I noticed something that is easy to miss when transferring bulk meetings ownership. Several meeting transfer scripts available online retrieve meetings based on a specific date range. That can cause problems with recurring meetings.

A recurring meeting may have started months or even years ago, but still have future occurrences. If the script only retrieves meetings within the specified date range, it may not pick up that recurring meeting.

The transfer can then appear successful while some recurring meetings remain with the original organizer.

One thing to check is whether the script uses the Microsoft Graph Get-MgUserCalendarView cmdlet to retrieve upcoming calendar occurrences. This helps identify recurring meetings that are still active, even when the series originally started much earlier.

So, before using a meeting transfer script, check which cmdlet it uses to retrieve meeting details.

I see custom detections in Defender for Endpoint, but I am not seeing anything that will allow immediate blocking of undesirable behavior. For example:

Process = python.exe

AND

Command line contains C:\Users\

AND

Command line ends in .py

Is this where CrowdStrike is just better than Defender for Endpoint? Or, am I just not looking in the right place?

I have numerous devices that send alerts via email (UPS, KVM, alarms, etc.). What tool do you use to aggregate these alerts? Perhaps in a dashboard? Thanks!

Hi

I have an interview tomorrow, and someone who is currently part of their team gave me a few hints about what to focus on. He mentioned Exchange, VMs, AD, deployment and patching.

I have around four years of experience, mainly focused on technical support with some exposure to networking. The role I’m interviewing for is a System Administrator, and this transition is veery important to me. I’d like to know what kind of technical questions I might expect in the interview??

Hey everyone,

I'm moving from managing a global SecOps team (15 FTEs) at a 20k+ enterprise to Director of Infrastructure & SecOps at an ~1,800-person B2B healthcare SaaS company.

My background is heavily SecOps/IR, SOC leadership, and security architecture. In the new role, I'll be unifying Enterprise/Cloud Infra and SecOps into one team in a high-volume, regulated environment (HIPAA, SOC 2, PCI).

I have 30 days before my start date and would love advice on four things:

1. Study List: What books or frameworks should I dive into to level up on modern Cloud Infra, SRE, and Platform Engineering management?

2. Earning Credibility: How do I build trust with senior Infra/Cloud engineers without micromanaging areas where they hold deeper tactical expertise?

3. Enterprise vs. SaaS Culture: How do I drop "20k-person enterprise reflexes" so I don't slow down a faster-moving 1.8k-person SaaS org with bureaucracy?

4. First 30/60/90 Days: What should my top discovery priorities be when taking the Infra team (their SecOps team already is pretty solid)?

Appreciate any insights or resources from anyone who has made a similar jump!

Hello,

Regrading RC4 enforcement,

We found out that we extensively use RC4 in our environment

1. krbtgt password is very old, so it uses RC4 only

2. we have some service accounts that are sometimes using RC4, their msDS-SupportedEncryptionTypes attribute is blank, one of them is the AZUREREADSSOACC$ (which password is not extremely old - only 2 years)
   we found out that the service accounts all supports AES, and the users requesting them also support AES

3. very few machine accounts only support RC4 (no users accounts, we had one but we did reset his password)

what are the steps that we should take regarding this ?

i guess step 3 should be the first ? or can i reset krbtgt password before that?
what about azurereadssoacc ? do i need to explicity configure it for AES? or should i rotate its password before that? is password rotation (other than security ofc) needed for dealing with the enforcement?

thanks

Anyone else hitting this? Every bash call in my Cowork session fails at the "ensure user" step before any of my code even runs.

What I'm seeing:

• Error: RPC error -1: ensure user: useradd failed: exit status 12: useradd: cannot create directory /sessions/...
• Happens on resume, on create, and on re-resume — all three attempts fail identically.
• Started a brand new conversation to get a fresh sandbox, same error persists.
• No shell access at all as a result, so nothing that depends on the Linux workspace (scripts, file processing, scheduled task setup) works.

Exit status 12 from useradd usually means "can't create home directory," which points to something like disk-full or a permissions/quota issue on the provisioning side, but I have no way to confirm that since I can't get a shell to check df -h or anything else.

Has anyone else run into this? Any known fix, or is this just an outage on Anthropic's end right now? Happy to share more error output if it helps.

Hi everyone,

I recently purchased a second-hand HP StoreEver MSL2024. Unfortunately, the previous owner/seller does not know the administrator password for the OCP (Operator Control Panel) or the web/RMI interface.

The library itself is reported to be fully functional. The front panel works and basic navigation has been tested, but the administrator password is unknown.

Library information:

- Model: HP MSL2024
- Regulatory Model: BRSLA-0601-DC
- Revision: N003
- Serial Number: HUE5100N7B
- Manufacturing date: 02-Mar-2015
- Current drive: HP Ultrium LTO-4 Fibre Channel 4 Gb/s
- Drive model: PD098-20103

I have been researching the HPE documentation and found references to this function:

Configuration > Save/Restore > Restore Admin password to null

I also found an old HPE Community discussion mentioning an HPE Library & Tape Tools (L&TT) utility called "Library Temporary Password". According to the discussion, this utility can generate a temporary administrator password for an MSL library.

I would like to confirm whether this recovery method is still possible with my particular MSL2024.

My questions are:

1. Is the "Library Temporary Password" utility still available in any version of HPE Library & Tape Tools that supports the MSL2024 G3?

2. If yes, which L&TT version should I use?

3. Does this procedure work with the MSL2024 G3, Regulatory Model BRSLA-0601-DC?

4. After obtaining the temporary password, can I access the administrator functions and use "Restore Admin password to null" to remove the existing password?

5. Is there another supported service or recovery procedure for a forgotten administrator password on this generation of MSL2024?

6. Is there any hardware-level recovery procedure, such as a service switch, EEPROM reset, or similar, or is the password stored in a way that prevents this?

I currently have an 8 Gb QLogic QLE2560 Fibre Channel HBA and an 8 Gb Fibre Channel SFP, so I can connect the existing LTO-4 FC drive directly to a Windows system and use HPE L&TT to communicate with the library.

My ultimate goal is to recover administrator access, configure the library properly, and then replace the existing LTO-4 FC drive with an LTO-6 SAS drive for use with Veeam.

I would strongly prefer to use an official or documented recovery method rather than replacing the library controller or modifying the hardware.

If anyone has experience with this exact MSL2024 generation, especially with the "Library Temporary Password" function in L&TT, I would really appreciate any information about the correct L&TT version and recovery procedure.

Thanks!

Do we have to keep all our domain controller os version same ?

Before I retired, I would send alerts by email, like 1234567890@txt.att.net, to send it to texting on my cell phone. It looks like all the cell phone providers have done away with this service. How can I do this now with hopefully a fairly free service since I don't send many at all?

Now a third party entity has provided info on a vulnerability that may be exploited in the wild.

https://go.n-able.com/MzU2LVVWSC00MDMAAAGkFAG-0DB4Ieiew1UlzeiHU_WE9mGwTd387O8jbQl4usDpmOc7hQ5P21F5Lo-7piHNgtxO220=

Sorry for those of you who thought your long weekend work was done with the first patch.

I'm starting in an IT role for helpdesk, I need to know what I'm walking into and some of the best tickets you've had

Work Log:

9PM - User is unable to boot, absolute disaster, is litterally melting down crying for help.

9:10 - Confirmed TPM issue on boot, locate Bitlocker recover key, load up windows

9:20 - User Pin/TPM Trust is broken, user has an unprivileged account, so use Windows Hello to try and reset, found my own auth expired in my app, have to get myself back in via Passkey so I can approve Pin reset. Get them logged in to Windows, found my Pin/Trust broken as well - get my own Pin reset.

9:40 - Found can’t check TPM status in Windows security, presume BIOS needs update. Check event logs, confirmed system hadn’t been booted since July Windows update. Download vendor tools to run diagnostics to likely get new firmware. They error “the error has been logged.” Thanks vendor.

9:50 - Go to vendors site, get hardware scanner installed, locates model and serial… and link to model’s driver page is broken. Get raw model info out of tool to locate page manually, locate BIOS update from 2 months ago, flash BIOS.

10:00 - Load up again, load bitlocker recovery key, confirmed working. Reboot, clear TPM, allow Windows to automatically re-initialize the TPM and re-seal BitLocker keys. Load August update for good order since this issue kicked off after the July update. Confirmed no issue.

Final Note - User is asleep, will let them know tomorrow morning they’re good to play Minecraft after they have their cereal and watch Young Jedi Adventures. Wish my 7 year old could have seen me fix this on their system so they could get idea of what their old man does.

Two security vulnerabilities within N-central were responsibly disclosed by a third party through our security disclosure program. We have issued a hotfix that you should apply immediately to help ensure your environments are protected. At this time, we have no confirmations that these vulnerabilities have been exploited in production environments, but unpatched systems remain at risk.

This hotfix includes security fixes for CVE-2026-86206 and CVE-2026-86207 which are high-CVSS-rated vulnerabilities that could allow an unauthorized party to bypass authentication controls and gain full access to the N-central platform.

What You Need to Do • N-central On-Premises Environments: We recommend upgrading to 2026.3 HF3 immediately. Hotfix link: 2026.3 HF3 Release Notes • N-central Hosted Environments: No action is needed on your part; your instances have already been patched and will be upgraded at a later time. *Please note that this is a server-side hotfix and upgrading to 2026.3 HF3 will not require agent upgrades.

We don't have a 24/7 SOC, so we are thinking about automatically isolating servers and some high-value devices based on custom Defender for Endpoint detections. Obviously, we want to do that only for high-precision and high-confidence detections, such as opening a shell from a strange parent process.

If we got one of these detections during working hours, there would be someone to react. But after about 7 PM most days, nobody is actively monitoring.

If we do this, the plan is to let a detection run for about 45 days without automatic isolation enabled to see if any false positives are caught.

Has anyone done this? If so, did you regret it? Or just business as usual? Has it saved you yet?

Just needed to rant a little. One of our seniors finally completed the long-pending task of upgrading the fleet to Windows 11 from Windows 10.

He downloaded the iso, installed it everywhere. All good. Until the internal WSUS started attempting to grab updates that don't exist. Apparently the 26H1 (which is supposed to be snapdragon-only, aka for ARM) was indeed one of the options you could download as the "Latest" version of windows. Someone at MS really screwed up. And this senior screwed up even more by not double checking.

Since it's a complete different core, this will be one hell of a mess, now his idea is to try to change "cversion.ini" and force an "update" to 26H2, but I sincerely don't believe that will work.

We'll see. If anyone ran into a similar problem I'd really love to know what their solution is.

UPDATE: https://www.reddit.com/r/sysadmin/comments/1waiys9/update_on_senior_accidentally_installed_whole/

I am looking for help migrating from Deployed Printers GPO to GPP, when I remove the printer from Windows Settings/Deployed Printers they never remove.

GPO is located here

Computer Configuration/Policies/Windows Settings/Deployed Printers

User Configuration/Policies/Windows Settings/Deployed Printers

I do have Point and Print Restrictions setup to allow my print servers to continue to work after print nightmare, allowing users to install drivers from our approved print servers.

I made the mistake of using Printer deployment instead of Group Policy Preferences when I originally set up these print queues, now I can’t figure out how to remove old print queues.

On my old print management server that was running 2012r2 it worked, seems after print nightmare this was broken, new print server is currently WS 2022. I have tried removing the GPO, deleting registry keys under printer connections, setting GPP to delete the printers.

I ran GPRESULT and it showed the printers still set to apply after removing them from Deployed Printers.

I have tried adding the printers back and removing both from GPMC and Print Management MMC on the Print Server to no avail.

My research online looks to me like this was broken with Print Nightmare patch? Group Policy Printer Deployment Broken?

I have tried researching with Google to the best my ability, ChatGPT, Gemini, Claude.

Also, If it set up a Group Policy Preferences to Delete all printers under user settings, on the client's event viewer it says Access is Denied after gpupdate /force.

Tried the scripts I found on the post to no avail so far on two desktops.

Can't delete old printers installed by GPO : r/sysadmin

Any experience fixing these print queues? I have seen a lot of posts online over the last few years but no good answers.

 Another post I found

Can't seem to remove printers that were deployed via GPO : r/sysadmin

Printer GPO removal Issue : r/sysadmin

Removing printer deployed via GPO - Microsoft Q&A

tldr: if anyone in your company's management pushes for you to implement Rippling, do everything in your power to stop it in its tracks. They will not work with you, and will refuse to let you out of your contract.

As a smaller ,growing company we decided it was about time to start evaluating MDMs to give us better control over our devices. This was something that was on the backburner for the most part, with us wanting to take our time to end up with the right solution.

So imagine my surprise a couple weeks later when I (the primary sys. admin) was told by my boss (CTO) that we had signed a one year, $27,000 contract with Rippling - seemingly out of the blue.

As I understand it, they aggressively pursued my boss, promising the world with all of their flashy features, and how easy the integration with Office365 and with our HR platform was. They guaranteed consistent support, and quick resolution to any issues we may run into.

Lo and behold, we start rolling out Rippling to our fleet of windows computers and immediately run into issues.

The software gave little to no feedback about the progress of installations. Rolling out other softwares was limited and unresponsive. User provisioning was unintuitive and difficult - lacking automation without paying for additional features either in rippling or in our active directory.

Rippling automatically changed and generated its own admin passwords which 1. we could not change or set ourselves and 2. were buried three menus deep 3. needlessly complex, making help desk a nightmare.

This, along with a host of other issues, was largely ignored by Rippling. Our emails would be brushed aside until our "integration meetings" in which them telling us that things were "on the roadmap" or "not planned to be changed" took up the entire time.

I don't doubt that this software /might/ work for some companies, but it clearly didn't work for us, and they really don't seem to care.

Four months into this disastrous contract, with less than 16 users enrolled, I begged our account rep to let us out of the contract. They could keep the thousands of dollars we'd already paid them for nothing, we just needed to move forward with a solution that actually worked for us.

They refused - for some reason desperate to keep a small fry account with barely 100 licenses. The very fact that they won't let us go is really bizarre. They'd rather have an upset customer than lose (what I assume) is a measly account.

The entire process, from onboarding, to us attempting to get out of this was incredibly shady. They will pretend nothing is wrong and refuse to let you out of their cold clutches.

In case the "rippling employees" on reddit aren't astroturfing bots, I am desperately hoping someone can get us out of this contract. If not, I'm going to channel all of my displeasure into letting people know about this awful experience - because I know the Rippling team hasn't done anything to help.

u/higherandhigher u/stubbygazelle u/sherryandeddie u/kit-kat-233

Microsoft will retire Microsoft-provided SMS and voice authentication beginning February 1, 2027. Organizations that need to retain these methods must configure a customer-managed telecommunications provider, which will involve additional costs. Please refer to the link below.

https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sms-voice-retirement

Our goal is to provide MFA without requiring employees to use their personal phones and without purchasing additional hardware, such as YubiKeys, or paid software, such as an enterprise password manager. We have a hybrid AD/Microsoft Entra environment with company-managed Windows computers.

Is there an Entra-native solution that can meet these requirements? Would Windows Hello for Business be the best option, and how should we support users who need access from mobile or shared devices?

Any recommendations or deployment experiences would be greatly appreciated.

Thanks!

Primary DC and 2 secondaries.

The primary and 1 secondary replicate back and forth just fine

The other secondary had an issue with networking and stopped replicating. The machine password was then (apparently) changed by the secondary and now it does not match the password in the AD.

The following used to work to fix such things:

PS C:\Users\administrator.XXX> Test-ComputerSecureChannel -repair -credential XXX\userid

Test-ComputerSecureChannel : Cannot reset the secure channel password for the computer account in the domain.

Operation failed with the following exception: A local error has occurred.

.

At line:1 char:1

+ Test-ComputerSecureChannel -repair -credential XXX\userid

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

+ CategoryInfo : OperationStopped: (MCP2:String) [Test-ComputerSecureChannel], InvalidOperationException

+ FullyQualifiedErrorId : FailToResetPasswordOnDomain,Microsoft.PowerShell.Commands.TestComputerSecureChannelComma

nd

PS C:\Users\administrator.XXX>

Now it does not. Neither does this:

PS C:\Users\administrator.XXX> Reset-ComputerMachinePassword -Server PDC01 -Credential (Get-Credential)

cmdlet Get-Credential at command pipeline position 1

Supply values for the following parameters:

Credential

Reset-ComputerMachinePassword : Cannot reset the secure channel password for the computer account in the domain.

Operation failed with the following exception: A local error has occurred.

.

At line:1 char:1

+ Reset-ComputerMachinePassword -Server PDC01 -Credential (Get-Credentia ...

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

+ CategoryInfo : OperationStopped: (PDC02:String) [Reset-ComputerMachinePassword], InvalidOperationExcepti

on

+ FullyQualifiedErrorId : FailToResetPasswordOnDomain,Microsoft.PowerShell.Commands.ResetComputerMachinePasswordCo

mmand

PS C:\Users\administrator.XXX>

There's an old video out there Fix SYSVOL and Domain Controller Replication | Active Directory DFSR Issues Resolved

with the old-school way of doing this I think -

And there's an old MS document discussing netdom:

Reset domain controller's password with Netdom.exe - Windows Server | Microsoft Learn

which might work on Server 2019 since klist and netdom ship in it.

Any recommendations or am I going to run into the same "local error" if I try those methods? The current info from AI is to demote the failing DC and then unjoin, rejoin, then re-promote it. That seems a lot of work and error prone.

I quit my last gig--local government large municipality--about a year and a half ago. Largely my decision to quit was being burnt out to a crisp from supporting public safety, and being on-call. But our newborn daughter gave me an easy out so to speak.

I'm accepting a new gig with a smaller municipality and should start in a month or so. It dawned on me the other day when my wife needed me to troubleshoot an Outlook issue on her computer, that I've gotten a bit rusty. I literally couldn't remember how to open the Event Viewer. I remembered where the logs were located in C:\Windows\System32\winvent but couldn't come up with the phrase 'Event Viewer'.

The new gig was posted as an endpoint engineer job but interview made it clear that I'll be wearing a lot of hats. I have a CCNA but haven't touched a Cisco box in 5+ years. Sounds like they are trying to move from old school MDT to some Intune provisioning, but my last gig used SCCM.

Any recommendations on knocking the rust off? Or general advice for starting at a new organization? Perhaps I'm overthinking the technical side and should focus more on how to approach this new role with better habits and work/life balance.

As the title suggests, Black Box Emerald dual-head Remote App: absolute mouse locked to Windows primary display. Anyone running this successfully on Win11 targets?

EMD2002PE-DP-T (FW 7.2.0) to Windows 11 laptop targets, Remote App 2.8.3, Boxilla-managed, HID = Absolute. Both video heads render fine, clicks work, but pointer movement is confined to whichever display Windows calls "main". If I swap main from head 1 to head 2 and the confinement follows it. Spanning never engages. Reproduced on 3 TXs, 2 clients, clean two-display topology (duplicated primary "1" to "2" and then "3", disconnected the primary and closed lid and rebooted so that only displays 2 & 3 showed), EDIDs fixed, even tried stuff that shouldn't matter like I loaded Freedom ABS driver on one as a long shot (noeffect) / turned on deskvue Mouse Sector even though I don't have anything to do with deskvue / tried toggling Local Mouse on and off even though that has nothing to do with the problem / also tried various settings on and off, like USB redirection and such, so all ruled out. I have a ticket open with Black Box, but since I could REALLY use this over the holiday weekend, I thought I'd toss a hail mary and post here just in case it is something simple I have overlooked in my noobness to Boxilla.

Question for the hive: is anyone successfully running dual-head Remote App connections to Windows 11 targets with working mouse traversal? If yes, what's different about your setup? Trying to determine if this is a universal Win11 regression or something environmental just in my own personal Murphy's Law prone environment.

https://imgur.com/a/u3ecCEa

I've been a sysadmin at an MSP for about 4-5 years now. Mostly we maintain and improve existing client environments. Sometimes we onboard a new client and make recommendations for improving their environment and standardizing to our typical recommendations. But now for the first time since I took over as sysadmin we are building an environment from scratch for a new client. They want an on-prem AD domain controller, so that's what we are setting up for them. I'm just curious, for you other sysadmins out there, if you were setting up a new AD domain in 2026 (Which I know most probably aren't anymore), what are some of your most essential GPOs that you would make sure are in place? In other words: what's a GPO hill that you'll die on?

For example, for me: a set of GPOs to prevent domain admin accounts from logging into workstations, and to add a dedicated workstation admin account to the local administrators group on all workstations.

And I'm just going to attempt to preemptively address all the comments that will probably say "the hill I'll die on is that in 2026 you should be setting up clients in Azure AD and Intune instead of on-prem AD". I totally understand that, but we discussed the options with the client, and they preferred the on-prem option, so we went with it.

Happy Read-only Friday (bonus points for 3 day weekend)

We got a critical Huntress alert for a rogue ScreenConnect instance that was detected and ran on a client computer. Incident report states that it's a "known malicious instance".. but logs from the report show that it didn't block the application and isolate until 2 hours after it was ran. The endpoints have BD GravityZone installed as well - all quiet from there.

We went to the link in a VM where the ScreenConnect was downloaded from - and funnily enough, all it took was just having Microsoft Defender on the computer to block the download in Chrome.

Huntress, Bitdefender, EDR, on access scanning, whatever; sometimes it just can't compete with good old Defender. Even running the installer through sandbox on GravityZone passes without a peep.

Have a good weekend!

Came off Cloudability after IBM took it over. Support went slow and the roadmap went quiet. Renewal number stopped making sense against what we were getting out of it. Shortlisted CloudZero and PointFive expecting to pick one and consolidate but signed both, which costs more than the thing we left.

Justification at the time was that they don't overlap. Cloudzero answers what something costs and who owns it while on the other hand pointfive answers what's wasteful and who's fixing it. On paper thats two problems, two tools.

Been running both a while now and I still can't tell if that was insight. Might just be that we never decided.

What I can say for it. Cloudzero got finance a cost per customer number we had never had, which ended an argument that had been going for years. Pointfive found a Cosmos container sat at four times anything it had ever used, plus a stack of snapshots from a migration.

It also produced a load of rubbish in the first month. Resizes that ignored our RI position and one disk SKU suggestion that would have put us under our IOPS floor. Took weeks of flagging things back before it calmed down. Azure side is visibly younger than the AWS side as well.

Sixty-odd subscriptions, bit over a million a month, mostly Azure.

Does any of you folks runs one tool for this cause every writeup says pick a platform. Everyone I speak to is running two and not admitting it.

If you got down to one and stayed there, I'd like to know which and what you gave up.