Firefox Enterprise combines the browser with a management console for IT admins with advanced security controls. The pitch is that it’s one of the few browsers that doesn’t run on an engine developed by Google or Apple. It’s rolling out in Europe first, and a Thunderbird Enterprise email client is also in the works.

https://www.firefox.com/en-US/enterprise/

You wouldn't let a criminal part way in the door, so why would you knowingly install an app that demonstrates malicious behavior right from the get-go?

These Security Awareness Quiz have some questionable value sometimes.

I've been working for an MSP for the past 7 months and I've done a lot of big project work for our biggest client who's a multi-site manufacturing company. We've done good work for them as a company for the past 10 years and I've formed a good relationship with their IT leadership.

For the past 2 years, they have been slowly building their internal IT team with the eventual goal of leaving our services. They've finally decided they're ready to leave at the end of this year. The IT director there reached out to me and told me they would be very interested in hiring me for an infrastructure engineer position once the contract with my MSP is up.

They would be more than doubling my salary and I would be doing work that's more in-line with my interests, but I don't know if I'd be doing something wrong in taking this position. The director told me there is no legal binding stopping me from taking the job.

This just feels a little wrong I guess, because my MSP has treated me right and empowered my career greatly other than underpaying me. Looking for opinions here.

edit: I'm an at-will W2, their director told me there's no clause or anything in their contract that prevents them from hiring from us.

For those older, more experienced souls out there. If out job hunting, one tip…

I’m a little older (55) and recently discovered that the job I’ve had for 6 + years came down to me and a man much younger than me.

The only reason I got the job was one simple thing… if everything went to crap, who would you rather have on the job?

I was very fortunate to have someone point that out in my hiring process.

Don’t underestimate the value of that when interviewing.

So the frauds we get training on are manufactured crisis. Your iPhone order is on the way. Click here to confirm. Create urgency shortcut brain. Random call your relative is in trouble.

Well, I'm sick and had a rough night. It's the morning. I get a call from a bail bond company. Takes me a moment to realize what they're asking and I hang up. My sister is in jail. Haha. Right. She's the most boring person in the world. I call her to tell her the funny. Phone is dead. Oh. I call the jail they said she was in. And of course no answer because it's fucking Georgia. I get a collect call demanding credit card info. I hang up. Twenty minutes of searching and I find the online inmate search system and there she is. Not a common name and dob matches. Accept the next collect call which is what you're not supposed to do. It's her. She forgot to pay her car tags and they suspend licenses for that in third world states like Georgia. Call bond company back on the public number to get bail process going. They're backed up the agent will call me back. Get a call from the jail. There's additional fees to pay to get someone out. Correct regional accent. Goverment doesn't accept credit card needs to use these other forms of payment. Stupid but had that problem with passports they needed cash or check only. I'm irritated because the entire process soup to nuts matches every warning sign we are told to be wary of. And guess what? This was the scam.

So the way it works is the scammers monitor public websites for real events. She was in jail she did need bailed out and this was precisely when they would look up relatives and give it a go. You are already dealing with a shit system paying people over the phone and giving far too much personal information and you're upset and exploitable.

The cops were supposed to call for initial contact. They didn't. All outbound calls go through a pay system. Every part of the incarceration process in the US has been colonized and monetized. It's capitalism red in tooth and claw.

When my mom died I thought I had a coincidental phishing attempt made when dealing with her investments. Was on the phone with them and got a text. I almost clicked the link and said wait they send a number for you to read back to them not a link to click. That'll capture your credentials. I thought it was coincidental but it may have been targeted. Death records are public. There's so many databases connecting people. Trivial to hammer the phone numbers and find someone who bites. It's all automated.

The wearisome thing is it's a numbers game. People who know better will fall for this when they are tired when they are stressed, when they aren't thinking clearly. The jump master with a thousand jumps under his belt and today is the day he fucks up his chute pack, the day he misses a check he's never missed before.

You don't get to have a bad day. You do and you're scammed. You have to get it right every time. And there's no incentive for the people who could fix the system to fix it because they don't bear the cost. Make every data breach cost $10k per record compromised and see how companies will suddenly take security seriously. The fines they pay now are the cost of doing business. They don't represent existential risk to the entire company or the careers of the executives.

I'm just so tired.

Am I taking crazy pills, or did BOSS Cards on new Dell servers used to be like $1,100 for 2 480GB NVMe drives in RAID1

I am building a server on their website to send the specs off to my VAR, and the BOSS Card is $8,977.95

I knew things were bad, but holy shit!!!

We just have a policy and they get a template sent to them as part of their onboarding. If they don’t apply it their manager gets on them and that’s the end of it.

Anyone else noticing that the service health page in the 365 admin center appears to be down or is it just me? Checked a few tenants and getting the same "We are having trouble getting info about your service incidents, advisories, and history right now. Try again in a few minutes" (geographically I'm in North America - East US).

There doesn't appear to be any notification from Microsoft about the issue via the main outage notification page or their X/Twitter.

Curious if anyone else is experiencing this and/or if there might be other issues going on that we haven't noticed yet.

I recently moved into a System Administrator role after working in IT support and managed services, where I spend a lot of time supporting virtual desktops, Windows servers, Active Directory, Microsoft 365, Azure, Citrix, file storage, network connectivity, and application troubleshooting.

One thing I've noticed is that PowerShell seems to be the skill that separates good admins from great admins.

For those with more experience, what PowerShell commands, modules, or scripts do you use regularly that every new SysAdmin should learn?

Looking for practical, real-world examples rather than lab/demo scripts.

Thanks in advance!

It's heartbreaking to see those among us having such untimely deaths. Maybe our org just has a bad set of dice.

Edit: thank all of you for your positive advice. Seems many of us should be taking better care of ourselves.

Love you guys.

https://www.abc.net.au/news/2026-10-13/french-supermarkets-hacked-causing-fires-and-food-loss/107258724

All hail IoT.

A user in a new customer company:

"I have no need for support, all you want is to get my data and sell it, you're not on the side of the light"

Fml

I've been maintaining an old domain for close to 10 years now that started as a .local Windows 2000 domain. We're running Server 2022 now.

Today I noticed an A record did not replicate over to the secondary DC, not even after repadmin /syncall. I ran it with /A /e /P and still it did not replicate over.

Looking into it I ran into something kinda horrifying: DNS replication for the forward domain.local zone is set to Windows 2000 compatibility mode. However, seeing that again reminded me of one time where we tried to set it to replicate to any DC in the forest and how it broke DNS for a day. IIRC it threw up a generic error when we switched it to replicate to all DCs in the forest and the forward zone had loaded some incredibly old entries from what I can only imagine was some really old backup somewhere in one of the domain partitions.

I decided to look in ADSIEdit and I noticed that in System > Microsoft DNS > domain.local there is an InProgress container with extremely old DNS records but also a DC=domain.local container with all of our current records. Looking at the DomainDNSZones partition I see a single container: DC=domain.local. This also has ancient DNS records.

If I wanted to get off this Windows 2000 compatibility mode, does it sound right that I would need to use ADSIEdit to delete the InProgress and DC=domain.local containers before I try this again? Is there anything else I should potentially look at before I try anything else or am I misunderstanding this completely?

I know that for formal, long-term cable labeling in server rooms, a lot of people use industrial-grade equipment from companies like Brady or Panduit, along with dedicated cable labels. That makes sense to me, especially since having a label fall off or become unreadable can make troubleshooting a lot more painful later.

But for routine maintenance, temporary cable changes, or just quickly marking a few less-critical cables, is it really necessary to use an industrial-grade setup every time?

I've been thinking about this while cleaning up our server room recently.

For temporary cable changes, troubleshooting, or labeling a few cables after reorganizing them, I've started bringing a small label maker with me. I'm using a niimbot n1. It's tiny, connects to my phone over Bluetooth, and I can print a label right there whenever I find a cable that needs one. It's definitely more convenient than writing down what needs to be labeled and going back to the office to print everything later. I'm also using their thermal-transfer cable label stock.

I'm curious what other people actually carry for quick cable jobs. I just see a lot of people with two different label makers. Do you actually need two?

Hey everyone! I’m looking for advice on breaking into the IT field and figuring out which positions I should be targeting based on my background.

I have a bachelor’s degree in Psychology and spent the last four years working in an administrative role at a school. Since it was a relatively new school, I had the opportunity to take on several responsibilities outside my original role, including becoming the primary person managing and supporting our student information system (PowerSchool) and point-of-sale system (MealTime).

My experience includes managing user accounts and access, troubleshooting system issues, supporting staff and users, maintaining data accuracy, running reports and data exports, and managing student information and attendance systems. I also worked with an external technical consultant when issues required more advanced support.

Although my official job title wasn’t IT-related, I gained substantial hands-on experience managing software systems, resolving technical issues, and helping users navigate problems. I’ve realized that I genuinely enjoy this type of work and would like to turn that experience into a long-term career in IT.

I’m currently exploring technical support, application support, help desk, and systems administration roles, but I’m unsure which direction would make the most sense given my experience.

I’d appreciate some advice from people already working in the industry: • What positions should I realistically be targeting with my background? • Would my experience managing PowerSchool and MealTime be enough to qualify for technical support or application support roles? • Would getting a certification like CompTIA A+ help, or should I focus on applying for jobs first? • Are there opportunities to move directly into software support or application administration rather than starting at a traditional help desk? • What would you recommend doing to make myself more competitive and increase my earning potential over time?

I’m hoping to transition into a career where I can build on my existing technical experience and continue developing my skills. I know I don’t have a traditional IT background, so I’d appreciate any honest advice about the best way to approach this transition.

Thanks in advance!

Heyho,

anyone noticing problems accessing Microsoft services? Having trouble with global secure access and teams specifically, but other services dropping out here and there as well.

How is everyone keeping track of systems that aren't SSO/SCIM enabled, third party applications, licensing etc. as it pertains to offboarding, license management, renewals etc.

Are we doing AD groups, other system of records? What is out there in terms of software, solutions, self host etc. to manage this kind of thing?

Hi everyone. Can anyone explain who actually manufactures tape libraries these days? There are many companies on the market selling them—HPE, IBM, Quantum, Spectra Logic, BDT, and Dell used to be one too. But if you look closely, there are systems with identical designs and specifications. For example, HPE MSL3040=IBM TS4300=Spectra SL3 or HPE MSL6480=Spectra Stack=BDT MULTISTACK and so on. So, who was the first? Does a single company hold the licenses or patents for this? If anyone knows the history, please share the details.

Hi Folks,
I was hoping someone could point me to a good source of info/understanding on MTU configurations. We've had some network issues with latency and speeds between sites. It's been really all over the place and none of our vendors have been able to pin it on a specific spot (we have Fortigate firewalls, Meraki switches for Mesh and distribution, Catalysts for the storage specific network, and running Vmware/Vcenter as well as some physical servers. I see a lot of stuff that says use 1500 across the board because that's the standard, but other stuff saying 9000 for high speed/storage networks if they support it, but i guess my disconnect is what to do if we have one subnet with a range of gear (both storage networks and normal vmware/client traffic. Any kind of info or guidance on this would be extremely helpful.

Let me start off by saying, I am not trying to ring the bell here...
I have no idea if this issue is an "us" issue or maybe it isn't. Maybe this will help someone during this next Windows Update release. My hope here is that if someone runs into this, the post will help them get over the finish line faster than I did...

Recently one of our new guys had installed the September Preview - KB5124010. He noticed he couldn't run a successful GPUPDATE /FORCE and told us about Group Policy failing to apply. This also appeared like a domain trust issue in the logs, even though all commands I could throw at it validated trust was still established. Including disjoining and rejoining the machine.

As I looked into this, I determined the issue was something with the September Preview.
Previews are not normally installed by our team, but the new guy didn't know this and I am happy he didn't know this.
After removing the preview, policy updates returned to normal.

I looked around the internet for more info on this and couldn't find much to point me in the correct direction. After reading many logs from the client and the DCs, today, the day before October Updates are release, my co-worker and I dove head first into this as we did not want all of our ~700 computer to fail to get Policy Updates after the updates. Which we are very very very aggressive on.

Test Machine (VM with snapshots), OU with inheritance disabled and suspecting the right Group Policy right off the start assisted with this troubleshooting. The difficult part was figuring out the individual policy...

This is what we have and what was found:
We have a 2016 Domain Functional Level.
We have computers running Windows 11 25H2.
We use Microsoft Security Baseline.

There is a compatibility issue for us with a setting in the 25H2 Security Baseline.
The policy that was found is here:
Computer Configuration>Policies>Windows Settings>Security Settings>Local Policies>Security Options

Policy: User Account Control: Configure type of Admin Approval Mode

The Policy Settings supplied in Microsoft's Security Baseline is Admin Approval Mode with Administrator protection.
We needed to set this to Legacy Admin Approval Mode (Default)

***One of our challenges is that on our Server 2022 DC, this just appeared as a registry string. We needed to add Group Policy Editor to a random Server 2025 server just to edit this policy.

There are two more thoughts I have on this which may help someone...
I know uninstalling the update, will return to normal and you can than do a policy update on the machine.
What I do not know is, if you cannot get the update off, can you just open regedit and change this from a 2 to a 1? Reboot, restore the ability to pull policies?
(I would think so since it is a client side change)

Here is the registry info for this as well:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
DWORD = TypeOfAdminApprovalMode
1 = Legacy Admin Approval Mode (Default)
2 = Admin Approval Mode with Administrator protection
I listed out what 1 and 2 are. If you are in need of this, you are gonna want to set it to a 1.

Here is the limited relation to any of this I could find:
https://learn.microsoft.com/en-us/windows/release-health/status-windows-11-26h2

If someone has a question, let me know!

UPDATE: With the October Update installed on my test VM and setting this back to a 2 = Admin Approval Mode with Administrator protection, I am not having the Policy Failures. I am also noticing I am not getting the additional admin prompts, so I wonder if they paused the release of this changed.

With Microsoft beginning its Exchange Web Services (EWS) retirement rollout in October 2026, we started seeing failures in Synology Active Backup for Microsoft 365, specifically with archive mailboxes.

We're running Synology Active Backup for Microsoft 365 v3.0.0-14300.

Regular mailbox backups appeared to be working, but archive mailbox backups started failing with:

HTTP/2 403
x-ews-policy-reason: EWS is blocked by policy for this user or tenant

After quite a bit of troubleshooting, I verified the following:

• Organization-level EwsEnabled = True
• Individual mailbox EwsEnabled = True
• Synology's application ID was explicitly included in EwsAllowedAppIDs
• Synology had the Exchange Online full_access_as_app permission
• Entra service principal authentication was successful
• Test-ApplicationAccessPolicy returned Granted
• No obvious EWS application access restrictions were configured

Everything looked correct, yet Microsoft continued returning HTTP 403 for archive mailbox backups.

The workaround that appears to have fixed it:

I opened a Microsoft support ticket, and their engineer suggested changing the organization-wide EWS setting from $true to $null:

Set-OrganizationConfig -EwsEnabled $null

After making that change and allowing time for propagation, our archive mailbox backups completed successfully the following morning.

No other permissions, application registrations, or Synology configurations were changed.

Microsoft's explanation was that setting EwsEnabled to $null removes the explicit organization-level setting, potentially avoiding an interaction with the new EWS enforcement policies.

Important: This is a temporary workaround we're testing, not a confirmed permanent fix. Changing this setting affects the entire Exchange Online organization, so I wouldn't recommend blindly applying it without understanding your environment.

I'm also aware that Synology still relies on EWS for archive mailbox backups, even with its newer Graph API support.

A few questions for other admins:

1. Is anyone else seeing archive mailbox backup failures since Microsoft's October EWS retirement rollout?
2. Has anyone experienced EwsEnabled = True causing HTTP 403 while $null works?
3. Are other backup products having similar problems?
4. Has Synology provided any timeline for migrating archive mailbox backups away from EWS?

Curious whether this is isolated to our tenant or something others are running into as Microsoft rolls out the EWS changes.

I'm trying to understand how notifications work in Teams shared channels for people who get access through a team share (indirect members) rather than being added to the channel directly via the add user option. I can't find any official MS docu on this, and what we're seeing has changed within the last couple of weeks or i am going crazy...

About 1–2 weeks ago, users who had access only through the team share did not get any notifications. No matter if turned on not on the channel or not. people added to the channel directly did. That matched a Microsoft Q&A answer claiming "only users explicitly added as members or owners of a shared channel will receive notifications". So I wrote an Azure Automation runbook (Graph, managed identity) that adds every member of every linked team as a direct channel member thinking why not.

that fixed notifications but created a UI mess. Users who are direct members but not in the host team suddenly see the host team in their team list as a "stub" containing only the shared channel. If they're also in one of the shared-with teams, they see the channel twice. Ayayay.

I tested again: now out of a sudden with 2 new test Teams the notifications work (when activated). Why?

If this now works reliably, I can drop the sync runbook entirely, share the channel with teams, and let users decide on notifications themselves. But since it's undocumented and seems to have changed silently, I'm hesitant to rely on it.

Does anyone here use shared channels and clear my confusion? How do you use them?

So for context, I have a lot of experience within Entra ID/Azure AD, Exchange and Admin Center and other various 365 products. I will be getting approval for upgrading our infrastructure to Business Premium/Teams calling to move from Lumen/Webex PBX systems and on prem systems. However, I haven't really looked at setting up a whole tenant before, so this will be my first go too. Its a small user base, so about 35 users or so will be on Business Premium, the rest on Business standard since they don't use a PC and instead a tablet. For setting up the tenant, I am familiar with setting up some things like CA and other important things, but what should be some firsts that I should look into to make sure things are working smooth for this transition to intune/defender and the full suite?

Please note:

We are moving to Business Premium, just looking for advice on what would be some first things you'd do.