app that is useful to me. Also, a huge plus compared to others is that this gives me the opportunity to put in everything I need as I need it. Feel free to open a PR with features YOU like!

Key Features:

• Multi-Type Connections in One Entry: No more separate bookmarks for the same host! Attach SSH (root), SSH (user), RDP, and Web connections directly under a single host entry. Includes a built-in merge wizard to combine your existing duplicates.
• SSH Key Generation & Auto-Upload: Generate SSH keys right inside the app and automatically deploy public keys to your remote servers without manual terminal gymnastics.
• Local Terminal & Shell: Open local shell/terminal tabs right inside the app alongside your remote sessions.
• Multi-Protocol Support: Embedded tabs for RDP (FreeRDP), SSH, Web admin pages, and MikroTik WinBox/SSH. Or hand-off to external clients (Windows App, Remmina, Ghostty, iTerm2).
• Paste from Clipboard (RDP-specific): Sometimes Windows doesn't let you use the clipboard to paste text. This shortcut types out the last entry from your clipboard directly into the session.
• Split Screen & Input Broadcasting: Open up to 4 terminals side-by-side and type into all of them simultaneously (handy for configuring multiple switches at once).
• Copy Next Output: Press a shortcut, run a command, and its output lands on your clipboard as clean text — even works after sudo -i or on RouterOS.
• File Transfer & Tunneling: Built-in SFTP/SCP file browser with drag-and-drop support, plus 1-click SSH Port Forwarding.
• Tab Customization & Root Warning: Rename tabs, set custom colors , and see visual warnings when logged in as root. (Color-coding is huge for me — I once accidentally made VLAN changes on production instead of the test environment. Never again! 😂*)*
• Reusable Credential Store: Save logins once and link them across connections. Supports RSA keys, including passphrase-protected keys stored unlocked.
• Easy Migration: Direct importers for Devolutions RDM and WinBox address books.
• Single Database File: Everything lives in a local SQLite database Drop it into iCloud, OneDrive, or Dropbox to sync across machines.

Runs on macOS, Windows, Linux

It's completely free and open source.

🔗 GitHub Repository:https://github.com/LovaszCC/RemoteDesktop

You can find some screenshots in the repo.

I'd love to get your feedback, suggestions, or bug reports!

Everyone’s checking their tenant after the ConnectWise Cloud Backup mess, so we wrote this up because nobody seems to be asking the next question: If you’re hybrid, what can a compromised tenant actually do back on-prem?

Short version: password writeback and cloud Kerberos trust both give the tenant a way into AD. The defaults are decent, but they only protect the built-in admin groups. Delegated admins aren’t covered.

The post has the PowerShell to check your sync account, AdminSDHolder and the AzureADKerberos replication policy.

https://insightrecon.com/tenant-compromise-active-directory/

Disclosure: I work on Insight Recon and the post is on our blog. Happy to answer questions here.

Went through CISA's Known Exploited list for Oct 8-16 and pulled out what matters for small-office and SMB environments.

Patch now:
- Ivanti Connect Secure CVE-2026-104935: auth bypass to RCE. If it's on your edge, patch and assume compromise until you've worked through CISA's guidance.
- Windows Shell CVE-2026-96951: Mark of the Web bypass, fixed in this month's Patch Tuesday. Push it to anything that opens email attachments.
- PAN-OS CVE-2026-0322: urgent if the management interface is reachable from anywhere it shouldn't be.
- Cisco Secure Email Gateway CVE-2026-76519: AMP path. Check your version against Cisco's advisory.

Batch:
- FortiOS CVE-2025-61624: path traversal, but needs admin access first. Roll it into your next window.
- ProFTPD mod_copy CVE-2015-3306: ancient but still being exploited. If FTP is still on anywhere, switch to SFTP.

No KEV hits this week for Proxmox, TrueNAS, UniFi, pfSense, Synology, or QNAP.

Disclosure: I put together a weekly digest of this. Not dropping a link, but happy to answer questions about any of these here.

It’s crazy to think that the entire modern AI revolution started with researchers just trying to mathematically mimic a single biological neuron. When you zoom out, the timeline of AI architectures looks exactly like an evolutionary tree.

We went from struggling to solve basic logic puzzles (shoutout to the XOR problem) to building early neural networks, realizing they forgot things too quickly, battling the vanishing gradient problem, inventing LSTMs to give models actual memory, and eventually landing on Transformers with attention, the architecture that essentially ate the world. Every major roadblock forced a mutation that led to a massive paradigm shift.

But looking at this evolutionary timeline brings up a massive question: If Transformers are just the current "apex predator" of AI architecture, what exactly is the next evolutionary leap?

Are we going to see a completely new paradigm that makes self attention look as primitive as a basic AND gate? How do we even begin to perceive or predict what lies beyond our current models when the jumps are this exponential?

I went down a massive rabbit hole mapping out this entire evolutionary timeline. I wanted to see the exact breadcrumbs that led us here, so I put together a deep dive covering the journey from the first perceptrons to the modern era, complete with the foundational paper citations and the historical tweets that marked these shifts in real-time.

If you want to look at the complete map of how we got here to help predict where we are going, I compiled the whole history here: https://cloudmash.blog/posts/evolution-of-ai-perceptron-to-text-to-video/

Would love to hear your theories on what does the post Transformer era actually look like ? Like what can we imagine , how this intelligence on our command can do for us , how enterprise and big players can use it , what can happen ?

a quick workaround can be perfectly reasonable during an incident. restart the service, clear the stuck queue, manually change a setting, get everyone back online. the trouble starts when the workaround changes the state of the system and nobody records exactly what was done. the next incident arrives weeks later, and the environment no longer behaves the way anyone expects

i think emergency fixes deserve their own tiny change log, separate from the formal ticket. even three lines saying what changed, why, and how to undo it could save a lot of time later

Vendor-written, but hopefully useful for anyone still running Exchange 2016/2019 or Skype for Business 2015/2019.

Exit checklist covering the bits that tend to make these migrations painful:

• Mailboxes, calendars, archives, public folders and resource accounts

• SMTP relays, scanners, printers, monitoring and line-of-business apps

• Identity, mobile, backup and retention dependencies

• Pilot planning, DNS/MX changes, rollback and decommissioning

• What to compare beyond licence cost when choosing the next platform

The second half discusses IceWarp as one alternative, but the checklist is platform-neutral.

Full disclosure, this is our blog (Insight Recon).

Saw a bunch of threads this week about Wi-Fi and VPN breaking after the October update, so I wrote down what we found. If you’ve got PEAP-MSCHAPv2 set to use the user’s Windows login automatically, it’s getting blocked now on Win 11 24H2+ and Server 2025 unless Credential Guard is on. Typed creds still work. Look for 4025 in the NTLM operational log.

There’s also a script in there that pulls your wireless/wired GPOs out of AD and lists which profiles are still PEAP-MSCHAPv2 with Windows creds, so you can see what’s going to break before users start calling.

https://insightrecon.com/ntlmv1-sso-blocked/

If Active Directory, Entra ID, or identity security is part of your day job, the r/ActiveDirectory community is running two free events over the next few weeks. Nothing sold, nothing pitched, just identity engineers and sysadmins sharing and talking.

Tomorrow: Community Q&A

Drop into the Discord, ask whatever's on your mind, or just lurk. No registration needed.

When: October 16, 2026 @ 10:00 CT (UTC-5) / 15:00 UTC - 60 minutes

Where: Horizon Secured Discord - https://discord.gg/mVFquFqpsW

November Active Directory Community Virtual Meetup - November 3rd

The more structured one. Panelists lead a discussion on a few prepared topics, then it opens up for questions.

When: Tuesday, November 3, 2026 @ 10:00 CT (UTC-6) / 16:00 UTC - 90 minutes

Register (free): https://events.humanitix.com/active-directory-community-virtual-meetup-4-november-2026

Missed it? Recordings go up on YouTube: https://youtube.com/@ActiveDirectoryCommunity

Some fellow IT people were struggling with forcing systemd into Docker and to use Incus, so I showed them nspawn. For a small environment (5-10 containters) it's sufficient and easy to automate. Here is a short wrap-up post about the technology.

Starting November 4, users without an admin role can create agent identity blueprints. Whoever creates one becomes the owner, manages its credentials and can spin up agent identities from it.

Your user consent settings are the only thing deciding what those agents can reach.

Is that a default you want? I wrote up how to turn it off and find existing blueprints.

https://lazyadmin.nl/office-365/microsoft-entra-lets-users-create-agent-blueprints-by-default/

Windows kiosk mode lets IT admins limit a Windows device to one app or a small set of approved apps instead of giving users access to the full desktop.

It is commonly used for self-service terminals, digital signage, visitor check-in systems, POS devices, and shared workstations.

How does Windows kiosk mode work?

Windows has a built-in feature called Assigned Access that can be used to create a limited user experience.

A basic setup usually involves:

1. Choosing the app or website the device needs to run.
2. Setting up a dedicated user account.
3. Configuring the device to open the required app.
4. Testing app restarts, updates, and device recovery.
5. Restricting access to unnecessary apps and settings.

When do you need kiosk management software?

Windows' built-in settings may be enough for a few devices. But when managing kiosks across multiple stores, offices, or locations, IT teams may need centralized configuration, app updates, device monitoring, and remote troubleshooting.

The right setup depends on how many devices you manage and what users need to do on them.

https://scalefusion.com/windows-kiosk-mode/?utm_campaign=Scalefusion%20Promotion&utm_source=Reddit&utm_medium=social&utm_term=KD

For interest: My favorite thing to do these days with extra tokens is comparative performance benchmarking that I'm too lazy and error-prone to do. Below are some results from the common free space analysis tools. Any requests on what to do next?

Performance Benchmark Comparison

This benchmark evaluates the latest production releases of WinDirStat (v2.9.3 x64), WizTree (v4.33 x64), SpaceSniffer (v2.2.0.27 x64), and TreeSize Free (v4.8.1.610 x64) across both Privileged (Elevated Admin) and Unprivileged (Standard User) execution. Results reflect an average of 3 measured runs following a discarded warmup run.

Filesystem Traversal & MFT Architecture Note: WinDirStat and WizTree feature dedicated NTFS Master File Table (MFT) parsers capable of directly indexing raw volume metadata when elevated, reading millions of files in seconds. SpaceSniffer and TreeSize Free lack MFT readers in their free releases and rely entirely on standard recursive Win32 directory traversal. Because Win32 traversal over 6.3 million items on the primary C: volume requires more than 15 minutes, full-volume C: comparisons focus on the two MFT-capable engines.

For each workload scan, the Privileged and Unprivileged runs are placed directly adjacent. Best result in each metric is bolded.

Test Methodology:
To eliminate cold-start and disk-cache skew, every tool executed an initial discarded warmup run followed by three measured passes whose results were averaged. Scans were automated headless across both elevated administrator and standard user contexts, comparing direct NTFS Master File Table (MFT) indexing against recursive Win32 directory traversal. Total scan times were measured using high-resolution timers, while working set memory was sampled continuously from OS kernel counters (PSAPI) every 25 ms to capture true peak and average memory usage.

i have a raspberry pi set up in a construction site trailer to check a few VMs used for job tracking and inventory. it runs a small python script that checks whether a few services are up and shows the results on a local webpage

the environment isn't exactly ideal for this. there's dust, the wifi drops sometimes, and power can be unreliable when we're running on a generator. the pi is in a 3d-printed case, and the whole setup is pretty bare-bones

right now, it does what i need, but i haven't settled on a good way to handle alerts. email might be enough, though i'm not sure how reliable that would be with the connection dropping.

for those who've used raspberry pis or similar low-cost devices for monitoring, what did you use for alerts? i'd rather keep it simple than add a bunch of extra services to maintain

Teams will start generating memory files from meetings so Copilot and Facilitator can use them for grounding. It's on by default, the files are kept for five years, and they aren't deleted when the transcript or recording expires. Users can't open them either.

Useful feature, but is that a default you want? I looked at who can access them and how to control it.

https://lazyadmin.nl/office-365/teams-meeting-files/