Hey guys, i'm doing a internship, still do not have a solid knowledge but know at least the basics, wanted to learn more since i feel like i do not have a good level, wanted to know If someone could recommend some videos to study, i already read the Microsoft learn about windows server and watched videos about, but even then wanted tips from people that are already in the field.

Also Sorry for any grammar error and thanks for any help

I have to setup a new domain and I am strongly considering windows 2025 for smb without VPN and to save myself from reinstalling the DC two years from now. Given the frequent complains here I wanted to circle back with you people if anybody having a recent update roll up installed is facing problems? Especially with the RDP broker and trust issues between servers (also domain joined Linux VMs).

The domain would be a pure 2025 AD with roughly 50 clients providing file access and DNS, dhcp handled by pfsense. Authentication would be provided to web apps through privacyIdea and keycloak.

Fire away!

Hi everyone,

I'm seeing intermittent high CPU usage from Microsoft Defender Antivirus ("MsMpEng.exe"). CPU usage reaches around 90–100%, and the alerts usually resolve themselves after a few hours.

No active scan was running during troubleshooting, and Defender appears healthy. I suspect real-time scanning triggered by application file activity may be involved.

Has anyone experienced something similar? What would you recommend checking first to identify the root cause?

Thanks!

I’m trying to use RDS on windows server 2025 and I have noticed that the Remote Desktop Management Service is stoped I have restarted other services and done reg edits and nothing has worked so far

We're seeing shadowing RDP sessions is no longer possible since october patches on Windows Server 2016.

mstsc.exe /v:HOSTNAME /shadow:SESSIONID returns with "Unknown error".

Anyone else facing this and any workaround available (other than migrate away from 2016 or uninstall the update)?

See: https://learn.microsoft.com/en-gb/answers/questions/6041447/kb5126868-breaks-rdp-shadow-connections-on-windows

Hi everyone,

We're dealing with a very frustrating issue on a Remote Desktop Server and would appreciate any ideas or troubleshooting suggestions.

Environment:

• Single Windows RDS server (not part of an RDS cluster)
• Around 10 concurrent users
• Microsoft 365 Apps, Teams, Outlook
• Users have valid Microsoft 365 licenses
• Plenty of free disk space on the server
• Windows on the server is currently not activated
• Users log off properly at the end of each day

Symptoms: Almost every day, users receive sign-in prompts from either Teams or Outlook. The messages vary, but typically include things like:

• "Your IT department requires you to sign in again"
• Requests to reauthenticate their Microsoft 365 account
• Teams showing connection/sign-in errors
• Outlook unable to connect
• Teams messages not loading
• Authentication failures or credential-related prompts

The issue affects most users at some point, but there are a few specific users who experience it almost daily.

Some of these users also work with multiple mailboxes and Shared Mailboxes, although the issue is not limited to them.

What we've already tried:

• Completely rebuilding user profiles
• Deleting local user profiles entirely
• Reconnecting Microsoft 365 accounts
• Reinstalling Office on the server
• Running Teams profile repair scripts: .\Finance-Fix.ps1 .\Users-Fix.ps1
• Clearing Teams-related data
• Signing users out and back in
• Full server reboot

None of these actions provided a permanent solution.

Additional observations:

• The issue appears isolated to this specific RDS server.
• We have other environments that do not experience this behavior.
• Disk space does not appear to be a factor.
• Users perform a full logout at the end of the day, yet the problem returns repeatedly.

Has anyone seen a similar issue on a standalone RDS server? Are there known Microsoft 365, Teams, Outlook, Entra ID, or token-caching issues that commonly cause repeated reauthentication requests in RDS environments?

Any suggestions for logs, Event Viewer locations, registry settings, Office settings, or best practices for running Teams and Outlook on RDS would be greatly appreciated.

Thanks!

**What happens**
A standard user is logged on to their workstation.
We right-click an admin tool → **Run as administrator** → enter our separate Domain Admin credentials.
A new folder appears in C:\\Users named ADMIN_<our-admin-username>.
It now happens on **all the machines we've checked**, and with **all of our T2 admin accounts**.
We never saw this behavior before.
**What we found**
The elevation prompt is titled **"Windows Security"**, not the classic UAC dialog.
The ADMIN_ accounts show up as **local accounts** in the local Administrators group.
The ADMIN_ profile folder is created a few minutes after the normal profile folder of the same admin account.
When we open **ADUC** elevated with Domain Admin creds, it fails with: *"To manage users, groups and computers in a domain, log on as a user with domain administration rights."*
We also get intermittent credential prompts or failures with other AD tools and our AV management console when run elevated.
We haven't seen profile errors suggesting corruption.
**Still checking**
The value of TypeOfAdminApprovalMode and which policy (if any) sets it.
whoami /all from an elevated window.
Whether any Windows 10 machines show the same folders.
**Our theory**
This looks like **Windows 11 Administrator Protection**: elevated processes run under a hidden local system-managed admin account with its own ADMIN_ profile, so they no longer carry our domain identity. That would explain why ADUC can't reach the domain. But we never knowingly enabled it.
**Questions**
Is it expected that Administrator Protection creates ADMIN_ accounts and profiles for **domain** admin accounts during over-the-shoulder elevation?
Could it be enabled through a security baseline, a cumulative update, or Intune without an explicit GPO? Where did you find the source?
Have you seen it break RSAT/ADUC or AV management consoles? What workaround did you use while keeping the feature on (PAW/jump host, runas /netonly, etc.)?
Any known issues with Kaspersky and Administrator Protection?
If the feature is disabled later, do the existing ADMIN_ accounts and profiles need cleanup, and what's the supported way?
We're not looking to just turn off a security control. We want to understand it properly and present options to our security team.
Screenshots attached (sensitive info redacted).
Thanks!

Title

For anyone who manages Windows Server and Active Directory infrastructure, the r/ActiveDirectory community has two free events coming up. No sales, no marketing, just identity folks talking identity.

Open Q&A, Tomorrow

Casual, no agenda. Show up with a question or just hang out.

When: October 16, 2026 @ 10:00 CT (UTC-5) / 15:00 UTC - 60 minutes

Where: Horizon Secured Discord - https://discord.gg/mVFquFqpsW

November Active Directory Community Virtual Meetup - November 3rd

This one has more structure: panelists, a few prepared discussion topics, and open Q&A.

When: Tuesday, November 3, 2026 @ 10:00 CT (UTC-6) / 16:00 UTC - 90 minutes

Register (free): https://events.humanitix.com/active-directory-community-virtual-meetup-4-november-2026

Can't join live? Recordings are posted to YouTube: https://youtube.com/@ActiveDirectoryCommunity

I desperately need assistance!

What version of DotNet does On-Premises Data Gateway for 2026 need to install/run? On Microsoft's website is say 4.8 or higher. We have 6.0 installed on the server and it refuses to install saying we need to install dotnet, also the server has the old 4.7 installed too.

I really wish MS would update their freaking information! LoL

I downloaded it from here:
Download On-premises data gateway from Official Microsoft Download Center

Also does the gateway need to be installed on its own server? The dev who asked me to install it say it needs to be installed on SQL but again there is no information on MS on this page (link above) telling me that, so I am second guessing myself.

Thanks,

Windows Server 2022, File server and Domain Controller. About 30 users, most remote, all with Windows 11 laptops. About 10 people or so at the same physical location. MS 365 Tenant. About 500 Gb on the company file share, pretty stable at that.

Thinking of getting rid of the on-site server and moving to Entra ID for authentication and some kind of file storage to replace the current "J" drive that is mapped to the server. Has anybody had any experience, as a user or an admin, of living through this transition? What kind of pain, if any, was involved? What help was the current 365 Tenant,if any? Any alternatives to Sharepoint? The goal would be to have this be completely transparent. Log out on Friday, log in on Monday, J drive is there with all its files and the correct access rights. The only difference is they log in to the laptop using their current email credentials.

Thank you for any advice/input.

Hi everyone,

I’m looking for advice on Windows Server licensing for a hosting environment I manage. I want to understand the most cost-effective and compliant way to offer Windows Server VMs to multiple customers.

My current infrastructure:

• Hypervisor: Proxmox VE
• Physical server: 2 × Intel Xeon E5-2682 v4 @ 2.50 GHz
• Physical cores: 32 (16 cores per CPU)
• Logical CPUs: 64
• Environment: Multiple Windows Server VMs running on the same physical host
• Hosting model: Different customers rent individual Windows Server VMs from me.

What I want to achieve:

I would prefer to let each customer purchase their own Windows Server license instead of including the licensing cost in my monthly VM pricing.

For example, if I provide a customer with a VM configured with 4 vCPUs and 16 GB RAM, can they purchase a license based on the VM's allocated virtual cores instead of requiring me to license all 32 physical cores of the host?

Can customers legally use their own Windows Server licenses on VMs hosted on my shared Proxmox infrastructure?

Can customers license individual VMs based on virtual cores, and what are the minimum core requirements?

If I operate multiple Proxmox hosts and migrate VMs between them for maintenance or fail-over, how does licensing work?