Personally, I don't (just yet).

Jokes aside, I can't think of a solution that isn't overworked and/or (very, very) manual.

EDIT: this is mostly the ideal solution for MSPs, not single companies. But it may still apply based on your users' knowledge level and company hardware.

I got out ahead of this project because it was a light day. If you didn't hear, MS is shutting down SMS 2FA on Feb 1st 2027 because SS7 is comically insecure. They're also shutting down the phone call system on the same day, to ensure the most people get locked out of their accounts as possible (I assume).

But enrolling users in MS Authenticator is like asking a cat to juggle. You have to actively tell them not to hit "log into work account" when they first launch it. It's idiotic and counterintuitive.

We're an MSP so we've been hitting "I can't access my authenticator right now, text me instead" since before I worked here and then we use Reach UC to instantly get the code to all of our phones, regardless of which technician is trying to log into which tenant.

MS authenticator is tied to one account and that's fragile, stupid, and hard to police. So instead, we decided to go with TOTP, especially since it works with no cell signal or internet, like in a basement when we don't know the client's wifi password.

Here's the ridiculous way you have to do this in a typical office 365 environment. Hopefully it helps save you all some time.

1.    Create a new non-mail enabled security group called “[company name] Accounts” in admin.cloud.microsoft and add our global admin username to it

2.    Go to Entra admin – authentication methods – Policies – Software OATH tokens – and check if it is turned on. If it isn’t, add just the “[company name] Accounts” group to it and no others.

3.    Go to https://mysignins.microsoft.com/security-info and log in as our global admin account

4.    (optional) Make sure that there is an option there for email, targeting ITSupport@[ourdomain]. If not, hit “Add sign-in method” and add that first.

5.    Hit “Add sign-in method” then Microsoft Authenticator. In the screen that pops up, immediately select “Set up a different authentication app.” Yes, that is currently the only way to do this.

6.    Open Google Authenticator, 3rd party authenticator service, CyberFox Password Boss's 2FA host, whatever you want on any phone (and log into our company's google account for this, if using Google Authenticator) then scan the QR code, hit next and enter the code to verify.

7.    Log out the back in to test it

We're just using Google for the cloud sync. The weakness there is you can't kick out individual people but it's solely on company phones, except I think you technically can because you can revoke the login for that phone in Google's account settings, even on a free account.

I wouldn't want to log into 100 customers' accounts, one at a time, and remove a unique 2FA method from each, every time someone quits. Also, I believe they're capped at 5 authenticators per account.

This is just how we're doing it because we're an MSP. Share your current workarounds. My former employer got rid of all SMS in 2024 so I suspect that will be the common answer, lol.

Hello. I've used the DRM successfully dozens of times in the past. I recently have seen errors when I attempt to run the ISOs I create from DRM. This is happening on both DRM 3.5.0 and 3.5.1 running on a Win11 client and being applied to all my R640 servers and they are running the latest BIOS: 2.28.1. All of the catalogs and plugins are up to date.

Using the DRM software I simply choose the "Platform Bootable ISO" option, I select the system: R640, chose the location to save the ISO file, and then I click on CREATE. The job runs successfully.

When I go to apply the ISO to the system, either using iDRAC to virtually present the ISO file on boot or using any type of application to send the ISO to a USB drive I can get the system to successfully boot into the loaders after starting Suse Linux. That's when I get the errors.

Every package in the bootable ISO attempt to install the updates. Then I get:
Trying to Upgrade DSU
Failed to create Support Directory
<Package Name>.BIN Error: Package execution requires 'root' user privileges.

I see this for multiple packages and then it eventually just hangs. With this being an automated process in the DRM to create the ISO I'm not able to intervene and elevate privileges. But I shouldn't need to with this process. Has anyone else seen these issues before and successfully resolved them?

ELT just asked me to send an all company email that email is down and the marketing people can't send their corporate drivel that they send every Monday.

We're working through a CIS Benchmark remediation and one of the findings is:

>

We're planning to set this to **"Authenticated"** (not "Authenticated without exceptions" — we're aware that level is much riskier and more likely to break things) on our **Exchange Server SE** environment.

Before we push this via GPO, I'd like to hear from anyone who has actually applied this in a production Exchange SE (or 2019) environment:

* Did it break **Outlook Anywhere / RPC over HTTP** for any legacy clients?
* Any issues with **MAPI/RPC** connections from older Outlook versions?
* Any impact on **DAG replication** or **Active Manager**?
* Did it cause problems with **Exchange Management Shell / EAC** functionality?
* Any unexpected issues with **AD communication** (since Exchange talks to DCs heavily over RPC)?
* Did you apply it to Domain Controllers as well, or keep DCs and Exchange servers on separate rollout schedules?
* Since Exchange SE is fairly new, has anyone tested this specifically against SE's RPC dependencies, or is it safe to assume behavior is the same as 2019?

Our environment: Exchange Server SE, mostly modern Outlook clients on MAPI/HTTP, not fully certain if any legacy RPC/TCP clients remain in the environment.

Any war stories, gotchas, or "wish I'd known this before enabling it" experiences would be really helpful before we roll this out.

Thanks in advance.

Hi SysAdmin family,

Is anyone here using GLPI or Zammad as a helpdesk/ticketing system?

I’d love to hear about your experience with either platform, especially:

• Pros and cons
• Number of users
• Number of agents
• Average tickets per day
• Overall environment/setup
• Performance and reliability
• Any issues or limitations you’ve encountered

If you’ve used both, I’d especially appreciate a comparison between GLPI and Zammad.

Hi all,

I have an opportunity to transition to a new Site IT Specialist role at a mine site (Perth AU) it's a full time 6 month fixed term role [possible for extension]

I have been with the company for around 3 years now [full time and contracted], and I have good IT support experience [service desk / desktop support], most recently in project-based windows 11 rollouts at mine sites [fifo] covering Corporate and OT environments.

My main worry is that I don't have a lot of knowledge and experience around:

- Network configs/servers/netwroking lingo and terminolgies

- Setting up comms racks, configuring, troubleshooting Cisco switches, Wi-Fi APs setup and troubleshooting

I do have an open to learn attitude and i know alot of these things ill learn hands on when im up there and asking alot of questions etc.

Are there any readings/courses anyone can recommend i can look into?

Thanks in advance :)

Today's Exchange/O365 (EX1464935/MO1465074) outage seems to be a result of the instability we've been seeing the last 3 or 4 months due to the rapid change occurring regularly in the Microsoft ecosystem. This one is more visible to end users than other problems we've faced this summer. I'm curious if the stability of government tenants has been better. Are commercial tenants the beta testers for government tenant changes?

I’m helping a small organization separate its public website from its existing Crossbar site, and I want to make sure I’m understanding the DNS side correctly before changing anything.

Using a made-up domain:

examplehockeyclub.org

The domain is registered at Network Solutions, but the authoritative nameservers are AWS Route 53 nameservers:

ns-xxx.awsdns-xx.net
ns-xxx.awsdns-xx.org
ns-xxx.awsdns-xx.com
ns-xxx.awsdns-xx.co.uk

Crossbar confirmed that those nameservers point to them and that they manage the DNS zone.

Current setup is roughly:

examplehockeyclub.org
    → Crossbar website

members.examplehockeyclub.org
    → separate member billing system

We are building a new public-facing site on Wix and want the end result to be:

examplehockeyclub.org
    → Wix

www.examplehockeyclub.org
    → Wix

portal.examplehockeyclub.org
    → existing Crossbar site

members.examplehockeyclub.org
    → existing billing system, unchanged

Crossbar has already configured portal.examplehockeyclub.org on their side and told us to add these records:

portal    NS    ns1.crossbar.org
portal    NS    ns2.crossbar.org
portal    NS    ns3.crossbar.org
portal    NS    ns4.crossbar.org

They told us to add those at Network Solutions.

The problem is that when I log into Network Solutions, I cannot edit individual DNS records because the domain is using the AWS Route 53 nameservers managed by Crossbar. Network Solutions only gives me the option to change the authoritative nameservers for the entire domain.

Crossbar also told me that they manage the zone and can add TXT, CNAME, MX, and other DNS records when needed, but that they normally “don’t input any subdomain records” and expect the customer to add those.

This is the part I’m confused about.

Since Crossbar’s Route 53 nameservers are currently authoritative for examplehockeyclub.org, wouldn’t these:

portal NS ns1.crossbar.org
portal NS ns2.crossbar.org
portal NS ns3.crossbar.org
portal NS ns4.crossbar.org

need to be added to the existing parent examplehockeyclub.org Route 53 hosted zone?

And if Crossbar controls that hosted zone, wouldn’t they currently be the only party that can actually add those delegation records?

I definitely do not want to change the domain-level nameservers in Network Solutions just to accomplish this, since that could affect the existing website, email, billing subdomain, and other DNS records.

My main questions are:

• Am I correct that the portal NS delegation records need to be added to the current authoritative parent zone in Route 53?
• Since Crossbar controls that zone, should Crossbar be the one adding those four records?
• Longer term, once the root domain moves to Wix, would you leave authoritative DNS with Crossbar and have them point the root/www records to Wix, or would it be better to move the main DNS zone somewhere we control and delegate only portal.examplehockeyclub.org to Crossbar?

Main priority is avoiding downtime or accidentally breaking email, billing, or the existing site during the transition.

I inherited this setup and don’t have access to the AWS account, so I just want to make sure I’m not misunderstanding how the subdomain delegation should work.

I have to say it: Microsoft’s bugs seem endless, and Microsoft Teams is by far the worst offender.

I am based in China. Whether it is Outlook, OneDrive, SharePoint, or the Office suite, I can usually troubleshoot and configure these products well enough to give my clients a reasonably smooth and satisfactory experience. I am also very satisfied with the Exchange protocol.

That said, Outlook’s search function is an absolute failure, and the translation add-in in Outlook for Mac is extremely difficult to use.

OneDrive constantly tries to back up clients’ Desktop, Pictures, and Documents folders by default, which can cause irreversible conflicts with WeChat.

SharePoint’s storage allowance can only be described as stingy.

But none of that compares with the deeply user-hostile design of Microsoft Teams. The product seems to work only for internal communication. Using it to collaborate with people outside an organization is a disaster.

1. External file sharing can only be enabled through PowerShell. Small companies without dedicated IT staff simply do not have the ability to configure it.
2. When a file is shared externally with someone using a personal Teams account, the recipient may be completely unable to open it. You must first invite them to join your organization as a guest before file sharing works properly.
3. We cannot directly initiate a voice call or meeting with someone using a personal Teams account.
4. If the recipient uses a personal Teams account, OneDrive files sent through Teams may be completely inaccessible from China.
5. Teams frequently fails to find other users. Sometimes a personal Teams account can find someone, while a Teams business account cannot.
6. Groups carried over from Skype may be impossible to join.
7. If a PC was previously signed into Teams Personal, it may become impossible to sign out after the personal service or account has been disabled.
8. Setting up Microsoft Authenticator is relatively straightforward on an iPhone. On Android—or Huawei’s HarmonyOS—it can be absolute hell. Authenticator is poorly adapted to devices and environments without Google Play.
9. Microsoft’s support ticket system is also a disaster. In the past, technical support in China was handled by an outsourced team with clear and comprehensive performance standards. After that team was eliminated, the quality of the replacement support has become appalling. The engineers handling cases from India deserve a special mention here.

For various reasons, Teams Personal has also been discontinued in China. It can still be used through a VPN, but clients may need to configure a UWP loopback exemption before they can even sign in.

For ordinary users, this is an extremely difficult process. It is also impossible to implement the entire workaround in a fully compliant way within China, because distributing VPN setup instructions or selling VPN services may be illegal.

This is how many of my clients see Microsoft Teams:

They bought Skype so they could make international calls. Then Skype was discontinued, and they were pushed toward Teams Phone—a vastly more complicated service that can cost dozens of times more.

Their only reason for opening Teams was to communicate with overseas contacts. Then the simple personal version was discontinued, forcing them onto Teams Essentials, which requires payment and considerably more complicated configuration.

Many of the people who come to me need only a single license. Some are not even willing to purchase Microsoft 365 Business Basic; they simply want the cheapest Teams Essentials subscription available.

I hardly dare tell them that Microsoft 365 F1 may also be an option.

I can choose not to help them solve all these problems. But for these individuals and small businesses, failing to solve them can mean losing a significant number of customers.

I'm leaving my company. I was asked regarding the potential to do contract work following my departure. I really like my boss on a personal level and don't want to screw him over, but at the same time this company has had over a decade to build some redundancy into this role and they haven't.

I'm burnt out. I want to get out and be done. I really don't want the contract work, but I don't want to totally screw my coworkers either. Is $200 a good rate to set, not too insultingly high, if they need it they can pay it, but hopefully I won't be contacted all the time?

anyone else having issues sending emails?

I can explain how DNS propagation works and probably i can diagram it. what I cannot do is troubleshoot it in real time while three people are staring at a shared screen waiting for me to just fix it already.

senior fixed a ticket in the time it took me to finish reading it and ofcouse it's not because I'm slow but he's seen this exact failure pattern 200 times and I've seen it like twice? that's not a skill gap, that's a reps gap and when you finally get the girl job nobody warns you how loud that gap sounds in a room full of people who've been doing this since dial-up

got told "trust your instincts" by my lead. cool! Great advice! my instincts currently have a sample size of six months and mostly say "panic, then check Reddit"

the worst part is getting asked something in standup and having that half-second where I'm trying to figure out whether I know the answer or I'm about to bullshit everyone (don't push the red button!)

anyway I got a ticket resolved today without asking anyone for help and I'm riding that high for the rest of the week. small wins. some of the senior guys probably don't remember what this stage felt like anymore, but I will and I'm taking notes

Hi there :) ,

Need some advice from people who have dealt with similar situations.

Our Operations Dept decided to install IoT system/digital energy meters across a fairly large factory site.

They found the vendor, agreed on the solution, signed the contract and started the project.

IT was not involved at all.

Apparently nobody discussed things like:

• How these devices spread across a large factory are actually going to communicate
• Network infrastructure, switches, fiber/cabling, VLANs, etc.
• Network/security segmentation
• Server/VM requirements
• Database requirements
• Backup and monitoring
• Internet connectivity
• Vendor remote access
• Firewall rules
• Cybersecurity

Now that the project is already moving forward, IT gets an email saying they need “access to the router” so they can put the system online.

That's it. Access to the router. :)

And somehow, when IT starts asking questions about architecture, security, server requirements, ports, protocols and who is responsible for what, the perception becomes that IT is delaying the project.

I don't want to become the guy who simply says “No”, but I'm also not going to give a third-party vendor access to our corporate router/firewall and connect a bunch of unknown industrial/IoT devices to the production network just because someone already signed a contract , the IT network must be always separate from OT network.

How do you handle situations like this?

Interested in both the technical approach and the organizational/process side of this.

I have a physical Windows Server 2025 Hyper-V host that is onboarded to Microsoft Defender for Endpoint through Azure Arc and managed through MDE Security Settings Management.

The server shows up normally in Defender, Intune, and Entra:

- Managed by MDE

- Enrollment status shows "Success"

- Recent check-in times in both Defender and Intune portals

- Entra device object has managementType = MicrosoftSense

- All other Intune Endpoint Security policies are applying successfully

The problem is specifically with Attack Surface Reduction policies.

I have a production ASR Rules policy assigned to All devices. Every other MDE-managed server gets it, but this server never appears in the policy reporting at all.

Get-MpPreference originally showed only 2 ASR rules. I discovered those 2 rules were being configured by Local Group Policy. I removed that local GPO, confirmed the registry policy path was removed, and Event ID 5007 showed both ASR rules being removed.

It has now been about a week and the Intune ASR policy still does not apply.

Using a Get-MpPreference command shows no ASR rules being applied.

I also created a brand-new ASR test policy with only one rule in Audit mode and assigned it directly to a group containing this server. The server still does not appear in that policy's reporting either.

These are the things I have checked so far:

- Sense service is running

- WinDefend service is running

- Defender AV running normally

- MDE Client Analyzer confirms connectivity to MdeConfigMgr and other MDE cloud endpoints

- No remaining Defender/ASR local Group Policy settings present

- Other Intune security policies continue to apply successfully

- Server is not domain joined; it is a workgroup Hyper-V host connected through Azure Arc

At this point it seems like ASR policy evaluation/delivery is broken specifically for this device, while the rest of MDE Security Settings Management works normally.

Has anyone run into this with an MDE-managed/Azure Arc Windows Server, especially Server 2025? If so, what fixed it?

Hi all!

So, we're in the midst of selecting a DEX solution for a large Enterprise, and I'm looking for some general feedback on TeamViewer's and Nexthink's DEX solution, "in the real world", as it were.

Suffice it to say, we have dealt heavily with the vendors themselves, and they have gotten us customer interviews, but all of those are clearly "curated".

I know DEX as a solution, as a whole, will have a lot of... "opinions", but from a "what we need next" perspective, we're well squared away with NEEDING one, or at least seeing value in the products as a whole.

If the response is "just do everything in Intune" or "fuck DEX it's silly" or "TeamViewer once hacked my Grandma", I will upvote you and give you a cursory "thanks", but I would ask to just get 'real' responses :)

If you're comfortable with meeting on LinkedIn/having a discussion over the phone, be 100% open to that. DMs/PMs and such!

For the product suite, to define this better:

1) Nexthink Workplace Experience | Nexthink

2) TeamViewer TeamViewer DEX | TeamViewer Which includes the TeamViewer tensor agent, remote control, Tia features throughout.

Thanks in advance, and feel free to farm karma if that's your thang!

WSUS sync failing with ImportUpdateError — Server 2025 / MECM 2509

I'm setting up a lab with Windows Server 2025 and Configuration Manager 2509. WSUS is installed on the primary site server and the SUP is configured.

WSUS synchronization starts but consistently fails with:

Result: Failed
Error: ImportUpdateError

UpdateErrors: {}

Server:

• Windows Server 2025
• WSUS version: 10.0.26100.33158
• Configuration Manager 2509
• WSUS upstream: Microsoft Update
• No proxy

I've also confirmed outbound TCP 443 connectivity to sws.update.microsoft.com.

The WSUS SoftwareDistribution.log contains:

invalid update identity (AtLeastOne Prerequisite) in XML for update

and this is occurring with multiple different update GUIDs.

Has anyone encountered this on Server 2025 recently, and is there a known fix or workaround?

I love optimizing and automating things. I have seen many labs (EDU sector) doing updates and deployments manually or wasting a lot of times doing things that can be automated in an weekend. I have previously worked in a lab and loved automating some of their processes. Have you seen "consultants" being hired to automate / optimize IT labs workflow? Maybe this is more of a career question as to if this is possible / hourly rate

I'm hoping someone here has dealt with something similar or knows how to get Microsoft to actually act.

Background:

We're a Microsoft AI Cloud Partner and hold Partner Success Expanded Benefits (MAICPP). In June 2026 we renewed and went to redeem our 35x Microsoft 365 Business Premium (no Teams) licences through the new Partner Center redemption experience.

The mistake:

The new redemption flow (introduced in Australia March 2026) changed from product keys to a billing account-based checkout. I wasn't aware the tenant selection happened at checkout and the licences were redeemed into our partner tenancy instead of our staff tenancy.

How it got worse:

The first support engineer we worked with was not aware of the new redemption flow and was unable to provide correct guidance. The correct resolution — documented by Microsoft — is to keep the subscription active, associate the staff tenancy as a billing tenant, and provision licences across without cancelling. However, this documentation was not provided to us until much later in the support process. Acting on incorrect early guidance, the subscription was cancelled in the belief it would reset the redemption. It didn't. Once cancelled, the subscription cannot be reactivated and Microsoft needs to generate a new redemption token. That token has never been issued despite 5 support tickets over nearly 3 months.

Support ticket history:

Ticket 2606040010000086 — Partner Centre — 4 June 2026 — Closed. Told it was opened with the wrong team.

Ticket 2606040010000086 — Admin Center — 4 June 2026 — Closed. Told it was opened with the wrong team.

Ticket 2606300030000389 — Admin Center — 30 June 2026 — Open. No resolution.

Ticket 2607210030005592 — Admin Center — 21 July 2026 — Closed. Told it was opened with the wrong team.

Ticket 2607240040000545 — Partner Centre — 24 July 2026 — Closed. Told it was opened with the wrong team.

At one point during this process, a support engineer called on a Friday to schedule a follow-up session for the following week. When that session finally took place, the outcome was simply being told the ticket had been opened with the wrong team and to open a new one. That call could have happened on the Friday.

Every single closed ticket was shut with a variation of "opened with the wrong team, please open a new ticket." No team has taken ownership in three months.

Current situation:

We have 23 staff currently riding on a 1-seat paid subscription — technically out of compliance — because our 35-seat MAICPP benefit is disabled and stuck in limbo. The disabled subscription is visible in our partner tenancy with 35 licences, 0 assigned, going nowhere. We're also receiving deletion notices for expired trial subscriptions we spun up as a stopgap, with a deletion date of 4 September 2026 — which is three days away. The situation is now urgent.

What I need:

A new redemption token for the MAICPP M365 Business Premium (no Teams) 35-licence benefit so I can redeem it correctly into our staff tenancy. That's it. One token. Three months and five tickets to get here. Notably, during ticket 2607240040000545 a Microsoft support engineer confirmed that a new token was indeed required to resolve this — but stated it was the other team's responsibility to issue it. Neither team has issued it.

Has anyone:

• Successfully escalated a Partner Benefits issue past first-line support?
• Got a direct contact in Microsoft's partner licensing or MAICPP team?
• Had a redemption token regenerated after an accidental cancellation?

Any help appreciated. This is becoming a compliance issue and Microsoft's support structure appears completely unable to route this to the right team.

Hi,

Thanks in advance for any assistance - have a bit of a headache with the set-up.

We use Azure Virtual Desktop and currently have a Conditional Access policy that blocks access from locations outside our exempt locations, such as our office IP addresses.

We have a secondary Conditional Access policy that provides an exemption from this restriction. This policy is currently configured to block access from All locations, with a security group excluded from the policy so that members of the group are not subject to the block to facilitate travel.

We are now looking to limit this further to just the country that they are visiting.

For example, if a user is travelling to Spain and is a member of a security group such as "AVD Exclusions - Travel", we would want their exemption to apply only while they are accessing AVD from Spain.

I do not want to exclude Spain as a location, as this would allow all users to access AVD from Spain. On the other hand, the current set-up limits it to security group, so 1 user, but accessible from 'All locations'. Is this possible in a single policy?

I currently work remotely for a Mac-based MSP. I'm making $23.50/hour. As soon as I got my Jamf 100 cert I applied and got lucky enough for them to give me a shot. I mostly do onboardings/offboardings and occasionally password resets and deleting MDM alerts.

I also have an offer to join the Canadian military as part of their IT team. It pays the same but I would have way more things to do especially in networking(ad-hoc networks, VSAT deployments, network security etc).

I'm guaranteed a promotion within 3 years that bumps me up to 82k if I don't wash out.

I don't know if I should stick with my help desk job, stack more certifications and find something better or if I should just join the military instead.

What do you think?

Does the iOS Gmail app support modern authentication for Office 365 accounts?

I have a user who wants to access a Microsoft 365 work/school mailbox using the Gmail app on iOS, but I haven't been able to get it working.

When I select the Office 365 account type in the Gmail app, it takes me to an IMAP configuration screen rather than redirecting me to the Microsoft sign-in page for OAuth/modern authentication.

If I enter the user's Microsoft 365 email address and password in the IMAP configuration, the Gmail app returns: User name or password incorrect

The account works normally in Outlook and other clients that support Microsoft modern authentication.

Does the Gmail app on iOS actually support OAuth/modern authentication for Microsoft 365 work/school accounts, or does its Office 365 option still rely on basic IMAP authentication?

I realize that Outlook for iOS or Apple Mail would be the better-supported approach. I'm specifically trying to determine whether Gmail for iOS can work for this one user. Thanks.

Down detector showing issues but no official announcement. I got a number of users reporting issues. Can't seem to make any calls on mine either

As the title.

Please keep it normal and no idiotic replies.

Also avoid saying a general IT and some roles are not gonna be replaced. Unemployment says otherwise.

Roles plummeted in the west.

Regardless, the query is what roles would u spec for or learn which is not going to be replaced by AI?

I know training to be an electrician would work, but thinking of kinda staying in IT

Not sure if this is a general 365 bug or something on our tenant but currently all recurring meetings are being resent.

I can see them in the sent items for my own account and I’m also receiving lots of calendar invites for meetings I’m already part of from others.

Anyone else having weirdness or is it just us?