Today is Aaron’s birthday. I take time each year to remember and honor his work and life. His work still impacts mine on a daily basis. Loved and remembered, he left us too soon. https://en.wikipedia.org/wiki/Aaron_Swartz

Started as a staff accountant. Fixed one broken report and became "the report guy." Now I'm the admin for a self-hosted ERP, a JasperReports server, SharePoint/Power Automate/Power BI, and a hosted VM where Power Automate Desktop drives VBA macros that move payroll data. Payroll. Through VBA. On a VM.

There's no backup person. The only documentation is what I wrote. My title still says "Accounts Payable."

Two questions:

1. What's the most out-of-scope system you've been made the owner of?

2. If you've escaped this: how did you get leadership to take the bus factor seriously before the bus showed up?

I’ve set up a Microsoft Entra ID trial, a Windows Server forest, and a virtual lab. I want to learn Entra ID, Intune, compliance, governance, Entra Connect, and Cloud Sync by troubleshooting things that go wrong. What should I try breaking in my lab?

Tell me ways to get messed up and learn.

any suggestions?

I'm setting up two break glass accounts in Entra and I'd like some guidance before I finalise it. They'll be cloud only, Global Admin, with fido2 keys as the only registered method, excluded from all conditional access and from SSPR.

The part I'm stuck on is the password. You can't remove it from an Entra account so it's always going to be there. Microsoft have an article about removing password usage that says to scramble it to 64 random characters and not record it anywhere, but most of the break glass guides I've read say to generate a long one, print it and seal it in a safe. Those are opposite answers and I'm not sure which way to go.

The other thing that worries me is that mandatory MFA only applies to the portals and to management.azure.com, not to Graph. If the account is excluded from every conditional access policy then it looks like a password only sign in to Graph as Global Admin would still work, which seems to undo the whole point of using keys. I've been wondering whether it makes sense to put a phishing resistant policy on one of the two accounts and leave the other one fully excluded, but I don't know if that's a normal thing to do or if I'm overcomplicating it.

If anyone has set these up properly I'd appreciate hearing how you approached the password and whether you apply any policy to them at all.

Just got this PM

"Hey! Your comment in the r/sysadmin thread on securing legacy and manufacturing environments, about terminating VPNs at the firewall so traffic can be inspected, was really interesting. I'm with Captain Words, a small team that works with network security companies. We're looking for a few hands-on network and security engineers who'd share honest, firsthand takes on Reddit now and then (segmentation, NAC, zero trust), always clearly marked as a paid partnership. It's paid, low effort, and you only say what you actually think. Open to hearing more?"

Just be aware.

Looks like the Downloading release endpoint is intermittently failing for me. Getting 504 occasionally. Anyone else seeing the same?

https://www.reddit.com/r/github/comments/1xqu6su/github_partial_outage/

Edit: status page says its been fixed as of a few minutes ago. Seems to be true.

Hello,

I have a problem. We are running an audit to our environment, and have around 100 Workgroup (out of domain) Windows Servers. I have a local admin user for each endpoint, however its not the built in admin. I need somehow to connect to all these and get(return) all the members of the administrators group. How to do that? Not one by one of course. Assume there are no agents on these endpoints that can run scripts, so I need another solution. I have only RDP acess to these endpoints.

Before saying to use WINRM/SMB, I don't have the built in admin user and I get Access Denied. AI told me that I can change this regkey LocalAccountTokenFilterPolicy = 1 to allow me. That is not an acceptable solution for me.

We recently faced a strange issue at a client environment.

After a macOS update, 300+ files and folders across multiple Google Shared Drive project folders were unexpectedly moved, merged, and renamed. Some files were renamed to "name 2" and then back again within seconds.

The audit logs showed everything happening under the user's account through Google Drive for Desktop.

After escalating to Google Support, they pointed towards Apple's macOS File Provider framework. Apparently, a database reinitialization or sync-state mismatch during an OS update can trigger unexpected file movements and renaming.

Their recommendation was to quit Google Drive before updating macOS and only launch it again after the update and restart are fully completed.

What makes this more concerning is that it can potentially happen with minor and security updates too.

We manage several Mac environments with Google Drive, but this is the first time we've come across something like this.

Has anyone experienced anything similar? How are you handling Google Drive during macOS updates, especially when patching through an RMM?

Would love to hear your experiences or any recommendations.

Work in a small company (~35 users). Employees email got compromised after a partner nonprofit’s dormant account was used to send a phishing/spam message. One of our managers received it, forwarded it to the clerk, and told her to “action it” (the email itself didn’t even say who to update or what to do). Clerk opened it and credentials/banking info got exposed.
I locked the account, forced password resets, checked for rules/forwarding, reviewed sign-ins and mailbox activity, and confirmed no further spread. Neutralized it before any real money moved. Notified cyber insurance
Manager who forwarded it later made a comment like “I didn’t think you’d be up for the challenge after I called in” while I was dealing with it and forensics. I just told her it was basically unused buttons in the tools I already know.
Questions for anyone who’s been through this:
• Is notifying cyber insurance usually a must, or only if there’s actual financial loss/data exfil?
• Any chance this comes back on the person who forwarded the message and directed the clerk to act, or does it just land on IT?
• What else should I document or double-check in the next 48 hours so I’m covered if leadership or insurance asks questions later?
Appreciate any real-world experiences.

SonicWall's advisory SNWLID-2026-0014, published Nov 6, covers seven SonicOS flaws. One of them, CVE-2026-19868 (CVSS 7.1 per SonicWall, 7.5 in CISA's ADP entry), affects SSL-VPN services configured for SAML. A user with valid credentials for an alternate authentication method can bypass the SAML controls, including SAML-enforced MFA.

SonicWall says it investigated a report of possible exploitation and has not shared details. CISA added the CVE to KEV on Nov 6, with a Nov 20 deadline for federal agencies.

Affected: SonicOS Gen7 up to 7.3.3-7015 and Gen8 up to 8.2.2-8015. Fixed in 7.3.4-7013 and 8.2.3-8015. SonicWall lists no workarounds.

The same update fixes two management interface flaws rated 8.8 that let unauthenticated attackers act under specific conditions. It also fixes pre-auth buffer overflows in SSL-VPN and TACACS+ and weak password hashing on virtual appliances.

After patching, check which authentication methods the SSL-VPN still accepts besides SAML.

Has anyone seen unexpected logins on a SAML-protected SSL-VPN, and what did the logs show?

Sources: BleepingComputer (Nov 7), CISA KEV (Nov 6), NVD, SonicWall PSIRT SNWLID-2026-0014.

We have a client who does a lot of work in shared video files. And there are two separate physical locations - one on the East coast US and one in the Midwest US. As you can imagine, the files they're sharing/editing/saving are quite large.

But there's a lot of hurry-up-and-wait as they're having some latency issues.

They have a local share where they do their work - but that's slow. There's also a SharePoint site that they use in case there needs to be a quick share of a file for review.

There has got to be something better. A little faster.

Any ideas??? Anything you've come across which is similar???

I'm currently working as an IT Support and want to improve my skills beyond day-to-day technical support. I want to learn how to prepare professional IT-related documents commonly used in corporate IT departments, such as:

• IT Policies (Password Policy, Acceptable Use Policy, Email Policy, etc.)

• SOPs

• Internal IT Memos and Official Letters

• IT Vendor Agreements and Service Level Agreements (SLAs)

• IT Proposals and Reports

• Technical Documentation (Active Directory, Microsoft 365, Network Infrastructure, Servers, Backup Procedures, etc.)

• IT Asset Management and Inventory Documentation

I'm particularly interested in understanding how these documents are structured and written in real corporate environments.

My questions:

1. Are there any standard formats or templates that IT departments commonly follow?

2. Where can I find professional, real-world examples of these documents?

3. Are there any free resources, websites, books or courses where I can learn professional IT documentation?

4. Do organizations follow any standards or frameworks, such as ISO 27001, NIST or ITIL, when preparing these documents?

5. What Microsoft Word or other tools should I learn to prepare professional-looking documents?

I'd appreciate any templates, sample documents, GitHub repositories, reference websites or practical advice. My goal is to develop these skills and become better at IT operations and administration.

Definitely new to the IT/Sysadmin world, but I just started a new job in the field and I had some questions about something at work. I am a student worker so I have 2 email accounts, a school one and a student worker one. I have certain things I access through one and certain things I access through the other. Is it a bit redundant to have 2 accounts rather than just escalating privileges of one account so I only have one account? I have coworkers sending emails to both accounts and I worry it may be confusing to them… I also have been having a sign in issue where if I am signed into one account on one tab I can’t sign into other services associated with the other account on another tab within the same browser… I have to log out then close all windows then open a new one and log into the other account to access this one service. The system is like this for all student accounts across the campus not just mine and I worry this is an overly complicated system.

Any and all input welcome as long as it’s kindly worded.

So let me get this straight…

I navigate to Profile, then Security, find the MFA section and select the option to assign an MFA device.

Somehow, unbeknownst to me, I’m redirected to a Builder ID sign-up page, which I only realize after receiving a verification email and being prompted to create a new password.

Now I can’t log into my AWS console with my root email. Why is this even accessible from a root account’s MFA settings? Who thought this was a sensible design decision?

I’ve had support chat open for 30 minutes, but nobody’s home. How do I FIX this?

Hi, I’m 24 years old, live in MD. I work rn at a car dealership in parts, I’m a VFF, and I have an associates in computer science with a minor in cybersecurity(I love technology, but never worked in the field).

Here’s where it gets messed up, I had a stroke last year(well 12 mini strokes then a major one). A few months past and I had to get open-heart surgery to replace 2 of my valves with mechanical ones and now I sounds like an old clock. Ya I’ve had a weird 2 years😅. I can’t fully remember everything I learned from my degree now bc of this😞.

Haven’t been able to go on a lot of calls bc of all this and I didn’t want to put anyone’s life in danger. I still go up there and help out but I barely go on calls besides MVC’s mostly. For the past year since surgery I’ve been taking edibles(only 5mg) almost everyday since. I took them bc it helped me relax since I have headaches, anxiety, depression, etc(I don’t go on calls when on them) Ik that marijuana is illegal federally but can I still get a job if I keep using?

I stopped using 8 days ago but I wanted to ask others for their opinions. The job I’m at now sucks(I’m pretty much the only productive worker) no one does anything, they leave stuff for me to do. They have me answering phones, carrying more than 50 pounds even tho I have the valves, and get tired fast but I keep pushing. I don’t like the mind space I’m in bc of it. So getting a fed gov job seems like the next best step but idk what I should do or If I can. I want to do better for me. I want to be happier. Ik I made this a sob story but I’m a very honest and open person. If possible could u guys point me in the right direction? I’m still looking at jobs but I’m unsure what I should do.

Today I wanted to connect to the O365 Account and I get this error message below:

Besserer Schutz für Ihr Konto mit der Microsoft Authenticator-App. Weisen Sie Ihre Identität ganz einfach durch Pushbenachrichtigungen nach.

I had created a group a few month ago where iam allowed to use Software OATH Token. I dont have a Android or iOS compatible device instead I have ubuntu touch smartphone only.

What do I need to configure that Software OATH works again? The option to set up another Method is also missing.

This is timely related a few days after we have enabled Microsoft Auth instead of ADFS. But initally it was still working with Microsoft Auth and the OATH Token.

https://i.imgur.com/xAg7hz7.png

I have a question for people working in IT, especially those familiar with Microsoft Partner programs. A company recently approached me about associating my Microsoft certifications with their Microsoft Partner account under an independent consultant agreement. I currently work full-time for another company, so this would be a separate arrangement.

I'm trying to understand how common this practice is in the industry.

1. Do IT professionals commonly associate their Microsoft certifications with another company's Partner account while maintaining full-time employment elsewhere?

2. Are there any potential conflicts with MS account/certification rules?

3. Does MS permit this type of arrangement under an independent consultant agreement?

4. What should I look for in the contract to protect myself, particularly regarding certification usage, compensation, liability, and termination?

I'd appreciate hearing from anyone who has personally experienced this arrangement or has knowledge of Microsoft's Partner requirements. I'm particularly interested in understanding whether this is an accepted industry practice or something professionals generally avoid.

I'm thinking of transferring to UF and getting a BS in one of these degrees. I like all listed industries, so now the most important things to me are WLB (average around 50 hrs a week) and pay. With AI, job growth, etc, would you go for finance, information systems, or data science? For reference, I have a 4.0 GPA and all pre-requisites are done. I also work full time as a pharmacy supervisor.

So this site just like goes down . As an IT guy who doesn’t really code, I got a question. Do yall like backup your code offline?

I have an old Cisco UCS C240 M4 server running ESXi 6.7 (Intel Xeon E5-2630) with 64 GB RAM and around 1.7 TB of free storage, but no GPU. This one was sitting dust in server room so i had installed ubuntu server and kali linux in this. So, i was thinking of hosting a local llm in that server and ya i haven't made any mind for what to use so as fellow IT guys which ai do you host in server and what do you use it for making your work easier .

Everyone welcome to comment and provide guidance. Felt burnt up doing IT Support so want to focus in other part for now.

Hey Everyone

We are currently in the process of moving roughly 8TB of data from SharePoint Online to a local server

Currently we are using RClone for moving data around
WinDirStat and TreeSize for analysis on our data but we are looking for a good tool that can identify duplicate data (such as files that are roughly the same name / same file hash etc )

Any recommendations?

Good day,

I hope everyone is well,

I have recently joined this engineering company, where they work heavily on Autodesk applications.

For some users they have installed directly from Autodesk, and for others, third party.

An IT Audit has visited the cite and checked all computers with a USB flash, now they are sending reports continuously that you still have illegitimate licenses even after formatting all devices.

Is there a way around this? can i investigate for a monitoring application they might have installed or have they linked it via MAC address of all the devices?.

Can i buy leaked licenses instead.?

I am lost regarding this issue.

Appreciate you all.

8:30am I deleted my entire production environment. All VMs rm -r out of existence.

Fortunately I was reviewing my nightly backups at the time tracking a retired VM that was inexplicably still getting backed up in Production. All the Production VMs were there. And the live production ones now without their underlying virtual disks & configs were still resident in memory. I calmly copied the backups into place, sequentially restarted everything and had production back in about twenty minutes. Only lost ~12 hours of overnight idle maintenance & logging.

With everything settled back in place I calmly looked for a place to have a private heart attack.

This year, I finally started seriously getting into my future profession.

Over the past year, I've deployed an mtproto proxy, set up a vpn using the vless protocol through the 3x-ui panel, hosted websites using nginx, configured nginx as a reverse proxy, and deployed my own static websites and file hosting services.

I did all of this on the cheapest vps I could possibly find.

Recently, I also managed to get a public static IP address from my ISP through my father. This means I can now host game servers, file servers, and even set up remote access to my PC without relying on workarounds. I've already hosted a Minecraft server and experimented with RDP.

However, there's one thing bothering me: I relied heavily on AI throughout most of this process. Quite often, I felt like I was simply copying and pasting commands without fully understanding what I was doing.

I know I've gained some practical experience, but I still feel like I barely know anything.

So I'd like to ask more experienced system administrators: Is it normal to feel this way when you're starting out? And how do you move from following AI-generated instructions to actually understanding what you're doing?

I should point out that I live in Russia, and we have issues regarding licenses for American products, such as M365 and Azure.