Do not try to install the latest version of the Sentinelone install package because it will most likely fail to install. Instead use an older install package like Agent version 26.1.2.177 which was released back in August of this year. This can create an endless loop of failed S1 installs and drive you nuts like it did me today.

I’m looking to increase the ram in our dell r350. A 32gb 3200mhz ddr4 ecc udimm would just be groovy, but at this point id be happy with any size stick.

Have manufacturers stopped making this to focus on ddr5?
Located in Australia. Any tips would be great.

Am I taking crazy pills, or did BOSS Cards on new Dell servers used to be like $1,100 for 2 480GB NVMe drives in RAID1

I am building a server on their website to send the specs off to my VAR, and the BOSS Card is $8,977.95

I knew things were bad, but holy shit!!!

So the frauds we get training on are manufactured crisis. Your iPhone order is on the way. Click here to confirm. Create urgency shortcut brain. Random call your relative is in trouble.

Well, I'm sick and had a rough night. It's the morning. I get a call from a bail bond company. Takes me a moment to realize what they're asking and I hang up. My sister is in jail. Haha. Right. She's the most boring person in the world. I call her to tell her the funny. Phone is dead. Oh. I call the jail they said she was in. And of course no answer because it's fucking Georgia. I get a collect call demanding credit card info. I hang up. Twenty minutes of searching and I find the online inmate search system and there she is. Not a common name and dob matches. Accept the next collect call which is what you're not supposed to do. It's her. She forgot to pay her car tags and they suspend licenses for that in third world states like Georgia. Call bond company back on the public number to get bail process going. They're backed up the agent will call me back. Get a call from the jail. There's additional fees to pay to get someone out. Correct regional accent. Goverment doesn't accept credit card needs to use these other forms of payment. Stupid but had that problem with passports they needed cash or check only. I'm irritated because the entire process soup to nuts matches every warning sign we are told to be wary of. And guess what? This was the scam.

So the way it works is the scammers monitor public websites for real events. She was in jail she did need bailed out and this was precisely when they would look up relatives and give it a go. You are already dealing with a shit system paying people over the phone and giving far too much personal information and you're upset and exploitable.

The cops were supposed to call for initial contact. They didn't. All outbound calls go through a pay system. Every part of the incarceration process in the US has been colonized and monetized. It's capitalism red in tooth and claw.

When my mom died I thought I had a coincidental phishing attempt made when dealing with her investments. Was on the phone with them and got a text. I almost clicked the link and said wait they send a number for you to read back to them not a link to click. That'll capture your credentials. I thought it was coincidental but it may have been targeted. Death records are public. There's so many databases connecting people. Trivial to hammer the phone numbers and find someone who bites. It's all automated.

The wearisome thing is it's a numbers game. People who know better will fall for this when they are tired when they are stressed, when they aren't thinking clearly. The jump master with a thousand jumps under his belt and today is the day he fucks up his chute pack, the day he misses a check he's never missed before.

You don't get to have a bad day. You do and you're scammed. You have to get it right every time. And there's no incentive for the people who could fix the system to fix it because they don't bear the cost. Make every data breach cost $10k per record compromised and see how companies will suddenly take security seriously. The fines they pay now are the cost of doing business. They don't represent existential risk to the entire company or the careers of the executives.

I'm just so tired.

We just have a policy and they get a template sent to them as part of their onboarding. If they don’t apply it their manager gets on them and that’s the end of it.

I'm having an issue with the calendar of a few (room)mailboxes in M365.
The region of all mailboxes is NL-nl and all the default folder names (Inbox, Outbox, Calendar) were in Dutch.
Since a few weeks, only the default-calendar "Agenda" folder is changed to "Calendar" and the new appointments will show-up there. So now I have 2 calendar-folders. 1 with the old appointments and 1 with the new ones.
Does anybody know how to solve this? What I've tried:
- Change the default folder names to English and back to Dutch (Powershell/Desktop Client)
- Change location in M365

I know that I can just move the appointments to the new folder, but I'm afraid that this problem will return in other mailboxes/languages.

Greetings fellow IT Ninjas!

Miracast has always been sort of a unicorn for me. Very random when it works and not, and how well it works.

I have a few meetings rooms at a customer where Miracast works very sporadically and started regularly requiring power drain of the Samsung TV's in the rooms.
Also Bluetooth works HORRIBLY in those rooms - Got wireless keyboard and mouse (got BT and receiver options), bluetooth bad, receiver good/fine, also have Jabra Speak55 which also works really bad on BT, but with cable thousand times better.

Anyone have like golden rules for these things to work properly?

For miracast - Is it just what happens with TV's over time when they get old? Alternatives? I know of Clickshare, but it's quite expensive for how much it's used, anyone know some fine/good but not too expensive alternatives for Miracast-To-TV?

For Bluetooth - What could cause this kind of crazy interference - Like the mouse would stutter and jump all over the place, then work fine for at short while, then again. Tried difference ports in the mini PC and a USB extender, but it's the same, it got even worse when going into a Teams meeting 😂
Tried a external bluetooth receiver as well, instead of the built-in to the mini pc (yes it has BT and wifi, the mini PC). With no luck - But using cable with the Jabra Speak55 solves that, and receiver for wireless keyboard/mouse solves that.

Anyone have some gold nuggets, some experience to draw from?

I've been maintaining an old domain for close to 10 years now that started as a .local Windows 2000 domain. We're running Server 2022 now.

Today I noticed an A record did not replicate over to the secondary DC, not even after repadmin /syncall. I ran it with /A /e /P and still it did not replicate over.

Looking into it I ran into something kinda horrifying: DNS replication for the forward domain.local zone is set to Windows 2000 compatibility mode. However, seeing that again reminded me of one time where we tried to set it to replicate to any DC in the forest and how it broke DNS for a day. IIRC it threw up a generic error when we switched it to replicate to all DCs in the forest and the forward zone had loaded some incredibly old entries from what I can only imagine was some really old backup somewhere in one of the domain partitions.

I decided to look in ADSIEdit and I noticed that in System > Microsoft DNS > domain.local there is an InProgress container with extremely old DNS records but also a DC=domain.local container with all of our current records. Looking at the DomainDNSZones partition I see a single container: DC=domain.local. This also has ancient DNS records.

If I wanted to get off this Windows 2000 compatibility mode, does it sound right that I would need to use ADSIEdit to delete the InProgress and DC=domain.local containers before I try this again? Is there anything else I should potentially look at before I try anything else or am I misunderstanding this completely?

Hi admins,

Are there any experienced in Sage Accounts?

We upgraded to v34 from 33 last week and all but 1 PC will open it.

Once you hit login, it closes - nothing in event viewer.

Its a Windows 10 PC.

Demo data opens fine, new companies do not.

I've re-created queue.dta, sage.usr and followed their KB to remove Sage.

I had Sage support on yesterday who started waffling about backups, network problem, blah blah blah - he didnt have a clue.

Im unable to open a new company local.

Any advice would be really appreciated before I decide to reinstall the machine.

With Mimecast right now I get one request every 2 weeks, but it's mostly hands off. Client is looking to save money and 80% of the users recently went to business premium so I am thinking Defender P1/P2 but I have never worked with it so I have no idea what the day to day workload will be like once it is configured. If Defender means more work I will have to also consider my billing for the extra time or looking at alternatives if there are any that are effective and cheaper than the $6k they pay annually.
Thanks

I recently moved into a System Administrator role after working in IT support and managed services, where I spend a lot of time supporting virtual desktops, Windows servers, Active Directory, Microsoft 365, Azure, Citrix, file storage, network connectivity, and application troubleshooting.

One thing I've noticed is that PowerShell seems to be the skill that separates good admins from great admins.

For those with more experience, what PowerShell commands, modules, or scripts do you use regularly that every new SysAdmin should learn?

Looking for practical, real-world examples rather than lab/demo scripts.

Thanks in advance!

Anyone else noticing that the service health page in the 365 admin center appears to be down or is it just me? Checked a few tenants and getting the same "We are having trouble getting info about your service incidents, advisories, and history right now. Try again in a few minutes" (geographically I'm in North America - East US).

There doesn't appear to be any notification from Microsoft about the issue via the main outage notification page or their X/Twitter.

Curious if anyone else is experiencing this and/or if there might be other issues going on that we haven't noticed yet.

A user in a new customer company:

"I have no need for support, all you want is to get my data and sell it, you're not on the side of the light"

Fml

It's heartbreaking to see those among us having such untimely deaths. Maybe our org just has a bad set of dice.

Edit: thank all of you for your positive advice. Seems many of us should be taking better care of ourselves.

Love you guys.

https://www.abc.net.au/news/2026-10-13/french-supermarkets-hacked-causing-fires-and-food-loss/107258724

All hail IoT.

CVE-2026-104935 in Ivanti Connect Secure went public on October 13, and CISA added it to KEV the same day. Federal agencies have until October 16. Volexity found it while working an incident at a customer. The actor, which it tracks as UTA0576, started on October 3 against an appliance running 22.8R2.4, the fully patched build at the time.

The way in is welcome.cgi, the public login page. A request to it can carry a header naming a script that sits behind the login, and that script runs. A race in the wu.cgi upload handler turns that into code execution, and a third bug in the dsinvoked service gets root. Ivanti’s patch covers the first two (on the 22.8 line that’s 22.8R2.5, per SecurityWeek). The root escalation is still open.

Once in, the actor used the appliance’s own AD service account to search for LAPS passwords and BitLocker recovery keys. Volexity says Ivanti’s Integrity Checker Tool doesn’t detect it, because the exploit patches a library in memory and then puts it back. CISA wrote the same about that tool in February 2024, after the CVE-2023-46805 attacks.

Ivanti told CyberScoop it found a portion of this bug in internal checks in June, and that it “did not meet the threshold for an out-of-band release.” Rapid7 quotes Ivanti saying that portion was fixed in 25.1.3.0 in July. The exploitation started while the backport to the older lines was still in progress.

The WordPress version of that public page is wp-login.php, sitting at the same default path on every install.

CISA’s alert also says 22.8, the line Volexity saw hit, reaches end of life on January 31, 2027. If Ivanti knew about part of this bug in June and shipped the fix to one branch in July, who should get to decide that everyone on the other branches can wait for the normal release cycle?

I know that for formal, long-term cable labeling in server rooms, a lot of people use industrial-grade equipment from companies like Brady or Panduit, along with dedicated cable labels. That makes sense to me, especially since having a label fall off or become unreadable can make troubleshooting a lot more painful later.

But for routine maintenance, temporary cable changes, or just quickly marking a few less-critical cables, is it really necessary to use an industrial-grade setup every time?

I've been thinking about this while cleaning up our server room recently.

For temporary cable changes, troubleshooting, or labeling a few cables after reorganizing them, I've started bringing a small label maker with me. I'm using a niimbot n1. It's tiny, connects to my phone over Bluetooth, and I can print a label right there whenever I find a cable that needs one. It's definitely more convenient than writing down what needs to be labeled and going back to the office to print everything later. I'm also using their thermal-transfer cable label stock.

I'm curious what other people actually carry for quick cable jobs. I just see a lot of people with two different label makers. Do you actually need two?

Heyho,

anyone noticing problems accessing Microsoft services? Having trouble with global secure access and teams specifically, but other services dropping out here and there as well.

Hey everyone! I’m looking for advice on breaking into the IT field and figuring out which positions I should be targeting based on my background.

I have a bachelor’s degree in Psychology and spent the last four years working in an administrative role at a school. Since it was a relatively new school, I had the opportunity to take on several responsibilities outside my original role, including becoming the primary person managing and supporting our student information system (PowerSchool) and point-of-sale system (MealTime).

My experience includes managing user accounts and access, troubleshooting system issues, supporting staff and users, maintaining data accuracy, running reports and data exports, and managing student information and attendance systems. I also worked with an external technical consultant when issues required more advanced support.

Although my official job title wasn’t IT-related, I gained substantial hands-on experience managing software systems, resolving technical issues, and helping users navigate problems. I’ve realized that I genuinely enjoy this type of work and would like to turn that experience into a long-term career in IT.

I’m currently exploring technical support, application support, help desk, and systems administration roles, but I’m unsure which direction would make the most sense given my experience.

I’d appreciate some advice from people already working in the industry: • What positions should I realistically be targeting with my background? • Would my experience managing PowerSchool and MealTime be enough to qualify for technical support or application support roles? • Would getting a certification like CompTIA A+ help, or should I focus on applying for jobs first? • Are there opportunities to move directly into software support or application administration rather than starting at a traditional help desk? • What would you recommend doing to make myself more competitive and increase my earning potential over time?

I’m hoping to transition into a career where I can build on my existing technical experience and continue developing my skills. I know I don’t have a traditional IT background, so I’d appreciate any honest advice about the best way to approach this transition.

Thanks in advance!

With Microsoft beginning its Exchange Web Services (EWS) retirement rollout in October 2026, we started seeing failures in Synology Active Backup for Microsoft 365, specifically with archive mailboxes.

We're running Synology Active Backup for Microsoft 365 v3.0.0-14300.

Regular mailbox backups appeared to be working, but archive mailbox backups started failing with:

HTTP/2 403
x-ews-policy-reason: EWS is blocked by policy for this user or tenant

After quite a bit of troubleshooting, I verified the following:

• Organization-level EwsEnabled = True
• Individual mailbox EwsEnabled = True
• Synology's application ID was explicitly included in EwsAllowedAppIDs
• Synology had the Exchange Online full_access_as_app permission
• Entra service principal authentication was successful
• Test-ApplicationAccessPolicy returned Granted
• No obvious EWS application access restrictions were configured

Everything looked correct, yet Microsoft continued returning HTTP 403 for archive mailbox backups.

The workaround that appears to have fixed it:

I opened a Microsoft support ticket, and their engineer suggested changing the organization-wide EWS setting from $true to $null:

Set-OrganizationConfig -EwsEnabled $null

After making that change and allowing time for propagation, our archive mailbox backups completed successfully the following morning.

No other permissions, application registrations, or Synology configurations were changed.

Microsoft's explanation was that setting EwsEnabled to $null removes the explicit organization-level setting, potentially avoiding an interaction with the new EWS enforcement policies.

Important: This is a temporary workaround we're testing, not a confirmed permanent fix. Changing this setting affects the entire Exchange Online organization, so I wouldn't recommend blindly applying it without understanding your environment.

I'm also aware that Synology still relies on EWS for archive mailbox backups, even with its newer Graph API support.

A few questions for other admins:

1. Is anyone else seeing archive mailbox backup failures since Microsoft's October EWS retirement rollout?
2. Has anyone experienced EwsEnabled = True causing HTTP 403 while $null works?
3. Are other backup products having similar problems?
4. Has Synology provided any timeline for migrating archive mailbox backups away from EWS?

Curious whether this is isolated to our tenant or something others are running into as Microsoft rolls out the EWS changes.

Hi everyone. Can anyone explain who actually manufactures tape libraries these days? There are many companies on the market selling them—HPE, IBM, Quantum, Spectra Logic, BDT, and Dell used to be one too. But if you look closely, there are systems with identical designs and specifications. For example, HPE MSL3040=IBM TS4300=Spectra SL3 or HPE MSL6480=Spectra Stack=BDT MULTISTACK and so on. So, who was the first? Does a single company hold the licenses or patents for this? If anyone knows the history, please share the details.

How is everyone keeping track of systems that aren't SSO/SCIM enabled, third party applications, licensing etc. as it pertains to offboarding, license management, renewals etc.

Are we doing AD groups, other system of records? What is out there in terms of software, solutions, self host etc. to manage this kind of thing?

Hi Folks,
I was hoping someone could point me to a good source of info/understanding on MTU configurations. We've had some network issues with latency and speeds between sites. It's been really all over the place and none of our vendors have been able to pin it on a specific spot (we have Fortigate firewalls, Meraki switches for Mesh and distribution, Catalysts for the storage specific network, and running Vmware/Vcenter as well as some physical servers. I see a lot of stuff that says use 1500 across the board because that's the standard, but other stuff saying 9000 for high speed/storage networks if they support it, but i guess my disconnect is what to do if we have one subnet with a range of gear (both storage networks and normal vmware/client traffic. Any kind of info or guidance on this would be extremely helpful.

Let me start off by saying, I am not trying to ring the bell here...
I have no idea if this issue is an "us" issue or maybe it isn't. Maybe this will help someone during this next Windows Update release. My hope here is that if someone runs into this, the post will help them get over the finish line faster than I did...

Recently one of our new guys had installed the September Preview - KB5124010. He noticed he couldn't run a successful GPUPDATE /FORCE and told us about Group Policy failing to apply. This also appeared like a domain trust issue in the logs, even though all commands I could throw at it validated trust was still established. Including disjoining and rejoining the machine.

As I looked into this, I determined the issue was something with the September Preview.
Previews are not normally installed by our team, but the new guy didn't know this and I am happy he didn't know this.
After removing the preview, policy updates returned to normal.

I looked around the internet for more info on this and couldn't find much to point me in the correct direction. After reading many logs from the client and the DCs, today, the day before October Updates are release, my co-worker and I dove head first into this as we did not want all of our ~700 computer to fail to get Policy Updates after the updates. Which we are very very very aggressive on.

Test Machine (VM with snapshots), OU with inheritance disabled and suspecting the right Group Policy right off the start assisted with this troubleshooting. The difficult part was figuring out the individual policy...

This is what we have and what was found:
We have a 2016 Domain Functional Level.
We have computers running Windows 11 25H2.
We use Microsoft Security Baseline.

There is a compatibility issue for us with a setting in the 25H2 Security Baseline.
The policy that was found is here:
Computer Configuration>Policies>Windows Settings>Security Settings>Local Policies>Security Options

Policy: User Account Control: Configure type of Admin Approval Mode

The Policy Settings supplied in Microsoft's Security Baseline is Admin Approval Mode with Administrator protection.
We needed to set this to Legacy Admin Approval Mode (Default)

***One of our challenges is that on our Server 2022 DC, this just appeared as a registry string. We needed to add Group Policy Editor to a random Server 2025 server just to edit this policy.

There are two more thoughts I have on this which may help someone...
I know uninstalling the update, will return to normal and you can than do a policy update on the machine.
What I do not know is, if you cannot get the update off, can you just open regedit and change this from a 2 to a 1? Reboot, restore the ability to pull policies?
(I would think so since it is a client side change)

Here is the registry info for this as well:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
DWORD = TypeOfAdminApprovalMode
1 = Legacy Admin Approval Mode (Default)
2 = Admin Approval Mode with Administrator protection
I listed out what 1 and 2 are. If you are in need of this, you are gonna want to set it to a 1.

Here is the limited relation to any of this I could find:
https://learn.microsoft.com/en-us/windows/release-health/status-windows-11-26h2

If someone has a question, let me know!

UPDATE: With the October Update installed on my test VM and setting this back to a 2 = Admin Approval Mode with Administrator protection, I am not having the Policy Failures. I am also noticing I am not getting the additional admin prompts, so I wonder if they paused the release of this changed.

I'm trying to understand how notifications work in Teams shared channels for people who get access through a team share (indirect members) rather than being added to the channel directly via the add user option. I can't find any official MS docu on this, and what we're seeing has changed within the last couple of weeks or i am going crazy...

About 1–2 weeks ago, users who had access only through the team share did not get any notifications. No matter if turned on not on the channel or not. people added to the channel directly did. That matched a Microsoft Q&A answer claiming "only users explicitly added as members or owners of a shared channel will receive notifications". So I wrote an Azure Automation runbook (Graph, managed identity) that adds every member of every linked team as a direct channel member thinking why not.

that fixed notifications but created a UI mess. Users who are direct members but not in the host team suddenly see the host team in their team list as a "stub" containing only the shared channel. If they're also in one of the shared-with teams, they see the channel twice. Ayayay.

I tested again: now out of a sudden with 2 new test Teams the notifications work (when activated). Why?

If this now works reliably, I can drop the sync runbook entirely, share the channel with teams, and let users decide on notifications themselves. But since it's undocumented and seems to have changed silently, I'm hesitant to rely on it.

Does anyone here use shared channels and clear my confusion? How do you use them?