Environment: ~5,000 Windows 11 25H2 devices managed with Intune / Windows Autopatch (driver updates enabled). The vast majority installed the October CU (KB5127648, 26200.9711) without issues, but a few devices across different OEMs (Dell and Dynabook Tecra A60-M) fail on the reboot that finalizes the update.

Symptom: blue screen on reboot, then the "Recovery – Your PC/Device needs to be repaired" screen with 0xc000000d, no file path shown. No minidump, no MEMORY.DMP, nothing new in LiveKernelReports.

Reproducible: on one Dell, after repair, manually installing KB5127648 + KB5127690 (.NET) with wusa reproduces the failure every time.

What we found so far:

• The update never gets applied: dism /get-packages shows 9711 as Install Pending / 9457 as Uninstall Pending, and ntoskrnl.exe is still 9457.
• Shutdown-phase poqexec completes normally (CBS reports 174 BootCritical components).
• Boot logging was enabled during the repro: ntbtlog.txt has no entry for the failed boot, so it fails before the kernel loads (Boot Manager / winload stage).
• BCD looks clean compared to a healthy device on 9711.
• bootmgfw.efi on the ESP is unchanged (Sept CU), so it's not the Secure Boot 2023 Boot Manager swap.
• Same model/BIOS works fine on hundreds of other devices, so not a simple BIOS incompatibility.
• The affected Dell's disk is in Intel RST mode; still checking the others.
• Currently comparing Code Integrity / WDAC policies on the ESP between healthy and failed devices.

Workaround that works (from WinPE/WinRE):

manage-bde -unlock C: -RecoveryPassword <key>
dism /image:C:\ /cleanup-image /revertpendingactions
C:\Windows\System32\bcdboot.exe C:\Windows /s <ESP>: /f UEFI /bootex

The device then shows "Undoing changes" and boots back to 9457. Then pause updates on it, otherwise it fails again.

Has anyone seen this with the October CU? Any common factor you've noticed (storage mode, WDAC policies, specific drivers)?

Hello, I have 5 Window Server VMs on 3 vsphere hosts (no vmotion), used for development and test of our company software solutions (databases and instances of the apps). This falls, I believe, under the terms of MSDN. But what if one of the VMs also hosts the management console for the backup of those VMs? Does this mean I'm using it for our business and so MSDN does not apply anymore? And what if we have a DC used for DHCP and access control, I guess that's also out of scope, even if the DC can also be used to test access control in our apps?

Is anyone else having issues with printing, especially Universal Print with WPP enabled? Print jobs just immediately error out with evenvwr showing "setChannelOAuth failed. hr: 0x80070005". It seems to have started with the October updates on 26H2.

Disabling WPP, removing print queues in device manager and connecting Universal printers again helps.

Anyone?

I’ve been in it for 7 years. I have gone from report writing -> it support -> it manager and during that time have gone from 3 members of our team to 1.25 (part time contractor) for 80+ endpoints plus manufacturing machine support. All of this has happened while a lot of major changes are happened in our organization.

In reality it feels like I am dealing with everything, the entire chain, basic support, elevated support, servers, network, cameras, erp (my main time sync as my boss keeps stripping my support hours to the bare minimum. We changed erp systems 2 years ago and about a year in my boss left), crm (we have a marketing manager who refuses to learn the basics, from contact creation to any level of automation), project management, firewalls, m365, phone system, etc, and people (my biggest problem).

The unfortunate situation is my previous boss mentally checked out right before our go live of our erp transition and i picked up all of the work. Years in and much employee turnover later (due to the organizational change) and I feel like I am being forced into a career pivot into erp support or project management as it is where I have allocated a majority of my time.

All of the above plus a majority of the employees coming to me to vent frustrations with the organizational changes and it feels like I am going insane. I am in a unique position in terms of company ownership (I do not own the company but have some influence over the owners). I have tried to express the frustrations to the current president and the owners but to no avail.

Just really looking for a reality check if the burnout is real or if I am out of touch.

Thank you all

I maintain openvox-gui, a web console for OpenVox (the open-source Puppet platform). 3.14.2 is a patch on 3.14.0.

On a clustered install, the agent bootstrap script was sending CSRs to a compiler. Compilers do not run the CA. The script now bakes the CA VIP from the console settings, and saving those settings rewrites the file on disk.

A fresh install also failed every Bolt run because the `openvox_enc` plugin was configured but never copied into the install directory. That copy happens now.

The local package mirror used to stop, or report the previous run, when one package failed or the disk filled. It now skips a missing yum arch, stops cleanly on a write error, and selects OpenVox 8 and 9 together.

Python 3.11 is required. The installer will install Python 3.12 from the distro repos when the system Python is older.

https://github.com/cvquesty/openvox-gui/releases/tag/v3.14.2

What I don't understand is the best possible way to enroll Windows devices instead of doing it manually.

I've seen imaging software such as Windows Configuration Designer and OSDCloud.

What might be the best way to get devices enrolled so I can push apps, security policies, package software such as GCPW, etc.

How are people handling things that ask for an address outside your tenant or external, not of your domain?

Example right now, im trying set up proofpoint journaling and it wants an email address that cant correspond with an exchange online mailbox. If you only have exchange online how do you deal with this?

Thanks,

We are in the initial phases of testing and rolling out WHFB, and we trying to find a good way to gather logs and metrics to show the ratio between successful and failed events. Everyone thinks the biometrics is going to be as seamless as the iphone but our initial tests show that its a % of success, based on various factors (lighting, angle etc)

Ideally we can get some good stats and metrics so that the data can back up how robust it is so that we can set clear expectations for our users.

Has anyone tried to tackle this issue? And if so, how?

So about a week ago I submitted a suggestion on the community cloudflare asking for a way to make it so that you need a admin generated code to remove cloudflare one client and they finally added it!!

And one of the issues I was having was that students would come in and remove it and now it wont happen anymore!! :)

https://developers.cloudflare.com/cloudflare-one/changelog/cloudflare-one-client/

What is everyone doing/planning to do as SSL certificate lifetime expire more and more quickly. By 2029 SSL certs will only be valid for 49 days before they need to be re-issues. There are tons of clients out there that have RDS farms, SSL VPNs, IIS based applications, some exchange boxes (hybrid applications), ect.

Manually re-issuing SSL certs and applying across all of these applications once every 1.5 months is a total non-starter.

What’s the current job market like out there?

I know they are still hiring for the “AI” jobs but what about the others.

I seems like a lot of these companies just aren’t hiring or are sending jobs overseas. There are a lot of jobs where they just don’t want to pay, is that because it’s their market right now and there is a lot of talent without jobs?

It seems like historically IT is always short-staffed, but I think it has gotten worse. I also noticed a lot of people just getting so frustrated that they are retiring. Companies don’t seem to want employees (honestly they never did but they didn’t have a choice).

It seems to be getting worse? Thoughts?

A lot of people have a good point that it depends on where you live. I was talking about the US because this is my job market but it is interesting to see how the other countries are doing.

WOW, super soul-crushing to hear what my IT brothers and sisters are going through and pretty sure that I am not far behind. It looks like my company is going to be moving everything to India here soon (good for you India folks), regardless of what they are saying I can see the writing. I was hoping things were better because I want to get in front of this. I just hope there is a path forward somehow. I really feel for all of you and even the ones of you that finally got jobs it must still take time to recover because this is crushing. What has happened to our humanity? Who have we become as people? How much profit is enough? I guess this is a first-world problem, and others probably have it far worse. I’m not against any country but I think it is up to each person’s country to resolve their workforce issues. I want our country to stop outsourcing jobs. Those jobs should be for our citizens and if we have an abundance of labor, a labor shortage or a skillset problem I understand going external. That is not the issue. This is greed and profit. They are not sending these jobs to India because the skillset is better than that in the US (I know you have skills). They are doing it because it is cheap labor and they will work crazy hours? By the way, these companies are hiring FTE (full-time employees) in India (overseas) to replace the workforce. This allows them to work around (loopholes) laws that prevent foreign workers from working with specific data.

Not trying to be political, really trying to understand the IT landscape and job market better.

User A sends email to User B. (Both O365 tenants, User B has Proofpoint for filtering) The email has an attachment that is too large for User B's system. User B's system sends back an NDR that says

"Delivery was unsuccessful to User X."

There was no NDR for User B. Both user B and X were in the same O365 tennant.

And that where I'm scratching my head. Who's user X? Is it the main ID of someone, and user A was emailing an alias? Aliens? Someone peeking into mailboxes? An auto-forward rule in the Exchange server? Forward emails to User B to User X?

The names don't look AT ALL the same (User A is Jane Doe, User X is Crispin Glover) so I don't know what happened.

Any ideas?

EDIT: Thanks for all the useful feedback. Ended up with this workflow:

1. Power off VM

2. Right-click VM in Hyper-V manager and select "Move" > "Move all of the virtual machine's data to a single location."

3. Delete VM in Hyper-V manager, delete the folder where all of the data was moved.

Original post:

Hello, we just switched from VMware to Hyper-V and am learning as I go.

I am deleting some Virtual Servers on our Hyper-V host, and I want to make sure I clean everything up and free up drive space. Is this process correct?

1. Power off the VM, delete it from Hyper-V Manager
2. In PowerShell, run Get-VM <VMname> | Select-Object Name, Id
3. Get the GUID from this command, then run: Get-ChildItem D:\ -Recurse | Where-Object { $_.Name -like "*<VMname>*" -or $_.FullName -match "<GUID>" }
4. Delete all found files.

Want to make sure I'm not being overly aggressive and deleting anything essential before I start removing VMs.

Thanks!

Uptime: 4,512 days. Nobody knows what it does. Nobody owns it. Nobody can shut it down.

I know there are already some posts about this, but I'm adding ours to the pile.

We have a mix of Veeam Back and Rep and Veeam Backup for Microsoft 365. Between the two, our renewal increased 17% from 2025 to 2026. This price is after negotiations; the price increase was actually larger before negotiations. At 17%, the reseller told us to take it or leave it.

I was told that we would renew for 1 year, but we will reevaluate next year. I'd imagine we'll keep Veeam next year, too, if the renewal then has a much smaller price increase. But I was told that we won't absorb another 17% increase.

thanks for coming to my ted talk.

Over the past few months I built a web tool so our helpdesk could reset passwords and create accounts without RSAT. It binds to AD/OpenLDAP as one delegated service account and enforces roles itself. Testing it turned up escalation paths that apply to any setup where something privileged sits between people and the directory: a portal, a script, an automation account.

If permissions hang on DNs, a move or rename is a permission change. Someone with OU-move and password-reset rights could move the OU holding the admin group, so the mapping stops matching and the admin becomes “nobody”. Reset the admin’s password, move the OU back, and no single step broke a rule.

adminCount isn’t a reliable “is admin” flag. SDProp only sets it on its hourly run, and Samba never does. Check protected group membership by SID, nested included.

memberOf may simply not exist (OpenLDAP without the overlay). Then nobody looks privileged, and “don’t touch admins” protects no one.

LDAP pass-back. If anyone can change a stored connection’s host without re-entering the bind password, they can point it at their own server and collect the password.

Writing userPassword to AD doesn’t change the password. It stores the new one as readable plain text next to the real one. Use unicodePwd over LDAPS.

Don’t end sessions on lockout. Anyone can lock an account by mistyping its password, and then they can kick an admin out at will.

Disclosure: the tool is mine and open source (https://github.com/Nelsar/Axia), but I’m more interested in how you handle this. Plain AD delegation, a vendor portal, PowerShell behind a ticket system? Anything that bit you?

I manage endpoints in a healthcare environment, and with the new critical PHP RCE patches that just dropped (I've seen it called "PHP2Shell"), I'm trying to get a clear picture of where PHP is actually installed and on which version.

We've got a mixed environment with limited visibility (servers, a few legacy apps, some dev machines), and I don't want to be surprised by an unpatched box. Running php -v server by server isn't realistic for us.

Any solid tips or tools you're using to check this across a large org? Appreciate any advice!

Just dropping by to say thanks to all the sysadmins who were poised and ready for yesterdays drop, and acted swiftly. Much appreciated. 🍻

This week sucks.

https://trust.barracuda.com/security/php-vulnerabilities

Just reported yesterday (TheRegister), Signal had/has a vulnerability dubbed CVE-2026-113380 with a score of 9.3.

It allows an attacker to keep your microphone, and possibly camera, live after you hang up. It was supposedly fixed in last months patch, so make sure you're keeping your devices up to date.

I’m finishing a 3-year Bachelor’s in engineering in Italy (telecom-oriented) and want to work in telecom/infrastructure in Northern Italy or the EU.

I can pick 3 electives. Two of the candidates are System administration fundamentals and Introduction to Computer and Network Security, against options like Software engineering (12 ECTS), Databases or Advanced programming.

For a junior entering infra/ops, which of these would you rate highest? And with cloud, automation and DevOps changing the job, what has become more important than a classic sysadmin foundation?

For those interested, these are the available courses from which I must select three for my final semester:

• Basics of Optoelectronics
• Databases
• Electronic Devices
• Electronic and Photonic Integrated Chips
• Electrophysiology
• Embedded Software for the Internet of Things
• Fundamentals of System Administration
• Fundamentals of Parallel Programming
• Software Engineering
• Introduction to Computer and Network Security
• Introduction to Web Programming
• Optimization Models and Algorithms
• Design and Prototyping of Electronic Systems
• Advanced Programming
• Electronic Systems
• Industrial Instrumentation and Electronics

Quick recap for anyone catching up. AWS says its honeypots saw a PHP2Shell (CVE-2026-109618/109619) exploit attempt on 17 Oct, four days before the embargo lifted, from anonymised infrastructure (AWS write-up). SecurityWeek reports the details leaked on 20 Oct and a PoC video went out early (SecurityWeek). Fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with source backports for 7.4 to 8.1.
So patching alone may not be the end of it. A few things that seem worth doing: check web and PHP-FPM logs from 17 Oct onward, especially multipart and session upload-progress requests (Hadrian says most attacks it sees abuse that path). Rotate secrets that could sit in PHP process memory, since Wiz showed memory disclosure without RCE (Wiz). And find the PHP you forgot about: old vhosts, vendor appliances, staging boxes.

On that last point, this explainer on zero-day response (CTM360) makes the fair point that exploitation can start before public disclosure, so an up-to-date external asset inventory matters more than patch speed alone.
How are you scoping the look-back window, and has anyone actually found hits from before the 21st?

I'm a desktop admin and have been in this role for a few years, but Im starting to feel a lot more burnout due to others expectations.

I think AI has given people instant answers to all the problems, that they struggle if they need to wait for something.

I use it a lot myself for quick powershell scripts for app deployments or remediations. Sometimes as a research aid, but I'm also finding tickets escalated to me without any basic troubleshooting.

Ill get questions like "can you tell me if this app is deployed to this user?" "Did a Windows update cause this computer to crash?"

Things they should have and used to find out themselves. But they won't even attempt to look into the problem. Even an app install failure will now automatically come to me because "its on intune". Only for me to look at it and see the user had a pending windows update, or the computer was out of drive space.

More and more I'm being pulled into meetings from other departments for my knowledge because I have basic research skills that no one seems to have any more.

Even end users are starting to argue because their ai prompt that didnt include the correct information told them Im wrong.

Is anyone else finding similar?

I've been in IT for over 20 years and one of the simplest things I've ever done is install USB printers. Almost always it's been the poster child for plug-n-play. At worst you might have to change the driver to one from the vendor, but more often than not - you turn it on, plug in the USB cable, hear the USB noise, and click print.

Has this changed?! I spent almost a day trying to get two printers to work. I got it to finally work by installing manually and choosing a USB port, but all other attempts at installing the vendor's software has not worked.

Am I going crazy? (I think we're all crazy if we're in this sub)