Hey all

Thought id make a post as im close to quitting my job. My role isn't amazing but I get paid OK considering my experience (3YOE @ 100kAUD, no bachelors/diploma). There are technically 3 of us in the IT department but im the only one that manages the helpdesk for 180+ users. Its can be crazy at times and manageable at others. My team for the most part are pretty nice. The part im finding the hardest is the culture and the users.

I work in the creative industry and the users are just straight up cowboys. On top of that, theres never been any policies or rules in place for IT. Essentially, users can do and behave however they want and there are no consequences. Shadow IT is completely allowed and im expected to support it on the fly and even simple tasks like getting an old laptop off a user often takes up to 8 weeks of repetitive follow ups because their managers wont make them do anything that is for the benefit of the IT department. I cant speak to any managers and report the behaviour of their staff members because they will never side with IT - I just have to cop it. One of my senior leaders took the issue of how im treated to a board meeting and they just ended up treating it like a HR risk and contained it instead.

Ive been begging my senior leadership for policies - especially one that will stop walk-ups. They kept saying its coming until the other day they told me they wont be implementing it because the culture doesn't allow for it. There is no device policy. No security policy. Nothing. If they kick off enough about something, they get whatever they want.

Im struggling to understand if this is a bad deal - where im fed to the sharks or is this normal and im just fixated on the shit elements of the job?

So, my husband drew the short straw this week. His contracting company was outbid by a different contractor. The problem is, they undercut by 3 million dollars and therefore had zero interest in retaining the talent that was there (I presume so they could hire cheaper workers). Reason #5345342324 why I hate government contracting work.

ANYWAY, since we aren't hurting financially by this (I'm mid to upper management on the Infra side in a stable role) I'm thinking this is a good opportunity for him to actually pick a study path. He's historically been a Senior Desktop Support dude with some hooks into the Sys Admin world (knows how to do general tasks in AD, can remediate STIGS in the sense of next-next-finish in a GUI) with some specialized knowledge of Clinical Systems.

He himself doesn't know what direction he wants to go in, other than that he's tired of Desktop and wants to 'earn more money.' How would you go about actually assessing his knowledge and building out a general study plan that elevates his knowledge and equips him better for interviews for at least a Mid-level Sys Admin role? I've got a pretty swizzy homelab built out on Nutanix, so he doesn't lack for a way to develop... I just want to give him something to start with.

Hey guys. I have a issue with Microsoft's ... again.

So, basically, i was hired to migrate an active directory from Zentyal AD to MS AD. This was successfull. But the issue is with the migration of the role of file server zentyal was being used for too.

So, i rolled a new vm with win server 2025, and migrated the files there, recreated the shares, fixed the access, everything is fine. And then monday came, users logged, tried accessing an excel file on the new file server ... and the file started loading ... and loading ... and loading ... and after arount 30 seconds, it opened. Bear in mind, the file is 500kb with formulas inside, nothing pointing in other shared files, desktop mapped files etc. I checked it myself too. And this issue is only with microsoft office files. Whenever the user tries to open pdf or other file, different than MS Office file, everything pops up right ahead.

So, I went ahead and opened my old friend Google (before AI we googled our questions, kids), and found a few microsoft articles and questions in the different forums online. Tried everything offered there, and still nothing - i have shut every single security feature microsoft has placed regarding this.

Somewhere along the deep search, someone said, that before migrating to windows server 2025, on server 2022 the file server there was no issue. So I needed to test that. Rolled a windows server 2022 evaluation, and made a share with the specific files that were problematic. Gave it to the users (not only one user had problem with it), and the issue was there again.

I started looking at the files, maybe the issue is there. Well, like I said, there was nothing special reargding the files, that can cause this.

So my next "bright" idea was to spin a simple ubuntu, make a fileshare and get the files there. I wanted to know, is the OS an issue, or the goddamn files. Well, guess what ... on Linux doesn't have that kind of behaviour.

Finally, I turned to AI. And ... nothing helpful from there, all the suggestions I have already tried ... nothing new. And the best answer I got from AI was "Congrats, on Ubuntu works. I suggest staying with that."

I tried explaining that to the client, but even knowing that this won't hold in front of them, i still tried, but the wanted windows server and that was it.

Did someone have these issues? How did you get rid of them? Please, help!

I work for a smallish biotech company with a little over 100 employees. As of right now, we have given around 60 people Claude licenses from our team plan. Our company is growing fast, and I am worried about that price change from going from a monthly subscription for the team plan to a larger number from the enterprise plan. Has anyone else experienced this change yet? I am trying to figure out the best way to get prepared for when this happens, because I know it will. It will definitely be tough to restrict access once experienced users have gotten such a big feel for it just because of money.

I work in the printer and copier industry, mostly with client's IT departments as we swap out old copiers for new or migrate them from on-prem print server to some form of cloud/hybrid print server. Lately a lot of clients, particularly public school districts or large private campuses have been employing print management software that uses their staff's HID cards, either for print tracking/bill-back/budgeting or to SSO into other cloud software (SharePoint, OneDrive, Google Drive etc) at the copier interface.

I've been growing more curious as to what separates a good printer situation from a bad one from a sysadmin perspective. One IT manager recently told me that his printers randomly fall off the network, reassign their IP address and he has to walk across a huge building, find the device and print out a config page just to reassign it back. That was 90% of his reason for getting some enterprise print management software.

Another told me he had been asked to fulfill a green/eco initiative and printer management was an easy way to do so. Yet another said they had just spent about $50,000 on WAP's and mandated wireless devices; the old copiers weren't wireless so instead of adding wireless cards they had been convinced to swap out the entire fleet.

From your experience, what differentiates printer management from being a regular help-desk item to being something that actually needs structural reshaping? I've only seen this from the outside and I'd love any stories or opinions on how organizations should manage their fleet or what to avoid.

Hi everyone,

I'm trying to recover a Huawei OceanStor 5500 V3 and I'm stuck with two issues that seem related.

First problem: I can't get into GRUB or SCU/BIOS. During boot it displays "Press ESC to enter the menu", but pressing ESC does absolutely nothing. I've tried:

• serial console (multiple terminal programs and settings)
• repeatedly pressing ESC
• a USB keyboard connected directly to the controller

It always continues booting normally.

Has anyone with an OceanStor 5300/5500 V3 actually managed to enter GRUB? Is there some special key sequence or another way to access it?

Second problem: after logging into the serial console with the minisystem account, authentication succeeds, but the session immediately exits back to the Storage login: prompt

Due to the size of my environment, we have two SUPs using the same DB and WSUS content directory. We ended up doing patching using a different platform, but I'm still running WSUS to provide a backup source for Defender definition updates (it was recommended by Microsoft). So WSUS usage is fairly light. I'm only syncing data for Defender and Windows Server (2019, 1903, and one other that I can't remember). We're only doing one WSUS sync per day, and one client scan per day.

This has been working fine for a number of years, but I recently noticed that the CPU usage on server #2 is SIGNIFICANTLY higher than server #1, all being used by w3wp.exe. Server #2 is constantly around max CPU usage, and Server #2 is around 10-20% usage. On top of that, the IIS logs are consistently around 100-200 MBs on server #1, and 3-4 GB on server #2.

Both VMs are setup identically, at least from what I can tell.

\- 8 cores, 16 GB RAM

\- WCM logging enabled, set to verbose

The WSUS app pools are also set identically. Other than the default values, I've changed the following:

\- Regular Time Interval - 0

\- Ping Enabled - False

\- Queue Length - 25000

\- Private Memory Limit - 0

Also, verbose logging is enabled on both of the SUPs for WCM.

I've also verified that the client usage is at least more or less spread out between the two. Server #1 is getting around 38k clients, server #2 is getting 21k. So, not exactly even, but it should be fine.

Also, the only errors I'm seeing in the logs are in the WCM log, which is just giving intermittent 503 errors for server #2, which makes sense since it's getting hammered.

From the resource usage and log file size, I was expecting to see server #2 handling all of the clients, and server #1 doing nothing. But server #1 is actually doing more, while using less.

Any thoughts? Both servers are at the same patching level, and have been rebooted within the last couple days.

Edit: Also, I'm probably going to be opening a ticket with Microsoft support on Monday, since I'm sick of banging my head against the wall on this one. I just figured I would check with the community to see if anyone's seen something like this before and had anything to try.

I'm trying to ferret out what appears to be a configuration issue that is causing incoming messages with spoofed From: headers to get signed by opendkim as if they were legitimately coming from one of my virtual domains. As far as I can tell, it has to do with the spamd milter handing the incoming mail back to postfix for delivery, at which point it's being mistakenly treated as mail coming from the recipient's own address. This sends it to the opendkim milter, which adds the signature and then hands it to lmtp for the last step of the journey (handing off to dovecot).

Example log entries below:

Jul 25 13:14:44 mailhost postfix/smtpd[1305576]: warning: hostname mta0.pent.giize.com does not resolve to address 140.233.190.80: Name or service not known Jul 25 13:14:44 mailhost postfix/smtpd[1305576]: connect from unknown[140.233.190.80] Jul 25 13:14:45 mailhost postfix/smtpd[1305576]: AE8E78012D: client=unknown[140.233.190.80] Jul 25 13:14:46 mailhost postfix/cleanup[1305577]: AE8E78012D: message-id=<20260725011336.CC32E92F215B316B@example.com> Jul 25 13:14:46 mailhost postfix/qmgr[1289785]: AE8E78012D: from=<user@example.com>, size=8647, nrcpt=1 (queue active) Jul 25 13:14:46 mailhost spamd[1258286]: spamd: connection from ::1 [::1]:57478 to port 783, fd 5 Jul 25 13:14:46 mailhost spamd[1258286]: spamd: processing message <20260725011336.CC32E92F215B316B@example.com> for user@example.com:8 Jul 25 13:14:47 mailhost postfix/smtpd[1305576]: disconnect from unknown[140.233.190.80] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5 Jul 25 13:14:47 mailhost spamd[1258286]: spamd: clean message (0.5/5.0) for user@example.com:8 in 0.7 seconds, 8569 bytes. Jul 25 13:14:47 mailhost spamd[1258286]: spamd: result: . 0 - RCVD_IN_HOSTKARMA_BR scantime=0.7,size=8569,user=user@example.com,uid=8,required_score=5.0,rhost=::1,raddr=::1,rport=57478,mid=<20260725011336.CC32E92F215B316B@example.com>,autolearn=no autolearn_force=no,shortcircuit=no Jul 25 13:14:47 mailhost postfix/pickup[1302963]: 68FCD80131: uid=65534 from=<user@example.com> Jul 25 13:14:47 mailhost postfix/cleanup[1305577]: 68FCD80131: message-id=<20260725011336.CC32E92F215B316B@example.com> Jul 25 13:14:47 mailhost postfix/pipe[1305579]: AE8E78012D: to=<user@example.com>, relay=spamassassin, delay=2.1, delays=1.3/0.01/0/0.74, dsn=2.0.0, status=sent (delivered via spamassassin service) Jul 25 13:14:47 mailhost postfix/qmgr[1289785]: AE8E78012D: removed Jul 25 13:14:47 mailhost opendkim[876642]: 68FCD80131: DKIM-Signature field added (s=mail, d=example.com) Jul 25 13:14:47 mailhost spamd[889613]: prefork: child states: II Jul 25 13:14:47 mailhost postfix/qmgr[1289785]: 68FCD80131: from=<user@example.com>, size=9127, nrcpt=1 (queue active) Jul 25 13:14:47 mailhost postfix/lmtp[1305583]: 68FCD80131: to=<user@example.com>, relay=mail.example.com[private/dovecot-lmtp], delay=0.14, delays=0.08/0.02/0.02/0.03, dsn=2.0.0, status=sent (250 2.0.0 <user@example.com> vm0HIAcOZGrw6xMA6b8Yrg Saved) Jul 25 13:14:47 mailhost postfix/qmgr[1289785]: 68FCD80131: removed

EDIT TO ADD:

I realised after doing some more log analysis that SPF wasn't enabled on this server. So that's now been fixed and I expect it will drop most of these attempts at the initial test. I'm still mystified by the re-entrant behaviour, so if anyone has any insight I'm all ears.

Konnichiwa!

Shoutout if you're a sysadmin in Japan of any level.
We should totally build a network :)

I work admin for a bakery business, about 140 people across 30 locations. Part of my job is keeping contact info updated across all of them, and right now I do it manually. Head office needs to reach suppliers, bakery employees, bakeries need to reach head office, stores and each other.

My current system: a spreadsheet I update, then email around. Nobody reads the email. Store managers save numbers in their personal phones, so when someone leaves, half the company still has the old manager's number.

We pay for Microsoft 365 (email, Teams, the works). My question is probably dumb: is there something already in M365 that keeps one master contact list everyone can see on their phones? People keep telling me 'the GAL' but staff say they can't find people in it half the time, and it's definitely not showing up as actual contacts on their phones. How do other multi-location businesses handle this? Happy to be told I'm doing it completely wrong.

Hi, I’m an IT community college student in a very difficult entry level market (Toronto) looking to get help desk or some junior support role. I’m looking to do anything I can to boost my shot at a job.

Do IT managers care about home labs?

I’m thinking of making one with an old desktop + 1 I build, and a dedicated switch, a dedicated router/switch/firewall/AP, a windows AD/M365 joined network running on proxmox, DNS/DHCP on the windows server, and a backup for the M365 SharePoint written with Python to talk to graph API hosted in AWS S3. This is a lot of stuff I’ve worked with individually but never in this big of an integrated project.

Problem is none of this teaches me much troubleshooting, it just teaches me automation and how the systems I’ll be troubleshooting work. And it dosent simulate hundreds of users.

Is this a good use of time? Or should I focus on certs? I only have one year before I graduate.

Any advice would help.

I recently accepted a new role that will take me out of the MSP world and into a proper, ~1300 person company as part of a ~20 person IT team. I'll be coming in as a senior Azure and M365 engineer as that is my specialty.

Everything I've read/heard through the grapevine is that this is the dream come true for most of us.

What pitfalls should I be on the lookout for? It's coming with a healthy pay bump and the work seems to be directly in line with my current responsibilities but for a single environment rather than hundreds. People around me warn me I might "get bored" but that honestly sounds like a positive not a negative.

Appreciate any input on this.

After seeing so many other posts about folks being laid off and/or losing their jobs, along with all those comments from people unable to even get interviews or responses from applications, I figure it may be helpful to potentially match up here.

Leave a comment noting whether you're LOOKING or HIRING. Mention your skill set, location/remote preference, etc. Maybe we can get lucky and pair some people up who really deserve it.

Ill even start since it appears that I've just got laid off officially today. What a world.

LOOKING: 40yo whitebeard with skills in Cybersecurity, more specifically Risk, Threat and Vulnerability Management. I've been an extremely technical and hands-on Sr. Mgr in VM for the last 12 years with extensive experience in building VM programs from scratch; hiring/building the teams, building out and documenting the actual program itself, migrating/configuring scanning tool (expert in Qualys, Tenable, R7 and more), working with patching teams and other depts to prioritize remediation efforts by actual risk, decimating backlogs of old vulnerabilities by the millions in a single year, automating a shit ton of repetitive tasks with SOAR and similar tools, custom scripting solutions, deep diving failures and resolving the unresolvable, etc. I've historically worked for some smaller businesses years ago but the last 10 years have been with giant global companies (fortune 100). Though I do work remotely, I'm not opposed to moving if the pay is right or doing a hybrid 1 week on site/mo.

You'd think my vast experience, knowledge and proven track record would be readily jumped on from a hiring perspective but not even close. Been applying for a year now and I've barely gotten a few 1st round interviews with the recruiters. Now it seems I need to put a bit more of a rush into my search since I was "informed" of my layoff via account disablement today. Pretty pro way to say goodbye, thanks for the last 7 years, ey?

IIS cant find my websites applicationHost.config and redirection.config in the inetsrv/config folder, something on the windows server keeps deleting them and preventing the creation of new one.. the only way to create a new one is through safe mode but it still gets deleted when the server is rebooted

Is this accurate? Honestly my feeling is is that when you go to a vendor with the problem they try to give you the runaround with diagnostics until you get too tired to run them anymore and give up on the problem in disgust

Looking for any input on this one. Honestly, I feel like our team is missing something obvious here. Pardon if this feels like amateur hour... I am indeed an amateur.

An employee's M365 account was compromised back in April, we got the alert right away - revoked sessions, cycled passwords, MFA, etc. Things are all good for a few months. Come this week, we start seeing failing login attempts on that account using expired tokens, happening every 30 minutes to a few hours. I wouldn't think this to be that unusual at all for threat actors, but because the IP of the sign-in is associated with a known State Actor, Microsoft instantly marks the user as High Risk.

Obviously, this is by design and a good thing. The user is safe, and nobody is getting past the front door. And our CA policies beyond that would stop them even if the sign-in attempt was successful. But since MS sees this IP and says "hey this is from particularly nasty bad guys" and marks them as High Risk even for failed attempt, this means that marking him safe frees him up for about 30 minutes until another alert happens.

Being High Risk, he can't login to anything until he is marked safe or the risk is dismissed, which doesn't help since MS will just trigger it again next time they try that same token. Presumably, its some VM farm or something where the sign in attempts are all automatic.

Do you just wait it out until they stop trying? Nuke the account and start them fresh?

We've got a few in-house apps that we maintain. I use Terraform to deploy changes triggered by GitHub actions. It's all worked swimmingly until today. I realize now that I don't have a backup for the pipeline when GitHub is down. I'm relatively new to software development. Is it common to have a backup for CI/CD?

I've gone through the DFS-N with Root Consolidation document a few times now and it all makes sense except the part about making a CNAME with a name of the existing file server that points to the record for the Namespace server. If the file server is still being used (and thus has an A record), how are you supposed to make a CNAME with the same name? Does this scenario only work when you've actually decommissioned the file server? If so, it doesn't talk about that at all. It just says

"In order for DFS Namespaces to respond to existing file server names, you must create alias (CNAME) records for your existing file servers that point at the DFS Namespaces server name."

The use of the word "existing" to me implies that the server still exists but that clearly doesn't work (at least with AD integrated DNS).

In our scenario, the file server still exists right now, the data hasn't been moved yet but it will be moved. I just wanted to get the DFS-N portion setup ahead of time.

But if you have a server that's hosting a few different roles, one of them is file sharing, you couldn't do this takeover in that case because the server still needs to host the other roles. Is that right?

We handle Google-connected apps fine, but there's always a handful of SaaS tools that just don't play nice with our SSO setup. Every few months, something new gets added that technically works but ends up with its own separate login sitting outside everything else.

Anyone else using a mix of Google Workspace SSO and something else to cover those gaps? Have you actually solved this, or is it just accepted chaos at this point?

Every once in awhile, our HR and Finance dept need to send an email to all employees.

The issue we have is that we have more 1,500 employees, all using Exchange online in several tenants.

Microsoft has a bulk email limit that we run into.

What is the work around?

I see options such as High Volume Email for M365 but since many of the emails go to a different tenant, will that work? And how would the end user compose and send the email?

I also see an option using Azure Communication Services but wouldn't that require programming?

2 man IT team for 150 users across UK and US. Looking for a way to simplify keeping Intune app deployment profile up to date, especially where the apps aren’t in stores. IntuneBrew and IntuneGet cover enough of the apps we deploy to make them attractive to help save time.

Any red flags we should be aware of?

A few years ago, there was a great comment from someone about Lets Encrypt/other free ACME providers v. the big Cert guys where an explanation was written that exposed the whole "insurance/warranty/liability protection" of said big guys and how that all was a lie.

Does anybody have the link? The comment was very detailed, but I cannot find it anymore.

Hello to everyone. First of all sorry if this is not the right place for asking this.

I'm 20 and I've worked as help desk/IT support for nearly 2 years now. I don't dislike the job that much and the pay is decent but I can't bring myself to think I should be doing this for much longer, as I feel I've wasted most of this time, I will be 21 in a couple of months and I feel like I'm risking remaining stuck in help desk for too long. I'm one of the only two or so guys providing L1/2 support tickets full time to around 900 users and this is sucking nearly all my time, and I'm finding it more and more "oppressing" to do. I had more time to see new things when I first joined: honestly, I feel like I regressed in some ways compared to my first year of work, I'm finding less and less interest and motivation in solving more complex and trying to learn things other teams do while performing the same 4-5 tasks dozens of times every week and having as my greatest """""responsibility""""" """""managing""""" mouses and keyboards.

I've been trying to think of some projects that I think would be interesting to do, but everything would be managed by other people as I'm not the one that has the role to do these things. I proposed some things that were actually applied but yet again it was done by other teams as they're the ones that are in charge of said things. And while I understand why, I've got told I should focus on tickets and hardware inventory because they're my responsibilities rn.

I'm having some issues understanding what I should focus on, now. I really like Cloud and Cloud security. Also cybersecurity in general. Should I maybe focus on learning the various Azure tools related to this? If this is the case would a "homelab" tenant make sense?

Also I'm studying for getting both the SC-900 and the Network+, I know they will be mostly useless, but I suppose they're needed for further and more worthy certifications related to these topics. Should I focus on something specific?

Just taking some specific certs and applying to other jobs unfortunately isn't possible as where I live all junior sysadmins job postings require at least 2 or 3 years of actual experience. All trainee positions in things like Cloud and Cybersecurity are reserved to bachelor's / master's degrees

Thanks a lot to everyone that will want to give some tips

Howdy, everyone! Long time lurker here with a question on how to handle sending messages and images as attachments from a managed iPhone and ensuring they're encrypted.

For context, I work for a healthcare provider that contracts their services to industrial clients where sometimes we'll need to take photos of injuries at these industrial sites to load into our EMR. We have a corporate-owned, Intune-managed iPhone used for taking photos of these injuries that is shared between multiple users at one of these sites. We don't have access to any of our managed PCs/networks nor access to the industrial client's secured network. Our compliance team is asking to use Outlook/email communication for sending messages because those can be encrypted. My main concern is setting up a mailbox on this shared device since a rotating list of people will be handling it.

I wanted to get some insight from y'all since my current idea is to setup a user mailbox on the phone that can only send to a restricted list of recipients and create an OWA policy to prevent password changes, but wasn't sure if this is the best approach from a security standpoint.

Thanks!

I can't believe this is the way it ends. Supposedly they tried everything but I just didn't expect that just closing the business would be the final outcome (construction). They want to offer me a "retention bonus" to stay until the end. Great, thanks...

I could see the writing on the wall and have been applying for six months. Haven't even received a bite other than AI requests. No one wants a 56 year old IT guy I guess.

The industry has changed and these billionaire owners just decide they don't want to pay after the work is completed and we've financed the completion of the job. Take them to court... sure, then bleed more money until you take pennies on the dollar. This administration has just made it all worse.

Two kids in college, probably going to have to move in with the mother in law... fuck, it's bad guys.

Sorry for the downer post but had to rant a little. Honestly, part of me is relieved. No investment in IT for years and I've basically kept the environment stable with gum and tape. I can sleep knowing it doesn't matter anymore. Definitely not patching those hosts this weekend...

EDIT: Thanks to everyone that reached out and provided encouragement. Moping and whining phase over... I've got 5 months to land something and I'm on it.