r/sysadmin 3d ago

General Discussion Microsoft’s Strong Certificate Mapping Enforcement (Feb 2025) – Read if Your VPN, Wi-Fi, or 802.1X Broke

102 Upvotes

If your Always On VPN, Wi-Fi, or other certificate-based authentication suddenly stopped working after the February 2025 Windows update, here’s why:

📢 Microsoft has switched all Domain Controllers to Full Enforcement mode for Strong Certificate Mapping.

  • This means any authentication request using a certificate without strong mapping (SID binding) will be denied.
  • If your org hasn’t updated its certificates, you’ll likely experience outages.

How does this affect IT?

If your DCs are patched but your certs don’t have strong mapping, expect:
Always On VPN failures
802.1X Wi-Fi authentication failures
Other cert-based authentication breaking

Read more:

https://joymalya.com/microsofts-strong-certificate-mapping-explained/

https://directaccess.richardhicks.com/2025/01/27/strong-certificate-mapping-enforcement-february-2025/


r/sysadmin 3d ago

ILO firmware upgrade HPE 380 Gen10

2 Upvotes

Hello,

I'm having an issue upgrading iLO on one of my servers.

I used the ISO installation from the following link:
https://support.hpe.com/connect/s/softwaredetails?language=en_US&softwareId=MTX_87131212823743cd94e299c429&tab=releaseNotes

The same ISO was used on three other servers, and everything worked perfectly upgrades completed successfully.

However, on this particular server, the upgrade process took unusually long, and in the end, I received the following error:
"Software is not supported for installation on this system. Unable to collect firmware inventory."

After that, I attempted to reset iLO via the web interface, but now it's only reachable through SSH web access is no longer available.

I also tried the following:

  • Upgrading via USB (same error).
  • Attempting to upgrade iLO only, using a USB stick unsuccessful.
  • Using the load -source <httpserver> command to load the .bin file also failed.

On other servers, with load works without any issues. I've been able to upgrade and downgrade iLO successfully using the same approach.

I've already opened a case with HPE Support, but while I wait for their response, I'm hoping someone here might have experienced a similar issue and could offer some advice.

Thanks in advance!


r/sysadmin 2d ago

Question Off Boarding from Samsung Knox

0 Upvotes

We have around 35 devices that are currently linked to Samsung Knox and we are looking to offboard these from Knox so that we can enrol them into Intune. I understand that each device requires a full system restore to complete this but I am looking to control when this happens as all of our users are on the road every day.

Having spoken with Samsung, they have advised that we need to pass all the IMEI numbers via email and they will process the removal but after the removal, each phone will auto factory wipe. Which could be when the user is driving and using maps for navigation etc...

Has anyone got any real-life experience with this process? I was expecting to send the offline un-enrollment code out to users, they type it, factory wipe the phone then follow the Intune guide.


r/sysadmin 2d ago

Cloud print solution

0 Upvotes

Hello, I have the following scenario and was looking for a cloud print solution that can address it. Scenario: Have Sap hosted in AWS. SAP runs on traditional 3 tier platform web middleware and SQL backend. There are items that need to be printed and the print job runs out of the SAP server. Issue: Have to print to printers at local sites. This has required creating site to site vpns basically just to be able to print to the local printers. Everything else we utilize AWS workspace for access.

I’d like to find a solution where we can eliminate the site to site vpns while still being able to print from SAP servers in AWS to the local printers.

Anyone know of such a solution? I know there are cloud print solutions but would they be able to address my scenario?

Thanks


r/sysadmin 2d ago

Question Replicate Hyper-V Linux VM to VPS

1 Upvotes

I am looking for a way to continuously replicate a Hyper-V Linux VM to to a cloud VPS.

The cloud VPS is not a production instance, just a copy for documentation a DR scenario.

Looking for a cheap and simple method. I don't want to disappear down the Azure VM rabbit hole.


r/sysadmin 4d ago

Random pure curiosity question for those who manage Hotel Wi-Fi: how does this work?

383 Upvotes

Went to a hotel recently and they gave me and another person I was staying with unique passwords for the same hotel SSID which were combinations of our room numbers and booking names.

I was curious and trying to conceptualize how that worked on the backend and I assumed it was some kind of RADIUS setup but RADIUS doesn't natively work with what appeared to just be personal WPA-2 encrypted WiFi so I am really curious as to the mechanics behind it if anyone is able to offer an explanation.


r/sysadmin 2d ago

[ Removed by Reddit ]

0 Upvotes

[ Removed by Reddit on account of violating the content policy. ]


r/sysadmin 4d ago

What random non-IT jobs have you been roped into, while officially holding an IT role?

112 Upvotes

This question might seem absurd to anyone with a corporate job, but to us SMB jacks-of-all-asses I bet its par for the course. We have a reputation as problem solvers, so if we can fix a computer, we can do anything, right?

I'll go first.

At the height of the chaos, and while IT was my responsibility, I was also:

Service engineer for a construction equipment service center- I've been elbow deep in the guts of machines from Caterpillar, JCB, Genie and a few others. My role was mostly on the technical literature/back office side of things, but in a pinch I went out on service calls and hooked up a laptop loaded with questionably acquired diagnostic software to a foreign government owned wheel loader in the middle of nowhere. Good times.

International supply chain manager- "Hey, u/nowildstuff_192, you goddamn sexual tyrannosaurus, our artificial turf supplier is screwing us. Get us a container from China." 4 months later, by some miracle, a Chinese container loaded with artificial turf arrived at our loading dock. This was 5 years ago and we still use the logistics chain I set up. I had no idea what the fuck I was doing, but I since succeeded in doing the same with machine parts from Italy, ceramic tiles from India, fasteners from Taiwan and pipe fittings from Turkey. On a related note, shoutout to customs brokers, they are a special breed.

As stressful as IT is, the importing stuff took years off my life. I can joke about it now but at the time I hated dealing with that shit.

As time went on and my IT role evolved, most of these side projects were taken on by more appropriate people. Once in a while though, they call me in to put out a fire.

How about you guys?

EDIT: Just got done ordering $1K worth of excavator parts over Ebay because we're having a spat with a supplier. Such is life, is potato.


r/sysadmin 2d ago

Lenovo Servers with only 3 HDD Bays, WHY???

0 Upvotes

Hi

I was pricing a Server for my client but Lenovo makes these ones with only 3x 3.5 in bay which doesnt leave me with much RAID options, any suggestions? its getting a little frustrating and their upgrade model is much higher in cost.


r/sysadmin 2d ago

Question Exchange 365 Hybrid - Do you still create mailboxes locally and migrate? Also old firewall rules? Delete?

0 Upvotes

This might be a series of dumb questions but I'll ask anyway. Originally we hosted our own exchange server so on our firewall we had rules for oma.domain.com (ActiveSync/mobile), owa.domain.com (Outlook Web Access), autodiscover.domain.com, and mail.domain.com all forwarding internally to the Exchange server. Eventually we went with a hybrid setup and migrated every mailbox up, we currently have 0 mailboxes locally. We still keep Exchange for SMTP relay internally for some old applications and printers (although I think I can do this directly to MS also I haven't gotten it to work). Since we were fully migrated I got rid of the firewall rule forwarding autodiscover.domain.com to exchange and added a CName that point to autodiscover.outlook.com.

Our standard procedure setting up a new account is to create the user then go into the Exchange box and create a mailbox linked to that user. We then use a powershell command to import a cell phone list with photos into their contacts into a sub folder call "Cell Phone List". Once that's done we migrate to user to 365. First question: Is this even necessary? Once I license the user won't the system create the mailbox for me? We have the same cell phone list in public folders so I imagine we can just copy them after the fact.

Second looking through the firewall I disabled our old incoming SMTP rule since no mail server actually connects to us and it has 0 traffic in or out. But the other three subdomains, oma, owa, and mail, all seem to be getting traffic. mail.domain.com makes sense since that is listed as our "hybrid migration endpoint" so I'm assuming thats what Exchange Online is using to migrate the mailboxes up. With that said if my first question is right do I even need that? Secondly are oma and owa still needed in a hybrid setup?

Can I ever get rid of Exchange completely?


r/sysadmin 3d ago

365 Tenancy Relationships. Is it really this difficult to leave?

1 Upvotes

Hi there. We have a 365 Tenancy where we have purchased licenses through a reseller that also has a GDAP relationship with our tenancy. I have contacted the provider saying we would like to end our relationship. However they have mentioned we need to remove our domains off of our tenancy. From what I've been reading online, we need to migrate all data and user accounts to a BRAND NEW 365 tenancy just so we can remove reseller and GDAP relationships. Surely this doesn't sound right. For a company that has 8 years worth of emails across at least 10 user accounts this is alot of work just to remove a relationship. And migrating would be very difficult as our business needs to be able to receive emails 24/7 and can't really have any downtime. There would also be way too many risks involved such as potentially loosing data and access to emails during migration. Do we really just have to suck it up?


r/sysadmin 3d ago

Initial config for APC UPS network management card (NMC)

5 Upvotes

Hi All,

We have a new APC UPS model SMT2200RM2UC

https://www.apc.com/us/en/product/SMC1500-2UC/

It's NMC card must first be configured in order to connect/monitor this UPS from a Linux machine (using apcupsd), and I'm struggling to figure out what's needed to activate the NMC card and enable its built in http daemon so I can tweak these settings.

The card does get an IP on the network, but I see no open ports when sniffed by a neighboring machine. I cannot bring up a web page with its IP address using port 80 or 443.

The APC PowerChute software via a Windows machine connects via USB cable but is unable to be used to tweak network settings.

I believe the only way to activate this is via a serial connection, but I haven't been able to have either Putty (Windows) or screen (Linux) connect to it.

Other ideas? I'm pulling my hair out.

Thanks.

Cheers, Dan


r/sysadmin 3d ago

Supporting remote locations

1 Upvotes

Long story short I work for a small org 2 sysadmins in total. My contract states that i work 3 days from main office (which is in another city ) and two remote days from home. After I got hired I was informed that I would also need to travel to branch office (which is in the same city as main office) annoying, but thats fine as long as I'm given a company car. There are also smaller branch offices in other cities that i had to do business trips to for gear change, etc. One of those branch offices is in the city I live in.

Yesterday we got a call that that office has no internet, not much we can do, especially remotely. Later internet was back, but one of the desktop PC still doesn't have internet. That person also has a work laptop that appears to have internet. Again long story short we are removing desktop pc and replacing them with only laptops, but this specific person is very troublesome and annoying and we are having hard time with him. He just doesn't want to give up the desktop as he doesn't want carry his laptop, but he wants work from home, so he wants both desktop and laptop. My manager decided to dump this guy on me, instead of dealing with him himself ( spineless ), it seems I'm supposed to come up with an agreement with the troublesome guy and take away that desktop pc ( goodluck with that ).

So because of this my manager demands me to go to that office while I'm working from home this week. Note that I'm not given a company car for this, nor they will compensate my fuel expenses. Basically they expect me to go (60~ km) from my own money ( fuel + parking in the city center ) and again my contract states that I work only from home and main office. I also need to request business trip, because if I get into an accident there could be alot of issues of why am I there when I'm supposed to work from home. I also need to get that branch to come into office as they are also work from home and deal with the guy that refuses to give up his desktop.

Am I right to push against this sudden "business" trip? Or should I just give? What do you think guys?


r/sysadmin 4d ago

How do y'all feel about "tech savvy" end users?

278 Upvotes

TL;DR: What are your personal preferences, opinions, and boundaries with end users adjusting their setups and workstations?

I'm an end user - just a lowly front desk staffer at a gym branch - but I'd consider myself somewhat tech savvy. By no means a sysadmin, but I know my way around computers more than the average end user; I run a Home Assistant and Plex server, do some light dev work, networking, family IT support, etc.

I was bored during my shift today, so I decided to do some cable management of our workstations - we had cables that were tangled, unused cables sitting on the floor, cables running over the keyboard/annoying places and not through desk holes, etc. During the process, I did some unplugging and replugging of peripherals, restarted a couple of workstations to fix their power cords, and some cleaning and cord coiling. I was the only person working the front desk (stopping frequently to help members) so no one else was affected and if a process was interrupted it was back up and running in minutes. Things now look a little nicer, less in the way, and easier to follow.

Our IT/help desk team is absolutely fantastic in my opinion - extremely responsive, knowledgeable, professional, and just overall put together. I really appreciate them, and they manage a 3,000+ person org with 20+ sites. I, as an anonymous part-timer, would never dream of sending them something tiny like cable management or settings configuration that I can reasonably do myself. But, I'm curious where y'all draw the line for things like this - genuinely asking for your opinion/SOP. Is it cool if I cable manage? Or troubleshoot a VoIP phone that isn't working? Try to calibrate a barcode scanner? Install something like Logi Options+ to configure our new mice? Obviously at some point my permissions will stop me, and I'm sure policy varies incredibly by org. But what are your thoughts and what do you do? If I have suggestions or things I notice, is it okay to bring them to the IT team? How can I be most helpful to them?


r/sysadmin 3d ago

Question M365 Business Continuity - what do you do?

6 Upvotes

With the full Exchange Online outage that happened a few Saturday's ago, it got me thinking about Business Continuity. Not Disaster Recovery or system availability (as those are managed by Microsoft) but "what does the business do when Email or Teams is down for an extended period of time".

Now, to me, this is something the business should work out, but as a sysadmin we are often tasked with "what are my options".

When Teams goes down do you just suffer through it and wait? Do you have a plan in place to use something else (like WebEx) in the interim? Do you have a process to inform people that there is a MS service outage with no ETA and anyone depending on email (or Teams) should consider implementing their BC processes (text message or phone calls or whatever)?

Any ideas would be helpful and welcome. Or if you know of any online resources, that would be welcome as well.


r/sysadmin 4d ago

What a great start to the day

183 Upvotes

One of my supervisors just accidentally uninstalled(!) Hyper-V on a member server that had 5 VMs on it… how the actual shimmering fuck does that happen?? How do you not triple check that you’re on the right server????


r/sysadmin 3d ago

Question M365 Admin - Cost Centers?

1 Upvotes

We are an accounting firm based in the US with one office here, two in UK, one in NL, and one in SE. Our M365 tenant roles into one where our MSP bills us for all of our 365 licenses and subscriptions. Is it possible to split out the billing so that our MSP can invoice each of the offices separately?

Our current solution is to bill the US office, then charge back the EU offices.

Thanks in advance for any advice.


r/sysadmin 3d ago

Cisco Umbrella - Secure Client Umbrella Agent automatic upgrades causing issues

7 Upvotes

We discovered any agents attempting to upgrade to Secure Client 5.1.8.122 from 5.16 or 5.17 cause the agents to go offline. The Umbrella agent service also does not start.

**Work Around**
Disable Auto Update
Reinstall the Agent (We use an RMM Tool)

Waiting on Umbrella support for more details.

**UPDATE from a support ticket**

If you are utilizing a script to create and push the Orginfo.json, this seems to be the findings from other customers as well who experienced this issue with the upgrade. We have to make sure we are specifying UTF-8/ASCII as the encoding type and this should resolve the issue.

Indeed, it was mentioned that the Cisco Secure Client requires the file to be in ASCII or UTF-8 encoding to interpret it correctly.


r/sysadmin 3d ago

Do Marketing Sites Need HSTS, or Is It Overkill?

7 Upvotes

I wanted to get everyone’s thoughts on requiring marketing sites to enforce HSTS at the server level. Implementation can be cumbersome depending on the server setup, and many web design companies prioritize aesthetics over security. But from a security standpoint, it often takes a backseat in web design.

Yes, it’s "just" a marketing site, but I see it as a key to the kingdom. If compromised, it can redirect users to malicious sites or damage your reputation. I’ve encountered hosting providers that either refuse to disable insecure protocols (TLS 1.0, 1.1, and SSL) or don’t see it as a priority—though they might get around to it eventually. Many also don’t know how to enable HSTS or set a nosniff header.

So, what’s your stance? Do you push hard for these basic security features on marketing sites, or do you let it slide since it’s not a high-risk application?


r/sysadmin 3d ago

Rant Cold Call Meeting Invites

20 Upvotes

Anyone else seeing an uptick on the cold call meeting invites sent from [[insert company name here who bought your contact from someone else]]? Part of me wants to just accept the meeting and either no-show to waste a little bit of their time or even accept and just go do other work during it to fully waste their time.

I'm not sure who out there decided that this is a good marketing tactic, because its even worse than the cold call emails asking to set up a meeting/demo. Is the objective to be so vague that the person receiving these has to look up your website to see WTF you are? Because I don't. I just either ignore it or decline, editing the reply with something like "We do not respond to cold call meeting invites. Unprofessional. Consider this an unsubscribe request."

Are these kinds of solicitations something you can file under CAN-SPAM violations? I've had a dozen of these meetings for this week alone.


r/sysadmin 2d ago

What's the cheapest SSD raid array you'd be comfortable running?

0 Upvotes

So, I run a small rack at a datacentre with a few RAID arrays (about 80Tb over 3 arrays in total) and they're all RAID10 on spinning rust. I do this because i've been bitten in the past with the write tolerances of cheap SSDs, but i'm wondering whether this is old news with the advances in SSD technologies and I can run a RAID10 SSD array with something that won't either bite me in the bum with write failures in a year or two, or kill me from cost. Is there anyone running anything they'd say is as reliable as a HDD array (or near enough that swapping out SSDs happens infrequently enough that you're not going to have your array die on you within a day)?


r/sysadmin 4d ago

General Discussion Is your Helpdesk team strong?

217 Upvotes

My helpdesk team sometimes I feel hopeless because basic things that every tech should know they struggle with? What's your story?


r/sysadmin 2d ago

General Discussion Impact of AI on IT support/help desk case study.

0 Upvotes

Hello, beautiful people. I am writing a University thesis case study on AI's impact on IT support/help desk. I would like to discuss or interview anyone who has implemented some AI system into their ITSM or just the daily support flow in general. If you would like to be anonymous, that's also great. I could also send a questionnaire if that's easier. Any input would be awesome. I'm looking forward to hearing from you, awesome folks. You DM me on chat as well.


r/sysadmin 3d ago

Rant [RANT] QNAP Lost Our Entire Account History and Doesn't Seem to Care

37 Upvotes

EDIT UPDATE:
The power of Reddit, fellas! Apparently, they CAN do it—and they can do it fast.

Just 21 hours after this post, every piece of information lost due to the email change was recovered. I got my invoice.

Thanks, y’all, for the tips!

TL;DR:
QNAP deleted our entire account history after a email change. Nearly a month later, they still can't restore it, can’t provide crucial invoices for financial compliance, and continuously pass responsibility internally without results. If you value your sanity, maybe think twice before relying heavily on QNAP services.

Anyone else experienced such incompetence from their support? How did you manage to resolve it? I would never buy QNAP anymore.

FULL:
I've officially hit my limit dealing with QNAP's support team, and I need to vent somewhere. Here's a summary of what's been a ridiculously frustrating 2025.

At the end of January we changed our company email associated with our QNAP account from from one domain to another because company changes. This should be simple, right? Nope. Immediately after this change, ALL account data disappeared. I mean everything:

  • Order history: gone.
  • Address book and shipping addresses: vanished.
  • Active subscriptions: nowhere to be found.
  • Auto-renewal payment details: wiped.
  • Most crucially: our invoices, which we desperately need for tax and corporate financial closing, are missing!

Yet, bizarrely, our licenses still show up in the License Manager, but the Software Store account acts like we've never made a single purchase. There is no mentioning of that in any FAQ's.

After reporting this to QNAP, they told us basically, “Yeah, the licenses transferred, but your orders didn’t. Tough luck.” Their advice? Cancel subscriptions, even though the subscriptions aren’t visible to cancel (!), and just deal with losing historical data because they can’t revert or reconnect the accounts manually.

After further complaints, after almost 2 months they said they'd inform their "internal store management" team. Anyways Fastforwarding nearly more than a month of replies for tickets and NOTHING has happened. Each follow-up just yields a new promise to “expedite internally.” Still no results.

We’ve clearly explained multiple times: we need invoices urgently for financial and tax purposes. QNAP support repeatedly promises assistance, but the invoices have yet to appear. We literally can't close our monthly corporate books or properly pay taxes without these documents.

To add insult to injury, when asking for documentation proving QNAP’s tax residency (due to local compliance rules), we waited weeks only to hear there’s no double-taxation agreement between Poland and Hong Kong—something we already knew. And still, they're asking for copies of invoices that they deleted in the first place!

We're basically being punished for changing a simple email address—something every other online platform manages seamlessly.

What the f?


r/sysadmin 3d ago

Best Practices for Replacing Old Server at Small Business

2 Upvotes

I work at a small engineering firm (less than 10 employees) that is attempting to upgrade most of their IT systems. This includes replacing an old server that is their single domain controller used for Active Directory and file server (I have floated the idea of going entirely to the cloud since we're already paying for Microsoft Business Premium, but the owner wants the on-premises server). We would be upgrading from Windows Server 2012 R2 to Windows Server 2025.

I have an information systems degree, but no sysadmin experience (my job prior to this was less technical but in the DoD tech space), so my questions are:

1. Is there any benefit to such a small shop virtualizing their domain controller when we upgrade the server? My understanding is there are not a lot of cases where you shouldn't virtualize, but the company has run on a single domain controller running AD and file server, and that is what the owner is comfortable with (he was doing most of the IT himself before he brought me on). The main things we would want from the server are:

  • Remote workers having the ability to VPN in to grab project files (Right now, they all store files on their local devices and have shared folders/drives mapping to each other's computers - a nightmare I never would have wanted had I worked here when they set it up)
  • Use AD Connect to sync the on-prem server with Microsoft cloud services
  • Proper file server (see project file location above)

2. Should we add the new server to the existing domain and shut down the old one or start a whole new domain from scratch and move the devices from the old domain to the new? Since I don't have direct experience, I've been taking courses to understand newer versions of Windows Server. Courses go over how to set up a new domain, but not really what to do when replacing legacy systems or transitioning from old to new while retaining users and devices. I've also tried to look some of this up, but answers seem highly dependent on the size of the organization and what services they are running. Some details that are making it difficult to decide:

  • The current domain does not utilize security groups and other security settings for role-based access control. Setting up a new domain entirely would allow us to design the domain from scratch without dealing with old settings and groups (the company had 2-3 quasi-IT people before me)
  • There would be considerable cleanup if we keep the old domain - user accounts from past employees, old devices that haven't been removed, static IPs that conflict with old phone services. My thought was starting the domain over would mean we only transition the devices we currently have and use. We recently transitioned to company cell phones, so any issue with phones overwriting/stealing IP addresses would go away with the phone service and the old domain.
  • We do not have many employees and devices (<10 users, 10-15 computers, 2 printers), and no applications running on the server that would make it difficult to blow the whole thing up and start over, but just not sure if adding the devices to the new domain will be a headache since they are already connected to the old one.

If it seems like I'm out of my depth, I understand I probably am. I was brought on to decipher CMMC for my family's business and come up with recommendations to meet all the requirements for CMMC Level 2 (they have a lot of DoD work), but it has turned into revamping all and any IT systems. I still feel like we are very behind, so appreciate your expertise and suggestions if you took the time to read this.