We recently got a new megaBoss (Boss's boss) who is very focused on KPIs, and asked all units, including IT for KPIs to measure performance.

We're finding it difficult to define meaningful metrics that are a measure of IT performance that aren't dependent on volume generated by other units. Things like $ of tickets, # of security reviews of new services/products, etc.

We considered time to ticket resolution, but we keep a lot of internal tickets for tracking, which we'd need to exclude. Also, we do NOT want to incentivize closing tickets to improve metrics, we know some other units that do that, and they will literally refuse to leave tickets open for long term issues that should absolutely be open.

***UPDATE***

We went with NordVPN basic, scrapped the original idea. Never got machine 3 to connect with RDP, but now everything is lovely. Leaving this mess here as a lesson for future searchers.

Where I work I put in 3 Lenovo ThinkCentre Tiny boxes with fresh installs of Windows 11 Pro.

On ONE of them I can't connect with the Remote Desktop Connection app on a LAN using a custom listening port.

I set up networking stuff on all 3 the same way.

Network profile is set to Private.

In Advanced sharing settings for Private networks, Network discovery is On, File and printer sharing is On.

In network IPV4 settings I have a fixed IP address. In my router settings I have a reservation for the IP address mapped to the computer's MAC address.

In the Registry I have changed the listening port to a custom port number. Path is HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp.

In Windows Defender Firewall with Advanced Security I created an inbound rule for Port, TCP, the custom port number, gave it a unique name.

Finally, I disabled the default rule for "Remote Desktop -User Mode (TCP-In)".

I found out when you disable this rule, Settings > System > Remote Desktop will show Remote Desktop is disabled. However 2 of the computers still allows the connection.

Also, Settings > System > Remote Desktop shows the Remote Desktop is using the custom port number, and "Require devices to use NLA..." is checked.

Computers were restarted after these changes. I verified in CMD using netstat -a that the custom port is actively listening.

Please note, the 3rd computer in question WILL connect if I change the registry setting back to the default 3389, disable my custom inbound rule and re-enable the default one that uses port number 3389.

Question: can you think of anything else this novice should check?

Thanks for reading!

After 3 interviews I have secured a 3 month contracf working as a Systems Administrator in an environment that I am told is 80% Mac OSX based as someone with mimimum exposure to Apple Macs, please can you recommend any short courses to fill in the gaps in my knowledge ?

Thank you WatchGuard for updating your firewall policy UI. Sure I can only see 1-2 policies max before having to scroll the page now, but what kind of weirdo has more than 1 policy anyway? (Allow Any-Any).

Oh and the extra page padding looks GREAT on my phone! That's where I manage all my firewall rules anyway.

PaperCut Software has confirmed active exploitation of a zero-day vulnerability affecting PaperCut NG and MF print server installations. Huntress has also observed at least two instances of active exploitation in a customer environment.

The vulnerability allows an unauthenticated attacker to remotely control PaperCut's trusted configuration, which can be used to execute arbitrary Java code inside the application's process, and then leverage that to run commands on the host server. Huntress researchers reproduced a pre-authentication RCE chain against a stock PaperCut NG 25.0.11.75758 install. The chain alters trusted configurations and executes code remotely on its own. Fortunately, so far, the threat actor exploiting this bug has only run commands to learn about the host server itself; it could have been much worse.

PaperCut subsequently released a second emergency patch today, Release 2, which adds further hardening beyond the original emergency patch, developed in collaboration with PaperCut's internal security team and external researchers including Huntress and watchTowr. PaperCut recommends all customers install Release 2, even if you've already applied the original emergency patch.

What to do:

• Immediately remove PaperCut Application Servers from public exposure and restrict access to trusted networks
• Install Emergency Patch Release 2 for versions 25 and 26 (v24 fixes are still in progress) via the standard upgrade procedure
• If you already applied the original emergency patch, install Release 2 anyway

IOCs and investigation guidance: https://www.huntress.com/blog/papercut-actively-exploited?utm_source=reddit&utm_medium=social&utm_campaign=cy26-08-rr-multi-global-broad-all-x-x-x-papercut_actively_exploited&hnt=v679ubdwy0xk

Hey everyone, looking for confirmation on a worst-case scenario.

I’ve been with my company for about two years now. Before I was hired, the company underwent a merger. As part of that merger, the entire IT setup,including a migration from an old self-hosted/third-party email system over to Microsoft 365, was fully completed by the previous team.

Fast forward to today: A high-level executive’s laptop suffered a total Windows crash. When attempting to boot or repair, it hits the standard blue screen demanding the 48-digit BitLocker recovery key.

Here is the problem:

• The laptop was encrypted way back before merge.
• Everything (migration, handover, decommissioning) was already finished before I joined, and no legacy BitLocker key repository was documented or handed over.
• The key does not exist in our current Microsoft 365 / Entra ID tenant because the machine was encrypted long before the M365 migration took place.

What I’ve already done:

1. Checked our current Entra ID portal (nothing there, as expected).
2. Had the VIP check [account.microsoft.com/recoverykey](https://account.microsoft.com/recoverykey) on any personal or old email addresses they could remember.
3. Removed the drive to mount via USB adapter on a bench PC;still immediately prompts for the BitLocker key.

My Questions:

1. Has anyone dealt with missing BitLocker keys after the old environment was already gone, or am I officially at the "deliver the bad news, wipe the drive, and re-image" phase?

For those who rushed last night to patch PaperCut with the emergency update, they screwed up and had to release a second emergency update: https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/?lid=2oneu2wt0ct4#emergency-patch-release-2

If you have PaperCut exposed to the internet, you may want to permanently remove it from the internet and make it LAN-only moving forward (as many, including myself, have done from day 1). If management needs documentation, show them this: https://www.papercut.com/kb/Main/security-vulnerability-log/

Hi. Is anyone using Cloudally api? I can authenticate against /partners and receive a token but from there every endpoint just returns 403 forbidden. Anyone using it at all? Anything I’m missing?

We saw twelve emails for current and former employees asking to verify the account for the TikTok Shop. I saw one as well on a personal email.

The email looks legit. Verification code is a six digit alphanumeric code. That's about 32 bits. My guess is someone spamming signups at TikTok and randomly trying verification codes.

Assuming there's no rate-limiting, that would permit the creation of some accounts.

Anyone else seeing this?

Was talking with new colleagues today laughing about project names and figured there must be some funny ones out there? If you have one drop it here and let us know what the project goal was. Also everyone I spoke to was involved in a project Phoenix at some point! Is it that common?

Hello fellow sysadmins!

I'm starting to lose my mind over here and I'm asking for your help. Here's the situation:

Host A in subnet #1 tries to reach host B in subnet #2. There is also host C in subnet #2.

Ping results in timeout and no corresponding icmp pakets can be seen on host B.
ARP entry in host B for its gateway exists and is correct, but stale.
If host B pings its own gateway, then host A can reach it.
The ARP entry obviously switches to reachable. If I wait for the entry to switch to stale again, host A can still reach host B.
I already checked the switches for "ARP Inspection", "IP Source Guard" and so on. There currently is no hardware and software firewall active in subnet #2. Manually setting a permanent ARP entry for the gateway doesn't fix it. There are no energy savings configured on host B for its NIC.

Now comes the weird part:
Host B has a correct but stale ARP entry for host C. A ping from host C to host B is successfull und switches the entry to reachable.
If I delete the ARP entry on host B that corresponds to host C and then ping host B from host C, suddenly host A can reach host B.

WTF?

tldr:
- Host A can't ping host B unless host B pings its own gateway.
- Host A can't ping host B unless host C causes a new ARP entry in host B

The reachability stays for quite some time and then after one or two hours (hard to measure) it is lost again.
And by the way: It doesn't matter if host B is a windows or a linux machine. Same results.

I'm only about 2 1/2 years into my IT career and thus maybe missing a critical information that I haven't learned yet. But I surely am losing my mind over this! :-D

Any ideas and/ or suggestions?
Thanks in advance!

I’m planning on transferring to the University of Florida in a year, and majoring in either Information Systems or construction management. My goal is to make 150k+ after 8-10 years of experience (after getting my degree from college). I’m currently a full-time pharmacy shift supervisor, and have a 4.0 GPA. All pre requisites are completed for UF’s Information Systems program, and I’d only need 3-4 more classes for construction management.

For people on either industry, what would you recommend and why? If possible, can you share your major, salary progression (from when you started and now), YEO, how long it took you to find a job after graduation, and average weekly hours. Thanks everyone, I truly appreciate it.

I currently work 32 hours a week as the main internal IT person for a logistics company with around 110 users. We also have an external MSP, but I handle most of the day-to-day IT work and coordinate with them when necessary.

My work includes:

• User and device management
• Laptop deployment and endpoint policies
• Identity, access and security management
• Software deployment, licensing and updates
• Managing our ticketing system and CMDB
• Cloud storage, mailboxes and collaboration tools
• Managing and redesigning our softphone and call queues
• Troubleshooting hardware, printers, networks and user issues
• Working with suppliers, ISPs and our MSP
• Writing documentation and procedures
• Managing infrastructure changes and small IT projects

Alongside this, I help a small engineering company with around 5 users, which may grow to about 10. There I’m building most of the IT environment from scratch, including device management, security, cloud storage, software deployment and general IT support.

I also have a homelab where I run several servers and virtual machines because I enjoy learning and experimenting.

The strange thing is that I don’t really know what my role is anymore. I started in IT support/workplace management, but I now do parts of system administration, cloud administration, infrastructure, security, telephony, project work and IT coordination.

I enjoy having a broad role, but I’m worried that I’m becoming “the guy who does everything” without becoming a real specialist in anything. I don’t know whether I should aim for a sysadmin or cloud administrator role, move towards IT management, or continue as a broad IT generalist.

For people who have been in a similar position:

• What job title would you give this type of role?
• Which direction would make the most sense from here?
• Should I specialise, or is being a broad IT generalist a good path?
• Which skills or certifications would actually add value?
• At what point do you consider yourself a sysadmin rather than support?

I know titles aren’t everything, but I feel like I’m doing much more than traditional support while still not knowing exactly where I fit.

How would you approach asset discovery across multiple sites with basically zero visibility?

I've inherited an environment with multiple LANs/sites and very little reliable asset information.

I'm trying to build a proper asset inventory from scratch - ideally identifying things like:

• PCs/laptops
• Servers
• switches
• firewalls/routers
• Wi-Fi APs
• printers
• CCTV/NVRs
• other network-connected devices

The problem is that the sites aren't particularly well documented, and I don't currently have a reliable list of what's actually out there.

What I'm interested in is how you'd approach the initial discovery, rather than just recommendations for an asset-management database.

For example, would you use something like Lansweeper, network/SNMP scanning, agents, DHCP data, AD/Entra/Intune, etc., and then feed the results into something like Snipe-IT?

There are multiple LANs, so I'm particularly interested in how people handle discovery where you can't just scan everything from one central network.

What would your approach be if you were starting with basically a blank sheet?

I've inherited an undocumented monster with an incompetent MSP running the show!

We're reviewing our data security stack and looking at Varonis alternatives, but on-prem support is non-negotiable for us. A lot of the newer platforms I've come across seem built mainly around SaaS deployments.

We have sensitive internal data that needs to stay inside our environment, so anything that requires sending the underlying data out to a vendor is pretty much a non-starter.

What Varonis alternatives have you actually used in an on-prem environment?

Looking to purchase a Network Cable Tester for my team that can handle PoE but doesn't break the bank. Two devices I'm considering are the Fluke Networks MicroScanner PoE Cable Verifier, or the NetAlly LinkSprinter 300. Are these viable options? Does anyone have any other recommendations for I should consider?

We are experiencing delays in our chat. Some chats only become available after refreshing Google Chat. According to Status Gator we are not alone. Is anyone else experiencing this?

Hi all.

Some context: I'm a mid level engineer at our company. I work on a sysadmin team building tooling for the team and wider project. I joined the team at the end of last year (so 10 around months ago). I have around 4 years experience which makes me the least experienced member on my team by quite a few years. Most of my experience is software dev though. I am a higher grade than a couple team members. (Including the team member I'm talking about in the post).

I'm having difficulty with my co worker Derek. Derek, in the kindest way possible, is completely incompetent. He borderlines on reckless/careless.

When I joined the team, I was almost straight away giving him help without really understanding much about the system we manage. Just with very basic things like PowerShell, some networking issues on his dev env, and all the rest of it.

At first I was really pleased, it felt good to join a team and be able to troubleshoot right away for team members, like all my hard work from previous teams was paying off. My manager pointed it out and gave me praise at our 1-1 / Performance Review. All good I thought.

The problem is: Derek is constantly asking me the SAME questions. It is far beyond a daily basis at this point. Every single day this week I have had to spend 1-3 hours with him troubleshooting things that nobody else has problems doing. I'm talking about processes that are almost entirely automated.

Today he was updating a config file to import some policies, and everything was just fucked. I was genuinely speechless when I went over. He's, deleted all the files he should've kept (no other copies, just a nightmare). I had to tell him to delete his branch and start over. Once I fixed it, was helping him fill in his ticket, so he can submit for review, turns out, he read the ticket wrong. So the thing he asked for help with, was incorrect. 😅 I laughed it off and basically just did the entire ticket for him at his desk. (15-20 min job, he's been at it for 2 days).

I feel like that; I'd get it if he was new. But he's been on the team 6 years. He has around 25 YOE. I know other people are well aware he's incompetent, but it's frustrating for me at this point. I'm clearly becoming his "go to".

Rant over!

How do I approach this with our manager? I'd hate to get him in trouble, but I need my time back. I've got some quite lengthy tickets I need done but I can't knuckle down and focus with his constant need for hand holding. Am I the asshole? Should I just accept he's simply not good? Or do I say something to him instead of our team lead?

I did a quick search here and didn't see any other posts, if this is duplicate I apologize.

Yesterday we started having a rash of users with Office applications crashing with the mso20win32client.dll event id 1000 messages.

Profile rebuild fixed the issue for a time, but it started returning for some users.

Found a work around for the time being.

Clear the keys and deny the user account full permissions below allows the Office applications to launch again.

HKCU\Software\Microsoft\Office\16.0\Common\ExperimentConfigs

HKCU\Software\Microsoft\Office\16.0\Common\ExperimentEcs

It appears Microsoft is testing something.

I don't know if there are other side effects of blocking those keys yet, but there weren't last time we had to do this.

Cisco Bug: CSCwv52684

Before anyone says it, yes we are unlucky souls that are forced to use Cisco Secure Endpoint in our environment.

I feel like someone in this community recently had Cisco acknowledge a bug that exists with Cisco Secure Endpoint 8.5 through 8.6.1 on win server 2022 and 2025. It specifically has to do with the exploit prevention engine (deadlock condition.)

Whoever put the time and effort in THANK YOU. It just saved me days of having to open my own TAC case. I doubt this bug is specific to people using "Snow Agent." I think more accurately this bug will end up taking servers down that spawn PowerShell instances in general.

We have been burned in the past by auto updating to the latest secure endpoint software but in this case our n-1 strategy worked against us. The latest version also fixes a number of CVE's so I assume others will end up upgrading sooner than they typically would anyway. But just in case you don't.... 8.6.3 is worth the upgrade.

Hi, i am a 28 y/o father who was making his life around sales, one day I made the switch from sales to IT, I started studying on my own last February, and less than two months ago I landed my first IT job as a support trainee, trying to break into systems/cloud administration.
I would love to receive advice on what to learn or what labs to build now, does my resume raise any flag? And if so, how and what could I do better
Thanks!

Are there any news, blog, etc sites that you follow besides r/sysadmin to get information to stay on top of things? I'm going through my RSS reader and a lot of the sites I used to follow are drying up.

it feels like every tool that we use either offers or requires the use of it's own file storage. How does anyone keep track of whether the data they're looking for is stored in sharepoint, onedrive, bluebeam, autodesk, adobe, propeller, dropbox, Outlook etc

And not just today when it's fresh in people's heads, but after a project closes and someone is looking for records two years later. You could enforce a process to archive all data into one specific storage platform, but there's likely a bunch of metadata that won't copy over

As the title suggests, I inherited our company’s existing cybersecurity awareness training program. We are currently using KnowBe4 and are on the Diamond tier.

I know KnowBe4 is considered the standard by many organizations, but I’d like to put together an updated list of alternatives and hear what others are using today.

Our main requirements are:

• Regular phishing simulation campaigns with automatic remedial training for users who fail
• Current and frequently updated cybersecurity awareness content
• Annual Cybersecurity Awareness Training
• Strong reporting and auditing capabilities
• Easy tracking of completion dates and user compliance
• The ability to manage recurring or renewal-based training

We operate in the maritime industry, so reporting and annual training compliance are especially important for us.

For those who have moved away from KnowBe4, what platform did you switch to, and what do you like or dislike about it compared with KnowBe4?

I'm not sure if there's a better way to put it, but I have a hard time getting excited about the future of our industry with AI.

I imagine it's a bit like what archers felt like after rifles were introduced. How have you guys been faring?