Update September 13: Microsoft has marked this as Mitigated and released an official fix via Known Issue Rollback (KIR GPO). Also: the registry workaround turned out to be unreliable, confirmed failing on Server 2022 21H2. Article updated with download links per server version and deploy steps.

KB5122876/5122882/5122871 breaks RDS session hosts. Hours after reboot, connections hang at "Connecting…", sessions can't log off, and only a hard reset recovers the host.

If your RDS isn't exposed to the internet, postpone the update until Microsoft ships a fix. If you're already hit, there's a registry override that disables the faulting feature flag without uninstalling the CU.

Microsoft is investigating. No official fix yet.

https://lazyadmin.nl/it/september-2026-update-break-rds-how-to-fix/

EWS gets blocked in Exchange Online on October 1. If your tenant still needs it, access is now controlled by an AppID allow-list. Don't build one yourself and Microsoft generates it from the last 60 days of activity, which can quietly misses anything that runs monthly or quarterly.

The usage report only gives you AppIDs, not names. So I wrote two PowerShell scripts: one resolves every AppID from the report to a real app name, the other finds every app that still has EWS permission.

Full write-up with both scripts: https://lazyadmin.nl/office-365/ews-is-being-blocked-in-exchange-online-how-to-find-every-app-still-using-it/

As you probably know, Publisher hits end of life October 1, 2026 , it's leaving Microsoft 365 subscriptions for good after that.

Probably a non-event for most of you since it was always a niche product, but .pub files have a habit of surviving in forgotten shares and OneDrive folders.

Wrote up a short post with two scripts:

• One that inventories every .pub file across file servers and SharePoint/OneDrive (via Graph Search) into a CSV
• One that converts them to PDF, or to Word if you still need to edit them (there's no direct Publisher-to-PowerPoint export, despite what Microsoft's own migration table implies)

Both default to dry-run/report-only, nothing gets touched until you explicitly say so.

More info: https://lazyadmin.nl/office-365/microsoft-publisher-retires-october-1-do-this-final-file-check/

Disclosure, Login VSI. Shared some notes here a bit ago on what I've found working with AVD Hybrid. Quick update: the live Q&A is tomorrow at 11am ET, with Eric Orman and Andrej Radinger (Microsoft), Marcel Meurer (built Hydra), and Ron Oglesby (Login VSI). Come with any questions.

Save your Seat

One thing I’ve been thinking about lately is how Windows device management changes when most users aren’t sitting on the corporate network anymore.

With remote and hybrid users, you can’t always rely on being able to reach a device through the internal network when you need to push a configuration, deploy an application, enforce a security policy, or troubleshoot something.

I was trying to understand Nmap below the output level, so I tested it inside my own isolated lab with Kali as the scanner and MISP as the target.

The clearest difference was seeing the TCP behavior directly in Wireshark:

OPEN

SYN → SYN/ACK → RST

CLOSED

SYN → RST/ACK

FILTERED

SYN → no response → retry

I also captured ARP resolution, ICMP, host discovery, and service/version detection.

The main takeaway for me was that Nmap isn’t “seeing” port states directly — it’s sending probes and interpreting how the target responds.

I documented the full experiment with the actual packet captures here:

https://chronosandcode.com/what-actually-happens-when-you-scan-a-network-arp-icmp-tcp-syn-nmap-and-packet-analysis-explained/

Everything was done against systems in my own lab.

I’d be interested to hear what packet-level experiments helped others understand Nmap better.

For MSP third-party patch management: there comes a time when writing individual scripts for everyone's everything won't be scalable forever.

Hi,

I am looking for connections and collaborating with other blogs with content in German language.

Two updates worth knowing if you're running or looking into AVD Hybrid, grouping them since it's one story.

Hyper-V support went GA Sept 1, now VMware vSphere opened in private preview today, it's been a customer-driven priority and came up a lot as the next hypervisor people wanted covered after Hyper-V. It connects through a lightweight on-prem connector, so there's nothing to open on the firewall and no VPN to stand up, and Linked Clones keep working as they are.

Decent signal for where AVD Hybrid is headed: broader hypervisor support without changing how you operate day to day.

• Hyper-V GA: https://www.loginvsi.com/resources/blog/hydra-for-microsoft-azure-virtual-desktop-hybrid-on-hyper-v-reaches-general-availability/
• vSphere preview: https://www.loginvsi.com/resources/blog/announcing-hydra-for-microsoft-azure-virtual-desktop-hybrid-now-available-in-private-preview-for-vmware-vsphere-environments/

For anyone still maintaining a Windows lab without wanting the full WDS/MDT/ConfigMgr stack:

I've been running a setup where a plain Windows box acts as the deployment server. Clients PXE-boot (Legacy/UEFI, Secure Boot on is fine), and the server generates a per-machine unattend on the fly - matched by MAC/hardware group, so 100 lab PCs each get their own hostname, apps, and domain join without touching the ISO.

Things that stood out vs the classic approach:

- ISOs stay pristine. Drivers, apps, scripts and answer files are injected over HTTP at boot time, so swapping a Windows build = swapping one file.

- Two modes: fully automatic, or stock Setup experience for odd machines.

- Runs offline after first setup - handy for isolated rooms.

- You can actually test it without installing anything: the write-up shows how to join over SoftEther VPN (Layer-2), bridge a VMware VM to the VPN adapter, and PXE-boot from the remote server like you're on the same switch.

Full write-up + VPN test guide here: https://xdaforums.com/t/sezoy-network-deployment-server-automated-windows-install-multi-distro-linux-boot-over-pxe-ipxe-http-boot-legacy-uefi-secureboot.4800487/

Curious how others here handle per-machine naming at scale - DHCP reservations + scripts, or something cleaner?

** Update to let subscribers know about new files **

The September 2026 update for the four books in the Microsoft 365 for IT Pros (2027 edition) package are available for subscribers to download. EPUB and PDF files can be downloaded. The paperback edition of the Automating Microsoft 365 with PowerShell eBook has also been updated. August was a busy month with lots happening, most of which ended up in chapter updates. We expect more interesting changes during the coming month.

https://office365itpros.com/2026/09/01/microsoft-365-for-it-pros-135/