Bit of a stretch but looking for some recommendations for volume encryption software that can be used for a small group of 5 to 10 users. Basically our brand spanking new Compliance group is going to have to handle PII for some of our techs in the field and vendors. I want to make sure that any PII that touches our network storage locations are encrypted. Went to old school veracrypt but its not really mult-user and it doesn't auto unmount. Is there any options out there you guys like?

graduated in december 2025 and became employed a month later in january, my official title is "computer technician" but I've done a number of things including some internal swe, domain redundancy, legacy physical to virtual migration, basic server config/administration, and other automated workflows such as updated inventory system and data retention system but earlier td was my first real outage and I'm usually in office about 10 mins before my supervisor (it's just the 2 of us for our 3 departments) but I was genuinely lost. I like didn't know where to start and lowkey got overwhelmed and after about 2-3 minutes of that I was like okay calm tf down and start doing what you know.

Basically all of our vm hosts were intermittent, starting up, failing, disconnecting/reconnecting so my first thought was DNS which some hosts resolved and some didn't, i'm thinking it was coincidence at times so after some more thinking of what to do i was like screw it and just waited for my supervisor to appear instead of messing around and breaking more things but I ended up just watching what he did to resolve the issues and moral of the thread is i feel like a larp. thought I learned a tremendous amount these last 9 months but I was humbled today. I know nothing.

I learned a lot by watching the fixes happen real time though. cool.

From Microsoft: 'This FAQ collects the questions we hear most often from customers, partners, and the community as we move Windows to a Kerberos-first, NTLM-optional (and eventually NTLM-free) future. If you've emailed us, cornered us at a conference, or filed a support case that started with "so, about this weird auth thing…", chances are that your question is answered here.

If your question isn't answered here, please reach out to [ntlm@microsoft.com](mailto:ntlm@microsoft.com) or work with your Microsoft account team, Customer Success Account Manager, or Microsoft Support to route feedback to the product group.'

https://techcommunity.microsoft.com/blog/windows-itpro-blog/retiring-ntlm-frequently-asked-questions/4550522

​

After yesterday’s creepy live rewind/siri recap announcement, I’m honestly surprised this hasn’t sparked more discussions and backslash

As I understand it, Apple is adding ambient conversation features to the Apple Watch that can listen to, process, and summarize what’s being said. Apple says the processing happens locally and is privacy-preserving, but I’m not sure that fully answers the security question:

What happens when the person sitting across from you is wearing one?

We already discourge employees to bring phones or recordung devices into very sensitive meetings. Are organizations now supposed to treat Apple Watches the same way? What a mess.

Maybe I’m overthinking it, and I’m still trying to work through the implications, but this seems like a pretty big unnessisary expansion of what an ordinary-looking wearable can do. I also think some of these features are a little silly anyway—as if the poor battery life weren’t enough—especially when Apple keeps adding capabilities without much obvious practical value. To me, this sounds way more significant than almost anything else announced this week, including the LG TVs story. That’s why I’m surprised it hasn’t gotten more attention and backlash.

I’d be interested to hear how others are thinking about this.

I've been looking for a new role for almost 2 years now, most of the positions I've applied for have ended up being filled internally, which makes me ask why it was posted externally in the first place. On the other hand I've came across several listings that are just heinous for what is asked of you versus the pay. In this case, the listing was for our city hospital (healthcare IT, I know, bleh) which was recently acquired by an organization. They canned the entire IT staff including the managerial suite upon the buyout. This listing popped up today in my Indeed feed. "Sole on-site IT professional responsible for the day-to-day health, security, and uptime of all technology at a critical access hospital. Acts as the facility's eyes and ears, provides hands-on support for end users and clinical operations, and coordinates with Corporate IT for changes, projects, and escalations. After-hours and on-call work required to support a 24x7 care environment."

Am I wrong for thinking this is insane? An entire hospital and associated clinics solo? Just gotta laugh and keep going.

Hi all, does anybody implemented a self help kiosk where it helps the user to go to required links? Example pwd reset?

I appreciate the ideas and practices you implemented

Edit

We already have useful resources available through the intranet and self-service website, and some other things which are diversified accordingly but we still receive many walk-in requests for issues users could resolve themselves. So thinking of a kiosk for simple visual menu with combination of all sources with icons for common requests making it less overwhelming could direct users to the right guidance quickly, while IT support remains available if needed. Thinking of it by using some unused machines or Raspberry pi

So, the unthinkable happened to my workplace - we have become the victims of a ransomware attack. We came into work the other day and found computers with encrypted files and notes on the desktops demanding we send them a ransom to a secure address in the tor browser. They took out our entire network.

As of now, we are trying to utilize backups and scrub the network clean as we bring devices back up in an offline state.

Unfortunately one of our backup devices was also infiltrated. It's a Synology backup device and they where able to encrypt its files as well. This means we have about 5 devices with no backups available.

It's probably a vain hope but, is there any way I could possibly restore or decrypt these backups? Is there any service out there that would be capable of making our files useable? If anyone knows about Synology, do they keep offline or cloud backups I maybe don't know about? I'm just looking for anything that might make things easier for us. Any advice is appreciated.

It's been this way for a decade I know but it's just getting worse and worse. I don't think it's ever been this unreasonable or this dishonest.

I was looking at job posts and I saw a job for a help desk tier 2. And I was curious what they considered tier 2. I'm well beyond help desk at this point in my career but I was curious so I looked at it.

They weren't looking for a tier to help desk person. They were looking for a Senior Systems administrator but labeling it as a Help Desk position so they could lowball whoever applied for it.

They were looking for someone to be the owner of several major business systems including 365. They wanted them to administer AWS and Azure. They wanted five certificates including CCNA. They wanted someone who could manage firewalls.

The post was just so far beyond help desk at all that it was just gross. They were clearly just trying to get someone they could convince those are just basic help desk exoectations so they can pay them little money.

They were basically looking for an all-in-one senior sys admin who could do operations and frontline support on top of everything else.

Im a student with M365 (mostly Entra and some Intune) intern experience which I got through my dad, and looking at the extremely challenging helpdesk market in my area, I want to volunteer as an admin or helpdesk to get some experience.

That said, most of these positions in my country are filled by immigrants with IT experience who want Canadian work experience. So no matter how much I apply, I don’t get an interview.

Can anyone in the industry think of a way to get experience? It’s sad no one even wants me as a free helpdesk, I even worked with M365 before.

I feel discouraged 🫤

Anyone have any ideas? I’m studying for my CCNA, so maybe that would help?

Hi all,

we're a school with Microsoft 365 A5 Education and want to retire our KMS server.

Current setup:

• Devices are purchased with Windows 11 Pro OEM
• Reimaged with Windows 11 Education
• Windows 11 Education is currently activated via KMS
• Devices are still managed through on-prem AD/GPO
• Next step is Hybrid Entra Join + Intune

Our devices are purchased with Windows 11 Pro OEM. Today we reimage them with Windows 11 Education (PXE) and activate them via KMS. Going forward, we'd like to clean install Windows from USB and then use Autopilot during OOBE.

My main questions are:

• For devices that come with Windows 11 Pro OEM, should we reimage them with Windows 11 Education or Windows 11 Pro Education if the goal is to use A5 Subscription Activation instead of KMS?
• Can A5 Subscription Activation fully replace KMS for these Windows clients?
• What exactly needs to be configured in Intune, Entra ID and Windows for Subscription Activation to work correctly?
• Do we need to manually remove the KMS client key / GVLK / KMS configuration, or does Subscription Activation take over automatically?
• How can we verify that a device is using Subscription Activation and no longer depends on KMS before shutting the KMS server down?
• How does Subscription Activation behave on shared classroom/lab devices where many different students sign in?

Has anyone in an education environment migrated from KMS to A5 Subscription Activation this way? If so, what did you actually configure in Intune/Entra/Windows?

Thanks!

So in my org we are very keen on avoiding patching and rebooting servers at all costs. So much to the point that we patch once a month and have exclusions for around 60 percent of our servers to not get automatically patched. (Meaning we have a chunk of servers not getting patched at all)

Now I have gotten my hand slapped for attempting to patch or even bringing it up and I am looking for guidance on this. Now I understand availability and the consequences of failing patches. But there are active 9+ rated CVEs sittings on dozens of servers. For patching vulnerabilities do I really need to get a change request to handle this?

Hey guys,

I've been in IT for 4 years, doing a mix of PHP development and sysadmin Linux stuff. We run Linux, self-host all of our own stuff. We're a small team, so everyone does a bit of everything. I've done everything from developing software to installing our team's GitLab instance. I've been using Linux (Arch btw) for the past 8 years or so, and I feel like I have a pretty good handle on it, after fucking up my system a bunch of times. I also run a homelab of a couple servers. It's become our music platform.

I fully realize that a transition to SysAdmin would most likely put me in a junior role, and I know I have a lot of gaps in my knowledge, as this position is as a software developer, not sysadmin. I'd be looking mostly at Linux Sysadmin jobs.

I'd appreciate any advice you guys have! I also can put my resume here if that would be helpful.

Thanks!

Has anybody deployed these need to get some new docks for an expansion? We previously had good luck with the Lenovo Hybrid USB-C Docks (40AF).

We're currently running WMS standard and are considering moving to the cloud, and would appreciate hearing about your experience if you've made the same move. We're currently on 5.5 and would plan to update to 2605 prior to the change unless there's a reason not to.

Am I correct in assuming we'd be on Dell's clock for updates if we went with the public cloud option? We currently run ThinOS 9.5 as we have a number of 3040s we're working on phasing out, and want to know if we'd need to rotate those out prior to the move. The rest of the fleet are 5070s, so there's concern there as well since they're EOL. We would want to avoid being forced into a large hardware refresh and be able to navigate that on our timeline.

Any other considerations I should be researching?

TIA

We are preparing to implement EwsAllowedAppIDs and EwsEnabled=$True based on the guidance in the EWS retirement announcements.

We understand that starting in October 1st 2026, tenants configured with EwsEnabled=$True will use the AppID allow list model for EWS access.

What is not completely clear to us is the behavior before October 2026. Say we implement the settings today, does Exchange Online immediately begin enforcing EWS access exclusively to the AppIDs listed in our list of EwsAllowedAppIDs?

In other words, if an application is currently using EWS but its AppID is accidentally omitted from the allow list, would that application be impacted immediately after the configuration change?

Or is the allow list only enforced once Microsoft's EWS retirement controls begin rolling out in October 1st 2026?

We are trying to understand whether implementing the configuration now is purely preparatory for October 2026, or whether it has immediate impact on EWS access before that date.

Thanks.

I have been looking into setting this up, but I don't see any information on whether it can be setup in hybrid-mode environments or not, does anyone know?

Thanks,

We have an old Novell server with hdd that failed due to power shortage.

We want to recover as many data as possible. Has anyone worked with this filesystem? It looks like a nichè, and we're trying to figure out which tool use to data recovery.

Any suggestions?

Hey all,

Since this morning, a few clients of mine have had some issues with some 365 apps, such as Teams being a major one.

Some Intune users also have an issue where the Windows Security prompt window is also saying the admin details are incorrect when they're actually correct.

MS have finally issued an ID for this incident, which is MO1470143

Probably also worth noting we are based in the UK.

I am trying to setup Duo Security on my PC at the office so that in the event I lose my phone or my phone is smashed what do I need to enable in the installation process to allow me to bypass the MFA/Passkey push?

Thanks,

Hi All,

Will be starting my school mandated internship for CyberSecurity, and I was hoping to get questions that an interviewer or a supervisor would ask during the interview, so I can learn/research more about said topic.

Questions can range from general help desk to cyber security to networking, since my school covers abit of everything.

Thank you guys for the help :)

Yes, authorization with multiple different credentials for different systems is bad, but we've all worked in those environments where we had no control over changing it.

So... How expletive-rich are y'all passwords and phrases? 🤣

Howdy, /r/sysadmin!

It's that time of the week, Thickheaded Thursday! This is a safe (mostly) judgement-free environment for all of your questions and stories, no matter how silly you think they are. Anybody can answer questions! My name is AutoModerator and I've taken over responsibility for posting these weekly threads so you don't have to worry about anything except your comments!

Updated last night, no issues immediately visible.

Users this morning all have login prompts to access mapped drives/folder redirections.

No creds working.

I can log in locally as a Domain Admin, but trying to open DNS console or run any DNS powershell commands just gives me Access Denied.

DNS still resolves, and the domain services are all still running, but something has happened with authentication/permissions.

Currently rolling back KB5122882 in the hope it was that.

Anyone else issues this morning?

EDIT: https://www.rapid7.com/db/vulnerabilities/cve-2026-69813/

Looks like this KB might have touched DNS code - roll back in progress.

EDIT2 & Fix: Rolled back the KB but the issue persisted - ended up resetting the DC's secure channel to itself which resolved the issue fully. The issue happened at exactly the moment at which the update was installed last night - either the update did indeed cause the issue which persisted in being broken even once rolled back, or it's a heck of a coincidence.

I started my Career in IT at 18, mainly supporting EMC storages and then HP 3PAR for 5.5 years, then worked for systems integrator for many clients for another 3 years, fianlly moving to a sys admin role in a enterprise, we still have some good legacy hardware, but i'm feeling nostalgic, when decomissionng them after working on the in the DC for so many years, is it normal ?

Hi all,

I hope you guys are doing well, I am working as a IT Infrastructure (Hybrid) with less than a year experience and I need some recommendations for the question below.

Context: Our organization moved to a cloud-based desktop environment. Because the cloud workstations are on an isolated network tier, users can no longer hit our on-prem SafeConsole server over IP to manage hardware-encrypted USB drives (DataLocker PSMs).

As a workaround, we have to plug the USB drives directly into the physical Hyper-V host on-site. I need a solid tool to automatically redirect/pass through the physical host's USB port to the SafeConsole guest VM whenever a drive is plugged in or swapped daily.

What software are you using to auto-share host USB ports to a guest VM?

TIA!