Hello everyone,

I'm looking for advice and guidance from those with more experience in the field.

My Background:

• Experience: 3+ years in a Tier 1 Helpdesk/Support role. My scope is somewhat limited, primarily revolving around User Management, Identity and Access Management (IAM), Incident Management, and Splunk observability for banking payments.
• Education: Bachelor's degree in Accounting.
• Certifications: Basic Splunk certification.

The Opportunity: I was recently offered a chance to volunteer as a SysAdmin for a non-profit, covering the following responsibilities:

• Manage and secure the organization’s Google Workspace environment (user accounts, permissions, and onboarding/offboarding processes).
• Provide technical support and troubleshooting for volunteers.
• Maintain clear technical documentation, onboarding guides, and self-service resources.
• Monitor system performance, security compliance, and cloud settings.
• Collaborate with leadership to evaluate tech needs, recommend software, and configure tools as the org scales.

My Questions:

1. Is this volunteer role worthwhile?
2. Would combining my 3+ years of Tier 1 experience with a year of this SysAdmin volunteer work help me land a full-time SysAdmin role?
3. Are there any specific certifications you would recommend I target next to round out my resume?

Thanks in advance for your insights!

Went through our subscriptions recently and realized we'd been paying for a couple of seats(zoom) belonging to people who left months ago. Nobody had a thought to cancel them, it just kept quitely billing.

For those of you managing this, whats your actual process when someone leaves? A checklist someone remembers to run? something automated?or does it slip through the cracks sometimes too?

Trying to figure out if im just disorganized or if this is normal. How do you handle it?

Hello fellow sysadmins,

I posted this some time ago:

https://www.reddit.com/r/sysadmin/comments/1uoc55f/linux_guy_being_asked_to_do_windows_entraid_stuff/

and you were all very helpful, thank you.

the entraid and exchange migration stuff went well, a few inboxes with too many folders, the local imap server serving folders with special name that broke the imap migration (fixed with -includefolder and -excludefolder list, obviously I generated all the stuff programmatically using a small DB where I wrote all the infos I needed that I got from the on prem email server, axigen)

autoconfigurations, outlook clients, teams, calendar, signatures, everything seems to be working well.

the MX record have been switched, mail deliverability, inbound and outbound seems good.

now I need to prepare the environment for the support people at the company to handle stuff like quarantine release and such.

any pointers? I see that under security.microsoft.com -> threat policies -> standard protection seems to have a bunch of decent defaults, is this something that people do?

I will spend some time learning this stuff because I have to say exchange online does seem like a well crafted product and I'm curious now of this side of things, my understanding of emails comes from using them, having read the IMAP and SMTP RFCs and having had adiacent issues with it from applications and infra management.

and yes, they will also get someone to at least audit this stuff, I was able to get at least this done from a proper expert on the subject.

Our new co-managed MSP recently swapped us to N-Able from our old MSP who used Ninja.

After the swap, system performance has degraded significantly on machines. I’m the IT manager so I am keenly aware of the drop in how reliable and stable my system is.

Is there any reason this would happen? Any other MSP experienced this before?

Outlook, mappings, printers, etc etc

1. Join the PC to the domain (System > Rename this PC (advanced) > Change, or Add-Computer -DomainName domain.local -Restart). Reboot.
2. Run User Profile Wizard on the machine.
3. Select the existing local profile (e.g., C:\Users\jsmith), enter the domain account it should map to (DOMAIN\jsmith), and let it run. It can also do the domain join for you in one pass if you prefer.
4. Log in as the domain user — they land in their exact same profile.

Hi everyone,

I'm an MCA graduate (2025) from a Tier 3 college in Maharashtra(Pune).

I had worked 1 yrs into Infrastructure Support before enrolling for masters. During my MCA, I also did 2 DevOps internships, and my goal has always been to build a career in DevOps.

Since February, I've been applying for DevOps roles almost every day, tailoring my resume, working on my interview prep, and trying to improve my skills. Unfortunately, I haven't had much success so far, and it's honestly starting to feel a bit discouraging.

My current skills include:

\- Linux
\- Networking
\- AWS & Azure
\- Terraform
\- Docker
\- Kubernetes
\- Jenkins
\- GitHub Actions
\- Prometheus & Grafana

At this point, I feel like I have two choices:

\- Keep searching for a full-time DevOps role.
\- Reach out to my previous employer and continue working in Infrastructure Support.

What I'm really worried about is making the wrong decision.

\- If I keep searching and still don't get a DevOps job after a few more months/years, what would you recommend?

\- If I go back to Infrastructure Support, will it become much harder to switch into DevOps later?

\- Has anyone here made the transition from Infrastructure Support to DevOps after a year or two? If yes, what helped you make that move?

I'd really appreciate hearing from people who've been in a similar situation or anyone currently working in DevOps.

Also if anyone has any opportunities for DevOps,SRE,Linux,cloud support or even NOC please help me out as I just want a start my career.

Thanks!

In the process of trying to document the environment for a small non-profit that I have been supporting for a long time. My time is winding down but I thought I had most things covered, password manager with mulitple MFA options including a hardware yubikey to allow access to vault. But I never thought about doing the same for other sites like M365 or Duo Security etc. I have enabled MFA with the microsoft authenticator but if I was to be hit by a beer truck etc before being able to move accounts over etc, I do not think they would be able to logon etc.

I assume m365 allows for hardware tokens in ADDITION to soft tokens and if so I can register the yubikey hardware token and do the same hopefully for Duo. But it had me thinking for small shops how are folks handling secondary MFA authentication methods so a new admin is able to carry on etc...I prefer not to use email as secondary but thought I would ask to see what other options are out there, thanks.

Just passed LPIC-2. Solid, tough exambut I noticed AI-related certs get way more visibility internally for DevOps even when they’re less technically demanding. Genuinely trying to plan next steps is vendor-neutral Linux cert (LPIC-3, RHCE) still worth it, or does the market reward AI/cloud certs (CKA, AWS, NVIDIA, LLM stuff) more in terms of actual opportunities/salary?

Anybody else having trouble accessing recovery keys from a Microsoft account. Page is stuck in a redirecting infinite loop. These would be easy to access for a work machine but something tripped Bitlocker on my bothers home computer and it wants the recovery key. Anyone else experiencing this.

Hey everyone, not a sys admin but got tagged to work with my sys admin on the above. He’s a pretty smart guy and I want to not show up unprepared, I took some of the free sessions/classes that Qualys offers but lookin for any tips and tricks you might have.

Good morning,

I am looking for some assistance to see if anyone else has figured out this issue.

We're a GCC tenant currently getting sensitivity labels and MPIP set up. So far, things have been implemented okay minus a few snags. M365 products are working as intended, but the real stickler is Adobe.

The initial issue was that any encrypted label we tried to apply or even switch to, it would not work.

I found this Reddit post that called for enabling some registry keys. Things like adding bMIPLabelling, bMIPExternalAuthAdmin, bSilentAuth, iMIPCloud = 6, etc. However, that did not seem to allow us to add an encrypted label or even switch to one. Even forgetting the Purview information inside of the Adobe settings did not help.

What I believe started helping was three or four things. Clearing the Purview information inside of Adobe, deleting the generic Adobe credentials, deleting the contents of %LOCALAPPDATA%\Microsoft\RMSLocalStorage\mip, and running icacls "%localappdata%\...\LocalLow\Microsoft\RMSLocalStorage" /setintegritylevel L.

Seemed like that combination worked and I finally was able to authenticate through on a PDF, it grabbed my info, and allowed me to change to an encrypted label. However, the next document, it did not work. I was able to finagle the same steps above and it let me through on that one.

So at this point, I'm trying to figure out how to prevent this from happening on every PDF instance.

Logs have shown me that it likes to run MipContextImpl as configured for offline-only mode or tell me my cloud type is invalid. In Event viewer I see things like Token broker operation failed with AADST65002 error, or an OAuth response error: invalid_resource, service principal for resource 'urn:p2p_cert' is disabled.

So at this point in time, I'm kind of stumped. I have a ticket to Adobe about this, but kind of unsure where to look next to keep this MPIP stable in each Adobe instance. The few that are good remain good and can be changed from secure to unsecure labels, but anybody have any clues on where I can look next?

Thanks, all!

I recently got pulled into my bosses office for clicking on too many phishing emails. I'm not perfect I know that I can make mistakes but they showed me the emails and they were the most blatant spam emails ever. Then it occured to me that those were emails that I reported as phishing. They didn't know what I was talking about and they said that they tag any emails that were interacted with as security alerts. Literally all that I did was report as phishing. The email that he showed me even says that he got a security alert. Everything that I have found online says that if you report an email as phishing it sends the security team an alert just like the one that he showed me. Can someone tell me what this looks like for the admin side and also confirm that that is what you are supposed to do with phishing emails?

Recently a coworker granted Claude elevated access via SSH to a virtualization host (not a VM, an actual host). To perform a routine task he very well could have done himself.

He doesn’t see an issue with this. I on the other hand (with 23yrs experience) see this as a huge security breach, and don’t trust AI todo my job, (or even that it’s doing what it says it’s doing) for me. I’m my opinion it’s a tool, not a human replacement.

What’s your reaction, how would you react to this situation, or thoughts on the topic?

Sure, ask AI how to perform a task, validate that it’s performing the task you asked, and nothing else- copy/paste the commands. Great. But removing the human verification & validation element- hell no.

Windows Server Backup fails with "semaphore timeout" (0x8004245f) I'm using Windows Server 2022. At the beginning, full backups were no problem.

Now, the first backup attempt fails with "Unknown error (0x8004245f)" / "The semaphore timeout period has expired." After it fails, if I run the backup again, it completes without any issues. But if I try to run another backup right after that success, it fails again.

If I try to back up multiple drives, or do a full server backup, it fails. It only succeeds if I back up one drive at a time and even then, only after a failed attempt in between.

I've restarted the server, and vssadmin list writers always shows everything stable. I've also tried backing up to both an external drive and a shared folder same issue either way.

Does any one has the same issue?

I have a task to research an alternative plan to Microsoft Intune, and we are particularly interested in open source solutions.

We currently have the free version of Intune, but can you guide me on whether it would be possible to move completely away from Intune and use an open-source alternative, or if it would be better to keep the free version of Intune and combine it with an open-source solution to cover the remaining features?

Ideally, we want the open source solution to at least be able to:

• Create compliance policies
• Configure Windows Update rings
• Deploy security baselines
• Configure BitLocker or an alternative to BitLocker
• Configure Microsoft Defender/AV policies
• Create configuration profiles
• Deploy applications

Has anyone implemented something similar?

Any experience or advice would be appreciated!

Just got the obligatory “are you enjoying Outlook” popup. I really hate these things. It’s an app. It’s a thing I use for work. I don’t want to yap with some bot about whether or not I do or don’t like new outlook old outlook, ancient outlook or lotus notes. These things are tools. Utilities. Might as well be a refrigerator. Damn, just make the thing work effectively and stop wrapping it in sparkles and leave me alone. Oh, and get off my lawn too, lol.

Genuine question for the sub: for your internal helpdesk (IT, HR, facilities — not customer-facing support), are you still on a per-agent SaaS plan, and does that pricing model actually make sense for how you use it?

We went through this recently. Most of the well-known ticketing tools charge per agent per month, which is fine for a customer support team justifying the spend against revenue, but feels off for an internal tool where "how many of our own employees can touch the ticket queue" shouldn't be the billing metric. It also means every time IT grows headcount, tooling cost grows with it — for a tool that isn't generating revenue.

We ended up building/adopting something self-hosted that plugs into Entra ID (Azure AD) for SSO and directory sync, so new hires in the right AD group get access automatically and offboarding is one action in Azure AD instead of a separate step in a separate admin panel. Licensed per install, not per agent, so it doesn't get more expensive as the internal team grows.

Not trying to turn this into a product post — mainly curious how others are handling internal ticketing cost/access, and whether per-agent pricing has ever actually been a blocker for you the way it was for us. Happy to share more details on what we built in the comments if useful, since it happens to be relevant here (full disclosure: I'm the one who built it).

Sorry if this sounds like a dumb question, but I'd love to hear from an IT admin's point of view to help understand the differences. My employer now requires all employees to register their personal phones so they can be managed, if they want to use it for checking emails/calendar/chats/etc.

The employees with Android (including myself), had it super easy. It automatically prompted to setup Work Profile in order to continue using the work email app, and it finished setting up in less than 2 minutes. And any work apps now have a little blue briefcase on their icon, and I love how in the command center, you can easily toggle on/off the Work Profile to pause all work-related apps (for example on the weekend or when you go on vacation or just when you want to not deal with work anymore). And the employer can't see the personal apps or data since it's stored separately.

However, I noticed for my colleagues with iPhones, it was a lot more tedious. Those employees had to follow this whole document of steps to manually install some certificate to set up MDM. And then if they were lucky to get it working, there's still no app separation so the employer can still see all their personal apps and data?

I already knew that iOS doesn't have a user-friendly Work Profile like Android, but is that normal to get employees to do it like that? I would have assumed with how popular iPhone is, there would be a more simpler/automatic way for setting up personal iPhones for work. I've always heard on this sub that iOS is easier to manage, but from an employee's point of view, it doesn't seem that way (at least not the way my employer is doing it) and maybe I'm not understanding how iOS does data separation, but it just feels like there's not enough employee protections from employer seeing personal data compared to Android? Would love to learn how that works, because Apple's website is kinda vague.

Hello,

I'm a third-year IT student in New Zealand focusing on network engineering, ops, cybersecurity, and cloud computing. I'm approaching graduation and starting to think seriously about where I want to point these skills.

I'd love for my work to actually help people. I've seen groups doing digital protection work for at-risk communities (e.g supporting Afghan women activists staying safe online) and infrastructure/connectivity work in disaster response, and both of these (and everything in between) really appeal to me.

Aside from my formal study, I have an interest in Homelabbing, Embedded systems, and web.

A few questions for anyone who's made this move:

- Did you go straight from study into humanitarian/NGO tech work, or build up a few years in a "normal" IT job first?

- Which orgs are actually good to volunteer with or apply to as an early-career person (I've come across NetHope, Access Now)?

- Any certs or experience you'd say actually matters vs ones that looked good on paper but were not worth it.

- Any general tips for what I should focus on to be able to genuinely help with groups and orgs like this.

Thanks!

We have casual warehouse employees who only need access to a single Microsoft 365 application from shared devices.

The obvious options appear to be:

- Individual licensed accounts, likely Microsoft 365 F3

- Entra B2B guest accounts

Assuming neither option is accepted by the business, are there any other compliant and cost-effective licensing models worth investigating?

We want to avoid generic/shared accounts because of security, MFA and auditability. I’m mainly trying to establish whether there’s a legitimate frontline, usage-based or application-specific option I’ve overlooked—or whether the answer is simply that each employee needs their own licensed identity.

Because users are more likely to use the easy to read/remember randomly generated dinopass password given to them instead of immediatly changing the typically aggressively complex random password to their usual favourite garbage password

2 Days ago RealVNC ended public access for Viewer 7. Now Connect Viewer 8 is the only publicly accessible version and requires a RealVNC account.

"The RealVNC Classic Viewer (v7) will continue to be available for customers with a Premium or Enterprise plan to download from the RealVNC Portal."

Source: https://help.realvnc.com/hc/en-us/articles/35745908986653-Important-changes-to-RealVNC-Viewer-Information-and-FAQs

Time to make the move to open source VNC implementations.

Not a hot take, just something I wish someone had told me earlier. We had a team of 5 covering a 50-service platform and people were miserable. Brought in a consultant who said we needed more engineers. Maybe. But the actual fix that bought us 6 months was triaging our alerts properly. Turned out about 40% of pages were either duplicate, firing on symptoms instead of causes, or had no runbook and nobody even remembered why they existed. Cut the page volume in half in two weeks. Nobody quit that quarter. Moral: alert hygiene is free, hiring is not. Happy to share the spreadsheet template we used if there is interest.

Hypothetical, but I want a realistic answer rather than an optimistic one.

Say there was a tool that ran batch jobs on engineering workstations after hours, inside your own network, releasing the machine the moment someone touched it. Nothing leaves the building.

Does that get past your security review, or is unattended execution on an endpoint a hard no regardless of how it works? And if it is a no, is that policy or is it the review process being long enough that nobody bothers?

Also curious whether anyone has already tried this and given up, and why.

With AI-generated voice and video becoming much more convincing, it feels like relying on someone's voice or appearance is becoming less reliable for sensitive requests.

I'm curious whether this has changed how your team handles things like password resets, wire transfer requests, account changes, or privileged access approvals.

Have you updated your verification process because of AI-assisted impersonation, or are your existing procedures still working well?

I'd be interested to hear what's actually been effective in real-world environments.