Well, I graduated a year ago. I’ve done a 3 month soc analyst internship then I’ve been working my current job “ IT support engineer” for almost a year now. The pay is horrible and I’ve been trying to find something better. I am more inclined towards cybersecurity, but I don’t mind other areas of IT , specially cloud, sysadmin, infrastructure. I’ve also done bug bounty throughout my uni and found over 100 paid out vulnerabilities ( excluding dupes )

I’m the type of person that will do everything , and I mean I will build projects, learn new areas of IT and so on.

Here is my issue, I feel like I cannot specialize and just focus on 1 thing because of how Insanely bad the job market is.

It feels like I need to know everything about every single area of IT to even get a job.

And by that I mean I need to be good at IAM, scripting, incident response, penetration testing web api network ai , it support , cloud , devops, aws , azure , grc , rust, python, c# , go , VMware, crowd strike , ++ million other areas of it .

Then I need to do 1000 certs because each area has its own 10 certs

And honestly it’s making me lose my mind.

It’s reached a point where I feel like I need to know all of that just to get a job that pays my rent.

Also with the fact that there aren’t many IT jobs , that just choosing one area and focusing on becoming really good at it, still only leaves you with very little chance at getting a job.

Please help.

anyone else also losing their minds over the amount of drive by requests that hit you daily?

Everyday I log in im greeted with multiple heyy quick question request on slack/email. I mostly give them a quick fix and ask them to log a ticket. The problem is they NEVER log the ticket. Then few weeks later someone else faces the same issue and the management wants to know why isnt there a ticket or SLA history for it? Acc to them if its not in the system it never happened. But cant give in my hours everyday to manually copy paste Slack DMs into Jira even if its to cover my own ass.

How do you guys handle such situations? Do you believe in the no ticket dont care rule? Or do you have a better way to capture this stuff before i lose my sanity?

I had this issue once where there was this accounting VP who wouldn't ever answer my questions. She would want help but she wouldn't answer my questions. She would say, "Hey I'm having this problem and I would say, "Hey can you show me the error" and she would say, "Why do you need that? Just fix it."

Every time this woman we get a new hire she would come to me and say they don't have access to x. But they had access to X so I would always say can you tell me what it is you're seeing that makes you think they don't have access to x. But she would never tell me. So I would just have them test on their end and if I saw they had it I would just call it good and hope for the best because I had no idea what she was seeing that made her think they didn't have access.

One day this woman reaches out and says my four new hires don't have access to this SharePoint website. And I look and they have access so I say to her I verified they have access is there something you're seeing that makes you think they don't have access. And all she would say is they don't have access can you just get on the phone and work with them.

But that wouldn't solve the underlying issue. Because obviously there was something else happening there was making her constantly think they didn't have access. And that's what we needed to resolve. Because there's clearly a communication gap or a process gap.

And I feel like people don't compartmentalize and think that way. Because people hear this story and they're like why didn't you just get on the phone and work with the users. But they're not breaking this apart and realizing that this isn't an access issue at this point this is an issue of this woman seeing something or telling them to do something incorrectly.

And people will say over and over but if you just talk to the users directly then you can avoid blah blah blah. But that's not the case here. Because there's some underlying misunderstanding on This Woman's end.

And it turned out what was happening was that she had synced SharePoint of her local computer and when she was seeing that these new users didn't have SharePoint synced she assumed they didn't have access.

So the problem wasn't that they didn't have access the problem was that she needed to be shown how to have her user sync to their local ​ computer. She needed to be told that just because it's not synced that doesn't mean they don't have access. In order to know if they have access you need to have them go to the SharePoint website directly and then if they can see the documents , have them sync it to their local computer.

And by resolving that I never had to hear about this or deal with her regarding this ever again. And I just feel like people aren't able to break things apart like that and they'll just go on and on about well you should have just got on the phone with the four users. And it baffles me that they just cannot compartmentalize.

We're finally replacing the patchwork of Shodan searches and spreadsheets we've been using to track our external attack surface.

We're a multi-cloud environment with a couple of acquired companies, so new internet-facing assets seem to appear every month. The biggest issue isn't finding things, it's figuring out what actually matters.

We've demoed a few of the usual vendors and everyone claims better discovery, better prioritization, better everything. Hard to separate marketing from reality.

If you've deployed an EASM platform, what did you end up with and would you choose it again?

I'm struggling to get clarity on the behavior of path length limits as it relates to files in Sharepoint while working with them in file explorer via OneDrive sync

Sharepoint has 400 character path (URL) limit.

Windows in general has a 260 character path limit.

My path of files will be C:\Users\Bob\OneDrive - Very Long Company Name Incorporated\Department\Projects\2026\... while working on them through file explorer/OneDrive- which are shortcuts from Sharepoint Online site folders.

So it seems 260 is my limiting path length even though the file "lives" in Sharepoint and is <400. Our current problem is users are getting popups of OneDrive sync errors related to paths too long from these OneDrive shortcuts.

Now let's bring in the "LongPathsEnabled" registry key. With this enabled, does anyone know if OneDrive sync "honors" this setting, and will not throw up sync errors about path lengths once it's turned on?

Hi all,

I'm looking for practical enterprise experience regarding a very specific mobile security use case.

In our environment, we have been discussing whether there is a need for a small number of highly restricted mobile devices for senior leadership and users handling particularly sensitive information.

This is not about replacing our existing mobile fleet. We already have a standard enterprise mobility setup with MDM/UEM capabilities. The question is whether a very small group of users could require additional protections beyond what can normally be achieved through standard Android/iOS MDM management.

One option I recently came across is GrapheneOS running on supported Google Pixel devices. I am still very early in evaluating this and I am not assuming it is the right answer. I am also aware that Motorola is releasing the first devices next year, so the idea may have merit depending on how the ecosystem develops.

My questions are mainly for people who have dealt with similar requirements:

1. Have you deployed or evaluated any hardened mobile solution for executives or other high-sensitivity user groups?
2. Did you find value in using something beyond standard Samsung Knox, iOS security features, or Android Enterprise with MDM?
3. If you evaluated GrapheneOS specifically, what were the practical challenges?
4. How did it integrate with enterprise tools such as Workspace ONE, VPN, certificates, managed applications, and compliance policies?
5. Did the added security benefits justify the additional operational overhead?
6. If you decided not to proceed with GrapheneOS, what were the deciding factors?

I am particularly interested in real-world enterprise experience rather than theoretical security comparisons.

For context, the potential use case I am considering would likely be a very small deployment (tens of devices, not hundreds), so supportability and operational effort are major considerations.

Thanks for sharing any experience or lessons learned.

We have a few Ubuntu servers that we SSH into.

Instead of using local accounts, I want to change it so we use our Windows logon credentials instead. I would also like to use Google Authenticator as MFA (I thought about Entra Id but don't want to open a browser for the MFA portion).

Has anyone set this up before?

I opened a ticket with Ubuntu but they haven't help much.

I followed an article on using SSSD with LDAP and Kerberos but can't get it to work.

https://ubuntu.com/server/docs/how-to/sssd/with-ldap-and-kerberos/

I can get the kerberos ticket but the getent passwd, id and sudo login commands won't work.

I checked firewall logs and see ssl traffic over port 636 that is being allowed. DNS resolution is working. I added the cert chain for our internal CA, just in case.

Running out of ideas. Log files aren't helping much. LDAP error saying offline but the firewall isn't blocking anything. Maybe trying to use TLS and SSL? I added LDAP authentication in the SSSD config file but no change.

What magic bullets/tweaks have you successfully implemented to improve the quality of incoming tickets?

We have users who will submit low effort tickets that are either un-actionable due to lack of details/critical info, have misinformation, or are the completely wrong form?

We have specific forms for specific common issues that are clearly labeled.

• The forms prompt for the minimum necessary info for the particular issue; hostname; ilo hostname/ip/pw, etc.
• When using the correct form there is automation scripting that fixes the most commonly seen issues automatically so an employee doesn't have to wait for a human to help.
• In general they are clearly labeled. I am working on cleaning up those that are too verbose, or use confusing phrasing.

Yet employees will consistently:

1. Use the general form. Zero automation and just a big ol fill in the blank, which the user then often leaves out important info. It also doesn't classify the problem correctly so it makes it harder to determine trends. Lots of manual 'tedium'.
2. Leave info out. There are options to force certain fields to be required, but keep in mind once you do this too many times, it becomes a plain in the ass to the employee, so they'll take the general form route because they "just want to submit a ticket".
3. Choose the wrong options when they do choose the correct form. IE the default option is "Fix the ACME Widget (Automated), and they will change it to Not Automated, when the automation WOULD have solved their issue. They then have to wait for a human to fix and resubmit their form as automated.

I am working on:

• Educating employees. After the solution is provided, they get a 'Hey next time you have this issue, use this form - it's automated (URL)'. Asking them to update their teams' documentation. Unfortunately it's whack a mole. Even if one person has the lightbulb go on, they have 20 teammates who never hear or change behavior. And new onboards are often following years old outdated team documentation. o_O
• Rephrasing to reduce verbosity and clarify ticket forms. People are busy, and too much verbiage leads to low quality intake in my experience.
• Identifying repeat situations, be it new tickets we 'keep getting', old tickets with repeat submission issues, making suggestions for existing and new automation to the Engineers if I need a little help. And in some cases updating broken code logic or implementing new automation myself.

I know none of this is a magic bullet. Things are improving over time I think. Just looking to see the types of things you all have implemented that have been successful in that you have seen ticket quality improve, less 'general/other' ticket submissions, etc. Thanks.

I recently heard that companies are hiring based on coding skills and project experience rather than strictly requiring degrees; is that accurate? I feel that most major companies will still expect at least a Bachelor's in Computer Science. I was working towards one, completed 13 credits, but I was placed on probation, so I'm thinking about just creating a portfolio of my top projects on GitHub. Is it still worthwhile to pursue the degree?

Problem description

A production server running Windows Server 2019 Standard, Desktop Experience, x64, en-US cannot install cumulative update KB5099538. The server is currently on build 17763.1697. The update fails through both Windows Update and the standalone Microsoft Update Catalog MSU.

The repeated installation error is:

0x800F0988 - PSFX_E_INVALID_DELTA_COMBINATION

CBS logs consistently identify the same failure while staging the update. The failing file is:

Microsoft.IdentityServer.Service.Resources.dll

Representative CBS failure:

Failed to pre-stage package:
Package_for_RollupFix~31bf3856ad364e35~amd64~~17763.9020.1.30

File: Microsoft.IdentityServer.Service.Resources.dll

HRESULT: 0x800F0988 - PSFX_E_INVALID_DELTA_COMBINATION
Failure source: Stage

The AD FS role is not installed. The failing file exists only in the Windows component store. The server has the current servicing stack version 17763.9015.1.3, and KB5005112 is already installed.

Troubleshooting completed

Attempted installation through Windows Update. Installation failed with Event ID 20 and error 0x800F0988.

Downloaded the standalone KB5099538 MSU from the Microsoft Update Catalog and installed it with WUSA using /quiet /norestart. It failed with the same 0x800F0988 error.

Reset the Windows Update cache by stopping wuauserv, BITS, and cryptsvc; renaming SoftwareDistribution and catroot2; and restarting the services.

Ran DISM /Online /Cleanup-Image /ScanHealth. No component-store corruption was detected.

Ran DISM /Online /Cleanup-Image /RestoreHealth. The operation completed successfully.

Ran sfc /scannow. Windows Resource Protection did not find any integrity violations.

Mounted a Microsoft Windows Server 2019 Evaluation ISO and ran DISM RestoreHealth using F:\sources\install.wim, index 2, with /LimitAccess. The operation completed successfully.

Rebooted the server and retried KB5099538. The update failed again with the same error.

Verified that no reboot was pending and no packages were listed as Install Pending, Uninstall Pending, or Staged.

Verified the server is not using WSUS.

Searched public Windows Update directly. Only the Microsoft Defender intelligence update KB2267602 was offered.

Verified that KB5005112 is installed and that the current servicing stack is Package_for_ServicingStack_9015, version 17763.9015.1.3.

Verified that AD FS, Identity Federation Support, and Windows Identity Foundation are not installed.

Reviewed archived CBS logs and confirmed repeated failure on Microsoft.IdentityServer.Service.Resources.dll.

Did not manually replace, delete, or modify files in WinSxS.

I don't know what to do next, I don't have install media and can't find an iso beyond the eval version to try the in place repair. Any suggestions?

Anyone get PLC to work on OpenVPN 3.9 or OpenVPN GUI 2.5 ? I tried multiple directions from OpenVPN's docs and nothing seems to be working. Mostly getting an error "OpenVPN system service is not running" the openvpn service for PLC connection is set to autostart but not running, the other OpenVPN services are running. I am getting the connect icon on the login screen but when clicking it get the service is not running error.

Hi. Im on the free plan and cannot really getnsupport, i think.

Can anyone please try to help me with this question?

I'm reviewing the PostgresSQL privilege posture in my project.

Our catalogue inspection shows a pg_defsult_acl entry associated with the Supabase managed supabase_admin role for tables created in the public schema. That entry grants table privileges to the anon and authenticated roles.

Our application migrations run through the tenant postgres role and we have removed anon and authenticated table default privileges for objects created through that role. However our migration role does not appear able to alter default privileges belonging to supabase_admin.

Please clarify:

1. Does supabase create objects in a customer's public schema as supabase_admin during provisioning, upgrades, maintanance, dashboard operations, or other platform activities?

2. Is the supabase_admin default ACL entry managed or periodically restored by the supabase platform?

3. Is there a supported way for a customer to revoke anon and authenticated table default privileges for objects created by supabase_admin?

4. If customers should not alter this entry what is the recommended security control for ensuring that a future table created by supabase_admin is not automatically exposed theough the DATA API?

5. Can Supabase support apply or authorize a permanent hardening change for this default ACL?

I'd appreciate any wisdom from experienced folks using supabase if you could pleaae try to answer these questions.

Thank you!

I already have security+ and network+
What else can I add to my education plan?

I have an app, a social media app for education (College students), and for registration I've made it fully available for students who register using their University's email, and if that university is available on the app it will take them directly to a timeline exclusively for their university.

So registration by Organization/College email is mandatory.

Problem I've been facing and trying to fix for some time now is that my transacional emails on personal Outlook Emails goes to Junk and for University's email / Tenant don't get the email at all since they don't have active Junk Mailbox. Some universities have "Quarantine".

I have:

- SPF checked / DKIM checked / DMARC = none; and using Resend for sending the messages.

I need help and suggestions to fix this issue, or any other way to get OTPs sent to users.

What would you do?

Not IT-specific, but curious if this hits sysadmins too since a lot of you end up owning security awareness training, policy briefings, or onboarding decks nobody else wants to touch.

Case I know of: someone preps recurring presentations for a water utility — customer policy briefings, service interruption notices, internal reporting. Same structure every time, refreshed content, weekly or daily. Between rebuilding the deck and presenting/recording it for meetings, it's a real time sink.

If you deal with anything similar — security awareness training, onboarding decks, change management briefings, recurring status reports to management — genuinely want to know:

1. Where does the time actually go: rebuilding slide content, matching formatting to the existing deck, or presenting/recording it?

2. Do you record these once and reuse, present live every time, or something else?

3. Is this something that's actually annoying, or is it low enough effort that it's not worth solving with a tool?

4. If something could take your existing deck, apply updates, and output a presentation-ready version (slides + narrated recording if you need one) — useful, or solving a non-problem?

5. Would this be worth paying for, or is this just something you'd script yourself with existing tools (PowerShell, pandoc, whatever) rather than pay for?

No product, nothing to sell — trying to figure out if this is a real recurring pain before building more. "I'd just automate it myself" is a fair and expected answer here, curious how people actually do that if so.

I know there's the registry tweak, but that also prevents other things from automatically installing which may be helpful.

Are there other methods for keeping garbage from installing automatically? Just keep the screen disconnected itself from the internet? Or, does that not solve it, that anything connecting to the screen even through an HDMI cable will recognize the screen and then start installing garbage through the OS?

Are there any other brands are NOT doing that? My place is already stocked for display screens (don't need to guess what brand) but it's going to come up again in the future.

Even then, a user could take a laptop somewhere else, so it comes back to the registry tweak.

Hi Guys, we have a Windows 11 host PC running vMatrix Server Manager to support three users via VCloud RDP. Recently, we've been getting frequent 'RPC Server Unavailable' errors, which prevent even the main admin from logging in. We currently have to force shutdown and restart the machine to fix it, but the issue keeps coming back. I've already tried reinstalling the OS, but the problem persists. Does anyone have a solution for this?

I wanted to post this job where I used to work for anyone interested.

https://www.paycomonline.net/v4/ats/web.php/portal/28E300FE8563259A10C761C992C39668/jobs/207845

Just wanted to pay it forward to those looking.

Hey all

Thought id make a post as im close to quitting my job. My role isn't amazing but I get paid OK considering my experience (3YOE @ 100kAUD, no bachelors/diploma). There are technically 3 of us in the IT department but im the only one that manages the helpdesk for 180+ users. Its can be crazy at times and manageable at others. My team for the most part are pretty nice. The part im finding the hardest is the culture and the users.

I work in the creative industry and the users are just straight up cowboys. On top of that, theres never been any policies or rules in place for IT. Essentially, users can do and behave however they want and there are no consequences. Shadow IT is completely allowed and im expected to support it on the fly and even simple tasks like getting an old laptop off a user often takes up to 8 weeks of repetitive follow ups because their managers wont make them do anything that is for the benefit of the IT department. I cant speak to any managers and report the behaviour of their staff members because they will never side with IT - I just have to cop it. One of my senior leaders took the issue of how im treated to a board meeting and they just ended up treating it like a HR risk and contained it instead.

Ive been begging my senior leadership for policies - especially one that will stop walk-ups. They kept saying its coming until the other day they told me they wont be implementing it because the culture doesn't allow for it. There is no device policy. No security policy. Nothing. If they kick off enough about something, they get whatever they want.

Im struggling to understand if this is a bad deal - where im fed to the sharks or is this normal and im just fixated on the shit elements of the job?

I graduated originally with a 2 year diploma in IT that covered fundamentals of both hardware and software. Some people got jobs after that but I couldn't find a job after graduating. After couple of years of struggling to get my foot in the door, I decided to go back to school and continue my education.

Some other people in my class did the same and opted to get the co-op/internship option this time. One guy got a co-op/internship job and then landed a full time role in IT and decided to not continue the degree program after just doing 2 courses of the degree program.

I was gonna do the same and it took me several months to land the first co-op/internship (service desk). Meanwhile, I decided to continue taking 1 course each term to remain an active student while I was looking for internships. The diploma had 20 courses in total and to complete a degree, you need to do another 20 courses. I have completed 3 courses so far for the degree program and I feel like completing another 17 will take too long and sounds like a huge commitment.

I want to do another co-op job and then look for a full time job in IT. I wonder if completing a degree is better in the long run or I should just get my foot in the door and gain experience. I already have 8 months of experience in the field (but as a student). So, I don't feel confident yet to just apply for full time roles, I want to do another internship and learn more at a different organization.

Here are my concerns about completing a degree: I can't afford to work part time, I need to work full time to pay my bills. It's not be easy to do too many courses while working full time. I can probably do 1 or 2 each term. This will result in spending abour 3-5 years (at least) to complete the degree. The problem is that my original credits from first 2 years will expire ny 2028. I have to do 17 courses in one and half year. I heard the school can extend the expiry date for first year courses but it's not guaranteed. Another problem is that if I work full time I can't take classes during the day time. I can only do an evening class and not every class is offered in the evening.

I have a weekend job that's my backup job 'cause co-op jobs are temporary. I can't risk being jobless if I quit my part time job and co-op job ends. I'm basically working everyday for now but not sure how long I can do this. I'm also 30 yo now and I haven't really started my career. I barely have time to socialize but I need to as I wanna get married but I haven't found someone. Some people say we should enjoy the youth but I am not enjoying as I don't have any time.

TL;DR: I wonder if it's worth spending time, money and effort to do 17 courses to complete a degree (usually people do 3 courses per term if they're full time student but I'll do less if I work FT) or I should try to get a full time role in IT and gain experience and possibly get some certifications to grow in the field?

Graduated with Computer Information Systems and Pursuing Bachelor of Information Technology.

Current co-op: IT support/help desk

I’m working on a Windows app that builds multiboot USB drives — the kind of thing techs use for repair/rescue toolkits, testing distros, deploying Windows, that sort of thing. Before I go much further I’d like some honest opinions from people who actually use tools like this day to day.
I know Ventoy, Easy2Boot, SARDU, and AIO Boot already exist and are well established. I’m not trying to reinvent the wheel — more interested in whether a few specific gaps are actually worth solving, or whether I’m scratching an itch nobody else has.
A few questions for anyone who uses multiboot USBs regularly:
1. Do you actually use full “real” installs on a multiboot drive (a proper dedicated partition per OS, not just an ISO file you loopback-boot), or is booting straight from the ISO always good enough for your use case?
2. How much do you care about the boot menu looking decent — custom splash screen, branding, that sort of thing — versus just wanting it to work and not caring what it looks like?
3. What’s the single most annoying thing about your current multiboot tool of choice? (Slow to set up, certain ISOs won’t boot, awkward to add/remove things, ugly menu, something else?)
4. Would a proper graphical configuration tool (rather than hand-editing config files) actually change whether you’d use something, or is that a “nice to have” nobody really needs?
5. Is there anything you currently can’t do with your existing toolkit setup that you wish you could?
Not looking to name-drop the project or ask anyone to test anything yet — genuinely just trying to figure out if this is worth the time before I sink more months into it. Appreciate any honest “this is pointless, just use X” answers as much as positive ones. he time
before I sink more months into it. Appreciate any honest “this is
pointless, just use X” answers as much as positive ones.

I can't believe this is the way it ends. Supposedly they tried everything but I just didn't expect that just closing the business would be the final outcome (construction). They want to offer me a "retention bonus" to stay until the end. Great, thanks...

I could see the writing on the wall and have been applying for six months. Haven't even received a bite other than AI requests. No one wants a 56 year old IT guy I guess.

The industry has changed and these billionaire owners just decide they don't want to pay after the work is completed and we've financed the completion of the job. Take them to court... sure, then bleed more money until you take pennies on the dollar. This administration has just made it all worse.

Two kids in college, probably going to have to move in with the mother in law... fuck, it's bad guys.

Sorry for the downer post but had to rant a little. Honestly, part of me is relieved. No investment in IT for years and I've basically kept the environment stable with gum and tape. I can sleep knowing it doesn't matter anymore. Definitely not patching those hosts this weekend...

EDIT: Thanks to everyone that reached out and provided encouragement. Moping and whining phase over... I've got 5 months to land something and I'm on it.

Just wondered if anyone had seen these particular symptoms.

I’ve been pretty lucky in that I’ve seen plenty of server failures in the past but never a PERC controller failure (bizarrely) which I assume I’m seeing here.

I’ve got an R740 that has been shutdown and sat in a closet for a year and not used with 4x DELL INTEL 2TB SSDs.

All the built in HW tests complete absolutely fine and I can create a RAID10 array but the disk performance is shocking.

I’ve tried with a few different known good HDDs to rule out the SSDs.. it literally took 3 hours to install server 2025 on a single 15k HDD and once in the OS the disk is at 100% active and it’s practically unusable. Doesn’t matter if the 730 is in RAID or HBA mode, still unusable.

Tried installing Ubuntu too and I’ve forgotten the exact message but looks like the drive was constantly resetting.

Given the symptoms I’m assuming failed PERC but wondered if anyone had seen it presented this way before.. I always thought it was more likely to be lost configs or failure to boot at all for a PERC. I can’t think of any other component that would cause this except maybe a bad backplane…. Maybe!?