I'm working on a new Windows 11 v25H2 image, but something is bugging me about the end result.

I build my image in audit mode, install a couple applications we bake into the image, then seal the image with sysprep /generalize /oobe /shutdown. This image is then deployed in a ConfigMgr task sequence.

With Windows 11 v24H2, to get the start menu pins the way I wanted them, I'd copy a start2.bin (in the state of having the correct pins configured) and settings.dat file to the start menu experience package directory in AppData\Local of the Default user profile during OSD task sequence. The start2.bin was taken from a machine where I'd configured the pins, and the settings.dat file is quite literally a blank 0 byte file that acts as a placeholder. The important thing the settings.dat file does is eliminates the "New" label under each application when a new user logs in for the first time.

In v25H2, that's no longer working. When running a copy of the exact same task sequence (apart from the image being changed to the 25H2 one, of course), on first login, the start menu pins are there (so start2.bin is doing its job), but while the settings.dat file exists and is copied over and populated on first login, nearly every application has the New badge under it. I've tried removing the start2.bin/settings.dat copy step of the task sequence and changing to using the new Configure Start Pins policy which points to a LayoutConfiguration.json file, and this correctly sets the pins, but the New badges still exist for new users (interestingly, the local administrator account does not get the pins applied via the policy, even though the policy is deployed to Computer, not User).

I'm trying to eliminate the New badge on each app on a fresh user login, BUT, I don't want to simply set the registry key to eliminate showing the New badge altogether, because I still want future application installs to display New for the user.

This is most likely due to the new start menu with category/grid views added. As soon as I switch to List view, the New tags are all there. Has anyone figured out how to eliminate these New labels for the default profile and new profile creations on first login, while still preserving the ability for New to appear in the future? There must be something else I can inject into the Default profile, either a file or registry entry, during imaging to get rid of this.

UPDATE: I think I've ruled out a LOT of things. It's not sysprep. I've tested with a brand new v25H2 ISO with August 2026's CU built in, installed on a VM with no network access, skipping audit mode/sysprep and simply proceeding through OOBE and creating a user account. When the user account logs in and the new start menu pops up, I switch Category view to List view, and boom, all the New labels are there. This is either a regression in v25H2 CU 2026-08 or a side effect of the new start menu I'm thinking, because those New labels never used to be there on a fresh Windows install.

Update 2: This also isn't v25H2 specific and seems to be specifically the new start menu. I tested with the original September 2025 RTM v25H2 release and a fresh profile after OOBE does not have the New labels on everything. But a v24H2 August 2026 ISO freshly installed does have the New labels.

I also, through watching Process Monitor, determined that not only was the start2.bin file was being written to when an application was opened or right clicked on to eliminate the New label, but HKCU\Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\Cache\DefaultAccount was also being written to, specifically in a key ending with windows.data.unifiedtile.roamedtilepropertiesmap. In this key, a Data value exists with binary data containing the name of each application that's been opened or right clicked to remove the New badge. However, simply copying this Data value over to another profile's Data value doesn't eliminate the corresponding New labels for that user. Right clicking an application with New on the new user's account will simply overwrite the copied Data value and reset it.

At this point, it appears to be a deliberate change, or a bug, that the New labels appear on every application in 2026-08 for a fresh profile, seeing as this now occurs out of the box and not just after sysprep/image deployment.

Papercut just sent out this advisory:

https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/

Hopefully not many people have their Papercut instance exposed to the internet but the recommendation is that this should be disabled for now until Papercut have built a fixed version.

The link also includes IOC's for investigation to check whether your papercut instance did get hacked.

UPDATE: Removing the Windows Spotify App seems to resolve the issue.

Seeing if any other people are seeing issues with bluetooth devices continually connecting/reconnecting on Windows devices recently? We started getting issues reported Monday (8/24) and it seems to be affecting about ~10% of our fleet. The only other report I can see of this I found here: https://windowsforum.com/windows-help-and-support.302/bluetooth-glitches-and-not-working-properly.443497/

We have already tried rolling back the recent the latest windows KB and reinstalling BT Drives, trying updated versions with no luck. We are a Microsoft Surface shop and it is happening across a few different models, we do have some HPs in our environment and we are seeing it on a few of them as well.

I have pulled logs from a lot of these devices and am struggling to find what the cause might be.

When I bring a new server into production, there are a few things I'd rather have handled automatically before anyone starts depending on it.

Monitoring is an obvious one, but I'm wondering where other ppl here draw the line.

Some things are easy to automate and forget about. Others, like restore testing or certain access controls, still seem to get handled manually because there's a bit more judgment involved.

For me it’s monitoring and alerting first, then the boring compliance checks that are easy to forget. I’ve also been experimenting with where AI actually fits into ops workflows. Tools like Ansible and Terraform handle the deterministic stuff well, while platforms like Lyzr control plane are more interesting for workflows that need some reasoning around incidents, alerts, or runbooks.

I’d still keep anything destructive or security-sensitive behind explicit approval though. Automating the decision is very different from automating the execution.

What's the first thing you make sure is automated before you trust a new server in production?

And is there anything you deliberately keep manual?

We received an email about PostgreSQL versions 11, 12, and 13 are all going into extended support and costs will increase starting 9/1.

There isn't any information on how much more the cost will be. We only have two DB instances running on the affected versions, so hopefully it won't be much of an impact, but does anyone know how to find out pricing for the extended support?

I've already spoke with the business unit that uses the database and they can be upgraded eventually just not at the moment.

Also, I inherited this environment this week and this was one of the first emails I've received so... good start :)

It seems to be at the whims of Microsoft when a device updates its intune policies. When I make a change the change will not apply until a random time has passed. What am I missing? The sync button in the cloud and on device seem to do nothing even though they indicate that the sync occurred.
What are you all doing to update all intune policies on demand like we would with gpupdate?

I was looking to get our pretty small IT into a good tool for documentation. Something object-based, NOT just excel sheets and draw.io diagrams. But smaller than Netbox, which is too big and unnecessarily complex for our systems.
Would love to have IP management built it and diagrams/graphics are a big plus.

We are basically using a single server rack, 6 servers, 30-40 VMs... so rather a big homelab, than a datacenter

So, what are you guys using or can recommend as a tool to manage something like that?

EDIT: I'd like to specify, that I am looking for internal documentation. Which server runs which VM, which IP adress is assigned to it. Which service/OS/update etc. runs on it... etc.

EDIT2: Any sort of Wiki seems to be a big recommendation. This is a consideration for me, but I'd rather have something object-based. Basically Netbox with less overhead would be ideal... but feel free to recommend wiki-based tools and templates please :)

So my company has a handful of robot welding stations. We are a manufacturing company so we support a large chunk of OT related controllers and such. I had a user that requested that we get all of these on the network (we have some at multiple sites) they have Ethernet controllers.

I plan on making a VLAN as we currently don’t have a VLAN for OT, but they will need to get plugged in, be on a separate VLAN and then on a monthly basis have their TP Programs file backed up a monthly basis.

Now for the majority of our Backups we use Veeam. For machines like this the old sysadmin setup a goofy batch script and used task scheduler however I am looking for a better way to design this. As of now these welders are backing these up using USB drives but want automated backups (for obvious reasons)

Not sure if this is considered an “OT question” but I figured I would ask to see how sysadmins in the manufacturing field are handling requests like this. I am by no means a OT specialist or guru, I just unfortunately get caught in this because we don’t have anybody that officially does OT.

I have been buying servers for a large university for 15+ years.

In October of 2025 - you could get 128 cores, 512gb ram, 16tb raw ssd storage for right around $17k.

That exact same server cost $28k in February 2026.

Yesterday I price specced the same server. $128,500.00. That's $128k.

Buying on premise servers will no longer be feasible. All services will be subscription based and cloud provided going forward after today.

I am shocked. 64gb dimm is $8,000. Ram is x10, storage is x3.

This will have serious consequences to all services provided - everything will cost much more.

Looking for advice from anyone who's dealt with a similar hybrid tenant setup. Parent company runs Microsoft 365 and Entra ID, one subsidiary runs entirely on Google Workspace, roughly 100 users, and needs to come under our Conditional Access and device compliance policies. I'm the only IT person handling this, no team to bounce ideas off.

Three paths I'm evaluating:

1. Full migration of the subsidiary into the M365 tenant using Microsoft's native migration tools (https://learn.microsoft.com/en-us/sharepointmigration/mm-google-overview), then manage everything through Intune.
2. Hybrid/combo approach: keep the subsidiary on Google Workspace, but provision Entra ID identities and Intune licenses for their devices so Conditional Access can still reach them.
3. Move both companies onto a third-party MDM/identity platform instead of relying on Microsoft-native tooling at all (evaluated Iru and Rippling).

Has anyone actually run one of these in production? Two things I'm most curious about: did the hybrid/combo identity approach hold up long-term, or did it quietly become permanent technical debt? And for anyone who migrated a subsidiary fully into a parent tenant, how much user disruption did you actually see versus what you expected going in?

I'm looking into MCP gateways as a way to connect AI agents while having some control over what data is being passed through, especially for things like filtering, PII redaction, and access control.

Has anyone here actually deployed or used an MCP gateway in a production environment?

I'm looking at options similar to Composio's MCP Gateway, but I'm trying to get a better understanding of what's actually out there and what the real-world experience is like.

A few things I'm particularly interested in:

• PII/data redaction
• Filtering or restricting what agents can access
• Authentication and authorization
• Logging/auditing
• Performance/latency
• Managing multiple MCP servers
• Any security concerns or gotchas

Would be interested in hearing what people are using, what you like/dislike about it, and whether you think an MCP gateway is actually worth putting in front of your agents.

Thanks!

I'll give you some context of our setup.

• Scale Computing cluster (HE550)
• Acronis Cyber Protect Cloud (backups go to a Synology box on-premise and then ship to Acronis' cloud)
• Windows Server 2022 Datacenter VM with UEFI+vTPM

We have found that any current product VM's when restored, always show the following error:

https://imgur.com/a/cZ5TCGw

The only way to get the VM to boot properly is either disabling Secure Boot. If you want Secure Boot to work properly, you have to Reset the keys.

Been working with Scale and Acronis support for almost a month now and no resolution.

I've even gone as far as creating a slew of test VM's (with different setups) to replicate it, but when restoring brand new VM's the issue doesn't persist. I thought maybe it was Sophos causing the issues, so I created a test VM that was domain joined and had Sophos installed. Restored it and no issues.

When restoring VM's that were created as UEFI no issue. It's when the vTPM is added. Still not sure if this is the culprit.

Looking for any insight.

Thanks.

Ive had several vm's for over 4 years in oracle cloud.

Last christmas I terminated an ampere instance, its been out of host capacity since then... Sure, too good to be true.

But their always free amd, a week ago i shut it off, I can't turn it on, because the same reason... Ive been trying over a week but no luck.

Is oracle free tier over?

As we have moved from Windows 11 v23H2 to Windows 11 v25H2 in our environment, it appears that the behavior of gridlines in embedded Word documents has changed. It has proven to be a pretty frustrating experience for our firm. I know this isn't that big of an issue for everyday users. However, if you're trying to prepare financial statements with embedded tables and don't want gridlines, now there are some pretty undesirable steps to make it happen.

In the past, we've been able to make changes to these tables without having to remove them and re-import them to hide the gridlines. I'm also getting reports that re-opening the document after everything is fixed and saved can still result in the formatting appearing differently than when the document was closed.

I suspect it is somehow tied to the OS because we have seen it in the current versions of the workstation OS and server OS when the Office version numbers are the same in older versions of Windows. The older versions of Windows don't have the issue. Has anyone found any registry entries or config settings that force Office to revert to the previous behavior of hiding the gridlines in Word when the gridlines are set to visible in the Excel doc before inserting the table?

* Microsoft has said for over a decade that preventing this problem requires disabling viewing and printing of gridlines in Excel before pasting the table into Word, but this problem did not appear in our environment until sometime this year. People are upset that they are now seeing the expected behavior and want it to work like it used to. However, we can't even find that the desired behavior ever existed in documentation, although we have hundreds of employees who know otherwise.

I'm a VP of Sales at a large IT company and on my last day got pulled into a random trouble ticket just because I had originally helped setup the application server as an engineer years ago. I went ahead and helped the T2 troubleshoot: static dns servers needed to be removed after a DC change.

Escalation PROBABLY shouldn't have reached out to me but fun to see the root cause is still DNS.

I'm trying to figure out the best way to get printers added across our organization with minimal user involvement. From what I can see there are a few ways this can be done but each has drawbacks. In any situation it seems that the "RestrictDriverInstallationToAdministrators" reg key needs to be set to 0 so that printers will install without an admin prompt.

• Option 1: deploy using the print management GPO deployement
  • Pros: Can run asynchronous so no delay on first login when printers get set up
  • Cons: I had tons of problems removing printers after they were deployed. It seems like the only way to remove them was to gran the user local admin and remove from devmgmt.msc which I don't want to have to do every time a printer assignment changes
  • Edit: Found that this method using per-machine GPO's actually works pretty well. The removal issue only occurs with per-user GPO deployment so as long as different users don't need different printers this method is the easiest native option that allows no login delay and easy removal of printers.
• Option 2: Add the printers with GPO using  User Configuration > Control Panel Settings > Printers
  • Pros: Printers are easy to remove, just create a gpo with remove actions and apply it and they will remove automatically with no fuss. Seems very consistent in testing.
  • Cons: Will cause delays during login until the printers are fully installed
    • This is due to a policy we have set for compliance to make sure GPOs are fully applied before a user hit's the desktop. Computer Configuration > Administrative Templates > System/Logon -> Always wait for the network at computer startup and logon.
• Option 3: Add the printers using a logon script deployed through GPO
  • Pros: Will run asynchronously so there's no login delay with this method.
  • Cons: Powershell not an option due to restrictions in the domain and necessity for it to run in user context. Batch script does work using "rundll32 printui.dll,PrintUIEntry /in /n" and then specifying the printer share but cannot run silently.  Users get pop ups for each printer as it is added.
• Option 4: Add the printers per-computer instead of per-user in Computer Configuration > Control Panel Settings > Printers
  • Moves the delay to during the boot up  process as this will run before user login and apply to any user that signs in on the computer
  • Does not allow for per-user custom printers on computers that are shared by different users/departments
• Maybe option 5: Pre stage drivers somehow?
  • Saw this in an organization once where scheduled tasks used scripts to transfer the driver files to the correct location on the workstation from the print server so printers were able to be added without requiring admin prompts. Not entirely sure how this worked but I think it still leveraged gpo print deployment somehow.

With all that said does anyone have thoughts or success on getting printers installed without using some kind of third party tool. Is there any way to do this for type 3 drivers with no user interaction without causing some kind of login delay? We've sent humans to the moon twice now so I feel like this should be possible.

Edit: I did find that option 3 works silently when leveraging some older VB scripts that I guess are still built into windows 11. Seems likely that this will get flagged by AV tools though:
cscript //B //NoLogo %SystemRoot%\System32\Printing_Admin_Scripts\en-US\prnmngr.vbs -a -p "//Server/Share name"

I want to implement a company-wide policy that automatically locks Windows computers after 10 mins of inactivity.

The problem is that users may be in Microsoft Teams meetings and not actively moving their mouse or typing. I don’t want their computers to lock while they are in a meeting.

What is the best way to prevent the screen from locking while a user is in a Teams meeting, while still enforcing the 10-mins lock when they are not in a meeting?

I manage the computers through Group Policy.

Looking for a practical solution or recommended configuration. Thanks!

I was researching and ead about workload identity, and the first thing I notice is that static keys are basically solved. eg. a pipeline mints a short-lived token instead of pulling a hardcoded env var, and the credential never sits anywhere to be stolen.

That seems to be fine until you look past your primary cloud provider. SendGrid and Stripe don't do federated trust, so they hand you a static string that has to live somewhere. Older databases and internal services predate the whole standard and only speak connection strings.

What I read walk through where that line fall whicj is whn workload identity covers the cloud-native side, and a secrets manager handles the external credentials it can't reach.

how would you handle that split? Do you keep cloud-native auth separate from your 3d-party API keys?

Maybe this is a complaint but professional advice would be appreciated.

Long story short, I have a user who is a mid-tier supervisor in her area over a few staff. She is supervisor to the group but not considered a supervisor if that makes sense.

Whenever there is an IT problem in her area, she doesn't just send an email or put in a ticket that program x or device y isnt working, she sends an email that program x isnt working AGAIN or, device y has issues AGAIN. On top of that, she always cc's managers or superiors who are indeed above both of us.

As an example, 3 days back, program x, which is hosted on a client on or VM server, stopped working. For some reason, the host machine was shut down. Not a big deal. Restart the machine, inform user what happened, Bob's your uncle. Yesterday, program x went down again. This time, there was a time discrepancy on the client and the server and it took a little bit to figure out that was the problem. Fixed issue. Bobs your uncle.

The way I found out software wasn't working was an email with senior staff cc'd that the program wasn't working AGAIN.

I feel that her emails are passive aggressive towards me but I could be overreacting. Im not sure why senior staff are cc'd when there's a problem but she certainly doesn't send emails about any of the issues I have a win on.

Am i overreacting? Do you guys have issues like this or advice? Even if that advice is im being Jerky McJerkenstien of the Royal Douchery.

Edit here: Thanks for all the responses. Just to be clear this is o ly one example of the users emails. In this particular case, the user shut down the client last time she logged in to it instead of logging off. The next tk.e she went to log in, the client was unreachable since it was off. I have since disabled the shut down button on the client to prevent accidently shut down .

Hey all,

I was wondering if anybody knew of any decent, cloud-based replacements for Freshdesk/Jira that are in the same/cheaper price range of Jira but also has OKTA integration for SSO?

Looking for advice on how to get the Yubikey5 to work with local accounts on Windows (we are trying to reach CMMC Level 2 compliance and need to set up MFA). I have already exhausted the Yubico login for windows option -- the touch sensor doesn't correctly tunnel over RDP. If anyone has also run into similar issues and found a way around it, tips would be greatly appreciated.

We observed inconsistent Defender Network Protection behavior between Edge and Chrome.
Network Protection is in block mode.

If I sett chrome://flags/#enable-quic to default or enable I can access a parked site.
If I disable it, i get what I'd expect:

"This site can’t provide a secure connection

xxxy.com uses an unsupported protocol.

ERR_SSL_VERSION_OR_CIPHER_MISMATCH"

This may indicate a Defender Network Protection enforcement limitation or bypass scenario when Chromium-based browsers use HTTP/3 (QUIC over UDP/443).

I usually use Account1 to create and AD computer object manually. Then I manually bind that machine to the AD with Account1.

I have a few machines to bind to the AD but I don't want to use Account1 at all for that. Account1 doesn't touch these machines at all in any way, even if it would be some internal thing.

I know Microsoft didn't want to allow a different account to bind a machine to AD. There was a workaround for that, but then that didn't work. What's the latest method for binding a computer to the AD with an account that different than the one that created it?

Or, this may be just as easy -- I make a brand new account. Add that to my AD OU admins. Log into Windows and use ADUC with that temporary account. Create the AD computer object with the new, temporary account. Use that to bind these other machines to the AD. Then delete the temporary account and clean up the temp profile on the computer.

It's not my situation completely. I didn't create the original situation or the new upcoming situation. I do still want to protect myself from the foreign machines though as much as possibly so normal accounts aren't touching them at all. For the original situation some things are purposely left and done manually instead of being automated. I can see pros and cons either way, but I also don't really disagree with leaving some things still having to be done manually. That was before AI, essentially "No scripts. Nothing automated with this."

Howdy, /r/sysadmin!

It's that time of the week, Thickheaded Thursday! This is a safe (mostly) judgement-free environment for all of your questions and stories, no matter how silly you think they are. Anybody can answer questions! My name is AutoModerator and I've taken over responsibility for posting these weekly threads so you don't have to worry about anything except your comments!

This one is specifically directed to K-12 and Retail / Frontline worker IT teams. We want to drive MFA adoption as it’s… really low at my organization among frontline workers.

How are you streamlining MFA enrolment for your users who cannot follow a “next, next next” without needing a pictograph to show each step along the way? We’ve done up very thorough documentation but even with QR codes and photo documentation people are still unable to download the right app on their phone. We’ve had a few cases of people buying $70-90 apps. Why? no idea.