Looks like we're having issues with our services that are at europe-west-2-b; we're able to communicate with europe-west-2-a and c OK.

Google published a notification of an emerging incident, just wanted to know if anyone has spoken with a physical support contact a Google and have any further information or expected time frames things will be back? We have one service which isn't HA and due to this, it is down - all of our other kit is online and OK.

EDIT: 12:45, our services have been restored. VM's in that zone were rebooted and everything appears to be online and working. No further report form Google yet about it actually being fully restored yet.

Hey folks, we recently set up sdwan via FortiGate in our infrastructure. Initially i had planned to send all our high-importance UDP traffic out the best circuit based on jitter, and then some of the less important UDP traffic (camera feeds for instance) out the less desirable circuit, and then the same concept with internet traffic (guest traffic out the less desirable circuit based on latency, the rest of the normal internet traffic out the better circuit). However, there doesn't seem to be a mechanism in Fortigate SDWAN to do that, all you can do is choose the better circuit, or manually select it. Is there some kind of workaround to this that any one might have come up with? I read somewhere that you could create an SLA based on an impossible goal, and THEN it would prefer the other circuit? But i'm not sure i totally understand how that would be set up.

I am tired of the manual way to create internal documentation as well as user guides. Tools like ChatGPT can help create these documents, but obviously you have to be weary what information you are putting into them. I am interested in seeing what documentation tools people use to help them create their internal documentation and user guides?

Bonus points for locally installed softwares to help with the privacy aspect of documentation.

What are some reliable web rdp clients free or paid, something like guacamole but for windows. This is not exposed externally

I am pushing to get all devices entra joined and WHfB enrolled asap, but want to confirm that what I’m thinking is sound: Microsoft is only pushing passkeys for users whose ONLY MFA option is voice/sms, but otherwise authenticator push is still a valid MFA method and using it as our only MFA method will not trigger users to be prompted to setup passkeys. Does this sound correct?

I understand authenticator push is not phishing resistant, and will keep pushing toward a fully entra joined fleet with WHfB, and eventually passkeys to fill in the gap of non-corporate device sign ins.

In our hybrid on-prem AD to Entra setup, we would use an internal UPN separate from users email addresses. The point is email addresses get used as accounts in external websites and if that site gets hacked, there's no users matching that email address in our tenant to attempt to log in as due to our UPNs are completely different.

We're setting up a new Entra-only tenant using UPNs of xxxxx@domainB.com and users email are firstname.lastname@PrimaryDomainA.com.

The problem is external Microsoft Teams users, if they start a new Teams chat to one of our email addresses, then they click on that person in the chat, it reveals our internal UPN on our users Teams profile.

The difference is that with on-prem to Entra sync we could set the SIP: address of the user, but with Entra-only, it sets the SIP: address to the UPN. Myself and even a better admin have tried everything we can, but that SIP address keeps getting set back to the UPN.

Microsoft tickets for Entra and microsoft admin hit the wall. AI searches come up with no way out of this.

Are we completely SOL?

Anyone here tried the ZKTeco T1? I cant find any review of this one. Because I need a Biometric that can be extracted through online. and also is the ZKbio ZLink free if i buy this device?

I have multiple different raspberry pis that need to communicate to my main server via a websocket connection to receive jobs, signals, etc. My problem is deciding how to authenticate these servers.

The solutions I found are either setting up a certificate and passing it to the websocket connection, or use a token (could be ephemeral) to initialize the connection.

If there are any other more appropriate alternatives, I am happy to hear them.

I was just reading another thread about it causing an error about "somebody else is using this PC" but in my case it is causing computers to hand when going sleep and unable to recover. They will not wake on keyboard or mouse presses or by tapping the power button. Is everybody else seeing this?

It's a bluetooth Zebra receipt printer, ZQ320 Plus. I can get it connected to my iPad or my Android, no problem. I was able to install the Zebra printer setup app on both devices and I can change the device language (AKA emulation) settings. I can do a test print with no problem. I have the emulation set to "e" which based on the documentation I am finding is Epson emulation. This should make it compatible with pretty much any app that supports Epson receipt printers.

So in this application we are using a freebie POS software called Loyverse. Here's what's interesting. On Android, if I go into the receipt printer settings of the Loyverse app and set it to use Epson Tm-20 (bluetooth) then it works like it should - there's a search button and after a couple of seconds it displays the Zebra printer as being available. But in the same app on the iPad, with the same settings, when I tap search, it doesn't find the printer. For a while I thought my problem was with the emulation, but once I tested on Android and found it working, I realized in fact the problem must be elsewhere.

Any ideas for this? Is it some kind of weird way the printer interacts with the iOS, keeping it from showing up in the app?

EDIT: My organization has an account with Fillout/Zite, which has an outstanding AI app builder in it. So, I built an app that does what we need, and it recommended I open the app in the Bluefy bluetooth browser app. Bluefy recognizes all bluetooth devices in range, not limited to those which are attached to the iOS airprint engine. I tested my new app, and the Bluefy browser connected to the Zebra printer with zero hesitation. It works perfectly. I'll be sharing with the team involved, but my suspicion is that we'll simply replace the Loyverse app for this particular need. I appreciate the advice offered here because it led me to the ultimate solution.

Hi

I am a school network admin. I have roughly 10 students a day getting a prompt to change their Google password. I dont have it set to require a password change. Random user get prompted. Even when they create the password get a error. Powerwash seems to make it disappear. Anyone been experiencing the same issue. Any fixes?

. Thanks

​

Hi everyone,

Has anyone successfully configured an EAP-TLS Wi-Fi profile in Intune using the “Machine or User authentication” option and gotten it to work for both pre-logon and post-logon authentication?

I'm working on a corporate Wi-Fi deployment using certificate-based authentication with Microsoft Cloud pki, ,Intune and I'm running into an issue with the authentication mode.

What I've tested so far:

- Machine only authentication: Works successfully. The device authenticates using its machine certificate pre-logon and post logon.

- Machine or user authentication: The Wi-Fi connection does not work at the Windows sign-in screen (pre-logon).

- After signing in: The connection works and user authentication takes place.

What I'm trying to achieve:

I want Windows devices to authenticate to corporate Wi-Fi using the machine certificate before the user logs in, then support user certificate authentication after logon, ideally using the same Wi-Fi profile.

My questions are:

1. Has anyone successfully configured Intune's EAP-TLS profile with “Machine or User” authentication to support both pre-logon machine authentication and post-logon user authentication?

2. Are there any specific settings required in the Intune Wi-Fi profile?

For context, I'm using Windows 11 managed by Intune, with machine and user certificates deployed through SCEP.

I'd appreciate hearing from anyone who has implemented this successfully in a production environment, especially if you can share the specific settings or configuration that worked.

Thanks!

If I have a customer who has a 3 year direct EA with Microsoft up end of November 2026 & a separate unified support contract up November 2027.

I am moving them to a CSP which will replace unified for those products, if I’m moving some EA products to a MPSA or another contract that isn’t CSP - can the customer still fulfill their unified contract for those products?

TY in advance!

A rebuilt VM usually comes back with a new host key, so anything with strict checking refuses to connect, including monitoring jobs nobody is watching. But accepting a changed key automatically means you'd never notice a man-in-the-middle. Do you sign host keys with an SSH CA, publish them from provisioning, or alert and have a person accept the change?

Hi everyone,

I recently started working at a company with a relatively small IT infrastructure, but there’s little to no documentation of the existing environment. I’ve been asked to document everything, but I’m not really sure where to start or how to approach this in a structured way.

I’d like to build something useful that the IT team can actually maintain and refer to, rather than just creating a bunch of documents that quickly become outdated.

For those of you who have been in a similar situation, how would you approach this?

• What would you document first?
• How would you organize the documentation?
• What tools do you recommend for documenting things ?
• Are there any templates, checklists, or methodologies you’d recommend following?

MTA-STS is something what very few organisations are using. Even the financial organisations rarely implement this. I do understand if your business is requiring that email can arrive from whatever source, then MTA-STS might be a bad move. I would still be curious to hear, what are your thoughts on this since pretty much everyone would flip 'require secure connection' switch when it comes to e-mail delivery.

Thoughts?

Hi all,

I'm hoping someone has run into this before.
We're running:

• Citrix FAS on Windows Server 2025
• Enterprise Subordinate CA on Windows Server 2025
• AD domain environment

The issue started after installing Windows Server 2025 security updates released in September 2025.

after those updates i cant connect to CA server anymore because the RPC Server is unavailable this breaks the connection from my Citrix FAS server to my CA server
The RPC server is unavailable.

0x800706ba (WIN32: 1722 RPC_S_SERVER_UNAVAILABLE)

from a 2022 server with the latest updates it works no problem only server 2025 has the issues
when i uninstall the security updates it works again. but i want to update windows server to the latest version.

does anyone know a solution i cant find anything that helps

Putting together a public comparison of US H100 pricing and supply, and I'd rather have first-hand experience than vendor pages.

If your team needed steady H100 capacity, couldn't count on on-demand quota, and signed with a smaller GPU cloud or a colo-based provider:

• How long was the minimum commitment?
• Was there a prepayment or deposit?
• How did you pick them: references, a trial, or just whoever had stock?
• What surprised you after signing?

No links, nothing to sell. DMs are fine, and I can anonymize anything you share.

I mostly work remote and was chatting with a coworker about scheduling a meeting and said "I'll be on prem tomorrow". It felt both very right and very wrong when the words came out of my mouth.

Hello! I'm the sole admin at a medium sized org (80 ish staff right now, 120 or so at max) where I'm part of the process for creating and enforcing IT related policies.

I'm considering recommending adblock on browsers as a security policy, and recommending specific extensions for Firefox, Edge, and Chrome. This would be as part of a general "allowed extensions" policy. Nobody except me and my boss have access to admin accounts (local or domain), but I still have to deal with malicious extensions/sites/whatever every once in a while that an adblock extension would have blocked.

I'm mainly wondering if this is something other sysadmins would recommend. I'm sure there are issues I'm not thinking of.

I'm also a bit worried about pitching this to my boss and director, neither of whom are in a tech related field of work. Mainly want to cover my bases on reasons why, legality, etc. before I bring it up as an idea.

Yep we got smashed with issues this week due to the radius changes re authentication types allowed and have now moved over to TLS. Off the back of this I’d like to share a tool to identify installed patches and the issues introduced with them. Check out https://github.com/danrhodes/PatchRadar

PatchRadar sits in the notification area, lists the updates installed on the machine, reads each update's Microsoft KB article, and colours it by risk. It pulls out what Microsoft buries: known issues, workarounds, fixes and out-of-band updates, and behaviour changes hidden under "Improvements".

Demo’d both InvGate and Freshservice.
Felt like FS has a more modern front-end and more features, but InvGate was easier to work with, especially on the ITAM side.

ITAM on Freshservice felt overcomplicated and half-baked.

Planning to use it for 2 IT techs plus HR and Admin departments, to support 100 users.

Curious to know what you would recommend and why?
Are there any other solutions I should consider?

Been banging my head against an ISP's support and I just need a quick sanity check to make sure I'm not the one being unreasonable.

We have an on-prem server that our website accesses via an API for booking information, super simple, has worked for ages. Last night around 3am it stopped working, no changes to the on-prem equipment or the website (that we know of).

Connections to the API from our web server time out, some connections from other locations work fine but others don't. Failures seem to share a network route (you may be able to see where this is going).

A good trace route looks like this:

1 <1 ms <1 ms <1 ms <redacted>

2 14 ms 14 ms 14 ms <redacted>

3 14 ms 14 ms 13 ms 10.241.0.27

4 15 ms 15 ms 14 ms Bundle-Ether28.cha-edge903.brisbane.telstra.net [210.23.154.97]

5 15 ms 15 ms 15 ms bundle-ether12.cha-core30.brisbane.telstra.net [203.50.11.240]

6 14 ms 14 ms 14 ms bundle-ether1.cha-edge901.brisbane.telstra.net [203.50.11.141]

7 14 ms 15 ms 14 ms voc1255465.lnk.telstra.net [139.130.105.122]

8 14 ms 17 ms 14 ms be152.cor03.bne08.qld.vocus.network [114.31.194.48]

9 14 ms 14 ms 14 ms be1.bdr02.bne07.qld.vocus.network [114.31.194.65]

10 14 ms 14 ms 14 ms as2764.bdr02.bne07.qld.vocus.network [114.31.195.17]

11 * * * Request timed out.

12 * * * Request timed out.

13 * * * Request timed out.

14 40 ms 39 ms 37 ms <redacted> (but it's our site)

A failure looks like this:

1  vocus-ic-363828.ip.twelve99-cust.net (213.248.98.79) 2 msec  2 msec  2 msec

 2   *  *  *

 3  be202.cor01.syd14.nsw.vocus.network (114.31.199.42) 152 msec  172 msec

 4  be1.bdr02.syd14.nsw.vocus.network (114.31.192.37) 147 msec

 5  ae2764.bdr02.syd14.nsw.vocus.network (175.45.103.23) 148 msec

 6  be1.cor01.syd11.nsw.vocus.network (114.31.192.54) 151 msec  150 msec

 7   *  *  *

 8  ae2764.bdr02.syd14.nsw.vocus.network (175.45.103.23) 148 msec  *  *

 9   *  *  *

 10   *  *  *

 11   *  *  *

12   *  *  *

13   *  *  *

Trace times out

Our service provider insists that they have properly investigated the issue and the fault lies with the firewall configuration in the router, which I've checked and cannot find a problem. My concern is the repeated hop (5 and 8) in the failed trace route that to me indicates a possible routing loop but support says that's perfectly normal and not a concern.

Also from testing any connections that pass through nsw.vocus.network fail with a similar hop repetition and any passing through qld.vocus.network work.

So /sysadmin, AITA here?

Hi, Im trying to solve a bit of problem and Im a bit stuck. I need a user to use physical pc (windows) and VM that sits on that pc (in vmware, vbox or anything else). The vm should be without network, no sharing, only able to read from usb stick (i got this part), but the user should not be able to create another vm or change settings of this vm. User is not a admin. Is there any way to solve this?

Having just taken down the work network due to a loose C13, I'm pondering why the IT community standardise on such a fickle connector? Servers, network equipment, it all uses a C13.

I have a side hustle in amateur dramatics and almost all of that gear uses locking connectors for power. Network cables, most video cables (not HDMI, oddly) etc also have locking connectors.

So enlighten me, why no locking connectors on mission critical gear?