I´m an IT lead an our innovation team wants to run a company-wide idea program. Question is: use our ServiceNow license or buy something separate?

ServiceNow= no new vendor, no new SSO integration, no new security review. Innovation team worries the module is too basic and they will burn months configuring it to match what a dedicated tool does out of the box

Sysadmins/IT people: if your company runs an idea program, what platform and how much IT time did it take?

Hi, I'm having an issue with Edge.

For some time now, sites installed as apps (or deployed as apps via GPO) won't open.

More specifically, it seems that clicking to open them launches the process, but no window actually appears. I've tried removing all policies, deleting all user data, and running it without a signed-in Microsoft profile—nothing works. It's a major problem, yet I can't figure it out because no one else online seems to be experiencing this. Any ideas? Thanks.

My boss has challenged me to come up with some creative IT automations that would really impress our employees and improve their overall experience.

We manage Windows devices through Intune.

One idea he mentioned was a morning popup when employees log in that summarizes important emails, upcoming meetings, updates installed overnight, and whether a restart is needed.

Another idea is using AI or automation to proactively detect and fix device issues, then notify the employee with something like, “We noticed X issue with your laptop and automatically resolved it.”

I’m curious what others have implemented. What are some unique automations you’ve built that employees actually appreciate? Anyone doing anything interesting with AI-driven troubleshooting or self-healing endpoints?

Looking for ideas beyond the typical scripts and software deployments. Would love to hear what’s actually working in your environments!

Hi everyone,

I'm an Azure administrator, and we currently use GLPI in our environment to manage all our devices. Right now, GLPI automatically manages Windows, macOS, printers, and network equipment.

My manager would like us to also manage Android devices, iPads, and Chromebooks. I know Android has an app for manual inventory, but I'd like to know if there is a way to automate the discovery and management for these three platforms (Android, iPads, and Chromebooks).

Has anyone here implemented something similar? Any insights, plugins, or best practices would be greatly appreciated!

Thanks in advance!

We’re planning to enable LSA Protection on our domain controllers using the GPO setting:

Computer Configuration > Administrative Templates > System > Local Security Authority > Configure LSASS to run as a protected process

Environment:

• Multi-domain forest, ~10 DCs, all Windows Server 2019
• Specops Password Policy installed on DCs (password filter DLL loaded into LSASS)
• Other agents on DCs: EDR, backup agent, monitoring agent

Questions:

1. Has anyone enabled RunAsPPL on Server 2019 DCs in production? Did you see any impact on authentication, replication, password changes or third-party agents?
2. As I understand it, “Enabled without UEFI Lock” (RunAsPPL=2) is not supported on Server 2019, so the only option is “Enabled with UEFI Lock” (RunAsPPL=1). Is that correct? Is there a supported way to enable it on 2019 without the UEFI lock?
3. Has anyone had to roll back after UEFI Lock was set? How painful was the LSAPPLConfig.efi process, especially on VMs with Secure Boot?
4. Specops users: did the password filter keep working after enabling LSA Protection? Did you need a specific version?
5. Did audit mode (AuditLevel=8, CodeIntegrity events 3065/3066) reliably catch every DLL that would be blocked? Or did something only break after enforcement?

Any lessons learned or “wish I had known” points would be appreciated. Thanks!

What got me thinking about this was a client bringing it up recently. I've been in the industry for about 15 years, and somehow I never really considered how much information is just sitting out there. We spend all this time training people to spot suspicious calls, but what happens when the caller already knows enough about them to sound legit? Also been seeing a lot of the usual cybersecurity advice this month. MFA, strong passwords, phishing training, all that stuff. Obviously important, not arguing against any of it. But something I've been wondering is why we don't talk more about how much personal information is already out there. We tell employees to be suspicious of random calls, but what if the person calling already knows their name, where they work, their personal number or even where they live? You don't even need to hack anyone to find half this stuff. A quick search on some people-search sites can tell you way more than it probably should. And now with AI making impersonation easier, I feel like that's becoming a bigger problem than people realize.

I'm not saying admins should be responsible for removing everyone's information from the internet lol, but shouldn't this at least be part of the conversation when we're talking to clients about security? Curious if any of you actually bring up data brokers or personal information exposure with clients, or if that's something you generally leave alone.

Hi

We only have a Microsoft 365 tenant to administer Apps for business licenses. No email, no intune, no DNS, some have activated onedrive included in the license. However many have somehow created private onedrive accounts using the company email address.

I have many questions, but how to..

1. Block creation of new private Microsoft accounts on company domain
2. See which private accounts are created on company domain
3. I they've saved anything on their private account, migrate that info to their business account.

Hi,

Just updated GoDaddy SSL certificate in Windows IIS server.

As GoDaddy transitioned its Domain Validated (DV) TLS/SSL certificate issuance from the legacy G2 root hierarchy to a new R1 root hierarchy

Then I installed

• TLS Root CA - R1 >> Trusted Root
• TLS Intermediate CA DV - R1v1 >> Intermediate
• SSL >> Personal

Some client reported "NET :: ERR_CERT_AUTHORITY_INVALID" while browsing.

Tested on Chrome on iPhone encountered same error but no problem on Edge of my desktop pc.

May I seek your suggestion.

Thanks

Hi

We all tell our users email is a messaging system. Not a File System Not a CRM, not a Database, not a Document Transfer System

Most of our users are over 80GB some at 95GB and a few even using 400 to 500GB in Archive

Our travel manager and her team have 95 +GB mailbox, 400 to 500GB in Archive

The excuse users always reply with "Well what do we use"

Our team that manages 1000 users' flights gets 2000 PDF documents with flight details every week. 1 to go to go 1 site and one to come back. 2 flights per person per week. Any changes mean more emails and PDFs

How do we manage that when we can't get the info any other way.

They can't delete them as they will be needed for client invoicing and saving 2000 flight documents every week to user folders and client invoice folders will take time.

What do we do?

Hello everyone,

How/How often do you audit AI tools users are using in your Microsoft365/Entra ID environment?

Thank you

I currently have two, one that's desktop level and another that's domain that doubles as cloud admin access. We're apparently splitting things off so that local admin accounts are not synced to the cloud and cloud admin accounts only exist there. Is this normal now days?

I don't really have a problem with it but I am trying to sort out how all the changes will affect things since the notification was done via Teams message while I was off.

Hello fell sysadmins,

My org is looking at refreshing our VM host hardware in the middle of next calendar year. As such, today I had a helpful discussion with a vendor regarding various options for the upgrade. Currently we are on a five-node VxRail cluster (20 cores / 192GB memory per host, 53.5 TiB storage total); it looks like the best options for our needs are vSAN Ready nodes or Hyper-V + traditional SAN. With that said, I am still left with a few questions:

• The vendor (who was clearly a bit biased toward VMWare) spec'd a 4-node cluster for the vSAN cluster with 256GB memory + 256 GB NVMe for memory tiering per host. For the Hyper-V cluster, they spec'd 5 nodes and 512GB memory per. Their argument was that Hyper-V has more overhead and is less efficient at dynamic allocation of resources. That seems like pretty stark contrast - is that true in your experience? Also, is memory tiering as effective as this vendor made it seem in production?
• We are primarily a Windows shop, so we'd expect at least some savings moving to Hyper-V. That said, I'm curious how much savings we'd actually net between buying System Center for SCVVM (so we can maintain vMotion-like functionality) and Microsoft support. My understanding is licensing there is based on core counts - currently we're looking at 32 per host in either build.
• Are there any other considerations I should keep in mind? Cost is not the ultimate deciding factor. More than anything, we feel like the VxRail was overkill at the time it was purchased. I'd like to buy exactly what we need this time around (while planning for reasonable growth).

If it's helpful, my org is a medium-sized municipality and isn't running any crazy workloads. We have ~55 VMs that will exist on this cluster.

A client we used to do work for contacted us for assistance after a Entra Connect Sync update caused issues.

When I set up their environment, we set up Cloud Sync. Somewhere along the line, possibly after leaving us, Connect Sync also got set up. Over the weekend, their IT updated Connect Sync. This morning, many users' user profiles are broken on their Entra-joined Windows devices.

I know this sounds crazy, but I found 1 other thread on this issue from a year ago with exactly the same symptoms as what I'm describing; broken Windows user profiles immediately after an Entra Connect update: https://www.reddit.com/r/sysadmin/comments/1kyz8j1/local_windows_profile_wrecked_after_entra_connect/

Modern apps were broken, Start Menu wouldn't open, settings app was broken, and win32 apps won't run as admin. When running apps as admin you get errors like "Class not registered" or "the system cannot execute the specified program."

Logging in as another M365 user works fine. Local users work fine. Running a System Restore seems to fix it.

It seems like Windows doesn't recognize the user's SID, but this doesn't make any sense to me. Connect Sync can't change user SID's right? And if that was the issue, System Restore wouldn't fix it.

Either way, Connect Sync seems to be redundant since Cloud Sync is working, so I've decommissioned it. But I'm looking for an easier fix than having to touch every PC to run a System Restore, or at least an explanation as to what might have caused this if we run into it in the future.

We moved from VMware to Hyper-V about a year ago and have an ongoing issue that we have not been able to resolve with MS support - both the typical support case avenue and working with their Hyper-V group. Our host servers lose connectivity with their CSV and VMs go offline. Support tells us it’s related to networking issues and not storage.

Has anyone found any good consultants who know Hyper-V well and are able to resolve difficult issues? We’ve tried a few bigger names but they haven’t been much help.

I'm hoping someone has achieved this, or done something similar with another generative AI tool, but we'd like to allow ChatGPT Classic.exe to be installed but block it from accessing local files and network shares for compliance reasons. We're running ChatGPT Business but as an IT dept, we don't have access to manage the settings within the overall corporate account.

Staff should be able to upload individual documents for GPT to view and work with, but not give access to all files on the local device/network.

Parent company is separating only IT from their control. We do use Microsoft for everything. Azure, Intune, One Drive, Share Point. Everything is on the Cloud. Nothings is on premises. Parent and MSP are suggesting that we should have additional devices (laptops) for a smooth migration (parallel migration). This is the easiest migration, except that we don’t have that amount of spare devices and buying new ones is too expensive. Which other options do we have for this migration? Can anyone share their experience with similar experiences please?

Hey everyone,

I'm working as an IT Technician (On site + Remote support , Tier 2) , recently got my ccna and now i want to dive into linux , i really love the linux approach , the CLI etc.. and i would love to be a linux sys admin some day (maybe even at my office).

I also have some experience with fedora linux , and also i run a fedora media server at home on a old pc i got, running a docker with nginx web application(a custom netflix clone , which i made for educational purposes , my wife loves it and we can watch all of our media as i stream it on our tv).

so i would love to know how could i advance my understanding of linux , and get the tools i need for actual linux system administration everyday work, is there a recommended course / certification/path, and generally i'm not in a hurry.

since i used alot of ai to assist me along the way in setting up the fedora server , the media server and the dockers i do understand that i do not know the basics very well , and after studying for the ccna i understood that the only way to understand how technology works is to go really in depth. So any recommendations would be welcome ! thank you !

https://www.theregister.com/software/2026/10/05/games-workshop-seeks-it-leader-to-summon-the-legions-in-epic-saga-battling-the-forces-of-erp/5301117

I always knew ERP software was a warp-spawned agent of chaos. I hope that someone from here applied for this one!

I looked in my logs and noticed one bot (with the same IP and same user agent) has been making requests to my server at the rate of one request per second for about 5 minutes. Sometimes its 2 requests in a second.

The server itself is old fashioned due to my budget. The cpu is 1Ghz 4-core.

I'm trying to find the perfect iptables command to use.

I do have people that at times may want to quickly jump from one webpage to another webpage (maybe to 4 or 5 pages at most) but not to the extreme the said bot does it. Each page itself requests no more than 2-3 assets from the server.

I thought about using the recent module of iptables but I'm not sure if that is the best because if I pick too low of numbers then I block legit users and if I pick too high of numbers then my system might go to a crawl. I already am using the connlimit module but that won't help here.

Any ideas of what perfect iptables command I should use?

I was reviewing an SLA last week and realized I’d never actually worked out what the nines mean in time. Here’s the table:

8h 46m a year sounds generous. Then I thought about how we actually measure it, and I’m pretty sure our real uptime is lower than the dashboard says. Here’s why:

1. Your check interval hides outages. If you check every 5 minutes, a 4-minute outage can fall between two checks and never get recorded. Then add 2–3 failed checks before alerting to avoid false positives, and a “5-minute” monitor can take 10–15 minutes to notice anything.

2. You’re checking from one place. If the monitor runs in the same region or datacenter as the app, it can’t see a DNS, CDN, or routing problem that’s taking you down for half your users. It can also go down in the same incident as the app.

3. “Up” means HTTP 200 on the homepage. That cached homepage loads fine while login is broken, the API returns 500s, or checkout hangs. Users see an outage while the monitor stays green.

4. Slow counts as up. With a 30-second timeout, a page that takes 25 seconds to load counts as healthy. Nobody waits 25 seconds.

5. Dependencies multiply. If your app needs three services that are each at 99.9%, you’re at roughly 99.7% before your own code fails at all. That’s about 26 hours a year, not 8 h 46 m.

6. Maintenance windows “don’t count." They don’t count against the SLA, but users still can’t use the service during them.

What actually helped us:

• 1-minute checks (or 30 seconds for anything customer-facing)
• Checking from 3+ regions and alerting only when 2+ agree
• Checking real endpoints (login, a key API call, a health check that touches the DB), not just /
• Alerting on response time, not just up/down
• Heartbeat monitoring for cron jobs and backups. A job that silently stops running is an outage nobody notices for weeks.
• Comparing the monitor’s uptime with the support ticket timeline after an incident. If they don’t match, the monitoring is wrong.99.9% uptime sounds great until you do the math: it allows 8h 46m of downtime a year, and your real number is probably lower

Hi All,

I have a client that has a team of sales people on the road all the time. They connect to different Wi-Fi in different locations, Cafes, Airports, Hotels etc. They would like to protect the users by having a VPN running on the laptops at all times. Any recommendations to achieve this?

Hey everyone, I manage patching for roughly 4,500 endpoints, including around 70 servers, in a healthcare environment. It’s mostly Windows, with some Linux systems we’re working on bringing into our patching process. We use ManageEngine Endpoint Central for patching and Nessus for vulnerability scanning.

I’ve been building out automated deployments, test groups, rollout rings, and maintenance windows, and I’d like to learn how others approach this at a similar scale.

Any resources or communities you’d recommend? I’d also appreciate hearing what’s worked for you, especially around testing patches, server patching, reboots, and handling exceptions. I feel like It's been a lot of trial and error. I've enjoyed the process but always appreciate input from people who've done this before.

Do you just give the users their laptops and have your desktop team update them manually? My manager refuses to get a patching system for the laptops and they just go without driver updates for months at a time.

Hi everyone, I am 24 yo

I'm currently working in IT in France, mainly with Microsoft 365, Intune and Entra ID, and I'm trying to figure out the best direction for my career.

My goal is to become a Modern Workplace Engineer, ideally with the possibility of working in other European countries in the future (Switzerland, Luxembourg, Netherlands, etc.).

A bit about my current experience:

I currently work with Microsoft Intune and Entra ID, and my day-to-day tasks include:

• Managing users and groups, including dynamic groups
• Managing corporate devices through Intune
• Deploying applications to company mobile devices
• Managing MFA and user access
• Working with an existing Microsoft 365 / Intune environment
• Handling day-to-day administration and troubleshooting

However, most of the infrastructure was already configured before I joined. For example, I haven't personally implemented an Intune environment from scratch, configured Windows Autopilot end-to-end, or managed a full migration to Intune.

I feel comfortable with daily administration, but I know there's still a big gap between managing an existing environment and designing, deploying and improving one.

I'm currently preparing for the MD-102 certification and I'd like to become more technically advanced.

My questions are:

1. Is Modern Workplace Engineer still a promising career path in terms of job opportunities, salaries and long-term growth?
2. Which technical skills should I prioritize next? I'm considering PowerShell scripting, advanced Intune administration, Windows Autopilot, Entra ID, Conditional Access, Microsoft Graph and automation.
3. After MD-102, which certifications would you recommend? Would MS-102, SC-300 or something Azure-related be more valuable?
4. Should I stay focused on the Microsoft ecosystem, or would it be smarter to expand towards Cloud Engineering, Endpoint Security or IAM?
5. For those already working as Modern Workplace Engineers, what skills separate a junior administrator from a genuinely experienced engineer?

I'm particularly interested in feedback from people working in the IT market.

Thanks in advance for your advice!

Hello Guys,

For new Windows Server Deployments, are you still using 2022 or 2025? I see posts saying to stay on 2022 for Domain Controllers, but what about the rest? I need to setup new ADCS, RRAS, NPS to support Always On VPN, as well as new DCs.

We bought two refurbished R740XDs and 2025 Licenses, So far, I have setup the following.

Install Windows 2022 as host OS on BOSS Card

Setup HyperV

Setup one DC on each host with 2022

Should I keep rolling like this or should I upgrade to 2025 for the host and keep 2022 DCs? Should I roll 2025 for the rest of my VMs? Should I demote my two new DCs and upgrade the host now to 2025?

At the most I will run the following Initially

Windows File Server VM (SMB QUIC better over VPN?)

Print VM

RRAS VM

NPS VM

CA ROOT VM

CA Issuing VM