-
Reddit SystemAdmin. Thanks @reddit2telegram and @r_channels.
Need a high level sanity check on replacing our DC's
We have 3x DC's. 2 are running server 2016 and these are the primary and secondary. Both running DNS/DHCP, the primary also runs our AD -> Azure Sync (which i understand now is not best practice to have on the DC?). Our 3rd DC does not have DHCP and is Server 2019 so I plan to leave it as is for now.
I have a feeling there is a bunch of stuff hardcoded to the IP's of the current DC's so I would like to re-use them (The names are changing though).
I have a new Server 2025 box spun up and ready to go. I was going to replace DC2 first then DC1.
Any tips for the general order that I should tackle this?
https://redd.it/1skh03y
@r_systemadmin
I'm desperate
I have a Windows client at our company, and I’m starting to lose my mind. The user is reporting the following issues:
\- Input is sometimes delayed. He types letters, and it takes seconds for the letter to appear.
\- SolidWorks (CAD program) sometimes crashes randomly
\- Explorer crashes randomly
The device is basically acting up.
It’s a Dell machine with 32 GB of RAM and an i9 processor, so it has more than enough power for everything he does.
I’ve already tried the following:
\- First, I did a complete Windows reinstall (using a bootable USB drive), and things were fine for 4–6 weeks
\- After that, the problems returned; this time I tried using “Troubleshoot problems with Windows Update,” but it didn’t work
\- SFC/DISM
\- I made sure Fast Startup is disabled
\- Updated all drivers using the Dell Support Assistant.
\- Excluded SolidWorks from Sophos Endpoint’s “Programs” (scan)
\- Checked various SolidWorks settings with the software manufacturer
Has anyone else had similar issues? Do you have any suggestions on how I can better address this? I’m slowly running out of ideas. The problems occur sporadically: no issues one day, and then a lot of issues again the next day.
https://redd.it/1skdurg
@r_systemadmin
Dont tie your Password Manager to SSO
I recently did a table top DR exercise with a client. The goal of the event was to see what could operate during a SSO outage and for how long.
The first thing that was caught was that the mandated password manager was SSO only and only 2 people had non-SSO accounts. Those two saved their non-SSO accounts in said password manager.
I may still have a bump on my head from my head hitting the desk...
https://redd.it/1skeoxg
@r_systemadmin
Vendor we fired 2 years ago still has VPN access and admin rights to our backup system
Started here three months ago. Been doing security cleanup and found VPN accounts for an MSP we stopped using in 2023. Contract ended, relationship over, but nobody disabled their technical access.
Five technicians from that MSP still have active VPN credentials. Checked what they can reach and it's bad. Domain admin on some servers. Full access to our Veeam backup environment. Read access to file shares with customer data. RDP to several production hosts. They could log in right now if they wanted to and we'd have no idea it wasn't one of our own admins because the accounts look legitimate in all the logs.
Asked around about offboarding process for vendors. There isn't one. When contracts end procurement closes the purchase order and that's it. Nobody tells IT to revoke technical access. We have a formal process for employee terminations but vendor relationships just fade away and their access stays forever. Started digging and found three other former vendors with active accounts. Consultants from projects that finished years ago. Implementation partners. A monitoring service we replaced.
The scary part is I only found these by manually going through account lists. No automated way to flag vendor accounts that outlived their contracts. No tie between procurement system and IAM. If I hadn't randomly decided to audit VPN access this month these accounts would still be sitting there. How do orgs actually track vendor technical access lifecycle when procurement and IT don't talk to each other?
https://redd.it/1skauc1
@r_systemadmin
Automated VMware Secure Boot PK update
I built a PowerCLI-based workflow to automate Secure Boot Platform Key (PK) enrollment for VMware VMs, and thought it might help others handling ESXi Secure Boot updates.
What it does:
Pre-checks for existing snapshots (aborts if present)
Copies a prepared PK VMDK into the target VM folder/datastore
Attaches disk, creates a rollback snapshot
Sets uefi.allowAuthBypass=TRUE and forces EFI setup
Sends USB HID keystrokes for firmware menu navigation
Powers off, removes temporary EFI settings, and restores boot flow
Supports cleanup mode to remove snapshots/detach/delete staged PK artifacts
Logs runs to JSONL for auditability
I published a sanitized repo here:
https://github.com/Scholdan/vmware-secureboot-pk-update
Reference used:
Broadcom KB 423919 (manual Secure Boot variable update)
https://redd.it/1sk8wzm
@r_systemadmin
A government org recently audited their 4,000 device fleet. They found 4,000 more.
Kyle Manilal from Sizwe IT Group was doing a guest session for us at Hexnode recently, and he dropped a stat about a public sector audit that has been stuck in my head ever since. So this government dept kicked off an inventory audit fully expecting to find a fleet of around 4,000 endpoints. By the time the audit finished, they had logged 8,000. They were completely blind to half of their actual hardware!
I feel like a 5-10% inventory drift is just par for the course when dealing with large fleets (still not right), but missing half your endpoints is wild. It really makes you wonder how much of the global attack surface is just forgotten hardware sitting in a drawer somewhere.
https://redd.it/1sk617x
@r_systemadmin
we migrated 3 years of legacy scripts to a proper config management system and it was less painful than expected
Straight up, I expected this to be a disaster.
We had accumulated maybe 200 bash scripts across environments.
Some documented, most not.
A few that nobody wanted to touch because the guy who wrote them left two years ago.
Decided to stop kicking the can and actually move everything into Ansible.
Took about six weeks.
Two of us doing it alongside regular work.
What actually made it manageable was starting with the stuff that changed most often rather than trying to eat the whole thing at once.
The stable crusty scripts could wait.
The ones getting modified constantly were creating the real risk.
A few things broke during testing that would have definitely broken in production at some point anyway, so in a way the migration just surfaced problems that were already there.
The thing that surprised me most was how much faster onboarding got afterward.
New team member can actually understand the environment now without a two hour verbal handoff.
Anyone else done something similar recently? Curious whether Ansible was the right call or if something else would have been cleaner for a shop our size.
https://redd.it/1sk47hv
@r_systemadmin
Windows 11 Bitlocker and HP BIOS/UEFI Firmware Updates via Windows Update
I'm in the process of deploying Bitlocker via Intune, but can't find a solid answer this question. If you deploy Bitlocker via Intune, will Windows Updates still try to deliver HP BIOS/UEFI firmware updates?
If it does still deliver BIOS/UEFI updates, this could cause the computer to prompt for the Bitlocker 48 digit recovery key (when the BIOS/UEFI is updated), which would cause a massive amount of calls to our service desk. How are you handling this potential problem? (e.g. Using Intune/GPO to disable driver updates via Windows Update)
https://redd.it/1sk0ndr
@r_systemadmin
Hardening AD, Workstations, Servers, NAS, HyperV Hosts etc..
I'd like to read up on best-practices in regard to hardening basic microsoft eco-systems. Instead of single pieces of advice, does anyone have a link to some youtube series or blog or website that would cover that?
https://redd.it/1sjqmlf
@r_systemadmin
Fixing a secureboot problem on computers imaged with sysprep
I’ve got a bunch of computers that were imaged using sysprep. Most computers are the same or similar, and there are a few that are a different Manufacturer, but that doesn’t seem to come into play here.
With secureboot off, which is necessary to restore my image to disk, every computer boots without issue to Windows. After finishing the oobe, they work great. Intune managed windows updates are doing an okay job from there.
With secureboot enabled, signature verification fails.
I’ve tried bios update,
bootrec /fixmbr
bootrec /fixboot
bootrec /rebuildbcd (0 os is found when scanned)
The other thing I’ve done, and may be the actual problem come to think, is use gparted to move and expand partitions as needed. Image was created with a 256GB disk and most workstation have .5TB or 1TB capacity.
Does anyone with more experience with secureboot know how I’m breaking, and how I can NOT break or repair the disks boot? I’d really like to be able to use secureboot in my compliance policy in intune….
Thank you.
https://redd.it/1sjlly8
@r_systemadmin
Do you work in Healthcare IT or a Hospital?
Hi everyone,
I’m a Ing. sistem student currently working on my thesis regarding **IT infrastructure in the healthcare sector**.
Any insights on the following would be a huge help:
* **Hardware:** How old are the daily-use workstations? (Are we talking modern builds or legacy machines still clinging to Windows 7/XP?).
* **HIS/Systems:** Does your Hospital Information System run in the browser (SaaS/Web-based) or is it a locally installed "thick client" (Java, .exe, etc.)?
* **Paper vs. Digital:** Do nurses have terminals/COWs (Computer on Wheels) everywhere, or is paper still the king for daily charting?
* **Pain Points:** Is there a specific piece of software that "always breaks" or slows everything down?
* **Contingency Plans:** What happens when the system goes down? Are there clear paper protocols in place, or does the facility go into panic mode?
* **Security:** Are USB ports strictly blocked, or is it still a "wild west" where anyone can plug anything in?
* **Integration:** Is there a single Unified Patient Record, or do departments (Lab, Radiology, ER) use separate systems that don't talk to each other?
https://redd.it/1sjhx11
@r_systemadmin
Helpdesk right now — Manager told me I could become a SysAdmin, but I do not know if I should believe it
Hey everyone,
I’ve been working at my company for about a year now, doing Level 1 and Level 2 helpdesk support.
I’m not sure whether I should stay and wait for an opportunity to move into a SysAdmin role. My manager has mentioned that it could happen, but honestly, I sometimes feel like he says that to everyone.
The good part is that my team likes me and trusts me. I’m basically the go-to guy for Ivanti and imaging/master deployment, and I know Lenovo hardware pretty well. I’ve also created a lot of PowerShell automations to help the team, so I know I’m bringing real value.
The problem is that I do not have a strong academic background. One of the newer guys told me the company would probably prioritize someone with higher qualifications over someone without a degree. Right now, I only have the Cisco Networking Basics certification, which is pretty small compared to a CCNA or CCNP.
Another issue is salary. I’ve been on €27k for the past year, which feels low. Some friends of mine with similar experience are already making around €34k at other companies.
So my question is: should I stay and wait for an internal opportunity, or should I leave?
I know one guy who moved from helpdesk to admin after 3 years because a system administrator left the company, but I really do not want to wait 3 years for that kind of move. I feel like 2 years would already be a fair amount of time, depending on the company.
I also have plans to leave Europe in the future, so I need to make money faster. That is another reason why I feel like this company may not be the best place for me long term.
I even asked the big boss about moving toward sysadmin when I had only been there for 5 months. I told him I did not want to stay stuck forever in the same position and wanted to grow. He basically said that since I had joined recently, they would prioritize people who had been in the company longer.
So right now I feel stuck, and I’m already looking for other opportunities.
What would you do in my position?
https://redd.it/1sjfzxr
@r_systemadmin
Software/application center to use for endpoints?
I'm new and it this new gig they are asking is there a way to install or push application update on the end points?
I remember from my last work that we are using something like software center and from that I can search applications I can try to install/update (aside from default office apps).
From my previous work, we normally use different apps for ticketing, monitoring, patching windows, installing application.
Tried google but not really sure what to look for, I'm a networking guy.
Currently we are using Entra, AD, not Intune but somekind of ticketing sysaid but one stop shop?
They are talking about ninja one but not really sure because its expensive.
Personally I prefer a different app for source of truth/documentation (netbox), different monitoring like PRTG, ticketing jira, and pushing updates using SCCM (not that I know how to set it up).
https://redd.it/1sj7z8g
@r_systemadmin
Weird device on network.
Is anyone familiar with what sort of device could begin like this Mac address c0:9a:f1:
Besides Internet providing decreasing the amount of internet usage per month, for the past 2 weeks or so the overall network has slowed possibly due to whatever this device is. No device is just *
Mac address searches came up with nothing. No one can figure out what it is.
https://redd.it/1sj2pc6
@r_systemadmin
Best way to move user to new AD account but keep existing mailbox? (Hybrid AD + M365)
Hey all, looking for some guidance on best practice here. I’m in a hybrid AD (on-prem + Entra sync) with Exchange Online. I had a user account that kept getting locked out (likely due to some external device or cached credential), so to get them working I created a new AD account and had them log into Windows with that — which fixed the lockouts. The issue now is the original account still has the mailbox with all their email, calendar, and meetings, and the new account doesn’t have a mailbox yet. My goal is to have the user log in with the new account but continue using the existing mailbox without disrupting email flow or losing data. I’m considering mailbox delegation (Full Access + Send As), converting the mailbox to a shared mailbox, or fully migrating it to the new account. In a hybrid setup like this, what’s the cleanest long-term approach? Would you stick with delegation or move the mailbox entirely?
https://redd.it/1sizmi1
@r_systemadmin
New printer prints upside down
So have a long time user that was just issued a new printer.
This person is older and set in their ways. They know how to do their one job and refuses to adapt to changes in work process, new or updated applications, etc.
They have a printer setup on the right side of their desk that they print to all day long. They print out something, reach over and staple it to something else, then they drop it into a basket where it is collected several times per day.
So after I setup the printer and made sure that it was working correctly I got a call from this user that there was a problem with the new printer.
I went over to her desk and had her print out one of the forms and it printed perfectly. After talking for awhile I discovered that the new printer would outfeed the printed page top first, while the old printer did the outfeed bottom first.
Apparently she had a pattern where she took the page out of the outfeed tray and stapled it to some other page that she had stacked to the left of her computer.
Since the page printed out in a different orientation she would have to remember to flip the page over before stapling the pages together and the change was disrupting her work flow.
https://redd.it/1skj4ko
@r_systemadmin
Best practise for staff requesting a second laptop for WFH
Currently all staff have 1 laptop. We are hybrid and all staff bring their laptops home for remote days (twice a week).
Some employees are requesting a second laptop to keep at home for remote working. As IT Manager, I've said it's not recommended as it adds to cost and involves additional maintenance. They still insist they need it so I expect it to be escalated soon.
I personally can't see the justification for it, other than simply not wanting to carry their laptop with them. If this gets approved, we could then have 60+ staff requesting second laptops. Is this the norm in other orgs, to allow second laptops?
My main concerns are below, but feel free to let me know if others exist. I also have some questions on things to check IF we allow a second laptop to staff.
- Additional cost for a new laptop (an obvious one! Older spare
laptops can be given but eventually we'll run out)
- We don't have always-on VPN enabled, as users don't need access to network drives. Would this need to be enabled to ensure the laptop gets necessary updates, GPOs, and is included in weekly health checks? Or is there another way to manage that outside of VPN?
- Are there any potential conflict or sync issues with using two laptops under 1 M365 account? I don't believe additional licences will be needed.
- Makes the offboarding process a bit more difficult. We can remind them to bring in their second laptop before they leave but there's a chance they don't. This is very unlikely to happen to the original laptop as they need to be in the office to work on their last day.
- IF Senior management approve a second laptop, then what criteria must be met to accept their request for a second laptop? I'd like to have some sort of procedure to follow to prevent all employees requesting one. At the moment I can't think of any reason other than something like "requesting due to medical reasons".
Update: Thanks for the feedback and reassurance. To be clear - I completely agree that a second laptop should not be given to staff. I was mostly looking for reasons to help my case when saying No - as I expect they will insist, stating "we can just use the old spare laptops in the server room". But the feedback has been very helpful - thanks!
https://redd.it/1skf4vr
@r_systemadmin
RustDesk appears to be down
Was banging my head against a wall and down detector confirmed it. First time I’ve seen their service go down in years.
https://redd.it/1ska2ge
@r_systemadmin
Learn to Speak
Sweet lord, just because we are computer nerds doesn’t mean we aren’t in a professional environment. If you want to advance in your career then learn to speak.
Sitting in a meeting and just face palming at some of my compatriots inability to articulate themselves.
That is all.
https://redd.it/1skaiog
@r_systemadmin
Visualizing Racks
So often, the question "what ticket system do you use?" is asked in this sub. For a change, my question is "how do you visualize racks?"
We're moving our data center, and I would really love to use something more intuitive/visual than spreadsheets to document which device goes where and which port is connect to where and with what colour cable.
For the visualization, I could use Microsoft Visio, which I have a license for, and has (third party) templates for many devices. It doesn't really help much with metadata however. I'm sure there are better solutions, but all I find are DCIM tools that do much more than just this and, therefore, for a premium price. But I don't want agents, voltage monitoring or asset discovery. I just want to document relatively small server rooms (max 4 racks) in many locations (50+).
https://redd.it/1sk77bm
@r_systemadmin
ADFS issue: Google searches for login.microsoftonline.com redirect to Australia's Department of Education and University of South Australia
Accidently came across this when I typed my url into the search bar instead of the address bar. This only happens if you click the link from Google and not when you type it in manually.
When this URL is opened (for example from a Google search), Microsoft begins a WS-Federation authentication flow using a request URL that includes parameters such as:wa=wsignin1.0, wtrealm=urn:federation:MicrosoftOnline, and wctx=...
These parameters are part of the WS-Federation sign-in request context used by Microsoft to manage authentication state and routing.
This request is then evaluated by Microsoft’s Home Realm Discovery (HRD) system, which determines whether the sign-in should proceed through Microsoft’s cloud login system or be redirected to an external identity provider (such as an ADFS federation endpoint).
While testing, instead of first showing the standard Microsoft login interface, the flow immediately redirects to external ADFS endpoints such as `https://fs.det.nsw.edu.au/adfs/ls/` or https://fed.unisa.edu.au/adfs/ls/. This indicates that HRD is selecting an external identity provider based on the perceived authentication context in the request. (Cached browser also adds my admin username to their login field)
Under normal conditions for a cloud-only login context, the expected behavior is that the user is first presented with the Microsoft sign-in page before any federation routing decision occurs. This does not happen.
Google redirects to the AU gov DoE.
Bing fails redirect on mid-authentication via SAML/WS-Fed.
Yahoo fails on mid-authentication via SAML/WS-FED.
Brave search takes me to the correct page oddly enough and doesn't redirect me.
I have no fucking clue what is going on at this point so I'm sharing my findings.
https://redd.it/1sk5s9m
@r_systemadmin
Office M365 version keeps downgrading on RDS session hosts.
Using M365 Apps for business on \~25 RDS sessions hosts.
We experience that the Office installations across these hosts revert to previous builds of MEC; all the way back to 19029.
No more than an hour after a successful installation of the latest build 19725 via ODT, it will be downgraded to 19029, 19328, 19426 or 19530. Some machines stay on 19725.
If we disable all update features, it may take a day or so for it to "heal" the update tasks, and downgrade anyway.
After weeks of AI shenanigans, and with many attempts to resolve this by ways if pinning the version, and or disabling / removing the update mechanisms. It appears that this is all by design, and we are simply getting what MS is offering these machines. This is also visible in the logs, for example:
SourceBuild : 16.0.19725.20170
TargetBuild : 16.0.19029.20244
Channel : MEC
UpdateTargetVersion = 16.0.19029.20244
There are no policies targeting these specific older versions.
Our regular PC endpoints have no problem staying on the latest MEC version.
Apparently, running RDS with SharedComputerLicense triggers a much more relaxed approach to which versions are offered and accepted by MS, but Defender is freaking out over having Office versions that are months behind.
Copilot recommends opening a MS ticket, and have them look into why we are stuck on older rings. Anyone seen this, and have something to recommend or confirm that a MS ticket is the way forward?
Thanks
https://redd.it/1sk356c
@r_systemadmin
Autopilot + Windows Hello not working???
Hello Reddit!
Here is the problem:
Domain joined Autopilot laptop, end users use windows hello/pin/finger print.
User changed password via lockscreen.
MFA stopped working/
Reset MFA via azure.
Setup MFA and Passkey all over again.
Passkey and MFA works now.
Rebooted end user laptop.
Changed PIN and Fingerprint via settings app & Lockscreen & rebooted.
End user is no longer prompted for pin or finger print sign in when it comes to company MFA prompted websites.
User cant pin or finger print sign in from lockscreen as it says "Something went wrong and your PIN isn't available (Status: 0xc000005e, substatus: 0x0). Click to setup your PIN again"
Then there is "Setup my PIN" which resets the pin and we run in a loop all over again.
Anyone got a fix for this?
https://redd.it/1sjw2sb
@r_systemadmin
What you monitor daily and weekly to ensure AD environment is health?
Hi Team,
What you guys monitor to ensure AD environment is health? Other than making sure each domain controller doesn't have any replication issues and status of FSMO.
I'm just trying build a script that will monitor common things that should be monitored and get a notification to my team members.
Let me know
https://redd.it/1sjnm1k
@r_systemadmin
Solo service desk manager with no agents in a niche technical environment — where do I start?
Hi all, looking for advice on structuring my approach to this role better.
I'm about 2 months into my first service desk manager role and honestly feeling a bit lost. Background is customer support with a brief research internship — total experience maybe 2-3 years — so I'm fairly early careers and this is my first management role.
It's a solo function with no agents, using Jira Service Management. The environment is fairly niche and technical, and the people who resolve tickets are colleagues from other teams rather than people I manage directly. I'm the first point of contact and responsible for the processes, but technical resolution sits with others. The service desk supports users of a digital platform rather than handling hardware or infrastructure issues — think software access, user onboarding, data requests and general platform queries.
My line manager is on the technical side so there isn't much specific guidance on the service desk management side of things. The function itself is also relatively new, so while the basic ticketing workflows, request types and forms are in place, there isn't much else established beyond that. A lot of what good looks like still needs to be defined.
I've done some process building and documentation but mostly when instructed to rather than proactively identifying what needed to be done myself. That's part of the problem — I don't have a strong enough grasp of what the role should look like to know what to work on without being told.
I'm planning to start ITIL 4 Foundation but wanted to ask — for those who've run solo or small service desks in non-traditional environments, particularly early in your career, what would you prioritise? What helped you develop the intuition for what you should be doing?
Thanks in advance.
https://redd.it/1sjjl45
@r_systemadmin
how easy/quick is it to change a phone number in google results?
We have 4 buildings, and I found that in addition to the main number I alwasy knew we had, we have another 80 lines from Brightspeed with a different phone number that goes to the same call tree and same desk phones and we are paying around $2600 a month for those.
Some of these lines are still copper, and I only found this out cause some users were complaining of a loud electronic hum over the line when people called in and they could not hear anyone over the hum.
I found out that if you google us, the phone number that shows up is this brightspeed number and not the one I was always familiar with.
So I am in the process of figuring out everything about these Brightspeed numbers, but was curious what the process/cost/time frame is in getting google search result phone numbers changed to something different. I am hoping we can actually get rid of these numbers as everything we have goes through i3 broadband now.
https://redd.it/1sjgzan
@r_systemadmin
Staying up to date
Hey everyone,
I’m a sysadmin working in a small team, so staying up to date is mostly something I have to manage on my own.
I’m curious how you all keep up with new technologies and developments in the field. What sources do you follow, and are there any courses, newsletters, or routines you rely on regularly?
To clarify, I’m not necessarily talking about deep specialization or learning entirely new skill sets. I’m more interested in how you stay informed about emerging tools, trends, or improvements that can enhance existing processes.
Would love to hear what works for you.
https://redd.it/1sjcqr0
@r_systemadmin
Hardware Procurement Automation
HI! For all those who've successfully implemented (or are trying to do so) hardware procurement automation or an automated IT hardware procurement process, can you share some best practices?
I need to understand what could go wrong and what are some best practices that you swear by?
https://redd.it/1sj506r
@r_systemadmin
Why do most sysadmins prefer Vim over Nano?
Hey everyone, I’m currently learning Linux and spending a lot of time in the terminal. I’ve mostly been using Nano because it feels simple and beginner-friendly.
But I keep noticing that many experienced sysadmins strongly prefer Vim.
I’m curious to understand the real reason behind this preference.
• What makes Vim more powerful or efficient in real-world scenarios?
• Is it just about speed, or are there specific features that make a big difference?
• At what stage should a beginner start learning Vim seriously?
• Do you still use Nano at all, or is Vim your default for everything?
Right now, I’m focusing on building strong Linux fundamentals for system administration / cloud roles, so I want to invest time in tools that actually matter long-term.
Would love to hear your experience and whether learning Vim early is worth it 🙏
https://redd.it/1sj2ncb
@r_systemadmin
O365 NS DNS
I purchased my domain name when setting up my O365 Account. That turns out to be a terrible thing to do. I'm hoping one of you knows something I don't on how to resolve my problem. When purchasing my domain name through MS it gets register to the registrar Wild West Domains. The only way I can see to manage the DNS is using the O365 Admin Center. I can seemingly change all other records except to modify the NS records which in my case is required to move to Cloud Flare Registrar. Cloud flare requires this and would seem like a normal requirement however MS is holding my domain hostage. At this point it doesn't appear I actually own the domain yet I pay for it. I tried contact support but I seem to be stuck in a loop and no way to talk to anyone or even submit a ticket. Does anyone else know the solution here? Should I just abandoned the domain name and give MS the finger on the way out?
https://redd.it/1sixoqn
@r_systemadmin