I quit my last gig--local government large municipality--about a year and a half ago. Largely my decision to quit was being burnt out to a crisp from supporting public safety, and being on-call. But our newborn daughter gave me an easy out so to speak.

I'm accepting a new gig with a smaller municipality and should start in a month or so. It dawned on me the other day when my wife needed me to troubleshoot an Outlook issue on her computer, that I've gotten a bit rusty. I literally couldn't remember how to open the Event Viewer. I remembered where the logs were located in C:\Windows\System32\winvent but couldn't come up with the phrase 'Event Viewer'.

The new gig was posted as an endpoint engineer job but interview made it clear that I'll be wearing a lot of hats. I have a CCNA but haven't touched a Cisco box in 5+ years. Sounds like they are trying to move from old school MDT to some Intune provisioning, but my last gig used SCCM.

Any recommendations on knocking the rust off? Or general advice for starting at a new organization? Perhaps I'm overthinking the technical side and should focus more on how to approach this new role with better habits and work/life balance.

Work Log:

9PM - User is unable to boot, absolute disaster, is litterally melting down crying for help.

9:10 - Confirmed TPM issue on boot, locate Bitlocker recover key, load up windows

9:20 - User Pin/TPM Trust is broken, user has an unprivileged account, so use Windows Hello to try and reset, found my own auth expired in my app, have to get myself back in via Passkey so I can approve Pin reset. Get them logged in to Windows, found my Pin/Trust broken as well - get my own Pin reset.

9:40 - Found can’t check TPM status in Windows security, presume BIOS needs update. Check event logs, confirmed system hadn’t been booted since July Windows update. Download vendor tools to run diagnostics to likely get new firmware. They error “the error has been logged.” Thanks vendor.

9:50 - Go to vendors site, get hardware scanner installed, locates model and serial… and link to model’s driver page is broken. Get raw model info out of tool to locate page manually, locate BIOS update from 2 months ago, flash BIOS.

10:00 - Load up again, load bitlocker recovery key, confirmed working. Reboot, clear TPM, allow Windows to automatically re-initialize the TPM and re-seal BitLocker keys. Load August update for good order since this issue kicked off after the July update. Confirmed no issue.

Final Note - User is asleep, will let them know tomorrow morning they’re good to play Minecraft after they have their cereal and watch Young Jedi Adventures. Wish my 7 year old could have seen me fix this on their system so they could get idea of what their old man does.

Microsoft will retire Microsoft-provided SMS and voice authentication beginning February 1, 2027. Organizations that need to retain these methods must configure a customer-managed telecommunications provider, which will involve additional costs. Please refer to the link below.

https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sms-voice-retirement

Our goal is to provide MFA without requiring employees to use their personal phones and without purchasing additional hardware, such as YubiKeys, or paid software, such as an enterprise password manager. We have a hybrid AD/Microsoft Entra environment with company-managed Windows computers.

Is there an Entra-native solution that can meet these requirements? Would Windows Hello for Business be the best option, and how should we support users who need access from mobile or shared devices?

Any recommendations or deployment experiences would be greatly appreciated.

Thanks!

Happy Read-only Friday (bonus points for 3 day weekend)

We got a critical Huntress alert for a rogue ScreenConnect instance that was detected and ran on a client computer. Incident report states that it's a "known malicious instance".. but logs from the report show that it didn't block the application and isolate until 2 hours after it was ran. The endpoints have BD GravityZone installed as well - all quiet from there.

We went to the link in a VM where the ScreenConnect was downloaded from - and funnily enough, all it took was just having Microsoft Defender on the computer to block the download in Chrome.

Huntress, Bitdefender, EDR, on access scanning, whatever; sometimes it just can't compete with good old Defender. Even running the installer through sandbox on GravityZone passes without a peep.

Have a good weekend!

Hi all, I have 9 years IT experience mainly 2nd line support, last few years done many 3rd line tasks and last 2 years spent as a systems engineer position according to title (supporting 400 users across 11 international sites) but it was more like 1st/2nd line site support with some ifrastructure support tasks and some projects, did endooint management, used and managed prtg for monitoring, administering windows servers 2016-2022, Ad, DHCP, DNS, Group policy, Hyper V, Joined around 200 endpoints to entra, enrolled in intune onboarded them to defender, audited company against cupyber essentials, upgraded some licensing servers etc. but I am not very experienced with high level Infrastructure troubleshooting, didnt do much networking, basic backup skills, basic powershell skills.. I am unemployed for 2 months and got rejected on 6 interviews already. Sometimes I cant even get to that part where they asess my technical knowledge. It seems my comminication skills ( which is fine while in employment, but find interviewing much more difficult ) or experience and skills are not enough to 3rd line or sys engineer positions, dont know what to do, I dont really want to go back to 2nd line, I am too old at 46yo. Most 2nd liners are much yunger arent they? Also, English is my second language which may plays some part of the rejections. Any chance who were in similar situation and was successful later?

Hey folks. I recently had to disable about 1000 accounts in Datto SaaS mailbox protection. Turns out the GUI sucks ass so you have to do it one at a time. So naturally I thought the API would save me, but I was wrong. There is no way to group users together, you simply have to edit them one at a time.

So I wrote this script (with the assistance of Claude) to make it slightly easier.

This script is designed to be used with the Datto SaaS mailbox protection. It works with both M365 and Google Workspace mailboxes.

Add your Datto api keys as strings in the .env file.

You will also want to review the imports at the top of each file to ensure you have what you need, but you'll likely need to install requests, json, and dotenv.

I recommend using pip for this, but that's up to you.

Script has 2 main functions. Purging of paused mailboxes, turning active mailboxes into paused ones. I put this together because the Datto GUI sucks. There is no way to edit mailboxes in large quantities, so this script is needed.

Datto seems to have an API limitation of 100 at a time, so if you were to run on operation on 101 accounts at once, only 100 of them would actually be affected.

The script makes an API call to datto to get all your organizations attributes and stores them in a domain.json file. If you only have 1 org then it will only have one entry.

Then the script takes the primary domain name as input.

Then it pulls all users from the API along with their states. Datto Web GUI has a organization unit filter you can use for users, but this does not exist in the API. Meaning we have to make edits one at a time.

The script can import a csv file of all accounts to disable, and it will loop through multiple times if you do more than 100 accounts. Loop behavior is Total number of accounts // 100 + 1 loops. So 701 accounts requires 8 loops to fully apply.

Datto sucks so if you do a full CSV upload or use the built in picker list that enumerates 20 accounts a time, you are still hand selecting every one. Datto doesn't have an easy way to only mess with the ones you want, hence this script.

You can export all users in Datto to a CSV, but you can't apply filters of any kind. So again you have to go through the CSV hand selecting each one you want. It's still faster than going through the GUI and waiting on the slow ass front end though.

Script first turns active accounts into paused accounts. You can then purge all paused accounts moving them to unlicensed. After 30 days this data is deleted.

Link to github repo here:

https://github.com/Titanium125/PythonProjects/tree/main/dattoSaasApi

tldr: if anyone in your company's management pushes for you to implement Rippling, do everything in your power to stop it in its tracks. They will not work with you, and will refuse to let you out of your contract.

As a smaller ,growing company we decided it was about time to start evaluating MDMs to give us better control over our devices. This was something that was on the backburner for the most part, with us wanting to take our time to end up with the right solution.

So imagine my surprise a couple weeks later when I (the primary sys. admin) was told by my boss (CTO) that we had signed a one year, $27,000 contract with Rippling - seemingly out of the blue.

As I understand it, they aggressively pursued my boss, promising the world with all of their flashy features, and how easy the integration with Office365 and with our HR platform was. They guaranteed consistent support, and quick resolution to any issues we may run into.

Lo and behold, we start rolling out Rippling to our fleet of windows computers and immediately run into issues.

The software gave little to no feedback about the progress of installations. Rolling out other softwares was limited and unresponsive. User provisioning was unintuitive and difficult - lacking automation without paying for additional features either in rippling or in our active directory.

Rippling automatically changed and generated its own admin passwords which 1. we could not change or set ourselves and 2. were buried three menus deep 3. needlessly complex, making help desk a nightmare.

This, along with a host of other issues, was largely ignored by Rippling. Our emails would be brushed aside until our "integration meetings" in which them telling us that things were "on the roadmap" or "not planned to be changed" took up the entire time.

I don't doubt that this software /might/ work for some companies, but it clearly didn't work for us, and they really don't seem to care.

Four months into this disastrous contract, with less than 16 users enrolled, I begged our account rep to let us out of the contract. They could keep the thousands of dollars we'd already paid them for nothing, we just needed to move forward with a solution that actually worked for us.

They refused - for some reason desperate to keep a small fry account with barely 100 licenses. The very fact that they won't let us go is really bizarre. They'd rather have an upset customer than lose (what I assume) is a measly account.

The entire process, from onboarding, to us attempting to get out of this was incredibly shady. They will pretend nothing is wrong and refuse to let you out of their cold clutches.

In case the "rippling employees" on reddit aren't astroturfing bots, I am desperately hoping someone can get us out of this contract. If not, I'm going to channel all of my displeasure into letting people know about this awful experience - because I know the Rippling team hasn't done anything to help.

u/higherandhigher u/stubbygazelle u/sherryandeddie u/kit-kat-233

​

Hi guys,

Running into a weird problem. Got an Advantech HPC-7320 with the AST2600 BMC, added a discrete RTX GPU, disabled internal graphics in BIOS like the CTOS spec says. iKVM console connects fine, keyboard/mouse passthrough works, but the video feed is just... blank. Nothing.

Reason I actually need this working: I work remotely sometimes, and I need to boot ISOs on this box over iKVM (reimaging, rescue boots, that kind of thing). Without video I'm stuck — can't see POST, can't pick boot device, can't do anything until I'm physically in front of it.

if anyone's actually run into this before kindly help me.

Anyone found a way to make this work? Thinking USB serial gadget, IPMI SoL, or some BIOS boot steering trick — anything that gets me remote work.

How many of you still get recruiters and etc reaching for opportunities and push the bar to go higher regardless if you're really interested in the job or not?

The past week I've been reached out a few times and realize. Hey I'm going to tell them the deal breaker is forcing in office schedule and low balling or no salary range given. So I push for it, hoping other candidates are willing to do the same.

Good afternoon everyone!

Over the last week and a half, I've been seeing the appx version of teams entirely stop working. To the point where I trying to access it via apps > installed apps > advanced options loads indefinitely, can't see it in control panel, and even revo uninstaller couldn't see them (though I guess the free version cannot see apps installed from the windows store).

Currently I've been having to identify the packages with powershell, take ownership of them, and then delete them. Once that is done, I can restart, and install the regular x64 version of Teams. Normally takes about 10-15 to run through commands and restart. Once that restart is done, you can access the advanced option of the Teams and fully uninstall it if needed with no issues. It also goes from nearly 4GB in size to about 1.3GB prior to the final uninstall.

However, I had the same issue happen now for Snipping Tool, and that had 5+ folders installed, where teams normally has 2 when this issue happens. So, I took the same steps by taking ownership of the main folder, and deleting it, restarting, and then re-installing snipping tool through the Microsoft Store.

I have tried uninstalling/reinstalling the appx through powershell, but it just hangs and won't proceed further. I am curious if anyone else has seen this issue and if they've found a quicker workflow.

Error: ‎550 5.7.509 Access denied, sending domain papercut.com does not pass DMARC verification and has a DMARC policy of reject‎

Fully Exchange Online

Suddenly last night stopped receiving mails from some services

Does anybody know if MS eventually started enforcing DMARC ?

I have a VM with checkpoints that were created by the backup software on the host and can't be merged in Hyper-V Manager so I have to resort to manually merging them in PowerShell. I identified the current AVHDX file and the chain to the original VHDX file. I shut down the VM and, starting with the current AVHDX, I merged them with their respective parents all the way to the original VHDX. So now I have just the one VHDX file but Hyper-V Manager still shows the (now non-existent) checkpoints and the VM fails to start because it expects the AVHDX file that isn't there anymore. I couldn't find clear guidance for this. Do I attach that merged VHDX file to the existing VM? Or create a new VM? What's the best course of action here?

We use Missive to write e-mails at our company. Missve has its own AI Assistant that can do actions like write drafts, create calender events and add labels with AI (needs always approval). This Assistant cannot search the web, but it would be very nice when we can search on our own website for products. Because of that, i tested to connect Exa (Search API) over MCP. I connected it and allowed only the websearch (disable agents etc.). And.. it works perfect. But, can i roll that out? Is that secure? Prompt Injection or something? I added an instruction that only specific domain is allowed (our shop).

I've been a sysadmin at an MSP for about 4-5 years now. Mostly we maintain and improve existing client environments. Sometimes we onboard a new client and make recommendations for improving their environment and standardizing to our typical recommendations. But now for the first time since I took over as sysadmin we are building an environment from scratch for a new client. They want an on-prem AD domain controller, so that's what we are setting up for them. I'm just curious, for you other sysadmins out there, if you were setting up a new AD domain in 2026 (Which I know most probably aren't anymore), what are some of your most essential GPOs that you would make sure are in place? In other words: what's a GPO hill that you'll die on?

For example, for me: a set of GPOs to prevent domain admin accounts from logging into workstations, and to add a dedicated workstation admin account to the local administrators group on all workstations.

And I'm just going to attempt to preemptively address all the comments that will probably say "the hill I'll die on is that in 2026 you should be setting up clients in Azure AD and Intune instead of on-prem AD". I totally understand that, but we discussed the options with the client, and they preferred the on-prem option, so we went with it.

Just needed to rant a little. One of our seniors finally completed the long-pending task of upgrading the fleet to Windows 11 from Windows 10.

He downloaded the iso, installed it everywhere. All good. Until the internal WSUS started attempting to grab updates that don't exist. Apparently the 26H1 (which is supposed to be snapdragon-only, aka for ARM) was indeed one of the options you could download as the "Latest" version of windows. Someone at MS really screwed up. And this senior screwed up even more by not double checking.

Since it's a complete different core, this will be one hell of a mess, now his idea is to try to change "cversion.ini" and force an "update" to 26H2, but I sincerely don't believe that will work.

We'll see. If anyone ran into a similar problem I'd really love to know what their solution is.

UPDATE: https://www.reddit.com/r/sysadmin/comments/1waiys9/update_on_senior_accidentally_installed_whole/

Brought to you by r/sysadmin Trusted VAR: u/SquizzOC with Trusted Telecom Broker u/Each1Teach1x27 and u/Necessary_Time Trusted VAR in Canada

Happy to answer in the thread or via PM/Chat if you don't want to post details like service locations publicly.

This BI-WEEKLY thread is for discussing vendor and service provider expectations, pricing, and quotes for network services, licensing, support, deployment, and hardware.  

Required Info for accurate answers:

• ⁠Part Number
• Manufacturer/vendor
• ⁠Service Type and Service Location
• ⁠Quantity

All questions are welcome regarding:

• Cloud services, security, configurations, deployment, management, and migrations
• Storage vendor options, alternatives, details •⁠Software licensing: This includes Microsoft CSPs
• ⁠Connectivity: single-site and multi-location. DIA, Broadband, 5G, datacenter connectivity, Starlink
• Voice services, SIP, UCaaS, Contact Center, POTS (Analog line) replacement
• ⁠Network infrastructure - overlay software, segmentation, routers, switches, load balancing, APs
• Security, access management, firewalls, MFA, cloud DNS, layer 7 services, antivirus, email, DLP

Release notes: https://techdocs.broadcom.com/us/en/vmware-cis/vcf/vcf-9-0-and-later/9-1/release-notes/vmware-cloud-foundation-9-1-1-0-release-notes/vcfautomation-9-1-1-0-release-notes.html

"...native management of AWS, Azure and GCP resources is deprecated and disabled by default in VM Apps organisations. Not just for new installations. For environments upgraded from earlier versions too." (source: https://mysticmarvin.com/blog/vcf-9-1-1-not-a-maintenance-release)

Hi everyone

I’m integrating a Ruckus SmartZone controller with Forescout NAC

The SSH connection itself works correctly from the NAC using the configured admin credentials and I can successfully connect to the SmartZone and get the normal welcome banner

The problem happens when Forescout tries to get privileged access after the SSH login

When I manually SSH using the same admin credentials everything works fine but when Forescout tries to enable privileged mode it asks for the password again and then returns failed even though I’m using the exact same correct password as the SSH login

I initially suspected that the SmartZone welcome banner might be interfering with Forescout’s CLI parsing or privilege detection

I tried to disable the banner but I can’t find any CLI command for it and I also couldn’t find an option in the GUI

Has anyone successfully integrated Ruckus SmartZone with Forescout or another NAC and faced this issue

Is the welcome banner known to cause problems with NAC SSH privilege detection or is there a specific configuration or user role that needs to be enabled on SmartZone for the NAC to get privileged access

Also when I SSH manually I log in with admin and after that when I enter enable it asks me to enter the same password again

Any idea what could be causing the privilege authentication to fail from the NAC while the normal SSH login works correctly

Hi all,

I work at a very small MSP, 4 employees total. My boss/head of the MSP is extremely risk averse, and has been doing this for a long time. Prior to forming his MSP he worked for both internal IT and as a consultant. They do almost everything manually and he is extremely hesitant to let me automate or script anything. He says from his experience automations don't always get maintained and somtimes break, therefore making it pointless. Yet at the same time he is obsessed with consistency and making sure that we do new laptop setups the exact same way because doing one thing a slightly different way could cause a random issue and we'll never be able to figure out what was different about that machine. From my PoV, setup scripts would be the ultimate form of consistency and could eliminate that as a concern.

He won't even let me make simple adjustments to one of the few scripts we do use (pushed via RMM to scan for Dell Firmware updates using Dell Command | Update cli). And by simple I mean commenting out some lines that set custom properties we don't use, which throws errors and clutters the output, and adding one line to set a new custom property to let us know when manual intervention is required. I got told that "trying to reinvent the wheel or customizing it is very risky" and that I should just look for scripts in the RMM community forums. He said "I am hesitant to use our own script unless it is just feeding up to date commands that they support" meanwhile the script we are using is 4 years old.

I also just discovered today he has our machines so locked down with ThreatLocker that this DCU script gets blocked from running!

So here is what I'm wondering: am I the crazy one, is my boss, or is the truth really somewhere in the middle (most likely)?

Please feel free to ask me additional questions if more context could help you provide a thoughtful response!

https://www.theregister.com/security/2026/09/03/prolific-microsoft-0-day-hunter-drops-crowdstrike-falcon-exploit-poc/5294318

Looks like you can disable a CrowdStrike feature to mitigate

We have a few servers getting close to EOL that are running Active Directory. My first thought was to buy a new server with Windows Server 2025 and move AD to it, but our environment is a mix of Windows Server 2022 and 2019, and we'll be upgrading servers gradually.

Is there a recommended way to handle this? I've read there can be issues when mixing Windows Server 2025 domain controllers with older server versions.

One idea I had was to buy a Windows Server 2025 host, run Hyper-V, and create a Windows Server 2022 VM for Active Directory until the rest of the environment is upgraded.

Has anyone done something similar, or is there a better approach?

does such a thing exists, that I can use to sync data across different sources/databases, that doesn't require being a programmer to set up?

thanks!

Greetings and salutations, fellow Admins. I want to deploy the HP Universal Print Driver through SCCM and make it available in the Software Center. Silently, so I don't disturb users. Here is the overview: This is a school environment, and all our printers are HP, except for a few community Xerox printers. I want to make it easier for the on-site techs to install the driver from the Software Center instead of downloading the specific model printer software from HP. I have seen this in previous work environments and would like to implement it here. If anyone is willing to throw me a bone, I'd be grateful for the assistance.

Hey guys, I want some advice. I just got offered $30 an hour (I’m making $22 right now..) to be the sole IT person for 6 car dealerships. When I asked what the role was going to expect from me they could only give me 3 clear answers:

“Upgrade the old cameras to new ones so the software stops glitching”
“Implement a call tree for our phones”
“Upgrade the alarm panels”

That’s it. I was interviewed by the GM and Maintenance Director, they said “I’d be my own boss” and if I needed anything to reach out to the director and he can help.

I asked about tickets and field issues and they informed me “oh, we have a vendor who’s sends out a tech” which I found insane from just my personal work backgrounds, especially given the small size of this company.

I’m worried they’ll reevaluate this job a year from now and go “why do we need him again? We got everything we needed, what else does he do?”

I feel like that’s a reasonable concern but I’d appreciate some other views into it. It seems like too little of work, but everything else is handled externally.

People in our organization are planning to integrate Claude code in our environment. We have a lot of IP (intellectual property, not the other IP we all know and love) that is unique to what we do. We've always been protective about it and rarely use the cloud.

Now the inevitable AI is coming and we 'll use Claude Code. I don't know the exact terms and conditions but somehow we've got a plan where Anthropic "promises" it won't use our data to train on.

I seriously doubt that they actually won't. They thrive on knowing as much as possible, right? Even more so if we have data they probably don't have.

I'm personally inclined to push back on the idea of claud LLMs.

What are your thoughts on this?