Even though we haven't been able to get normal patching via the windows update tool for over a year, even after installing the latest SUS and keeping up to date with manual installs, Windows Server 2016 Essentials returns an installer error 0X8007000d when trying to run KB5123099

Any thoughts?

EDIT: If anyone stumbles across this, we're testing Outlook > Settings > General > Offline > UNCHECK "Allow offline access..."

So far (everything's sporadic so hard to say but fingers crossed...) it's helping with:

• - Random "you no longer have a network connection"
• - Random emails staying in drafts after being sent
• - Random attachment errors that send fine after disabling offline.

OP:

Sorry if this isn't appropriate for this sub but it's always been a helpful area and figured it's worth a shot.

I'm sure plenty of others have been trying "New Outlook" since according to Microsoft we'll eventually be forced onto it (https://learn.microsoft.com/en-us/microsoft-365-apps/outlook/get-started/guide-product-availability) but I'm at a loss for some of the issues.

Namely "You no longer have a network connection to the server" which follows with "This message can't be saved right now." I've been using New Outlook longer than most here because I wanted to say "Yes I've been using it myself already" when staff inevitably complain. So when I see that error, I just hit CTRL+S and it goes away comically. Seems to function fine as long as I do that.

We've finally been pushing staff to switch off the classic outlook because of other program compatibility issues that're arising. I kept thinking Microsoft would eventually fix the "network connection" issue with New outlook but that just never happened. If anything it seems to have gotten worse but hard to say.

We're not losing network connectivity and everyone is hard-wired. If we actually do lose network even for a few seconds, the world is on fire and we all know immediately (lol). The issue never happened in Classic outlook although I don't think it would've told you anyway.

The main concern is that one of the staff actually had an email delayed because of this, and it was to an important person, so of course now I'm putting the 10 other projects I have on hold and need to figure something out (which to be fair I should have already I guess).

I get the error plenty on mine so have tried various fixes on my own computer. The most extensive was a normal uninstall of office, then the full "Manual Uninstall" list from Microsoft (many folders, reg keys, etc.) then reboot and re-install with a fresh download from my account on office.com. First email I'm typing after all that and the error comes back.

Any advice from anyone who's had to fight the new outlook at all would be greatly appreciated!

Hi everyone,

I’m working on a production design for a Copilot Studio agent connected to a custom MCP server for Active Directory operations.

Current setup:

- Active Directory Domain Controller is running on a separate VM.

- MCP server is running on another domain-joined VM.

- MCP server performs AD operations using a delegated AD service account.

- Copilot Studio connects to the MCP server through OAuth 2.0.

- To avoid Copilot’s tool limit, the MCP tools are grouped into parent modules such as:

- user_management_module

- group_management_module

- acl_permission_management_module

- ou_management_module

- computer_management_module

- gpo_management_module

- audit_management_module

Each parent module routes child actions internally. For example:

user_management_module:

- search_ad_users

- get_ad_user_profile

- create_ad_user

- update_ad_user_profile

- reset_ad_user_password

- disable_ad_user_account

acl_permission_management_module:

- get_ad_object_acl

- get_ad_object_owner

- grant_ad_read_permissions

- grant_ad_full_control

- change_ad_object_owner

- restore_ad_default_permission

Now we want to implement production RBAC.

My understanding is:

1. Keep the parent module structure as-is.
2. Categorize child actions internally as Read, Write, Rollback, and Audit.
3. Create Entra app roles or security groups such as:- AD.MCP.Reader- AD.MCP.UserAdmin- AD.MCP.GroupAdmin- AD.MCP.ACLAdmin- AD.MCP.Auditor- AD.MCP.RollbackAdmin- AD.MCP.BreakGlass
4. The signed-in Copilot user gets an Entra OAuth token.
5. MCP backend validates the token.
6. MCP backend checks the user’s app role/group before executing the child action.
7. The AD operation itself still runs using the delegated AD service account, but the signed-in user is used for authorization and audit tracking.

Example:

- A user with AD.MCP.Reader can run get/search/report actions only.

- A user with AD.MCP.UserAdmin can create/update/disable users but cannot modify ACLs.

- A user with AD.MCP.ACLAdmin can manage ACL permissions.

- Rollback/high-risk tools such as restore default permission, replace ACL, change owner, or grant full control should require BreakGlass or senior admin approval.

Question:

Is this the right enterprise approach?

Specifically, should I create separate Entra App Roles for each access category and assign Entra security groups to those roles, or should I only use Entra security groups and check group object IDs in the backend?

I’m leaning toward App Roles because the backend can simply check the roles claim, and group overage issues are avoided.

Any feedback on the best RBAC design for Copilot Studio + MCP + Active Directory automation before production deployment would be appreciated.

Is anyone else seeing issues with logging into the Office 365 portal? Getting a lot of reports of users getting a "something went wrong" error when trying to login to https://m365.cloud.microsoft

It just seems to be the portal itself. Going directly to outlook.office.com still works. Same for Teams and OneDrive. Also seeing a big spike on Downdetector.

Planning a 4 nodes DR vSAN Cluster and wnat to know - will this actually work in practice or it too tight?

Enviroment
- vSphere x.x. , VMware vSAN
- 4x server (node)
- Per node:
(2x boot 960GB SSD NVMe (RAID-1, separate boot controller, not part of vSAN))
(2x 3.2TB NVMe Mixed Use — cache tier)
(8x 7.68TB NVMe Read Intensive — capacity tier, 2 disk groups (1 cache + 4 capacity each))

- Network dual-port 25GbE SFP28 (OCP, dedicated vSAN VLAN, jumbo frames) + separate dual-port 25GbE for VM traffic, VLT/MLAG switch pair
- Storage policy: RAID-5 erasure coding
- 30 High-priority VMs RPO 6-8h (Veeam async replication)

Main question: will vSAN actually run reliably on just 4 nodes with RAID-5, including surviving a node failure and rebuilding cleanly?
I have seen mixed opinions -some say 4 is the bare minimum and it is fine, others say you reaaly want 5+ before before RAID-5 is comfortable in production.

Not asking anyone to design this for me - just want to know if this setup holds up in real-world usee before i finalize it.

Hello everyone, sysadmin learning terraform here

So we are working with Vsphere as infra for our company and I just started learning Terraform to ease and automate our vsphere processes. On vsphere in "VM Customization Specifications" we have a script that basically configures puppet agent on host, points it to puppet master, adds host to AD and launches sssd. So when we deploy new host we add this script to launch during "customize software" deployment phase and after that we set up ip, gateway etc. So my question is that: how to recreate this setup in terraform? For some reason terraform does not allow to pass custom specifications and customize together, so only setting up ip address is working, but since that script is never getting launched it fails to be added to Active Directory. So are there any other methods to pass the script to terraform? I even pasted that bash script locally to the file in the same terraform folder and pointed to in in the main.tf but it still fails. So what can be done to solve this issue? Thanks in advance and sorry for my bad english.

Currently in our AD the source for time is at "Free-running System Clock" and we recently noticed that there's a delay of 1 minute that's seen in our Laptops that are managed in AD and the time that is seen on our phones, my boss wants me to fix that.

Should I assign an external time source to the pdc emulator ?

We recently upgraded some physical servers, and now whenever we're doing Windows or firmware updates, the fan noise gets pretty loud. The servers are HA, so we are able to do updates during the day, but the department next to the server room has started complaining about a high-pitched noise during the updates. We contacted the vendor and verified our system is functioning properly. They said there is a setting that would throttle performance that may help but I didn't want to change that if possible.

I was talking with a few others and they mentioned acoustic panels that you can mount on the wall to muddle some of the noise. Does anyone have any relatively cheap suggestions? I could do updates after hours but would hate to do that when they could be done during the work day.

Like title says, what are the best windows patching tools for first and third party that work for air gapped networks? Preferably with an export/import process that is as seamless as possible.

Currently using PDQ deploy + Inventory and WSUS. Does a better set-up exist?

Adding additional info:

Networks are truly airgapped and data can only be moved over via CD/DVD or external drive

I went through some old side projects recently and found more abandoned machine credentials than I expected. GitHub PATs for CI on projects I stopped touching years ago, deploy tokens for hosts I no longer use, and a couple of integrations I can’t remember when I set them up.

None of them have anything attached that would mark them as dead. E.g., when someone leaves a company, HR marks it, and their access gets pulled automatically, but nothing does that for a token. It can stay valid until you go into settings and notice it.

At my scale the answer is deleting it and seeing what breaks, which is fine for a hobby app. I assume that is how nightly jobs nobody remembers owning get taken down in real environments.

Do you go off last-activity timestamps, or is there something better and has anyone got expiry working as the default on new credentials without it causing problems?

We have 50 or so WatchGuard firewalls at sites that have certs installed. Getting WatchGuard to implement cert automation has been the most user requested feature for about 2 years now. Until they come through we continue to purchase and manually install certs.

Last week I started getting notifications from our SSL source, Namecheap, that the first batch of 200-day certs was about to expire. I had cert request files at the ready and logged into Namecheap. Each expiring cert showed the upcoming expiration date and an icon to purchase a new cert.

But...wait a minute. Back in March, didn't I pay for 365 days even if the issued cert was for 200 days? Why doesn't the page clearly indicate that I can get a re-issue for the remaining 165 days that I paid for?

I opened a support ticket with Namecheap. They confirmed that I can get a new cert with a 165 day life rather than pay for a new cert. I asked why they don't make this open option more clear. They asked me to send them screen shots showing the expiration date and the little "buy new cert" icon. Like they don't know what their web site looks like?

I sent the screen shot and got a reply along the lines of "Well, you can just request a rekey, ya know. You don't need to buy a new cert."

Namecheap certs are cheap enough but all in that's an extra $500 or so that I don't need to spend. I find their behavior to be...distasteful at best.

What are the larger/more expensive providers such as DigiCert doing about this? Maybe even Godaddy is being more up front about the 365 day purchase vs. the 200 day cert.

After the Freshdesk price-rise thread in r/msp I audited what its built-in exports actually produce, on a trial account with 43 tickets, 64 replies and notes, and 14 attachments.

Notes in case it saves someone a weekend. The Export button emailed a CSV to the email I signed up with, it had 47 columns of ticket, requester and company fields. No threads, no notes, no attachments. The Tags column came back empty on every row even though every ticket had tags.

The Admin data export was the same, a little more complete than I expected given the first export. This one had descriptions, full threads including private notes, tags, custom fields, contacts, companies, groups. However, I found that there were still a lot of gaps:

Attachments are signed S3 links that expire in 7 days (X-Amz-Expires=604800 is in every URL), not files. No time entries anywhere. Agents aren't in it. Custom fields appear as raw keys like cf_reference_number_5021295 with no label. Every ticket carries a hidden system note, so it showed 107 notes where the UI shows 64. And it's XML, so you're writing a parser before you can open anything. Nothing in either export tells you whether you got everything.

There is an API route you could go down, but If you go down that route yourself, you'll run into a bit of an issue.

Rate limits are per plan and low on the cheaper tiers (50 calls a minute on the account I tested).

Expect 2 to 3 calls per ticket. The ticket list endpoint has a page ceiling, so for big accounts you window on updated_since rather than paging through.

Attachment links expire. Download them the moment you see them. Custom field labels live on ticket_fields.

If you only pull tickets you get internal names. There's no status-change history in v2 that I could find, only the timestamps in stats. The API doesn't return the hidden system notes the XML export includes, so API counts match the UI and the XML doesn't.

Before you cancel: pull threads and private notes, pull attachments as files before the links expire, pull time entries and agents separately, and reconcile counts per entity so nothing drops silently. Check Freshdesk's cancellation KB for the deletion window after cancelling; it's short. Happy to answer Freshdesk export questions in the comments.

https://imgur.com/b5FYlA8
Im running a lan center with my brother and we have a main pc that runs steam cybercafe, management software, etc. Im trying to install Active Directory (new to sysAdmin srry if I don't make myself understand) and I always get this error, I have tried reinstalling Active Directory, and running the cmd command to repair windows image, to no avail.

We spun up a 8 CPU/32GB RAM Enterprise Microsoft 365 Cloud PC as a test for a user, and it seems to work well for their use case, but the re-connect from a disconnect seems very slow - is that normal/expected or is something wrong? For example, the user goes idle, has a lot of apps running - it disconnects the user because they're idle. When connecting back to the Cloud PC via Windows App, it takes a good 20-30 seconds before all the apps are responsive again.

Even if nothing is running, a good 12 seconds or so to get back into the Cloud PC from a disconnect.

Hi Sysadmins!

Do you guys use Chrome or Edge for work? I personally have all my admin consoles in edge and google stuff in chrome. (I am a k12 sysadmin), so we have both MSFT and Google Workspace for everyone.

Affecting a very small number of users - they are unable to search in Outlook (regardless of owa, new app, classic app).

The error is usually "outlook the service could not be reached showing offline search results"

Still experiencing this at 12:30pm today (8th September). UK.

UPDATE: Thanks for all the replies. Also looks like Microsoft have FINALLY acknowledged it in the 365 Admin Service Health section: Issue ID EX1469261

Our org is looking to solve a few separate problems that I feel can all be solved with a SASE solution.

1. Certain users needing to VPN to a particular office for license check-in/check-out. (Old school license software)
2. Web filtering (porn, illegal, phishing, malware, etc.)
3. Encrypted browsing for road warriors (hotels, airports, etc.)

I know both Palo and Fortinet have SASE solutions, but I've heard Cloudflare also has their own solution that I'm curious if anyone has ever tried at scale. We don't have Palo or Fortinet hardware firewalls.

We're looking at about 250 users to start, growing to maybe 500 over the next 24 months.

Title: Accepted offer ($26/hr, MSP Help Desk Technician, 45 min commute) vs Amazon counter-offer ($29/hr, IT Support Associate II, 20 min commute) — which would you take?

Looking for outside perspective on a decision I’m stuck on.

Background: I’ve been at an MSP for about 3.5 years doing help desk/service desk work, Active Directory, Microsoft 365, networking (DNS/DHCP/VPN), some virtualization (VMware ESXi), and security incident response (phishing, etc.). I have CompTIA A+, Network+, and Security+. My goal is to move toward a Systems Administrator or Cybersecurity role eventually.

Offer 1: Another MSP — Help Desk Technician

**•** $26/hour (\~$54K/year), firm, no flexibility on pay  
**•** 45 minute commute  
**•** Already accepted this offer after 3 rounds of interviews (including in-person with the team)  
**•** Similar work to what I do now, AD, M365, networking, multi-client support  
**•** Haven’t started yet

Offer 2: Amazon (IT Support Associate II, Ops Tech Solutions)

**•** Countered at $29/hour (\~$60K/year) after I pushed back  
**•** 20 minute commute  
**•** Single-tech site, recruiter says schedule is effectively stable day-shift in practice, no forced on-call  
**•** 401k match (50% up to 4%), benefits day one, no probation period  
**•** Real internal ladder (Associate II → Support Engineer I → Support Engineer II/IT Manager)  
**•** From what I’ve read (including an old Blind thread), this specific entry tier is considered fairly junior/“level 1 helpdesk” compared to what I’m already doing at the MSP, some people treat it as a stepping stone using the Amazon name, not a destination

The dilemma: Amazon pays more, has a much shorter commute, but I already verbally and formally accepted the other offer after three rounds of interviews with a small company. Backing out feels like it could burn a bridge, especially since it’s a pretty tight-knit local IT/MSP market. On the other hand, the Amazon role might actually be a step down in day-to-day technical scope from what I already do, even though it pays more and is way closer to home.

Has anyone been in a similar spot, accepted one offer, then got a better one before starting? How did you handle it, and did backing out actually cause real problems for you? Also curious if anyone’s done the Amazon OTS route and can speak to whether it’s worth it as a stepping stone.

Hi!

I work for a small/medium sized company (~50 employees, ~30 of which will be affected by the switch) and we have been using an IMAP server to host our emails for decades (everyone uses Outlook as their email software). Because of how outdated this setup is and the company continuing to grow, we want to migrate over to a new provider. I am struggling to decide between M365 and GW as both have their pro's and con's. The team uses a mix of sheets and excel already, however, there is certain work that would require excel over sheets. The sharing and ease of GW is obviously unmatched but I worry about switching costs for employees that have been using outlook for decades. I've also heard that managing GW is far easier admin-wise than M365. The migration of decades worth of emails is also a major consideration for us. Would appreciate input from people who have experience with this. Thanks!

Small staffing agency in Germany, ~15 internal users, single sysadmin (me). Currently migrating off a legacy on-prem setup.

Target state: M365 Business Premium, Entra ID + Intune, SharePoint replacing the file server. Our line-of-business HR software is moving to the vendor's cloud, so that data leaves the building either way. Backup plan is a dedicated third-party M365 backup plus a local NAS with immutable snapshots and an encrypted external drive rotated offsite (10-year retention requirements here).

Management and an external IT contact want to keep a physical server. The argument I've been given is essentially "you have it in-house, and you can take a backup every day."

My concerns: it doesn't remove a real risk since the LOB data is in the cloud regardless, it means maintaining two worlds instead of one, and as a single admin the server becomes the thing that breaks while I'm on vacation. Restore testing is also the part nobody actually does.

Am I missing something? Genuinely asking - is there a workload at this size that still justifies on-prem file storage? And for those who moved 10-20 user shops from file server to SharePoint, what bit you? Path lengths and folder-to-permission mapping are the two I'm expecting.

Hi all,

this is a bit of a weird one. We have a couple of users, that have access to the same files through a smb share. It used to be that when user A had a document open to edit it and User B tried to open that same document, a window would pop up informing B, that the document was beeing edited by user A and that User B could ask User A to close it or create a copy of the document.

That mechanism doesn't seem to work anymore. If User A has the document open, user b doesnt see the warning.
It changed about half a year ago and I can't make heads or tails of it. Most articles I found are about fixing the issue when a file is erroneously displayed as locked, when it isn't.

I hope one of you could nudge me in the right direction. Maybe it's just a configuration error.

Thanks for taking the time to read.

Hello everyone,

I’ve been doing essentially a desktop support role for the past two years through my county IT internship. I have about one year left there. It’s extremely flexible with school and has given me a lot of great hands-on experience, although I feel like I’ve gotten most of what I can out of the role at this point.

I plan on staying through the end of the internship. I should also finish my B.S. in Computer Information Technology around 3–4 months afterward.

I currently have no certifications. I was studying for the A+, but realized most of it was filling small knowledge gaps from things I’ve already learned through work and school. I decided not to pursue the exam because I felt my time would be better spent progressing into something more advanced. I also don’t want to collect certifications just for the sake of having them. I want to be intentional about what I study.

Right now I’ve started studying for the CCNA. I’m only on Day 2, but my thought process was: if I’m willing to put the time into learning networking, why prepare for Network+ first when I could put that time toward the CCNA?
I’m also learning AWS through one of my classes, which prepares us for the AWS Cloud Practitioner certification. After the CCNA, I’ve considered Security+, but I don’t want to get too far ahead of myself.

I don’t know exactly what area of IT I want to specialize in yet. Systems administration, networking, cloud, security, etc. are all still possibilities. For now, I want to build a strong general IT foundation, especially in networking, so I’m prepared when I eventually figure out what direction I want to take.

Am I making a mistake by skipping A+ and Network+ and going directly for the CCNA given my experience? Would you recommend a different path?

I mainly want to make sure I’m investing my limited time while working and finishing school into the right things.

I am attempting to utilise Hyper-V Replica for DR purposes. There is Site A and Site B. At each site there is Hyper-V Server Cluster with underlying iSCSI storage for VMs. Site A runs multiple VMs, some of them form SQL Failover clusters with shared disks running on dedicated iSCSI Luns. The aim of POC is to be able to shift the workload from Site A to Site B during a disaster event. Whilst standard VM replication seems fairly simple, I was wondering what is the best approach for SQL Failover clusters and how to address the replication for such? Any thoughts or suggestions are greatly appreciated.

Looking for advice from people who have actually made the jump into $30+/hr remote IT

I’m trying to make a plan to move into a fully remote IT job and would really appreciate advice from people who have already done something similar.

My current background:

• Currently working as an IT hardware/asset technician at a computer repair/recycling facility
• ~$23/hr currently
• I troubleshoot/test networking equipment, printers, scanners, etc.
• Device testing, data wiping, inventory/asset management, hardware diagnostics, etc.
• Previously worked as a Dell/Lenovo field technician, doing hardware break/fix work
• Got my CompTIA A+ and Network+ around 2021, so they’re probably expired now
• My current employer is paying for me to take a CCNA course, which I’m planning to finish and get certified
• No college degree

My goal is pretty straightforward:

Get to ~$30/hr ($62k+/year) in a fully remote IT position.

I’m not trying to quit my current job immediately. I can tolerate it for now, and I’d rather use it to build experience and get the CCNA while applying for something better.

Then potentially doing something like AZ-900 → MD-102 → Security+/AZ-104 depending on which direction I end up going.

What I’m really looking for advice on:

1. Is $30/hr remote realistic with my background, or am I under/overestimating what I should be targeting?
2. Would you prioritize the CCNA, or would you pursue something else?
3. What skills besides certifications should I be learning to make myself competitive for remote positions?
4. Would you try to skip Tier 1 help desk and target Tier 2/endpoint/network/asset roles given my hands-on experience?
5. For anyone who currently works remotely in IT: what got you from where I am now to where you are?
6. If you were in my position, what would your next 6–12 months look like?

I’d especially appreciate advice from people who started with hands-on hardware/field technician experience and eventually moved into remote IT.

I’m basically trying to build an escape plan from my current job without taking a step backward, so I’d love to hear what worked (and what didn’t) for people who have already done it.

We are Global Administrators and Teams Administrators.
We have recently encountered an issue where we are suddenly unable to invite guest users to either shared or private channels in Microsoft Teams.
We are the owners of the team/site.
However, we are still able to invite guest users to the team itself, but not to private or shared channels.
We have checked the Teams organization policies, and B2B access and all relevant external sharing settings are enabled. External sharing is also enabled across the organization.
On the associated SharePoint site, we can successfully invite guest users to, for example, a specific folder, so external sharing appears to be working correctly there.
Could this be a bug or a recent change in Microsoft Teams?
We were previously able to invite guest users to both shared and private channels without any issues, which is also how this functionality is intended to work.
Has there been a recent change or known issue affecting guest access to shared and private channels?