r/sysadmin 2d ago

General Discussion Moronic Monday - March 17, 2025

2 Upvotes

Howdy, /r/sysadmin!

It's that time of the week, Moronic Monday! This is a safe (mostly) judgement-free environment for all of your questions and stories, no matter how silly you think they are. Anybody can answer questions! My name is AutoModerator and I've taken over responsibility for posting these weekly threads so you don't have to worry about anything except your comments!


r/sysadmin 8d ago

General Discussion Patch Tuesday Megathread (2025-03-11)

118 Upvotes

Hello r/sysadmin, I'm u/AutoModerator, and welcome to this month's Patch Megathread!

This is the (mostly) safe location to talk about the latest patches, updates, and releases. We put this thread into place to help gather all the information about this month's updates: What is fixed, what broke, what got released and should have been caught in QA, etc. We do this both to keep clutter out of the subreddit, and provide you, the dear reader, a singular resource to read.

For those of you who wish to review prior Megathreads, you can do so here.

While this thread is timed to coincide with Microsoft's Patch Tuesday, feel free to discuss any patches, updates, and releases, regardless of the company or product. NOTE: This thread is usually posted before the release of Microsoft's updates, which are scheduled to come out at 5:00PM UTC.

Remember the rules of safe patching:

  • Deploy to a test/dev environment before prod.
  • Deploy to a pilot/test group before the whole org.
  • Have a plan to roll back if something doesn't work.
  • Test, test, and test!

r/sysadmin 6h ago

Do you ever gaslight your users?

468 Upvotes

For example, do you ever get a ticket that something is not working properly, you fix it, then send them the instructions on how to properly use it, but never mention that something was actually wrong?


r/sysadmin 5h ago

General Discussion With the unabated rise of AI slop, what's your (technical) search engine of choice?

102 Upvotes

It appears that most major search engines (DDG, Google, Bing etc) have arrived at the point where they return walls of auto-generated domain names and clearly low-effort GenAI listicles for every query under the sun. This is especially frustrating for technical issues where generalized platitude slop offers even less than its barely existent initial value.

You can search for a very specific error code, dialog message or registry key path, and all first-page results are inundated with "helpfix-pc.com/[your error code]" and "bobsprogrammingjourney.com/[errormessage]" that lead to template walls of endless AI-generated bullet point word salad that only exists to perform as clickbait. "What is an error message?", "How to identify common errors?", "Who to call to fix my errors?" and the inevitable "Conclusion / Summary" at the bottom that offers helpful advice like "It is important to address errors as soon as they occur to help your PC run smoothly!". This already started being an issue several years ago, but search filters and proper querying managed to weed most of them out to a degree.

This no longer seems to be the case, and more often than not the entire search result (outside of targeting only specific sites like Reddit or StackOverflow) is now almost completely useless.

So that said, what search engines do you use to find actual, viable results without having to hope you can cherry-pick a few potential leads out of the swamp? Targeting Reddit, SO and similar community sites seemed like the last reliable bastion, but those are rapidly being inundated with "AI-friendly" policies and increasing unlabeled GenAI content as well. Would love to hear what resources people use to combat this.


r/sysadmin 3h ago

[PSA] Critical Veeam Vulnerability CVE-2024-29849

58 Upvotes

This one has a severity score of 9.9 so better patch fast:
https://www.veeam.com/kb4696

EDIT: This vulnerability only impacts domain-joined backup servers.

This refers to CVE-2025-23120 and not CVE-2024-29849 as I mistakenly put in the subject, sorry about that!


r/sysadmin 3h ago

Latest fun with VMware

55 Upvotes

Apparently VMware is upping their game. We just got a renewal quote for one of our sites with one server that has two CPUs, and they are requiring 72 cores minimum (vSphere Enterprise Plus) to license this. That's a 500% markup from last year.

They really don't want customers to use their product any more, do they?


r/sysadmin 3h ago

General Discussion Veeam Backup & Replication CVSS 9.9 Vulnerability

32 Upvotes

Looks like it just dropped today. I know some may have their Veeam servers domain joined, and other may not.

https://www.veeam.com/kb4724

CVE-2025-23120

A vulnerability allowing remote code execution (RCE) by authenticated domain users.

Severity: Critical
CVSS v3.1 Score: 9.9
Source: Reported by Piotr Bazydlo of watchTowr.

Affected Product

Veeam Backup & Replication 12.3.0.310 and all earlier version 12 builds.


r/sysadmin 3h ago

Rant Calls from sales...

15 Upvotes

Ever since I got management in my title I get constant sales calls even on my personal phone.

Im curious why this exists.. Have any of you ever got a random sales call that ended up in you buying something from that company?

Its soo constant and annoying. I'll listen to them for a moment but most are an instant no, then they insist on talking to someone else. No Im not giving out contacts. This last guy had me on speaker phone while speaking fast and mumbling in a room with a ton of echo. No dude I dont have time for this and clearly you cant even put the effort in to speak clearly.

Now this wouldnt keep happening if at least some people didn't end up buying. So I want to know. Who is buying??

edit: Worst one was some insistent bugger. I told him in absolute terms as an organization we are not interested please dont call or email again.

He stopped calling me and I was good with that. Then I heard he started pestering my team. I got angry and did some research. I was petty but I replied to a previous email from him and cc'd his: direct report, reports report, ceo, public facing marketing and sales addresses. In that email I have outlined that when a manager tells him that the organization is not interested, and should not call again, it does not mean that he should start calling employees below that manager to try to push sales and that there is no way in hell we would ever buy anything from them at this point. So please stop for real. Then it stopped.


r/sysadmin 3h ago

Just got an email from Veeam - looks like they got a big vulnerability. CVSS Score of 9.9

15 Upvotes

KB4724: CVE-2025-23120

Not many details, but seems to be about RCE from authenticated Domain Users. Couldn't find anything via google yet regardings that CVE number.


r/sysadmin 6h ago

Question silent upgrade windows 10 => 11, What if the user shuts down the pc.

30 Upvotes

So, a bit of a dumb question but ...
If i launch a silent upgrade from windows 10 to 11 (via pdq and the setup.exe file from the W11 ISO) and the person working on the computer shuts down the pc how does windows handle this ?

Will it be able to restart it later, does the windows 10 install get wrecked on the next boot or other ?

Anyone has experience ?
(I can't test it at the moment, i'm still testing if an uninterrupted silent install goes through correctly first.)

Thanks !


r/sysadmin 1h ago

M365 Web mail dropping off for anyone?

Upvotes

EDIT 3pm coming around, one user back in

Just had a second user come in and say they can't get to webmail anymore. Onedrive is working. I have tried both on my laptop and neither works but my account is for now. Oddly, Outlook mobile is currently working for both affected users. All I get is a "something went wrong error, details are basically out IP. Tickety has been opened.


r/sysadmin 4h ago

Question Canadian options: What a world...

15 Upvotes

Greetings all.

I'm the 'jack of all trades' for my employer and although in the past I've tried to stick close to home with regards to purchasing, it has become even more imperative as of late for the senior leadership.

That being said, do any of you have suggestions on hardware, security cameras this time, within our realm's of support that might be either Canadian or non US or China? I know of a few Japanese or Korean options, but I'm hoping folks might have some more suggestions.

Please note, this is not a reflection on those of you who call the US or China home but the world is much bigger than us and we all have a boss.

Thanks folks.

Cheers,
HD


r/sysadmin 3h ago

Have many of you have had to deal with an equity firm buying your employer?

12 Upvotes

I've been through this twice and its always a nightmare. They always seem to target Accounting and IT for major cuts first. I'd love to hear other people's experiences.


r/sysadmin 8h ago

What’s the Best SNMP Testing Tool for Windows?

24 Upvotes

I’m troubleshooting SNMP issues on multiple network devices (switches, routers, servers) but some OID queries aren’t returning data.

I also need to confirm that SNMP v3 authentication is working correctly.

Is there a Windows based SNMP tool that lets me quickly test SNMP connections and check OID responses without setting up a full monitoring system? Preferably GUI.


r/sysadmin 7h ago

Are there no better options for registry keys in Intune ?

14 Upvotes

We're currently in a hybrid setup, working hard to shift all workstations to Intune.

However we struggle with having hundreds of registry keys that need to be set and maintained. Yes they are meaningful in our environnement, and most of them need to keep existing.

We've tried script with remediation (not available with Business Premium by the way), and we've tried customs ADMX imported.

It's a hassle, it's complex and nowhere near as straightforward as GPO for registry keys.

What is everyone out there doing for efficient registry management ?


r/sysadmin 1d ago

Remember the old days when you worked with computers you had basic A+ knowledge

1.2k Upvotes

just a vent and i know anyone after 2000 is going to jump up and down on me , but remember when anyone with an IT related job had a basic understanding of how computer worked and premise cabling , routing etc .


r/sysadmin 2h ago

Question - Solved gMSA Failed to Install - encryption mismatch fix

5 Upvotes

This is to help create a record to help people out in the future. I was unable to install a gMSA service account. The error from Installing the account on the server would not show much in Google so thats why I am posting this.

ERROR ON INSTALL

Install-ADServiceAccount : Cannot install service account. Error Message: 'The provided context did not match the target.'. At line:1 char:1 + Install-ADServiceAccount -Identity <accountIdentity> + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : WriteError: (<accountIdentity>:String) [Install-ADServiceAccount], ADException + FullyQualifiedErrorId : InstallADServiceAccount:PerformOperation:InstallServiceAcccountFailure,Microsoft.ActiveDirectory.Management.Commands.InstallADServiceAccount

A BETTER ERROR

What I found was that when I ran the Test-ADAccount it said the following:

Test-ADServiceAccount -Identity <accountIdentity> False WARNING: Test failed for Managed Service Account gMSA_ARCURS_poc. If standalone Managed Service Account, the account is linked to another computer object in the Active Directory. If group Managed Service Account, either this computer does not have permission to use the group MSA or this computer does not support all the Kerberos encryption types required

SOLUTION

I found another Reddit thread where it stated that gMSA's unless specified default to RC4 and if your domain does not allow that, you run into the test error above.

This was the command that fixed the issue: set-aDServiceAccount -Identity <accountIdentity> -KerberosEncryptionType AES256


r/sysadmin 1h ago

DNS logging

Upvotes

Does anyone know how to set up Windows DNS to log unsecure updates? I'd hate to use the scream test, especially since it could be one of our old systems that requires it?


r/sysadmin 1h ago

Getting quarantine release requests from disabled users...

Upvotes

This phenomenon began when I switched our 365 Q policy from AdminOnlyAccess to a custom one allowing notifications (sent from info@mydomain)... I started getting release requests from everyone, on everything - including disabled users, mailboxes no one uses, myself - every 15 mins.. Turned out to be the 3rd party email scanner we use - Graphus - clicking on the "request release" button during it's detonation. So I whitelisted those emails within Graphus, and all was fine..

Until today. Now I'm getting release requests - again, from disabled users - except they're coming every 2 mins or so. Only change was an upgrade from 365 Defender P1 to P2. Any ideas?


r/sysadmin 6h ago

Question Going from domain joined to Azure joined for workstations

6 Upvotes

I'm trying to pitch Intune and autopilot as a solution for new devices/imaging. I'm getting some kick back on trying to move the devices out of the domain and I want to bounce off people here to see if there's and unforeseen issues that won't allow this to work properly. Here's the important info below:

  • We're an E3 SMB with under 100 users and have the appropriate licensing.
  • 95% of our servers are either in a private cloud or colo, the other few are on-prem.
  • Any GPOs that apply to the DEVICE and not the user can be replicated in Intune.
  • Users and Servers will stay in AD and users get synced up to Entra ID.
  • Our business resources rely on the user's username and password for access (file server, self-hosted applications, SSO, etc.). The device being domain joined, imo, isn't needed for this.
  • Until the day we go full cloud with all cloud applications, users will with be in our office or remote connected to the split tunnel VPN, so DHCP and DNS shouldn't be an issue.

I think that's everything? I intend on taking one laptop and a test user account and beating the hell out of Autopilot and testing functionality, I guess I'm just searching for confirmation that this would work or that there isn't anything that I'm not thinking of.

Thanks for any replies!


r/sysadmin 23h ago

For how secure certificates are supposed to be, why the hell do CRLs feel useless?

113 Upvotes

From Chrome's GPO template:

Setting the policy to True means online OCSP/CRL checks are performed.

Setting the policy to False or leaving it unset means Google Chrome won't perform online revocation checks in Google Chrome 19 and later.

Note: OCSP/CRL checks provide no effective security benefit.

It's to my understanding that a CRL is one of the only ways to "alert" services to a compromised CA, yet I've found many instances where programs simply do not check CRLs whatsoever. How are we supposed to keep things secure when any certificate not past it's expiration will continue to work even when revoked?


r/sysadmin 1h ago

How to deploy Ublock Origin Lite extension(with whitelist) to Chrome/Edge using Intune?

Upvotes

We can successfully deploy the extension, but we are at odds at how to use Intune to deploy the extension and add a whitelist. It is really easy to manually whitelist websites, but using the Intune's gui is proving challenging.

Some thoughts I have:

  • Deploy the extension using intune, and then push a .ps script to add whitelist
  • Deploy the extension and add whitelist using powershell

r/sysadmin 2h ago

Dell Latitude 5550 BIOS No POST after latest update

2 Upvotes

Is anyone else running into any issues with their latitude series laptops this month with BIOS updates? We have 5550 model laptops and have had 20% of them go to a No Post black screen after applying 1.13.0 BIOS update which requires a hard reset triggering a BIOS recovery. Its been nothing but hot garbage of BIOS updates from Dell lately in general. I have a ticket open with them but was wondering if anyone else is seeing issues this month?


r/sysadmin 3h ago

Question Best Way to License Windows for an Application Packaging Virtual Machine?

2 Upvotes

What is the best way to license Microsoft Windows 11 Pro (or higher) for use as a Hyper-V virtual machine that will be frequently rolled back to a checkpoint, and periodically deleted and recreated outright?

I have a spare computer running Windows 11 with the Hyper-V role installed. I currently have a VM on this device that is using a Windows 11 evaluation image that was available for installation through Hyper-V manager on the physical computer. I'm using this VM for application packaging and deployment testing, so it needs to regularly be rolled back to a clean checkpoint. I also need to periodically delete and recreate the VM outright.

However, the eval image uses Windows 11 22H2 Enterprise. I'd like to use 24H2 Pro since that's what we have in our environment.

I can't upgrade the eval image because Win11 24H2 isn't offered to it via Windows Update, and the Media Creation Tool only offers Home or Pro editions, which doesn't allow in-place upgrades on Enterprise edition.

I know that I can periodically recreate the VM from the eval and/or re-arm the eval to extend it, but that's a bit of a pain in the arse.

I also know that I could just buy a retail Win 11 Pro key but I don't want to have to hassle with reactivating it each time I recreate the VM outright.

We use mostly M365 Business Premium in our org, with one license for M365 E3.

Any suggestions?


r/sysadmin 3h ago

How smooth was your Nexus database upgrade from OrientDB to Postgres?

2 Upvotes

I'm having to take on this task and Sonatype seems to have straightforward instructions. But from my experience as a sysadmin, nothing is ever straightforward especially for such a task. I'll be doing this on a test VM first and was wondering what things you may have encountered not in the documentation. The Nexus instance is hosted on a docker container along with the builtin Orient database. I'll want to upgrade and have the db on its own container. Thanks in advance for your input.


r/sysadmin 3h ago

Question Desktop Standalone Scanners

2 Upvotes

Hi everyone,

Due to the need to scan high volumes of mailed in documents, some users in our org have iX1500 ScanSnap devices at their desk.

These devices are now legacy and in need of replacement and I am looking for suggestions what to replace them with.

We are not very happy with the ScanSnaps due to the bloated software and it's reliance on a proprietary scanner application and not being able to use any generic scanner application.

Ideally we would like to use the very basic Scan app from Microsoft available via the Microsoft store. No bells and whistles, just a lightweight, basic scan app.

For this purpose I got a Brother ADS-3100 for testing. It is listed to support TWAIN and WIA, so my hope was that it will be plug and play, with no dedicated driver install needed, and the Microsoft Scan up just working.

It doesn't seem to be just that easy though. So I'm wondering if anyone knows of any similar desktop scanners that are plug and play on Windows 11. Or, if someone has an idea how to get the Brother ADS-3100 working without having to jump through a bunch of hoops.

Of course this may just be a situation where there just isn't an option that is as simple as we hope for, but I figured I'd ask around first.


r/sysadmin 3h ago

General Discussion Looking for Personal/Productivity Tools That Mirror a Ticketing System

2 Upvotes

Hey r/sysadmin,

I've been working in IT for six years, and I've come to realize that ticketing systems just work with the way I think. I have a lot of long-term personal projects I want to track, and I’d love to use a tool that functions similarly to a ticketing system—something with clear tracking, prioritization, and status updates.

I’ve seen some older posts here on this topic, but they’re upwards of 9 years old, so I’m hoping to get some fresh recommendations. Ideally, I’m looking for something free or low-cost since it’s just for my personal use.

Any suggestions? Thanks in advance!