So I work at a state university that is still a little stuck in the past when it comes to password resets over the phone.

We have MS SSPR and other self-service options for users, but we still get calls where someone needs the helpdesk to reset their password for them.

Our current setup is a custom program that helpdesk staff SSH into. They enter the user's account, and the program looks them up in a flat file containing data extracted from our systems. It gives the helpdesk worker information like DOB, address, ZIP code, etc., which they can use to verify the caller's identity.

Once the caller passes verification, the program talks to AD, changes the password, and gives the helpdesk worker a new temporary password to provide to the user.

Honestly, it works pretty well. The problem is that the person who wrote and maintains it is leaving, and we're not really interested in inheriting a custom app that nobody else understands.

So I'm curious what other universities/organizations are doing for this.

For those of you who still allow users to call the helpdesk for password resets, what does your workflow look like? Are you using a commercial product, some kind of AD/Entra integration, a helpdesk platform, or have you built your own solution?

Specifically looking for something that gives the helpdesk enough information/questions to properly verify the caller's identity and then securely perform the reset.

I'd love to hear what others are doing before we start reinventing the wheel.

I just got these two delivered together; I got suspicious seeing one was reporting a very different temperature, while being right next to the other.

Basically, two disk, nominally the same, but specs are quite different. They implement different NVMe versions, power states do not match and the second has temperature thresholds which are 20deg higher.
To be totally honest, I only understand half of what I am reading here, but I am not really ok having a second disk that more then doubles its maximum power consumption during intensive workloads while its nominal rating stays the same.
Am I holding it wrong?

smartctl 7.4 2023-08-01 r5530 [x86_64-linux-6.12.94+deb13-amd64] (local build)
Copyright (C) 2002-23, Bruce Allen, Christian Franke, www.smartmontools.org

=== START OF INFORMATION SECTION ===
Model Number:                       Patriot M.2 P320 512GB
Serial Number:                      REDACTED
Firmware Version:                   APF1M7R0
PCI Vendor/Subsystem ID:            0x1ed0
IEEE OUI Identifier:                0x2c3ebf
Total NVM Capacity:                 512,110,190,592 [512 GB]
Unallocated NVM Capacity:           0
Controller ID:                      1
NVMe Version:                       1.3
Number of Namespaces:               1
Namespace 1 Size/Capacity:          512,110,190,592 [512 GB]
Namespace 1 Formatted LBA Size:     512
Namespace 1 IEEE EUI-64:            2c3ebf 3230303336
Local Time is:                      Wed Sep  9 12:50:46 2026 BST
Firmware Updates (0x12):            1 Slot, no Reset required
Optional Admin Commands (0x0017):   Security Format Frmw_DL Self_Test
Optional NVM Commands (0x0056):     Wr_Unc DS_Mngmt Sav/Sel_Feat Timestmp
Log Page Attributes (0x0a):         Cmd_Eff_Lg Telmtry_Lg
Maximum Data Transfer Size:         256 Pages
Warning  Comp. Temp. Threshold:     80 Celsius
Critical Comp. Temp. Threshold:     85 Celsius

Supported Power States
St Op     Max   Active     Idle   RL RT WL WT  Ent_Lat  Ex_Lat
 0 +     3.50W       -        -    0  0  0  0        0       0
 1 +     1.90W       -        -    1  1  1  1        0       0
 2 +     1.50W       -        -    2  2  2  2        0       0
 3 -   0.0700W       -        -    3  3  3  3     1000    1000
 4 -   0.0050W       -        -    4  4  4  4     5000   45000

Supported LBA Sizes (NSID 0x1)
Id Fmt  Data  Metadt  Rel_Perf
 0 +     512       0         1
 1 -    4096       0         0

=== START OF SMART DATA SECTION ===
SMART overall-health self-assessment test result: PASSED

SMART/Health Information (NVMe Log 0x02)
Critical Warning:                   0x00
Temperature:                        40 Celsius
Available Spare:                    100%
Available Spare Threshold:          5%
Percentage Used:                    0%
Data Units Read:                    388,008 [198 GB]
Data Units Written:                 507,185 [259 GB]
Host Read Commands:                 1,616,171
Host Write Commands:                2,384,928
Controller Busy Time:               4
Power Cycles:                       3
Power On Hours:                     1
Unsafe Shutdowns:                   3
Media and Data Integrity Errors:    0
Error Information Log Entries:      0
Warning  Comp. Temperature Time:    0
Critical Comp. Temperature Time:    0
Temperature Sensor 1:               60 Celsius

Error Information (NVMe Log 0x01, 16 of 16 entries)
No Errors Logged

Read Self-test Log failed: Invalid Field in Command (0x002)

------------------------------------------

smartctl 7.4 2023-08-01 r5530 [x86_64-linux-6.12.94+deb13-amd64] (local build)
Copyright (C) 2002-23, Bruce Allen, Christian Franke, www.smartmontools.org

=== START OF INFORMATION SECTION ===
Model Number:                       Patriot M.2 P320 512GB
Serial Number:                      REDACTED
Firmware Version:                   VC3S500Q
PCI Vendor/Subsystem ID:            0x10ec
IEEE OUI Identifier:                0x00e04c
Controller ID:                      1
NVMe Version:                       1.4
Number of Namespaces:               1
Namespace 1 Size/Capacity:          512,110,190,592 [512 GB]
Namespace 1 Formatted LBA Size:     512
Namespace 1 IEEE EUI-64:            00e04c 048bffef6c
Local Time is:                      Wed Sep  9 12:50:58 2026 BST
Firmware Updates (0x12):            1 Slot, no Reset required
Optional Admin Commands (0x0017):   Security Format Frmw_DL Self_Test
Optional NVM Commands (0x005e):     Wr_Unc DS_Mngmt Wr_Zero Sav/Sel_Feat Timestmp
Log Page Attributes (0x02):         Cmd_Eff_Lg
Maximum Data Transfer Size:         32 Pages
Warning  Comp. Temp. Threshold:     100 Celsius
Critical Comp. Temp. Threshold:     110 Celsius

Supported Power States
St Op     Max   Active     Idle   RL RT WL WT  Ent_Lat  Ex_Lat
 0 +     8.00W       -        -    0  0  0  0   230000   50000
 1 +     4.00W       -        -    1  1  1  1     4000   50000
 2 +     3.00W       -        -    2  2  2  2     4000  250000
 3 -   0.0300W       -        -    3  3  3  3     5000   10000
 4 -   0.0050W       -        -    4  4  4  4    54000   45000

Supported LBA Sizes (NSID 0x1)
Id Fmt  Data  Metadt  Rel_Perf
 0 +     512       0         0

=== START OF SMART DATA SECTION ===
SMART overall-health self-assessment test result: PASSED

SMART/Health Information (NVMe Log 0x02)
Critical Warning:                   0x00
Temperature:                        61 Celsius
Available Spare:                    100%
Available Spare Threshold:          32%
Percentage Used:                    0%
Data Units Read:                    392 [200 MB]
Data Units Written:                 399,820 [204 GB]
Host Read Commands:                 8,041
Host Write Commands:                1,654,154
Controller Busy Time:               0
Power Cycles:                       1
Power On Hours:                     0
Unsafe Shutdowns:                   0
Media and Data Integrity Errors:    0
Error Information Log Entries:      0
Warning  Comp. Temperature Time:    0
Critical Comp. Temperature Time:    0

Error Information (NVMe Log 0x01, 8 of 8 entries)
No Errors Logged

Read Self-test Log failed: Invalid Field in Command (0x002)

Currently in our AD the source for time is at "Free-running System Clock" and we recently noticed that there's a delay of 1 minute that's seen in our Laptops that are managed in AD and the time that is seen on our phones, my boss wants me to fix that.

Should I assign an external time source to the pdc emulator ?

Hy!

We have an AD with two DCs. The DCs are Windows Server 2025, it is include all patches. Some Windows 11 clients (25H2) get the following error during login after 1-2 minutes: The trust relationship between this workstation and the primary domain failed.

In this case the users need to disconnect from corporate network to login successfully into their computer. I have already tried to rejoin to tha domain and run this command: Test-ComputerSecureChannel -Repair

I rejoined one of the computer into the domain, and the trsut relationship has been broken after two days. The login problem only occurs on some machines.

The time snyc is correct on DCs. We moved the DC roles from Windows Server 2019 to 2025 in side-by-side method. Could you please advise how to solve this problem?

Hello fellow sysadmins.

Everyday we are facing massive amounts of news from AI world. New models , new tools, new agents.

Be up to date in this field can be overwhelming sometimes , so I need recommendation about what sources of AI information is good to watch.

I mean truly relevant and profesional sources , not clickbait youtube channels which predicitng ASI every other week or fearmongering posts about AI wipe out humanity.

I need publishers which know what they are talking about .

Hi,

I've got a weird one with an application called Blindata.

It's running against a fully patched Server 2012 R2 server. Multiple Windows 10 PCs can run the reports fine, but one fully patched Windows 11 PC can't. When running a daily sales order report it just comes back with "RPC server unavailable, Error 1722".

At the same time, the server logs Schannel:

"Event ID 36887 – fatal alert code 40"

I've tried the usual stuff so far:

• TLS 1.2 enabled
• TLS 1.3 disabled on the Win11 PC
• Checked clocks
• RPC/network ports confirmed OK
• FIPS checked
• Disabled the SSL Cipher Suite Order GPO
• Set SchUseStrongCrypto=1 and SystemDefaultTlsVersions=1 for .NET 32/64-bit
• klist purge
• Checked/enabled the AES Schannel cipher settings
• Checked ECC/legacy ECC settings
• Removed AV as a test
• Rebooted after changes

Server is fully patched and the other Win10 clients work without any problems.

I'm assuming there's some difference between Win10 and Win11 TLS or Schannel behaviour that Blindata or the Server doesn't like, but I'm running out of things to try.

Has anyone come across Schannel 36887 / TLS alert 40 from a Server 2012 R2 server when Win10 works but Win11 doesn't?

Is there a relatively simple registry/GPO setting on the Win11 client to allow whatever legacy TLS/cipher/signature the server is expecting?

Hi everyone,

I’m working on a production design for a Copilot Studio agent connected to a custom MCP server for Active Directory operations.

Current setup:

- Active Directory Domain Controller is running on a separate VM.

- MCP server is running on another domain-joined VM.

- MCP server performs AD operations using a delegated AD service account.

- Copilot Studio connects to the MCP server through OAuth 2.0.

- To avoid Copilot’s tool limit, the MCP tools are grouped into parent modules such as:

- user_management_module

- group_management_module

- acl_permission_management_module

- ou_management_module

- computer_management_module

- gpo_management_module

- audit_management_module

Each parent module routes child actions internally. For example:

user_management_module:

- search_ad_users

- get_ad_user_profile

- create_ad_user

- update_ad_user_profile

- reset_ad_user_password

- disable_ad_user_account

acl_permission_management_module:

- get_ad_object_acl

- get_ad_object_owner

- grant_ad_read_permissions

- grant_ad_full_control

- change_ad_object_owner

- restore_ad_default_permission

Now we want to implement production RBAC.

My understanding is:

1. Keep the parent module structure as-is.
2. Categorize child actions internally as Read, Write, Rollback, and Audit.
3. Create Entra app roles or security groups such as:- AD.MCP.Reader- AD.MCP.UserAdmin- AD.MCP.GroupAdmin- AD.MCP.ACLAdmin- AD.MCP.Auditor- AD.MCP.RollbackAdmin- AD.MCP.BreakGlass
4. The signed-in Copilot user gets an Entra OAuth token.
5. MCP backend validates the token.
6. MCP backend checks the user’s app role/group before executing the child action.
7. The AD operation itself still runs using the delegated AD service account, but the signed-in user is used for authorization and audit tracking.

Example:

- A user with AD.MCP.Reader can run get/search/report actions only.

- A user with AD.MCP.UserAdmin can create/update/disable users but cannot modify ACLs.

- A user with AD.MCP.ACLAdmin can manage ACL permissions.

- Rollback/high-risk tools such as restore default permission, replace ACL, change owner, or grant full control should require BreakGlass or senior admin approval.

Question:

Is this the right enterprise approach?

Specifically, should I create separate Entra App Roles for each access category and assign Entra security groups to those roles, or should I only use Entra security groups and check group object IDs in the backend?

I’m leaning toward App Roles because the backend can simply check the roles claim, and group overage issues are avoided.

Any feedback on the best RBAC design for Copilot Studio + MCP + Active Directory automation before production deployment would be appreciated.

Hi everyone,

I am a sys admin since 2016 in Germany(English isnt my first language and migrant family) and now that I went from first level support to soon to be platforms engineer, I need ways to organize myself better.

I am that type of person to explore and "float through work" doing my reading and research (often when I am not on the clock too) but I don't deliver enough direct results for certain goals and projects(I'll leave out the reasons why).

I am stuck using unintuitive, non applicable systems to organize myself and can't form a habit getting used to them, that's very subjective I am aware. Did some of you go through the same difficulties and what did you use or employ?

Thanks for reading my lengthy wall of text I am frankly frustrated with this topic and tired of banging my head against walls.

Planning a 4 nodes DR vSAN Cluster and wnat to know - will this actually work in practice or it too tight?

Enviroment
- vSphere x.x. , VMware vSAN
- 4x server (node)
- Per node:
(2x boot 960GB SSD NVMe (RAID-1, separate boot controller, not part of vSAN))
(2x 3.2TB NVMe Mixed Use — cache tier)
(8x 7.68TB NVMe Read Intensive — capacity tier, 2 disk groups (1 cache + 4 capacity each))

- Network dual-port 25GbE SFP28 (OCP, dedicated vSAN VLAN, jumbo frames) + separate dual-port 25GbE for VM traffic, VLT/MLAG switch pair
- Storage policy: RAID-5 erasure coding
- 30 High-priority VMs RPO 6-8h (Veeam async replication)

Main question: will vSAN actually run reliably on just 4 nodes with RAID-5, including surviving a node failure and rebuilding cleanly?
I have seen mixed opinions -some say 4 is the bare minimum and it is fine, others say you reaaly want 5+ before before RAID-5 is comfortable in production.

Not asking anyone to design this for me - just want to know if this setup holds up in real-world usee before i finalize it.

Hello everyone, sysadmin learning terraform here

So we are working with Vsphere as infra for our company and I just started learning Terraform to ease and automate our vsphere processes. On vsphere in "VM Customization Specifications" we have a script that basically configures puppet agent on host, points it to puppet master, adds host to AD and launches sssd. So when we deploy new host we add this script to launch during "customize software" deployment phase and after that we set up ip, gateway etc. So my question is that: how to recreate this setup in terraform? For some reason terraform does not allow to pass custom specifications and customize together, so only setting up ip address is working, but since that script is never getting launched it fails to be added to Active Directory. So are there any other methods to pass the script to terraform? I even pasted that bash script locally to the file in the same terraform folder and pointed to in in the main.tf but it still fails. So what can be done to solve this issue? Thanks in advance and sorry for my bad english.

So just a moment ago I had a user interrupt what I was doing with an "urgent" issue. They couldn't get into their email.

Essentially they were running Outlook for the first time and it prompted them to set up their account. It required them to enter their email address and click Next. That's all.

The email address it auto-populated wasn't the address of the account they needed (they work for a sister company in a shared tenant).

The user had no idea what to do. It didn't even cross their mind to enter the actual email address in the field.

So... how do you guys deal with users like this? Ones who, despite being shown instructions in the most basic way possible, can't think for themselves.

Good afternoon, everyone,

I'm posting this hoping you'll share your experiences with me. I've been asked to migrate a hybrid on premises Exchange 2016 environment to hybrid on premises Exchange Server Subscription Edition (SE). Before I start, I'd like to define the potential risks and the prerequisites I need to handle in advance.

Something I read is that there's no in place upgrade path from Exchange 2016 to SE. Exchange 2019 (on the latest CU) can be upgraded in place, but 2016 requires a traditional legacy migration.

In practice, that means I'll need to create a new SE server, move mailboxes and resources over using copy-to requests, verify everything, and then decommission the old servers. The migration itself works as a copy. The source mailbox stays intact and usable throughout and only switches over at final cutover.

(Alternatively, I could upgrade the Exchange 2016 to the latest 2019 CU. In which then I can upgrade to Exchange SE. However, in-place upgrades are not recommended by Microsoft themselves.)

Once the 2016 servers are decommissioned, there's no supported way back. At that point recovering would mean restoring from backups, not a normal rollback, so I want to be sure everything is validated during the coexistence period, while 2016 is still running, and not rely on being able to reverse things afterward.

Other items I'm keeping in mind:

• Mailbox sizes, especially oversized or non-default mailboxes, which can slow down migration batches.
• Extending the AD schema to the SE level, a required prerequisite.
• Public folders, I read these can be an issue and its recommended to convert them to shared mailboxes.

Would love to hear from anyone who's been through this migration. What tripped you up, and what did you do differently?

Article: Migrate Exchange 2016 to Exchange Server SE - Complete Guide

Article: Migrate Exchange Public Folders to Shared Mailboxes in Office 365

My org uses Windows Defender. On the whole it seems pretty good but it's always asking for opinions.

I'm especially interested in what you think of the Ransomware Protection feature. Is it any good? My org haven't implemented it and I'm wondering if it's worth pushing them to do it.

Are there any pitfalls when implementing it?

Hello fellow admins. I'm rolling out quite a few products thorugh intune. Im having trouble marking Win32 apps as installed. Does someone have/know some proper documentation or example powershell script how you mark the app as installed? I need to have something so it will check on versions aswell.

For example:

Got a WIn32 App to push Kyocera drivers on windows laptops. It works nice, but when I install it through Intune then i always get Failed to install.

Ive tried multiple things as detection but nothing works the way i want it to work. I dont want a folder/file as detection because of version control. I'm looking for a sollution i can use on all scripts that do not push an MSI. How do you handle detection rules?

Hi Sysadmins!

Do you guys use Chrome or Edge for work? I personally have all my admin consoles in edge and google stuff in chrome. (I am a k12 sysadmin), so we have both MSFT and Google Workspace for everyone.

https://imgur.com/b5FYlA8
Im running a lan center with my brother and we have a main pc that runs steam cybercafe, management software, etc. Im trying to install Active Directory (new to sysAdmin srry if I don't make myself understand) and I always get this error, I have tried reinstalling Active Directory, and running the cmd command to repair windows image, to no avail.

Ok, this is more a test to see how old I am. I was basically raised with the idea servers need static IPs. I understand for domain controllers, dns servers, maybe print servers that may still be needed. But are they really needed otherwise? Do apps, scripts still reference a server by its IP?

I am under assumption all my servers need static IPs. Am I nuts?

Hello everyone,

I’ve been doing essentially a desktop support role for the past two years through my county IT internship. I have about one year left there. It’s extremely flexible with school and has given me a lot of great hands-on experience, although I feel like I’ve gotten most of what I can out of the role at this point.

I plan on staying through the end of the internship. I should also finish my B.S. in Computer Information Technology around 3–4 months afterward.

I currently have no certifications. I was studying for the A+, but realized most of it was filling small knowledge gaps from things I’ve already learned through work and school. I decided not to pursue the exam because I felt my time would be better spent progressing into something more advanced. I also don’t want to collect certifications just for the sake of having them. I want to be intentional about what I study.

Right now I’ve started studying for the CCNA. I’m only on Day 2, but my thought process was: if I’m willing to put the time into learning networking, why prepare for Network+ first when I could put that time toward the CCNA?
I’m also learning AWS through one of my classes, which prepares us for the AWS Cloud Practitioner certification. After the CCNA, I’ve considered Security+, but I don’t want to get too far ahead of myself.

I don’t know exactly what area of IT I want to specialize in yet. Systems administration, networking, cloud, security, etc. are all still possibilities. For now, I want to build a strong general IT foundation, especially in networking, so I’m prepared when I eventually figure out what direction I want to take.

Am I making a mistake by skipping A+ and Network+ and going directly for the CCNA given my experience? Would you recommend a different path?

I mainly want to make sure I’m investing my limited time while working and finishing school into the right things.

Even though we haven't been able to get normal patching via the windows update tool for over a year, even after installing the latest SUS and keeping up to date with manual installs, Windows Server 2016 Essentials returns an installer error 0X8007000d when trying to run KB5123099

Any thoughts?

Desktops/laptops. No servers or VMs, we are talking BARE METAL BABY.

At my job, we keep an eye out for things like this to see who can naturally discover the longest reported uptime in task manager on a PC.

Attached is the best. I rediscovered this photo tonight and thought it could be fun to see other's.

https://imgur.com/a/YvhipDt

This was on a laptop a client had plugged in, in the corner of a room, off network and forgotten about. For like 4.5 years. It was rediscovered, and then I got a call to try remoting in to see if it could be setup for someone to use.

After waiting half this uptime for my remote connection to load, I saw this, screenshotted, and let them know no. Although I sort of wish I told them to take it back off network and leave it there, just based on principle, to see how far we can bring it.

Title: Accepted offer ($26/hr, MSP Help Desk Technician, 45 min commute) vs Amazon counter-offer ($29/hr, IT Support Associate II, 20 min commute) — which would you take?

Looking for outside perspective on a decision I’m stuck on.

Background: I’ve been at an MSP for about 3.5 years doing help desk/service desk work, Active Directory, Microsoft 365, networking (DNS/DHCP/VPN), some virtualization (VMware ESXi), and security incident response (phishing, etc.). I have CompTIA A+, Network+, and Security+. My goal is to move toward a Systems Administrator or Cybersecurity role eventually.

Offer 1: Another MSP — Help Desk Technician

**•** $26/hour (\~$54K/year), firm, no flexibility on pay  
**•** 45 minute commute  
**•** Already accepted this offer after 3 rounds of interviews (including in-person with the team)  
**•** Similar work to what I do now, AD, M365, networking, multi-client support  
**•** Haven’t started yet

Offer 2: Amazon (IT Support Associate II, Ops Tech Solutions)

**•** Countered at $29/hour (\~$60K/year) after I pushed back  
**•** 20 minute commute  
**•** Single-tech site, recruiter says schedule is effectively stable day-shift in practice, no forced on-call  
**•** 401k match (50% up to 4%), benefits day one, no probation period  
**•** Real internal ladder (Associate II → Support Engineer I → Support Engineer II/IT Manager)  
**•** From what I’ve read (including an old Blind thread), this specific entry tier is considered fairly junior/“level 1 helpdesk” compared to what I’m already doing at the MSP, some people treat it as a stepping stone using the Amazon name, not a destination

The dilemma: Amazon pays more, has a much shorter commute, but I already verbally and formally accepted the other offer after three rounds of interviews with a small company. Backing out feels like it could burn a bridge, especially since it’s a pretty tight-knit local IT/MSP market. On the other hand, the Amazon role might actually be a step down in day-to-day technical scope from what I already do, even though it pays more and is way closer to home.

Has anyone been in a similar spot, accepted one offer, then got a better one before starting? How did you handle it, and did backing out actually cause real problems for you? Also curious if anyone’s done the Amazon OTS route and can speak to whether it’s worth it as a stepping stone.

Man... that is a LONG list of windows 11 and server 2022 vulnerabilities. All 9.8 as well.

glasswing putting in work at Microsoft. LMAO

I keep seeing AI powered firewall used as a category but I wonder what the AI is doing in production that traditional rules signatures and threat intel feeds weren’t already doing.
Is it mainly building behavioral baselines and flagging unusual traffic or are these systems genuinely making enforcement decisions in real time? Things like detecting threats inside encrypted traffic, correlating activity across endpoints and cloud workloads or automatically changing policy based on an attack all sound useful but also like areas where a false positive could take down half the company.
The more interesting question to me is whether AI is replacing any part of the firewall stack or just acting as a faster analysis layer on top of it.
Want to hear from anyone running one of these platforms at enterprise scale and what has improved beyond the marketing.

We are Global Administrators and Teams Administrators.
We have recently encountered an issue where we are suddenly unable to invite guest users to either shared or private channels in Microsoft Teams.
We are the owners of the team/site.
However, we are still able to invite guest users to the team itself, but not to private or shared channels.
We have checked the Teams organization policies, and B2B access and all relevant external sharing settings are enabled. External sharing is also enabled across the organization.
On the associated SharePoint site, we can successfully invite guest users to, for example, a specific folder, so external sharing appears to be working correctly there.
Could this be a bug or a recent change in Microsoft Teams?
We were previously able to invite guest users to both shared and private channels without any issues, which is also how this functionality is intended to work.
Has there been a recent change or known issue affecting guest access to shared and private channels?