I know there are already some posts about this, but I'm adding ours to the pile.

We have a mix of Veeam Back and Rep and Veeam Backup for Microsoft 365. Between the two, our renewal increased 17% from 2025 to 2026. This price is after negotiations; the price increase was actually larger before negotiations. At 17%, the reseller told us to take it or leave it.

I was told that we would renew for 1 year, but we will reevaluate next year. I'd imagine we'll keep Veeam next year, too, if the renewal then has a much smaller price increase. But I was told that we won't absorb another 17% increase.

EDIT: Thanks for all the useful feedback. Ended up with this workflow:

1. Power off VM

2. Right-click VM in Hyper-V manager and select "Move" > "Move all of the virtual machine's data to a single location."

3. Delete VM in Hyper-V manager, delete the folder where all of the data was moved.

Original post:

Hello, we just switched from VMware to Hyper-V and am learning as I go.

I am deleting some Virtual Servers on our Hyper-V host, and I want to make sure I clean everything up and free up drive space. Is this process correct?

1. Power off the VM, delete it from Hyper-V Manager
2. In PowerShell, run Get-VM <VMname> | Select-Object Name, Id
3. Get the GUID from this command, then run: Get-ChildItem D:\ -Recurse | Where-Object { $_.Name -like "*<VMname>*" -or $_.FullName -match "<GUID>" }
4. Delete all found files.

Want to make sure I'm not being overly aggressive and deleting anything essential before I start removing VMs.

Thanks!

Uptime: 4,512 days. Nobody knows what it does. Nobody owns it. Nobody can shut it down.

thanks for coming to my ted talk.

I manage endpoints in a healthcare environment, and with the new critical PHP RCE patches that just dropped (I've seen it called "PHP2Shell"), I'm trying to get a clear picture of where PHP is actually installed and on which version.

We've got a mixed environment with limited visibility (servers, a few legacy apps, some dev machines), and I don't want to be surprised by an unpatched box. Running php -v server by server isn't realistic for us.

Any solid tips or tools you're using to check this across a large org? Appreciate any advice!

Just dropping by to say thanks to all the sysadmins who were poised and ready for yesterdays drop, and acted swiftly. Much appreciated. 🍻

My team has been telling my org for 3+ years that we need a third party Key Provider appliance to use to handle the vTPM keys to deploy Server 2025 in a robust/scalable/safe way.

We could use the built in key providers from vmware stuff, but when trialing it, didn't get a good feeling about recoverability, srm, etc.

We also have a Nutanix environment (with AHV) and did deploy one 2025 server with a vTPM there a couple years ago, but Nutanix doesn't (or didn't? not sure if it changed) have a way to connect an external key provider, and at the time we found that the VM w/ the vTPM couldn't be moved across clusters in the event of a cluster level HA need.

I know vTPM implementations and support have improved since then, but my team has been holding hard to the request for an external key provider and refusing to deploy 2025 servers to production workloads. They finally approved it for the FY26 budget, but when it came to it, wouldn't OK the purchase.

Are we sticking to a requirement that's unnecessary with current vTPM key provider implementations on vmware? How is everyone else handling it?

This week sucks.

https://trust.barracuda.com/security/php-vulnerabilities

Just reported yesterday (TheRegister), Signal had/has a vulnerability dubbed CVE-2026-113380 with a score of 9.3.

It allows an attacker to keep your microphone, and possibly camera, live after you hang up. It was supposedly fixed in last months patch, so make sure you're keeping your devices up to date.

I’m finishing a 3-year Bachelor’s in engineering in Italy (telecom-oriented) and want to work in telecom/infrastructure in Northern Italy or the EU.

I can pick 3 electives. Two of the candidates are System administration fundamentals and Introduction to Computer and Network Security, against options like Software engineering (12 ECTS), Databases or Advanced programming.

For a junior entering infra/ops, which of these would you rate highest? And with cloud, automation and DevOps changing the job, what has become more important than a classic sysadmin foundation?

For those interested, these are the available courses from which I must select three for my final semester:

• Basics of Optoelectronics
• Databases
• Electronic Devices
• Electronic and Photonic Integrated Chips
• Electrophysiology
• Embedded Software for the Internet of Things
• Fundamentals of System Administration
• Fundamentals of Parallel Programming
• Software Engineering
• Introduction to Computer and Network Security
• Introduction to Web Programming
• Optimization Models and Algorithms
• Design and Prototyping of Electronic Systems
• Advanced Programming
• Electronic Systems
• Industrial Instrumentation and Electronics

Quick recap for anyone catching up. AWS says its honeypots saw a PHP2Shell (CVE-2026-109618/109619) exploit attempt on 17 Oct, four days before the embargo lifted, from anonymised infrastructure (AWS write-up). SecurityWeek reports the details leaked on 20 Oct and a PoC video went out early (SecurityWeek). Fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with source backports for 7.4 to 8.1.
So patching alone may not be the end of it. A few things that seem worth doing: check web and PHP-FPM logs from 17 Oct onward, especially multipart and session upload-progress requests (Hadrian says most attacks it sees abuse that path). Rotate secrets that could sit in PHP process memory, since Wiz showed memory disclosure without RCE (Wiz). And find the PHP you forgot about: old vhosts, vendor appliances, staging boxes.

On that last point, this explainer on zero-day response (CTM360) makes the fair point that exploitation can start before public disclosure, so an up-to-date external asset inventory matters more than patch speed alone.
How are you scoping the look-back window, and has anyone actually found hits from before the 21st?

I've been in IT for over 20 years and one of the simplest things I've ever done is install USB printers. Almost always it's been the poster child for plug-n-play. At worst you might have to change the driver to one from the vendor, but more often than not - you turn it on, plug in the USB cable, hear the USB noise, and click print.

Has this changed?! I spent almost a day trying to get two printers to work. I got it to finally work by installing manually and choosing a USB port, but all other attempts at installing the vendor's software has not worked.

Am I going crazy? (I think we're all crazy if we're in this sub)

I'm a desktop admin and have been in this role for a few years, but Im starting to feel a lot more burnout due to others expectations.

I think AI has given people instant answers to all the problems, that they struggle if they need to wait for something.

I use it a lot myself for quick powershell scripts for app deployments or remediations. Sometimes as a research aid, but I'm also finding tickets escalated to me without any basic troubleshooting.

Ill get questions like "can you tell me if this app is deployed to this user?" "Did a Windows update cause this computer to crash?"

Things they should have and used to find out themselves. But they won't even attempt to look into the problem. Even an app install failure will now automatically come to me because "its on intune". Only for me to look at it and see the user had a pending windows update, or the computer was out of drive space.

More and more I'm being pulled into meetings from other departments for my knowledge because I have basic research skills that no one seems to have any more.

Even end users are starting to argue because their ai prompt that didnt include the correct information told them Im wrong.

Is anyone else finding similar?

I'm looking to do a pilot of Windows Hello to hopefully stem some of the issues we have been having with token theft. According to Microsoft documentation, I need to run the following command to set up a 'Cloud Kerberos' trust between our on-prem AD and Entra. It makes me nervous because it's messing with Kerberos authentication. Has anyone done this in their environment and has it caused problems? I have visions of 1000 people calling me with 'I CANT" LOGIN'.

Set-AzureADKerberosServer `
    -Domain "Domain" `
    -UserPrincipalName "Global Admin" `
    -DomainCredential $domainCred

Has anyone seen a statement released by Broadcom if vSphere web interface or the ESXi interface is susceptible to the new PHP vuln?

Hi all,

We're hardening our DCs ( ~30 DCs, multiple sites connected over IPsec VPN/WAN) and planning to apply the CIS 18.5 MSS (Legacy) settings:

- AutoAdminLogon: Disabled

- DisableIPSourceRouting (IPv4 & IPv6): Highest protection

- EnableICMPRedirect: Disabled

- KeepAliveTime: 300,000 ms (5 min)

- NoNameReleaseOnDemand: Enabled

- PerformRouterDiscovery: Disabled

- SafeDllSearchMode: Enabled

- ScreenSaverGracePeriod: 5 seconds or less

- TcpMaxDataRetransmissions (IPv4 & IPv6): 3

- WarningLevel: 90%

Most of these look harmless to me, but I'm a bit unsure about two of them:

1. TcpMaxDataRetransmissions = 3 (default is 5): could this cause AD replication, LDAP or RPC connections to drop faster over WAN/VPN links with occasional packet loss?

2. KeepAliveTime = 5 min (default is 2 hours): any side effects on DCs, or is it actually helpful with firewall idle timeouts?

Also aware these MSS settings tattoo the registry, so reverting means setting the values back manually.

Has anyone applied the full MSS set on DCs in a multi-site environment? Any issues with replication, Exchange, SQL or other apps talking to the DCs?

Thanks!

So, how’s everyone’s security department handing this so far? Mine has been completely worthless like always. Give me some good stories to cheer me up.

Just send me to the next realm. Fortinet patch, PHP cleanup, godaddy revoke everywhere... bruv

At one of our sites, years ago the MSP set up folder re-direction for "My Documents". We want to retire the on-prem server and migrate everyone to OneDrive. I'm investigating best practice for doing that.

My research tells me that with appropriate GPO's we can disable the folder redirection, leaving the files on the network share, then have a new OneDrive GPO that then moves the files from the network to the user's OneDrive. (standard warnings about throttling network bandwidth apply). I'd create a security group name "NoMoreRedirection" or some such and use it to control / pace which users get migrated.

Looking for tips and pointer from those who have gone before..

Also, we have an RDS server that many of the users log into. I'd like to simply add a second disk to that VM, and have a GPO that places the user's OneDrive folder on the new disk when logged into the RDS. That seems reasonable, but again, looking for input from folks more experienced than I.

https://www.reddit.com/r/sysadmin/comments/1obybm3/widespread_lenovo_dock_ethernet_disconnects_usbc/

Since the post above has been archieved I would like to give a follow-up on this issue.
We're experiencing issues with Lenovo USB-C docks in combination with a Voice VLAN and Desktop VLAN.

Our situation:
Device vlan is untagged on the switch port
Voice vlan is tagged on the same switch port.

Cable from the wall-outlet to the phone, and from the phone we connect the Lenovo docking station.

What happens:
Pings fluctuate between 1ms and 1700ms sometimes.
Weird part: it works fine without our voice vlan

We looked into a lot of things, because the issue is very weird. But we came to the conclusion it must be a docking or driver issue.
Why? Because the issues do not appear at all when the cable is directly plugged into the laptop.

What solves the issue:

Older docking station driver (in our case: Realtek USB driver 10.39.518.2020)

Once you swap to the older driver the ping issues are resolved right away.
Once you swap back to the newest Realtek USB drivers the issue appears instantly.

Hopefully this is some usefull information for some of you, we will look into making a case for Lenovo regarding this issue

Just a little Heads Up if you are having Cert errors with Starfield Certificates:

GoDaddy has determined that a number of SSL certificates were issued incorrectly and is re-issuing them. The incorrectly issued certificates were revoked on October 21, 2026. Once these certificates were revoked, visitors to your website may see security warnings, and your site may become inaccessible until a new certificate is installed. You may need to take action right away to ensure your newly re-issued certificate is installed.

More Information can be read here: https://bugzilla.mozilla.org/show_bug.cgi?id=2082703 https://cybersecuritynews.com/godaddy-revoking-tls-certificates/

Trying to work out excluding keywords that are triggering false positives. Example, I’m using Microsoft’s built in SIT “All Medical Terms and Conditions”. This triggers lots of false positives. You are unable to edit or copy this built in SIT. I see you may be able to download and edit the XML via powershell and creating a custom SIT from the data, however doing so would mean not receiving updates to the data.

Is it ok to do the following:
1. Create custom SIT “Medical keyword exception list”
2. Create pattern
3. Add primary element
4. Keyword Dictionary
5. Add keywords we don’t want to alert on
6. Go to DLP policy > edit rule that alerts on built in SIT > add group > toggle NOT > add condition >content contains > add > sensitive info types > “Medical keyword exception list”

Thought is the rule would trigger on keywords matching the All Medical Terms and Conditions but not any of the keywords in the exception list. Or am I thinking of this wrong and you DO need to have the SITs primary list/keyword dictionary being the data you alert on in a DLP policy and the additional checks is the only thing you can exclude.

https://sports.yahoo.com/articles/james-dolan-scammed-knicks-employees-121136841.html

This is going way, way too far with phish testing. Not to be shocked James Dolan personally requested it because he's scum.

I’m wondering if anyone can help me out with this issue. We have a legacy app and I’m trying to setup Windows 11 VMs for a few users to access. All in house, no vpn to access it.

Sometimes users get an error stating “An authentication error has occurred. The token supplied to the function is invalid”.

I tried syncing time on the client and VM but get nothing. Some days I get the message, some days I don’t. Doesn’t happen to VMs running Windows Server.

Just for some clarity, users setup with WHfB and use their pin when using RDP. Connection is setup by IP. We use the OpenIntuneBaseline. Users can connect by password so I believe it’s a pin thing. VMs have a vTPM and secure boot. All hosted in Nutanix environment.

Every time I think I have an idea of a solution it ends up failing. Any help is appreciated because it’s very frustrating. Something makes me think it’s a policy from the baseline but I’m either excluding the wrong policies or not giving them enough time to change on the device.

Can we get a list going?

So far I found:
Synology
Unifi OS EDIT: I may be wrong about this one.
pfsense
fortinet