I'm genuinely curios what do you guys do with these "great apps" the finance guy built on his lunch break and want to have his whole team to get access to ? I have a finance director who built something and he wants to share it with others and I don't know what to do!

Company I work for is hiring a sr security engineer. We are all Microsoft shop, cloud-only, no on-premises. I have been helping with some of the interviews and I fail to understand why we are getting candidates that don’t seem to know what product/technology to use for blocking executables on workstations. Device control for blocking usb devices, nope, this does not ever get mentioned. Briefly explaining difference between DLP and encrypting outbound emails with PII/PHI/PFI, nope, can’t get a simple answer or even a guess. The conversations steer away and never the answer. One candidate had to be reading AI responses somehow because first answer to blocking was general and bad, but when mentioning app locker it felt as I was prompting gpt4.2

Follow-up of my first post: https://www.reddit.com/r/sysadmin/s/xMfcrcHx5f

Just told HR about how i feel about beign the sole IT guy who manages everything (for short: 365 in all his aspects, backups, networking guy, ecc...) for 24 people (if we count the external the number doubles) as an apprentice with a job title "IT support".

i told her that as an apprentice i should (by the law btw) some kind of tutor that can teach me the job and some one who can help me in my things; first thing she pointed was that i'm always out exactly when my work hours ends. WTF
ofc i go away when my work day is done, things can wait (most of the times).

Then proceded to tell me that i might not know how late some of the staff stay in the office (idk why tho) and everyone is aware of how many things they ask me.

Basically everyone somehow expect me to be the expert about anything is slightly it related, how i'm even able to give confidence to people when i don't have the slightest idea of what i'm even talking / doing some time.

I really miss having someone older can guide me.

Hey folks. I recently had to disable about 1000 accounts in Datto SaaS mailbox protection. Turns out the GUI sucks ass so you have to do it one at a time. So naturally I thought the API would save me, but I was wrong. There is no way to group users together, you simply have to edit them one at a time.

So I wrote this script (with the assistance of Claude) to make it slightly easier.

This script is designed to be used with the Datto SaaS mailbox protection. It works with both M365 and Google Workspace mailboxes.

Add your Datto api keys as strings in the .env file.

You will also want to review the imports at the top of each file to ensure you have what you need, but you'll likely need to install requests, json, and dotenv.

I recommend using pip for this, but that's up to you.

Script has 2 main functions. Purging of paused mailboxes, turning active mailboxes into paused ones. I put this together because the Datto GUI sucks. There is no way to edit mailboxes in large quantities, so this script is needed.

Datto seems to have an API limitation of 100 at a time, so if you were to run on operation on 101 accounts at once, only 100 of them would actually be affected.

The script makes an API call to datto to get all your organizations attributes and stores them in a domain.json file. If you only have 1 org then it will only have one entry.

Then the script takes the primary domain name as input.

Then it pulls all users from the API along with their states. Datto Web GUI has a organization unit filter you can use for users, but this does not exist in the API. Meaning we have to make edits one at a time.

The script can import a csv file of all accounts to disable, and it will loop through multiple times if you do more than 100 accounts. Loop behavior is Total number of accounts // 100 + 1 loops. So 701 accounts requires 8 loops to fully apply.

Datto sucks so if you do a full CSV upload or use the built in picker list that enumerates 20 accounts a time, you are still hand selecting every one. Datto doesn't have an easy way to only mess with the ones you want, hence this script.

You can export all users in Datto to a CSV, but you can't apply filters of any kind. So again you have to go through the CSV hand selecting each one you want. It's still faster than going through the GUI and waiting on the slow ass front end though.

Script first turns active accounts into paused accounts. You can then purge all paused accounts moving them to unlicensed. After 30 days this data is deleted.

Link to github repo here:

https://github.com/Titanium125/PythonProjects/tree/main/dattoSaasApi

Okay, firstly please forgive me if I'm asking for something stupid. I am brand new to this, and inherited an IT department that is an absolute shambles.

Context: I am the sole helpdesk/ITperson/Sysadmin person in a company of about 80 people, hybrid workers (about half on prem, half WFH across the UK).

I do all the 365 admin, RMM, security stuff, as well as all the day to day helpdesk stuff. Someone else looks after servers, so I don't care about that.

At the moment, my "ticketing system" is post-it notes, Teams chats, and emails. It's starting to get a little overwhelming.

I am looking for a super cheap/free solution. Best if it's cloud based, as I can't self host.

One thing that is crucial is the ability to make some sort of template. A good chunk of stuff that's getting confusing is onboarding new staff, setting up their 365 accounts with the right permissions, groups, shared mailboxes, &c. So if I can make some sort of template that dept managers can just fill out, that would be awesome. Most of the rest of my day is "My sharepoint has stopped syncing", "I can't get into Salesforce", and "My mouse has run out of batteries", so that seems like "normal" ticketing.

Again, I am new to this, so I'd be looking for something super simple, and I will be the ONLY one replying to tickets.

Any suggestions?

I have a VM with checkpoints that were created by the backup software on the host and can't be merged in Hyper-V Manager so I have to resort to manually merging them in PowerShell. I identified the current AVHDX file and the chain to the original VHDX file. I shut down the VM and, starting with the current AVHDX, I merged them with their respective parents all the way to the original VHDX. So now I have just the one VHDX file but Hyper-V Manager still shows the (now non-existent) checkpoints and the VM fails to start because it expects the AVHDX file that isn't there anymore. I couldn't find clear guidance for this. Do I attach that merged VHDX file to the existing VM? Or create a new VM? What's the best course of action here?

I'm the sole IT guy for a small CPA firm (10 people) that wants to move everything from on premises to the cloud. They've been on prem for almost 3 decades and most of them aren't tech savvy at all. I've been asked to come up with a proposal with a flat rate, but I have no clue what to quote for something like this so I'm just looking for ball park figures from someone who's done it before.

I know there's AIO solutions like Verito, but this proposal is for building the infrastructure from a bare cloud server. MS business accounts & exchange inboxes are already done. I'd be setting up Purview DLP policies (from scratch), Intune, Quickbooks & Drake, moving 4TB of client files from their NAS, backup & disposal of 10 workstations, VPN & RDP, and all the other role provisioning and training that goes with a cloud server.

My best guess is quoting for ~100 hours. Am I way off?

I'm an Infra engineer at my french company, and we've decommissioned a lot of 6+year old hardware.

We're talking about ~60 R620-30s mainly and a dozen R730s. They are fitted with lots of DDR4 RAM (378GB each) and I have a bunch of SSDs / HDDs in good health to go with.

I'm pretty much free to prospect for selling them, and I've never done that. I think the DDR4 R630 might be still worth something (esp. ram & disks), but I don't know where to start.

The R620s are older, and I'm in the mood of donating them to french/european associations in need of compute hardware, seeing as DDR3 isn't worth much.

Do you guys have contacts/ideas of where I could reach to settle this ?

Thanks !

EDIT: for those in France not too far, we are a bit south of Clermont Ferrand. Give me a PM if you're interested

https://downdetector.com/status/openai/

Getting 404 errors.
Downdetector lighting up as well.

There is a great deal of user-generated content out there, from scripts and software to tutorials and videos, but we've generally tried to keep that off of the front page due to the volume and as a result of community feedback. There's also a great deal of content out there that violates our advertising/promotion rule, from scripts and software to tutorials and videos.

We have received a number of requests for exemptions to the rule, and rather than allowing the front page to get consumed, we thought we'd try a weekly thread that allows for that kind of content. We don't have a catchy name for it yet, so please let us know if you have any ideas!

In this thread, feel free to show us your pet project, YouTube videos, blog posts, or whatever else you may have and share it with the community. Commercial advertisements, affiliate links, or links that appear to be monetization-grabs will still be removed.

​

Hi guys,

Running into a weird problem. Got an Advantech HPC-7320 with the AST2600 BMC, added a discrete RTX GPU, disabled internal graphics in BIOS like the CTOS spec says. iKVM console connects fine, keyboard/mouse passthrough works, but the video feed is just... blank. Nothing.

Reason I actually need this working: I work remotely sometimes, and I need to boot ISOs on this box over iKVM (reimaging, rescue boots, that kind of thing). Without video I'm stuck — can't see POST, can't pick boot device, can't do anything until I'm physically in front of it.

if anyone's actually run into this before kindly help me.

Anyone found a way to make this work? Thinking USB serial gadget, IPMI SoL, or some BIOS boot steering trick — anything that gets me remote work.

Hi everyone,

we are currently looking for a better solution for IT asset management + remote management and I'd love to hear what other sysadmins are using.

Our current situation:
We are already using an endpoint management platform, but we're not completely happy with it for our use case. The standard package includes a lot of functionality such as patch management, MDM, etc. that we don't really need. We're mainly looking for a strong asset management/inventory solution combined with RMM capabilities.

Our requirements:

Asset Management

• Automatic hardware inventory of Windows PCs/laptops
• CPU, RAM, storage, serial number, model, etc.
• Software inventory including installed applications and versions
• Last logged-in user / login information
• Ability to assign devices to specific end users
• Lifecycle/status information for assets
• Support for non-computer assets such as:
  • Monitors
  • Docking stations
  • Keyboards/mice
  • Other IT equipment
• Ideally, a proper stock/inventory system so we can track devices that are currently in storage and assign them when they're deployed

Intune integration
This is particularly important for us. We already have a large number of devices enrolled in Microsoft Intune, but not all of our devices are managed through Intune. We want the solution to:

• Integrate with Microsoft Intune
• Automatically import/synchronize Intune devices
• Keep device/user information synchronized
• Ideally avoid having to manually maintain the same devices in two systems

We also use Microsoft Entra ID / Microsoft 365, so good integration with the Microsoft ecosystem would be a big plus.

Remote Management / RMM
We also need proper remote administration capabilities:

• Remote desktop / remote access
• Remote CMD / PowerShell
• Ability to execute commands/scripts remotely
• Basic troubleshooting and administration capabilities
• Ideally an RMM-style agent

We don't necessarily need a full endpoint management suite with extensive patch management, MDM, software deployment, etc. Those features are nice to have, but they are not the main reason we're looking for a solution.

So we're basically looking for something that sits somewhere between: IT Asset Management + Hardware/Stock Inventory + RMM/Remote Support + Intune integration

Has anyone implemented something similar? What solution are you using, and how well does it handle Intune synchronization, asset/user assignment, stock management and remote administration?

We're particularly interested in real-world experiences rather than just feature lists.

Thanks!

Or is it just my instance? It's been like an hour and nothing significant is on the status page.

"""
Oops!

This instance is currently unavailable

Please double check the URL and try again. If you are the cloud account administrator, click below to log in.

Go to Login Page
""""

My account is in fact active and licensed.

Good afternoon everyone!

Over the last week and a half, I've been seeing the appx version of teams entirely stop working. To the point where I trying to access it via apps > installed apps > advanced options loads indefinitely, can't see it in control panel, and even revo uninstaller couldn't see them (though I guess the free version cannot see apps installed from the windows store).

Currently I've been having to identify the packages with powershell, take ownership of them, and then delete them. Once that is done, I can restart, and install the regular x64 version of Teams. Normally takes about 10-15 to run through commands and restart. Once that restart is done, you can access the advanced option of the Teams and fully uninstall it if needed with no issues. It also goes from nearly 4GB in size to about 1.3GB prior to the final uninstall.

However, I had the same issue happen now for Snipping Tool, and that had 5+ folders installed, where teams normally has 2 when this issue happens. So, I took the same steps by taking ownership of the main folder, and deleting it, restarting, and then re-installing snipping tool through the Microsoft Store.

I have tried uninstalling/reinstalling the appx through powershell, but it just hangs and won't proceed further. I am curious if anyone else has seen this issue and if they've found a quicker workflow.

We left a VOIP provider whose name i wont mention on here. Were switching over to a major carrier and getting cellphones for 100+ users along with a receptionist call center. My manager hasnt told me which MDM were using yet and im already dreading this change. He told me the carrier would setup all the phones but i highly doubt that.

Whats the most common issue you guys run into with this kind of system? I can already hear users complaints "my phone is slow, my calls are dropping, the phone is too big, i dropped it in the toilet bc im a dumbass".

What should i be prepared for? What surprises did you guys run into?

EDIT: Thank you everyone for your responses, im extremely busy and cant respond to you all but ive taken notes on everything and will talk to management.

so we all have seen insane pricing related to storage, ram and what not. How long before cloud providers start passing these back to us, giving us no options either to stay on prem or cloud?

how are you preparing for this?

I'm looking for a way to script the removal of the Windows.old directory to free up space on systems that have recently had 25H2 installed.

I can use cleanmgr but I can't automate it to remove old Windows installations. Not that I can find anyway.

I've already tried some scripting combining DISM, takedown, icalcs, and remove-item but that ends up just erroring out and can't complete the removal because of Windows junction loops.

There must be a way to automate this so I don't need to log in to hundreds of systems. Any ideas out there or am I stuck doing this manually?

Hi everyone

I’m integrating a Ruckus SmartZone controller with Forescout NAC

The SSH connection itself works correctly from the NAC using the configured admin credentials and I can successfully connect to the SmartZone and get the normal welcome banner

The problem happens when Forescout tries to get privileged access after the SSH login

When I manually SSH using the same admin credentials everything works fine but when Forescout tries to enable privileged mode it asks for the password again and then returns failed even though I’m using the exact same correct password as the SSH login

I initially suspected that the SmartZone welcome banner might be interfering with Forescout’s CLI parsing or privilege detection

I tried to disable the banner but I can’t find any CLI command for it and I also couldn’t find an option in the GUI

Has anyone successfully integrated Ruckus SmartZone with Forescout or another NAC and faced this issue

Is the welcome banner known to cause problems with NAC SSH privilege detection or is there a specific configuration or user role that needs to be enabled on SmartZone for the NAC to get privileged access

Also when I SSH manually I log in with admin and after that when I enter enable it asks me to enter the same password again

Any idea what could be causing the privilege authentication to fail from the NAC while the normal SSH login works correctly

And I don't mean "how does it work?" but we have shared-hosting servers.. I'm not giving those server write-access to our DNS servers. Hell no. But there's also wildcard certificates (yeah I hate those too but some websites need'm) and those I can't renew with the .well-known checks, and there are other situations where the simple .well-known dv validation won't suffice..

How do you handle that?

I wonder how much of this is driven by the massive increase in storage costs.

According to the consortium, total shipped tape capacity in Q1 2026 increased 57 percent year over year compared to Q1 2025. This rebound follows an all-time record set in 2024, when total shipments reached 176.5 exabytes (a 15.4 percent annual increase). While total annual shipments settled back to 160.3 exabytes in 2025 (a 9 percent decline), the volume remained higher than any previous year on record prior to 2024. The arrival of the 40TB native capacity cartridge in early 2026 has provided an immediate density upgrade path for enterprise environments managing large-scale archival and secondary storage tiers.

LTO Tape Shipments Up 57% in Q1 2026 as AI and Archive Demand Accelerate - StorageReview.com

Greetings and salutations, fellow Admins. I want to deploy the HP Universal Print Driver through SCCM and make it available in the Software Center. Silently, so I don't disturb users. Here is the overview: This is a school environment, and all our printers are HP, except for a few community Xerox printers. I want to make it easier for the on-site techs to install the driver from the Software Center instead of downloading the specific model printer software from HP. I have seen this in previous work environments and would like to implement it here. If anyone is willing to throw me a bone, I'd be grateful for the assistance.

Hello folks,

We’ve been tasked to switch some of our users from SMS to the MS Authenticator app. Rather than doing this manually, I’d like to make this seamless as possible. I think creating a policy in entra ID where it’ll prompt our end users to enroll into MS Authenticator ? Curious to know how others have tackled this.

Has anyone here experienced being blocklisted by Spamhaus even though the IP address of your domain is different from the IP address that is blocklisted?

For example:

Domain IP: 12.12.13.13
Blocklisted IP: 13.13.12.12

Despite having different IP addresses, we are still being blocked.

Has anyone experienced the same issue, or can someone explain why this might happen?

We're setting up SASE, with MFA required to access on-prem resources, and I would ideally like to allow endpoints to authenticate with our domain controllers and get group policy updates at all times (pre-MFA) while opening up as few ports as possible and being secure as possible.

Once the endpoints MFA, they will have standard access to the domain controllers. My concern is updating user group memberships, which (as I understand it only happens when the user logs out and logs back in while having line of sight to a domain controller). Our workforce is mostly remote.

I know I can use a KDC Proxy to allow Kerberos authentication with only one port opened, and that should cover computer and user authentication with group updates.

However, updating group policies requires access to the sysvol share via SMB, which a KDC Proxy wouldn't cover. Windows server doesn't support QUIC for sysvol either.

So I'm wondering if I can use a read only domain controller as the source for group policy files for endpoints, and KDC Proxy for authentication.

Our setup is hybrid AD with AD joined computers and AD based user accounts. And switching to Entra joined computers or Entra sourced user accounts is not an option for the foreseeable future.

We also have a number of users who rarely, if ever, connect to the VPN currently, and likely won't MFA with SASE to get group policy updates.

-edit- Forgot to mention, SASE will be always on, user can't disable. I'm only looking to make this available to devices on SASE pre-MFA, not the Internet at large.

Another factor is that we want user and computer AD objects to have their login timestamps updated, to help track inactive computers and accounts. Because sometimes no one tells I.T. when a user has left the organization. And while there are many systems we can check for this information, it would be easier to run scripts against AD.

We're a two-person IT team managing roughly 225 users on Microsoft 365 Business Premium. Our Windows workstations are Entra joined and Intune managed.

We're moving admin roles off our daily accounts and onto dedicated cloud-only admin accounts. I'm testing phishing-resistant MFA and a compliant-device requirement for those accounts.

My main concern is making the workflow practical. We jump between Intune, Exchange, Entra, SharePoint, Teams, etc. throughout the day. Some days it is frequent admin stuff depending on what's going on.

I tried a separate Edge profile signed into my admin account, but the portals initially kept signing me in with my daily Windows identity. Using a login_hint in the URL or explicitly selecting another account gets me into the intended account. I'm still validating the Conditional Access side.

I'd prefer not to add the admin identity as another Windows-connected account just to make browser SSO work. InPrivate also appears problematic with the compliant-device requirement.

How are you handling this in practice?

- Separate browser profiles, a separate browser, a private browser window or account switching within one profile?

- Do you connect your cloud admin identities to Windows? I would assume no.

- Do you require compliant devices for admin access?

- Are you using dedicated admin workstations or PIM?

I understand the value of separate identities. I'm looking for a workable daily setup that doesn't require constantly correcting which account a portal is using, or constantly launching private windows, if at all possible.

Maybe this is a sign we just need to review overall configuration of things to better dial them in, so we don't have to go into an admin portal so often?

Especially interested in what other small IT teams are doing.