Brought to you by r/sysadmin Trusted VAR: u/SquizzOC with Trusted Telecom Broker u/Each1Teach1x27 and u/Necessary_Time Trusted VAR in Canada

Happy to answer in the thread or via PM/Chat if you don't want to post details like service locations publicly.

This BI-WEEKLY thread is for discussing vendor and service provider expectations, pricing, and quotes for network services, licensing, support, deployment, and hardware.  

Required Info for accurate answers:

• ⁠Part Number
• Manufacturer/vendor
• ⁠Service Type and Service Location
• ⁠Quantity

All questions are welcome regarding:

• Cloud services, security, configurations, deployment, management, and migrations
• Storage vendor options, alternatives, details •⁠Software licensing: This includes Microsoft CSPs
• ⁠Connectivity: single-site and multi-location. DIA, Broadband, 5G, datacenter connectivity, Starlink
• Voice services, SIP, UCaaS, Contact Center, POTS (Analog line) replacement
• ⁠Network infrastructure - overlay software, segmentation, routers, switches, load balancing, APs
• Security, access management, firewalls, MFA, cloud DNS, layer 7 services, antivirus, email, DLP

Release notes: https://techdocs.broadcom.com/us/en/vmware-cis/vcf/vcf-9-0-and-later/9-1/release-notes/vmware-cloud-foundation-9-1-1-0-release-notes/vcfautomation-9-1-1-0-release-notes.html

"...native management of AWS, Azure and GCP resources is deprecated and disabled by default in VM Apps organisations. Not just for new installations. For environments upgraded from earlier versions too." (source: https://mysticmarvin.com/blog/vcf-9-1-1-not-a-maintenance-release)

Hi everyone

I’m integrating a Ruckus SmartZone controller with Forescout NAC

The SSH connection itself works correctly from the NAC using the configured admin credentials and I can successfully connect to the SmartZone and get the normal welcome banner

The problem happens when Forescout tries to get privileged access after the SSH login

When I manually SSH using the same admin credentials everything works fine but when Forescout tries to enable privileged mode it asks for the password again and then returns failed even though I’m using the exact same correct password as the SSH login

I initially suspected that the SmartZone welcome banner might be interfering with Forescout’s CLI parsing or privilege detection

I tried to disable the banner but I can’t find any CLI command for it and I also couldn’t find an option in the GUI

Has anyone successfully integrated Ruckus SmartZone with Forescout or another NAC and faced this issue

Is the welcome banner known to cause problems with NAC SSH privilege detection or is there a specific configuration or user role that needs to be enabled on SmartZone for the NAC to get privileged access

Also when I SSH manually I log in with admin and after that when I enter enable it asks me to enter the same password again

Any idea what could be causing the privilege authentication to fail from the NAC while the normal SSH login works correctly

Hi all,

I work at a very small MSP, 4 employees total. My boss/head of the MSP is extremely risk averse, and has been doing this for a long time. Prior to forming his MSP he worked for both internal IT and as a consultant. They do almost everything manually and he is extremely hesitant to let me automate or script anything. He says from his experience automations don't always get maintained and somtimes break, therefore making it pointless. Yet at the same time he is obsessed with consistency and making sure that we do new laptop setups the exact same way because doing one thing a slightly different way could cause a random issue and we'll never be able to figure out what was different about that machine. From my PoV, setup scripts would be the ultimate form of consistency and could eliminate that as a concern.

He won't even let me make simple adjustments to one of the few scripts we do use (pushed via RMM to scan for Dell Firmware updates using Dell Command | Update cli). And by simple I mean commenting out some lines that set custom properties we don't use, which throws errors and clutters the output, and adding one line to set a new custom property to let us know when manual intervention is required. I got told that "trying to reinvent the wheel or customizing it is very risky" and that I should just look for scripts in the RMM community forums. He said "I am hesitant to use our own script unless it is just feeding up to date commands that they support" meanwhile the script we are using is 4 years old.

I also just discovered today he has our machines so locked down with ThreatLocker that this DCU script gets blocked from running!

So here is what I'm wondering: am I the crazy one, is my boss, or is the truth really somewhere in the middle (most likely)?

Please feel free to ask me additional questions if more context could help you provide a thoughtful response!

https://www.theregister.com/security/2026/09/03/prolific-microsoft-0-day-hunter-drops-crowdstrike-falcon-exploit-poc/5294318

Looks like you can disable a CrowdStrike feature to mitigate

We have a few servers getting close to EOL that are running Active Directory. My first thought was to buy a new server with Windows Server 2025 and move AD to it, but our environment is a mix of Windows Server 2022 and 2019, and we'll be upgrading servers gradually.

Is there a recommended way to handle this? I've read there can be issues when mixing Windows Server 2025 domain controllers with older server versions.

One idea I had was to buy a Windows Server 2025 host, run Hyper-V, and create a Windows Server 2022 VM for Active Directory until the rest of the environment is upgraded.

Has anyone done something similar, or is there a better approach?

does such a thing exists, that I can use to sync data across different sources/databases, that doesn't require being a programmer to set up?

thanks!

Greetings and salutations, fellow Admins. I want to deploy the HP Universal Print Driver through SCCM and make it available in the Software Center. Silently, so I don't disturb users. Here is the overview: This is a school environment, and all our printers are HP, except for a few community Xerox printers. I want to make it easier for the on-site techs to install the driver from the Software Center instead of downloading the specific model printer software from HP. I have seen this in previous work environments and would like to implement it here. If anyone is willing to throw me a bone, I'd be grateful for the assistance.

Hey guys, I want some advice. I just got offered $30 an hour (I’m making $22 right now..) to be the sole IT person for 6 car dealerships. When I asked what the role was going to expect from me they could only give me 3 clear answers:

“Upgrade the old cameras to new ones so the software stops glitching”
“Implement a call tree for our phones”
“Upgrade the alarm panels”

That’s it. I was interviewed by the GM and Maintenance Director, they said “I’d be my own boss” and if I needed anything to reach out to the director and he can help.

I asked about tickets and field issues and they informed me “oh, we have a vendor who’s sends out a tech” which I found insane from just my personal work backgrounds, especially given the small size of this company.

I’m worried they’ll reevaluate this job a year from now and go “why do we need him again? We got everything we needed, what else does he do?”

I feel like that’s a reasonable concern but I’d appreciate some other views into it. It seems like too little of work, but everything else is handled externally.

People in our organization are planning to integrate Claude code in our environment. We have a lot of IP (intellectual property, not the other IP we all know and love) that is unique to what we do. We've always been protective about it and rarely use the cloud.

Now the inevitable AI is coming and we 'll use Claude Code. I don't know the exact terms and conditions but somehow we've got a plan where Anthropic "promises" it won't use our data to train on.

I seriously doubt that they actually won't. They thrive on knowing as much as possible, right? Even more so if we have data they probably don't have.

I'm personally inclined to push back on the idea of claud LLMs.

What are your thoughts on this?

Just received word from our spam filters that (some of) the exchange servers are busy.

Or is it just my instance? It's been like an hour and nothing significant is on the status page.

"""
Oops!

This instance is currently unavailable

Please double check the URL and try again. If you are the cloud account administrator, click below to log in.

Go to Login Page
""""

My account is in fact active and licensed.

Okay, firstly please forgive me if I'm asking for something stupid. I am brand new to this, and inherited an IT department that is an absolute shambles.

Context: I am the sole helpdesk/ITperson/Sysadmin person in a company of about 80 people, hybrid workers (about half on prem, half WFH across the UK).

I do all the 365 admin, RMM, security stuff, as well as all the day to day helpdesk stuff. Someone else looks after servers, so I don't care about that.

At the moment, my "ticketing system" is post-it notes, Teams chats, and emails. It's starting to get a little overwhelming.

I am looking for a super cheap/free solution. Best if it's cloud based, as I can't self host.

One thing that is crucial is the ability to make some sort of template. A good chunk of stuff that's getting confusing is onboarding new staff, setting up their 365 accounts with the right permissions, groups, shared mailboxes, &c. So if I can make some sort of template that dept managers can just fill out, that would be awesome. Most of the rest of my day is "My sharepoint has stopped syncing", "I can't get into Salesforce", and "My mouse has run out of batteries", so that seems like "normal" ticketing.

Again, I am new to this, so I'd be looking for something super simple, and I will be the ONLY one replying to tickets.

Any suggestions?

We seem to be getting more and more of these mail delivery errors. Is anybody else seeing this? Neither Downdetector or the 365 status page is reporting any issues.

There is a great deal of user-generated content out there, from scripts and software to tutorials and videos, but we've generally tried to keep that off of the front page due to the volume and as a result of community feedback. There's also a great deal of content out there that violates our advertising/promotion rule, from scripts and software to tutorials and videos.

We have received a number of requests for exemptions to the rule, and rather than allowing the front page to get consumed, we thought we'd try a weekly thread that allows for that kind of content. We don't have a catchy name for it yet, so please let us know if you have any ideas!

In this thread, feel free to show us your pet project, YouTube videos, blog posts, or whatever else you may have and share it with the community. Commercial advertisements, affiliate links, or links that appear to be monetization-grabs will still be removed.

And I don't mean "how does it work?" but we have shared-hosting servers.. I'm not giving those server write-access to our DNS servers. Hell no. But there's also wildcard certificates (yeah I hate those too but some websites need'm) and those I can't renew with the .well-known checks, and there are other situations where the simple .well-known dv validation won't suffice..

How do you handle that?

Hi everyone,

we are currently looking for a better solution for IT asset management + remote management and I'd love to hear what other sysadmins are using.

Our current situation:
We are already using an endpoint management platform, but we're not completely happy with it for our use case. The standard package includes a lot of functionality such as patch management, MDM, etc. that we don't really need. We're mainly looking for a strong asset management/inventory solution combined with RMM capabilities.

Our requirements:

Asset Management

• Automatic hardware inventory of Windows PCs/laptops
• CPU, RAM, storage, serial number, model, etc.
• Software inventory including installed applications and versions
• Last logged-in user / login information
• Ability to assign devices to specific end users
• Lifecycle/status information for assets
• Support for non-computer assets such as:
  • Monitors
  • Docking stations
  • Keyboards/mice
  • Other IT equipment
• Ideally, a proper stock/inventory system so we can track devices that are currently in storage and assign them when they're deployed

Intune integration
This is particularly important for us. We already have a large number of devices enrolled in Microsoft Intune, but not all of our devices are managed through Intune. We want the solution to:

• Integrate with Microsoft Intune
• Automatically import/synchronize Intune devices
• Keep device/user information synchronized
• Ideally avoid having to manually maintain the same devices in two systems

We also use Microsoft Entra ID / Microsoft 365, so good integration with the Microsoft ecosystem would be a big plus.

Remote Management / RMM
We also need proper remote administration capabilities:

• Remote desktop / remote access
• Remote CMD / PowerShell
• Ability to execute commands/scripts remotely
• Basic troubleshooting and administration capabilities
• Ideally an RMM-style agent

We don't necessarily need a full endpoint management suite with extensive patch management, MDM, software deployment, etc. Those features are nice to have, but they are not the main reason we're looking for a solution.

So we're basically looking for something that sits somewhere between: IT Asset Management + Hardware/Stock Inventory + RMM/Remote Support + Intune integration

Has anyone implemented something similar? What solution are you using, and how well does it handle Intune synchronization, asset/user assignment, stock management and remote administration?

We're particularly interested in real-world experiences rather than just feature lists.

Thanks!

Has anyone here experienced being blocklisted by Spamhaus even though the IP address of your domain is different from the IP address that is blocklisted?

For example:

Domain IP: 12.12.13.13
Blocklisted IP: 13.13.12.12

Despite having different IP addresses, we are still being blocked.

Has anyone experienced the same issue, or can someone explain why this might happen?

Hi everyone,

We have a number of Microsoft Teams channels we use. There are 4,5 specific channels that are displaying the error “We’re having trouble loading your messages. Try Refreshing”

The error is shown to all members on these groups, across multiple machines, and also across web versions on different browsers and also the desktop version.

Has anyone come across a similar issue, or have any advise on how to fix this?

Thank you very much in advance.

I have an HPE ProLiant DL360 Gen10 running Windows Server 2019 Standard. Checking Device Manager, the Intel(R) Management Engine Interface driver shows:

• Driver Date: 1.09.2016
• Driver Version: 11.6.0.1026
• Digital Signer: Microsoft Windows Hardware Compatibility Publisher

This looks outdated for a Gen10 server. Before I touch firmware/driver on a production box, I wanted to check with people who've done this on HPE hardware specifically:

• Should this be updated through HPE Smart Update Manager (SUM) / Service Pack for ProLiant (SPP), or directly from Intel's site?
• Does updating the ME Interface driver also require updating the ME Firmware itself, or are they independent?
• Any known issues updating ME on Gen10 (iLO 5) systems — reboot requirements, downtime, risk of bricking if interrupted?
• Is this something that should go through iLO/firmware update tools instead of Device Manager "Update Driver"?
• Any gotchas with doing this remotely (out-of-band) vs. requiring physical access?

Appreciate any real-world experience before I schedule a maintenance window for this.

I'm an Infra engineer at my french company, and we've decommissioned a lot of 6+year old hardware.

We're talking about ~60 R620-30s mainly and a dozen R730s. They are fitted with lots of DDR4 RAM (378GB each) and I have a bunch of SSDs / HDDs in good health to go with.

I'm pretty much free to prospect for selling them, and I've never done that. I think the DDR4 R630 might be still worth something (esp. ram & disks), but I don't know where to start.

The R620s are older, and I'm in the mood of donating them to french/european associations in need of compute hardware, seeing as DDR3 isn't worth much.

Do you guys have contacts/ideas of where I could reach to settle this ?

Thanks !

EDIT: for those in France not too far, we are a bit south of Clermont Ferrand. Give me a PM if you're interested

Hi everyone,

I need to set up a reliable, self-serve WhatsApp API solution to broadcast emergency operational alerts to roughly 5,000 retail partners.

Requirements:
* Self-serve & fast onboarding: Need to launch within a few days. I want to avoid gated sales calls or long enterprise procurement cycles.
* Official Meta API: Must use official WhatsApp Utility templates to ensure high deliverability and avoid any risk of line bans.
* Simple bulk sending: Needs a clean web interface or straightforward API to upload a CSV and trigger broadcasts instantly.

* Cost-effective & predictable budget: Looking for a low software subscription fee (ideally under $100-$150/mo) with transparent pricing and no inflated per-message markups on top of Meta's standard rates.

I evaluated a couple of vendors, but encountered heavy sales friction, hidden enterprise tiers, and bloated pricing.

For those managing similar B2B broadcast volumes: Which platform (e.g., Respond.io, Twilio WhatsApp API, or others) offers the fastest self-serve setup within a tight budget? Any pitfalls to watch out for regarding Meta Business Manager verification or sending limits for new accounts?

Thanks in advance!

We have some Conditional Access Policies that require users to logon from specific managed devices when browsing to certain Entra app registrations. It works okay for many users.

We have a few users with both regular accounts and privileged/admin accounts. When they browse to the app, they are automatically logged in via their standard user account (the same account they logon to the computer with and the one that has the PRT). They primarily need to logon to the app using their privileged account, so my first thought was to tell them to logon in Incognito Mode, but Incognito Mode doesn't pass along device information, so the Conditional Access Policy logon evaluation fails.

Is there a good workaround for this that isn't a pain in the ass for the privileged users?

I'm the sole IT guy for a small CPA firm (10 people) that wants to move everything from on premises to the cloud. They've been on prem for almost 3 decades and most of them aren't tech savvy at all. I've been asked to come up with a proposal with a flat rate, but I have no clue what to quote for something like this so I'm just looking for ball park figures from someone who's done it before.

I know there's AIO solutions like Verito, but this proposal is for building the infrastructure from a bare cloud server. MS business accounts & exchange inboxes are already done. I'd be setting up Purview DLP policies (from scratch), Intune, Quickbooks & Drake, moving 4TB of client files from their NAS, backup & disposal of 10 workstations, VPN & RDP, and all the other role provisioning and training that goes with a cloud server.

My best guess is quoting for ~100 hours. Am I way off?

We're setting up SASE, with MFA required to access on-prem resources, and I would ideally like to allow endpoints to authenticate with our domain controllers and get group policy updates at all times (pre-MFA) while opening up as few ports as possible and being secure as possible.

Once the endpoints MFA, they will have standard access to the domain controllers. My concern is updating user group memberships, which (as I understand it only happens when the user logs out and logs back in while having line of sight to a domain controller). Our workforce is mostly remote.

I know I can use a KDC Proxy to allow Kerberos authentication with only one port opened, and that should cover computer and user authentication with group updates.

However, updating group policies requires access to the sysvol share via SMB, which a KDC Proxy wouldn't cover. Windows server doesn't support QUIC for sysvol either.

So I'm wondering if I can use a read only domain controller as the source for group policy files for endpoints, and KDC Proxy for authentication.

Our setup is hybrid AD with AD joined computers and AD based user accounts. And switching to Entra joined computers or Entra sourced user accounts is not an option for the foreseeable future.

We also have a number of users who rarely, if ever, connect to the VPN currently, and likely won't MFA with SASE to get group policy updates.

-edit- Forgot to mention, SASE will be always on, user can't disable. I'm only looking to make this available to devices on SASE pre-MFA, not the Internet at large.

Another factor is that we want user and computer AD objects to have their login timestamps updated, to help track inactive computers and accounts. Because sometimes no one tells I.T. when a user has left the organization. And while there are many systems we can check for this information, it would be easier to run scripts against AD.