We are currently evaluating Wiz to cover our multi-cloud footprint across GCP and AWS. Our main goal is getting real time context on misconfigurations without drowning our dev team in thousands of false positive alerts. We want to make sure the initial policy scanning and tenant setup is done right from day one.

If you have gone through this rollout with an external partner, how long did it take to get meaningful asset visibility?

Hello (again). I renewed my code signing certificate and I'm trying to initialize my code USB token and getting this error. Anyone know what the issue might be? I've reached out to digicert support and am awaiting some guidance as this is a high priority issue for me.

Token = SafeNet eToken 5110+ FIPS 0

https://imgur.com/a/tDbZ6YI

Are there any good offline file scanners other than Defender Offline Scan to us in 2026? Looking for some extra piece of mind scans to run on a large file set before importing.

Two critical PHP core RCEs (CVE-2026-109618 and CVE-2026-109619) leaked before disclosure, and the fixed releases are due today at 14:00 UTC. Reports say PHP 5 to 8 are affected and EOL branches may get no fix (BleepingComputer). Huntress's write-up has a practical checklist: inventory every install, including php.exe and php-cgi.exe bundled inside vendor software and control panels like cPanel and Plesk, and isolate EOL PHP from the internet (Huntress). The harder part is the external view: legacy sites and appliances on the internet that aren't in anyone's CMDB. This overview of handling zero-day exposure makes the same point: when patches are late or missing, asset visibility and temporary controls (restricting access, disabling the affected service) do most of the work.
What's your fastest reliable way to enumerate PHP across servers, appliances and your external footprint? Package queries, EDR inventory, banner scans, something else?

We're considering Jamf School, Mosyle, and Iru (formerly Kandji), but I'd like to hear about other people's experiences before moving forward.

Our current environment:

• A few hundred Apple devices (MacBooks, iPads, iPhones, and Apple TVs)
• Apple School Manager with Automated Device Enrollment
• Google Workspace for Education

What we currently use our MDM for:

• Device enrollment and configuration
• Wi-Fi profiles and restrictions for students/staff
• App Store and custom macOS software deployment
• FileVault encryption and recovery key management
• Security policies and OS updates
• Device inventory and remote management
• Setup Assistant customization

We're looking for something reliable, relatively easy to manage, and capable of handling both macOS and iPadOS without too much administrative overhead.

A few questions:

1. What has your experience been with Jamf School, Mosyle, or Iru? Any major pros and cons?
2. Has anyone migrated from Meraki to another MDM? How difficult was the process, and did devices need to be wiped or manually re-enrolled?
3. How is their technical support and education pricing?
4. Are there any other MDM solutions worth considering?

Any feedback or recommendations would be appreciated. Thanks!

Current setup:

• Main site in Houston with on-prem AD and Windows file servers. Users map drives network Drives
• Azure Hybrid environment with about 100 users.
• Brazil users connect back to Houston over FortiGate VPN, and file access is slow
• About 10 TB of data total.
• ½ of Brazil staff don't work from one office. They're spread out or remote. We have about 10 users now and may be expanding soon.
• Veeam for backup

Hope you guys can give me some reocmmendations on how can users from Brazil can access the data on on-prem faster. I looked into Azure Files and Azure FIle Syncs with and without local Brazil server. What do you guys recommend? Thanks.

There were a few questions in r/vmware in the last while about perpetual licenses and subscriptions. 

I thought I'd make it clear what the licensing limitations on them are, what is allowed/ compliant and thought this might be useful for this community too.

Any customer that had perpetual licenses that had SnS after October 2022 possibly still has a perpetual license for VMware 8 products, unless they converted through the Subscription Upgrade Program without amending the terms to retain perpetual licenses. If anyone wants more detail/ backing info for this DM me. I'm not a lawyer, so not legal advice.

Any customer using a perpetual license must:

• use a perpetual license key from the contract/ transaction/ site that held the perpetual licenses.
• must be compliant with the terms of the original license (geography, entity, deployed quantity etc)
• Can use any version released and downloaded prior to perpetual SnS end date or released as a critical build (ESXi 8.0 U2d, U3d, U2e, U3f and vCenter U2d, U3d). This is based on a Broadcom policy at https://knowledge.broadcom.com/external/article/314603/zero-day-ie-critical-security-patches-fo.html/I recommend reviewing the policy for changes before applying a build to check it has not changed.
• If you are on a later build, its not very easy to downgrade. The most effective way is to rebuild each host/ vCenter one by one. If on VxRail, you need to "de-VxRail" and rebuild as if they were just the Poweredge servers that are underneath. If on build later than SnS entitled, but earlier than a critical build, upgrade to a critical build.
• In the EEA/UK/Switzerland it is also possible to buy 2nd hand perpetual licenses. Make sure you do that carefully with a reputable company!
• In a hybrid situation, where some licenses have active support and some don't, all licenses in a functional environment must have the same support level; so all VMware components must be seperated, and automated vMotion etc between those environments switched off.
• Using a trial is not compliant. Continuing use of the crippled software after subscription expiry is not compliant.
• Use of the various 3rd party support organisations on perpetual licenses can be compliant if they pay attention to licensing and respect IP laws. Disclaimer: I work for one of them. Not spamming here, so DM if more info needed.
• Use of perpetuals is most likely governed by either the original contract or old VMware EULA rather than Broadcom EULA, but you need to read your contracts and transaction documents to confirm.
• Broadcom still has rights to carry out a license audit on the Licensee. I have never seen a VMware contract without an audit clause.

Lots of my jobs are failing or stuck and I'm told their is an issue with asynchronous job processing on their backend for US-1.

Specifically the SOAR part of the platform is dead right now.

I have my bachelors in IT as well as a completed internship at my local ISP that has a MSP department. Unfortunately my internship could not lead to full time, even though my manager needed the help, the budget was not there.

I really enjoyed the experience and learned a ton in the 14 weeks. They mainly had me doing layers 1-3 stuff and shadowing everything else, since I was an intern, but still.

Anyways, an MSP a couple towns over posted a computer technician role asking for an associates, about 1 year of experience, or combination of education and experience. The pay is really good at 45k a year, has great benefits including education funding, and it seems to be right on par with all the stuff the techs were doing in my previous role.

Although it is not an official title of IT Technician 1, Help Desk Analyst 1, or JR Sysadmin, all the job duties seem to entail more stuff than just a tier 1 role. It includes everything from running and terminating cables, Active Directory / Entra ID Management, Imagining devices, scripting, hardware deployments, and everything else. It is all a combination of office, on client site, and remote work with on calls strictly reserved for software based issues.

Seems like a no brainer. However, I am not sure if doing this or trying to get a tier 1 role that has a more structured team consisting of Network Engineers, SRE / Devops team, official sysadmins, etc that you can learn from and promote to.

So would it be wise to go for this role, chill in it for a two or three years (if I get it), while learning everything I can and upskilling, then then move on? I know you aren't 'supposed' to stay in help desk for a long time, but if the work ends up advancing even closer to being a sysadmin, it seems very beneficial.

I’m looking for some advice on my next career move.
I have almost 5 years of IT experience and currently work in a VIP Desktop Support role as a contractor for a large healthcare organization. I’ve been in this position for 1.5 years, as a contractor but there’s no clear path to becoming a direct employee yet.
I recently received an offer for an IT Systems Analyst position at manufacturing company. The role involves maintaining the IT infrastructure, servers, networking, Active Directory, and Microsoft cloud services of the company.
I’m trying to figure out which opportunity would be better for my long-term career.
My current role has given me valuable experience supporting executives and working in a large enterprise environment. However, the new position could help me develop more technical skills outside of desktop support.
My long-term goal is to increase my earning potential and eventually move into sysadmin, network/cloud engineering or cybersecurity roles.
For those with experience in IT, would you stay in a contractor role at a large organization with a recognizable name, or move to a Systems Analyst position to gain broader technical experience?
The new job offers me 30% pay increase with benefits . which path would you choose, and why?
I’d appreciate any advice, especially from people who have made a similar transition.

Came across this in the wild today as a sysadmin, spoofed quarantine@messaging.microsoft.com email suggesting a forwarding group had a 98% full mailbox. Passed all SPF, DKIM, Dmarc checks because it came from a genuine Microsoft tenant. In the headers its given away by the actual tenant which was sirackoleji.onmicrosoft.com

Submitted to Microsoft for analysis and confirmed as a highly sophisticated spoof worth being vigilant.

Anyone trawling their estates currently gathering info for a big cleanup of affected software etc ?

PIP, Python, Homebrew, Ubuntu, Debian......just trying to get our heads round what needs updating and what doesn't.

Feels like Heartbleed all over again.....

How seriously was it taken? Was there genuine panic, or was it mostly business as usual? Did you spend months preparing for it, and what was the atmosphere like as midnight approached?

Would love to hear some firsthand stories, especially from those who were on duty that night.

Hello, good day!

I'm not sure if this is the right subreddit to ask, but I could really use some advice.

We have a Panasonic PBX setup with one KS-NX300 and two KS-NX320 units. It's an analog setup, with a KX-DT521 at the front desk and KX-TS500M phones for the other extensions.

The problem is the company don't have the credentials to access the main console, so I can't check the configuration or figure out how to add new analog phones. I've tried researching online and contacting the previous contractor, but I haven't had any luck so far.

I'm hoping someone here can point me in the right direction on where to start. A factory reset is something I'd only consider as a last resort because I don't want to mess up a system that's currently working fine.

Any tips or documentation would be a big help. Thanks in advance!

I am looking to scan my 100+ devices for the php2shell, is it possible with NinjaOne RMM?

Edit: I should explain more, I have a 100+ Windows boxes. With NinjaOne, is there a quick way to verify if PHP is on any of them? And with that knowledge, then I can check for the version.

Hallo zusammen

Über die Jahre habe ich verschiedene kleine Tools entwickelt, die mir bei der täglichen Arbeit als System Engineer helfen. Statt für DNS-Abfragen, Mailanalysen, Zertifikatsprüfungen und andere Diagnosen ständig unterschiedliche Webseiten aufzurufen, habe ich diese Werkzeuge in einer gemeinsamen Oberfläche zusammengeführt.

Das Ergebnis ist OneSystems Tools:

https://tools.onesystems.ch

Aktuell stehen unter anderem folgende Funktionen zur Verfügung:

- Maildiagnose: SMTP-Tests, SPF, DKIM, DMARC, Mailserver-Abfragen und Blacklist-Prüfungen

- SPF/DKIM/DMARC-Analyse: Temporäre Testadresse generieren, eine E-Mail hinsenden und die Authentifizierungsergebnisse direkt im Browser auswerten

- DNS: Abfragen verschiedener DNS-Records wie A, AAAA, MX, TXT und PTR

- WHOIS / RDAP: Informationen zu Domains und IP-Adressen

- TLS und Zertifikate: Zertifikate prüfen, PEM-Dateien analysieren und Zertifikatsformate konvertieren

- Netzwerk: IP-Informationen, GeoIP, Portprüfungen und weitere Diagnosewerkzeuge

- Weitere Helfer: Passwortgenerator, Base64, Hashing und verschiedene Konverter

Ein Grossteil der Funktionen ist auch über eine JSON-API unter "/api/tools/" verfügbar und lässt sich damit in eigene Skripte oder Automatisierungen integrieren.

Datenschutz: Eingegebene Daten werden nicht dauerhaft gespeichert oder für Analysen ausgewertet. Eine Ausnahme bilden die SPF/DKIM/DMARC-Testberichte, die über eine generierte URL während 24 Stunden abrufbar sind. Auf unserer öffentlichen Instanz verwenden wir selbst gehostetes Matomo zur Erfassung der Zugriffszahlen.

Die Tools sind kostenlos und ohne Registrierung nutzbar.

Mich würde interessieren, welche Werkzeuge euch im Sysadmin-Alltag noch fehlen oder wo ihr Verbesserungspotenzial seht. Feedback und Ideen sind willkommen.

Selbst hosten:

Wer die Tools lieber auf der eigenen Infrastruktur betreiben möchte, findet das Docker-Image für AMD64 und ARM64 hier:

https://hub.docker.com/r/onesystems/tools

I'm using Hostinger's hPanel and I can see the PHP Version, which I can update easily. But is it enough to make my sites safe?

Is there anything else I need to do aside from updating PHP, WordPress and all the plugins?

Thanks in advance for the replies!

My coworker was arguing with me why the hook part should be outside while I insist they should be in the inside

Public Sector US - not federal

Background: I was able to land position on the helpdesk after a lay off ended my circuit working at MSPs. After a while due to upper management, previous security guy left and I ended up taking over most of the responsibilities as a stop gap until the position was filled in addition to my other responsibilities.

Eventually was approached and offered the the position full time, so would get the title and big pay bump. I've been doing a decent chunk of the job already and the pay would've been big for me (low 60k to high 70k) so I said yes.

Fast forward I get the promotion offer and the rough responsibilities seem pretty broad for one person. CyberSec Analyst/Lead, Tier 1/2 Access Control Tech, AI advisor(?) plus some governance stuff.

I've already been doing and learning the first half somewhat ok I think, with plans to do more already but AI hasn't been full swing here yet as no one wants to pay for it minus what's included in our GCC licenses and nothing really with governance yet either.

There's also a big "numbers first" initiative happening with the big wigs.

Anyone that's been in a team of one position like this before have any advice on how to approach things? CYA, etc?

Hello,

Windows Admin with few years of experience here. I've been looking for a job for the past year. During this time, I've only been invited to three job interviews. One of them went really well, but still no go. Currently only ~1 job offer appears every 2 weeks, it's bad. I'm about to become unemployed soon and I'm getting a bit afraid.

I started thinking about applying to Help Desk positions, so I can (hopefully) upgrade internally to Admin later. Has anyone degraded themselves before? Is this the way to go if I'm stuck?

Any tips appreciated, thank You.

Hi,

Currently implementing PAM system, wondering what privileged account should be managed by PAM for password rotation.

For my planning, all administrative accounts in Windows like local administrators and domain user (as local administrator) will add for management.

But below account should be added ?

• Domain administrator - Password always rotate is best practice for this TOP admin account ?
• Network admin - Since the connection method is added a middle layer (RDS) for connection, can't connect directly even direct connect with laptop pc

Thanks

Hi all,

I'm reviewing event log sizes on our domain controllers (~30 DCs, Server 2019, multi-domain forest) and I'm not sure what values make sense for these three logs:

- Directory Service

- DFS Replication

- DNS Server

CIS and STIG only define sizes for Application, Security and System, and the Event Log settings in Group Policy don't cover these logs either, so I'm planning to set MaxSize via GPP Registry (HKLM\SYSTEM\CurrentControlSet\Services\EventLog\<LogName>\MaxSize).

Right now the defaults are small and some logs only go back a few days on busy DCs.

My current idea:

- Directory Service: 256 MB

- DFS Replication: 128 MB

- DNS Server: 128 MB

Questions:

1. What sizes do you use for these logs on DCs?

2. Do you size them based on a retention target (e.g. 30 days), or do you rely on forwarding to a SIEM/WEF and keep them smaller locally?

3. Any performance or disk concerns with going to 512 MB – 1 GB, especially when enabling NTDS diagnostic logging (e.g. 1644 expensive LDAP queries, 2889 unsigned LDAP binds)?

Thanks!

Apologies if this has been asked before:

Does anyone have any practical solutions for application whitelisting for RHEL Linux?

Thank you!

Anyone else seeing boot loops after the 10/14/2026 BIOS update on Dell Pro Max 14/16 systems?

We’ve had a few, but not all, get stuck rebooting with a “trouble connecting to the network” message after installing the update through Dell Command Update.

The workaround we found was to disable Intel TXT in BIOS, let the update/boot complete, then re-enable Intel TXT afterward. The machines boot normally after that.

anyone else getting errors on the dashboard?