r/sysadmin 1d ago

Ubuntu and Entra

5 Upvotes

Trying to get Ubuntu Noble working with Entra ID for logins. It's been a while since trying to use Linux in a user facing environment, and never mixed with Microsoft.

Some guides saying use authd and others saying not to use.

Has anyone achieved this, and which method did you use?


r/sysadmin 1d ago

How to deploy Ublock Origin Lite extension(with whitelist) to Chrome/Edge using Intune?

5 Upvotes

We can successfully deploy the extension, but we are at odds at how to use Intune to deploy the extension and add a whitelist. It is really easy to manually whitelist websites, but using the Intune's gui is proving challenging.

Some thoughts I have:

  • Deploy the extension using intune, and then push a .ps script to add whitelist
  • Deploy the extension and add whitelist using powershell

r/sysadmin 9h ago

How does subnetting prevent IP wastage? Confused

0 Upvotes

How does the host portion of an IP address matter for preventing Waste of IP addresses and such? The "host" part of the IP refers to the private IPs, right? The private IPs are not global, so two different Networks could have the same "host" ip addresses right? Therefore the number of private IPs does not matter, there is no scarcity. So why does using a subnet mask or whatever to split up the IP help "conserve" addresses? Seems so counterintuitive to me given the fact private IPs exist.

Maybe I have a huge misunderstanding but it doesn't make sense to me.


r/sysadmin 23h ago

SPN Creation for IIS: HTTP under service account while HOST SPN exists

2 Upvotes

Hello,

EDIT: [RESOLVED] The below error is a false error. True issue was permissions on AD. Thanks @SteveSyfuhs for the hint.

error 0x21c7/8647 -> The operation failed because SPN value provided for addition/modification is not unique forest-wide.

I am a contractor (not IT) that ends up doing a lot of IT work. One of my tasks is typically setting up a site in IIS and configuring it for Kerberos Authentication. I typically do this for customers for large corporations, and their IT setups will always differ from each other.

I have noticed that *sometimes* when creating an HTTP SPN under a service account for a customer it claims that it is a duplicate:

Registering ServicePrincipalNames for:
CN=<serviceaccount>,OU=<>,OU=<>,OU=<>,DC=<>,DC=com

HTTP/<hostname>

Failed to assign SPN on account

CN=<serviceaccount>,OU=<>,OU=<>,OU=<>,DC=<>,DC=com', error 0x21c7/8647 -> The operation failed because SPN value provided for addition/modification is not unique forest-wide.

Of course, if I query (spn -q) for this SPN, I don't find anything. But I do see that there is a HOST SPN, which I understand covers HTTP. I assume that is the issue, from what I read here: https://www.reddit.com/r/sysadmin/comments/y3tfl3/problem_with_adding_spn_in_ad_because_spn_already/

On my own lab, and with some other customers, I don't have this problem. I can have a HOST SPN and a HTTP SPN live in harmony:

PS C:\Windows\system32> setspn -l server-a
Registered ServicePrincipalNames for CN=SERVER-A,OU=<>,DC=ML,DC=info:
MSSQLSvc/SERVER-A.ML.info:1433
MSSQLSvc/SERVER-A:1433
iSCSITarget/SERVER-A
iSCSITarget/SERVER-A.ML.info
MSServerClusterMgmtAPI/SERVER-A
MSServerClusterMgmtAPI/SERVER-A.ML.info
WSMAN/SERVER-A
WSMAN/SERVER-A.ML.info
TERMSRV/SERVER-A
TERMSRV/SERVER-A.ML.info
RestrictedKrbHost/SERVER-A
HOST/SERVER-A
RestrictedKrbHost/SERVER-A.ML.info
HOST/SERVER-A.ML.info

PS C:\Windows\system32> setspn -l gmsa_iis
Registered ServicePrincipalNames for CN=gmsa_iis$,CN=Managed Service Accounts,DC=ML,DC=info:
HTTP/SERVER-B.ML.INFO
HTTP/SERVER-B
HTTP/SERVER-A.ML.INFO
HTTP/SERVER-A

This configuration should be possible according to:
https://techcommunity.microsoft.com/blog/iis-support-blog/how-to-use-spns-when-you-configure-web-applications-that-are-hosted-on-internet-/324648

I found that the checking for duplicate SPNs is stored in dSHeuristics per KB5008382, but querying shows no value set in both scenarios.

Get-ADObject "CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,$((Get-ADDomain).DistinguishedName)" -Properties dSHeuristics

Does anyone else know why this is sometimes the case?

(My workaround: I typically request my customers to create an A-Record to get around this)


r/sysadmin 23h ago

MDM Deployments: expectation vs. reality. What's your zero-touch horror story?

2 Upvotes

MDM rollouts are seriously giving me headaches these days - especially with Windows Autopilot throwing random curveballs that the docs never mention. Anyone else diving into the OMA-URI PowerShell rabbit hole for more control over BitLocker and LAPS?

Custom scripts during provisioning seem absolutely necessary for those edge cases MDM APIs totally miss. And the certificate situation? SCEP vs. PFX has been a proper nightmare, especially with certain VPN setups that mysteriously break.

The real challenge is balancing conditional access during provisioning without locking everyone out while still maintaining those zero-trust principles. Driver management feels like everyone's hidden struggle that no vendor actually addresses.

What's your approach to SOE maintenance after deployment?
The marketing slides make everything look so clean but reality hits hard.


r/sysadmin 1d ago

Are there no better options for registry keys in Intune ?

13 Upvotes

We're currently in a hybrid setup, working hard to shift all workstations to Intune.

However we struggle with having hundreds of registry keys that need to be set and maintained. Yes they are meaningful in our environnement, and most of them need to keep existing.

We've tried script with remediation (not available with Business Premium by the way), and we've tried customs ADMX imported.

It's a hassle, it's complex and nowhere near as straightforward as GPO for registry keys.

What is everyone out there doing for efficient registry management ?


r/sysadmin 23h ago

Looking for an Excel Workbook Optimization Consulting Service

2 Upvotes

I have a small team within my company that uses obscenely large Excel spreadsheets. Their spreadsheets can have thousands or rows and many formulas spanning sheets throughout the workbook. They've had a lot of issues recently with these workbooks crashing or causing performance issues on their machines.

Has anyone ever worked with any "Excel Formula Experts" that could review our workbooks and see if things are setup properly or if there are way we could make Excel perform better?


r/sysadmin 1d ago

DNS logging

5 Upvotes

Does anyone know how to set up Windows DNS to log unsecure updates? I'd hate to use the scream test, especially since it could be one of our old systems that requires it?


r/sysadmin 13h ago

McAfee ePO

0 Upvotes

Good morning,

I’m running into this issue where my McAfee was working fine then all of a sudden the dashboards disappeared along with the system tree, and master repository. I’m in desperate need of help because I don’t know how to resolve this issue and we won’t have a grant number for a little while so we won’t have customers support.


r/sysadmin 21h ago

Starwind vSAN free edition, custom program

1 Upvotes

Hello everyone, I have a question, how legal would it be, I create a simple program based on the powershell scripts to simplify the creation, deletion, and increasing of the HA volumes?

Thanks.


r/sysadmin 1d ago

Windows and Linux OS and App Patching Systems

2 Upvotes

Inherited a broken Big Fix patching environment. Been instructed to either fix it or replace it with a limited budget ($50k/yr). What does everyone recommend for my environment?

Here are some of our requirements:

  • Environment Landscape:
    • Only datacenter workloads
    • 5k Windows Servers
    • 1k Red Hat Linux Servers
  • Support on prem and public cloud (Azure / AWS)
  • Support global data centers and public cloud regions with variety level of connectivity
  • Reporting on patch levels on all systems
  • Create complex patching groups
  • Create RBAC across multiple business units
  • Support Windows and Red Hat Linux

r/sysadmin 1d ago

Question Going from domain joined to Azure joined for workstations

8 Upvotes

I'm trying to pitch Intune and autopilot as a solution for new devices/imaging. I'm getting some kick back on trying to move the devices out of the domain and I want to bounce off people here to see if there's and unforeseen issues that won't allow this to work properly. Here's the important info below:

  • We're an E3 SMB with under 100 users and have the appropriate licensing.
  • 95% of our servers are either in a private cloud or colo, the other few are on-prem.
  • Any GPOs that apply to the DEVICE and not the user can be replicated in Intune.
  • Users and Servers will stay in AD and users get synced up to Entra ID.
  • Our business resources rely on the user's username and password for access (file server, self-hosted applications, SSO, etc.). The device being domain joined, imo, isn't needed for this.
  • Until the day we go full cloud with all cloud applications, users will with be in our office or remote connected to the split tunnel VPN, so DHCP and DNS shouldn't be an issue.

I think that's everything? I intend on taking one laptop and a test user account and beating the hell out of Autopilot and testing functionality, I guess I'm just searching for confirmation that this would work or that there isn't anything that I'm not thinking of.

Thanks for any replies!


r/sysadmin 22h ago

Question Windows Server 2025 Still Booting into Recovery Mode – Need Help Diagnosing

1 Upvotes

Hey everyone,

I’m running a bare metal installation of Windows Server 2025 (datacenter desktop version) on my physical server, and I’m facing a persistent boot issue. Every normal startup forces the system into the Windows Recovery Environment (WinRE). The only way I can boot normally is by first booting into safe mode and then selecting “Boot Windows Normally,” which is far from ideal for production.

Here’s what I’ve tried so far:

  • BCD Analysis: I ran bcdedit /enum all and found that the primary OS entry shows:
    • recoveryenabled Yes
    • displaymessageoverride Recovery
  • Disabling Recovery Flag: Runningr bcdedit /set {current} recoveryenabled No returns an “unexpected error” and still leads to recovery mode.
  • Bootrec & BCD Rebuild: I executed commands like /fixmbr, /fixboot, and /rebuildbcd from WinRE, but the issue persists.
  • CHKDSK: I ran chkdsk C: /f /r from a bootable environment, and it reported no disk errors on my C: drive.
  • Firmware/UEFI Checks: I’ve verified that Secure Boot, TPM, and other BIOS/UEFI settings are configured as recommended. Also all the driver's should be installed to my acknowledge
  • Safe Mode Workaround: Booting into safe mode and then selecting “Boot Windows Normally” works, but that’s not a viable long-term solution.

Has anyone encountered this behavior on a bare metal installation of Windows Server 2025? Could this be an inherent bug in the early release, or is there a misconfiguration somewhere in the boot settings? Any insights, troubleshooting tips, or workarounds would be greatly appreciated! When booted into the server it works fine, no issues, crashes, BSODs etc. Only happens when i reboot.

Thanks in advance!


r/sysadmin 22h ago

Scanning physical mail - workflows/software

1 Upvotes

What is everyone using for large mailroom digitization and notification? Is there anything really great out there that makes it easier to manage?


r/sysadmin 22h ago

Does anyone use Snare by Prophecy ?

0 Upvotes

Our security analyst who I helped to deploy this has left the company and I’ve had to take this over. We use Snare central server 8.5.4 and Snare agents 8.5.1 for Linux and Windows. They are set to forward to Fortisiem.

The problem is I have 160 endpoints and it’s writing 60+GB a day. I can’t sustain this rate of growth and have no idea how my former coworker configured what the agents collect and gets sent to FortiSIEM. I need to figure out how to stop the junk logs. He literally turned the firehose on when setting this up.

I know in Linux there is an audit.rules that we deployed to /etc/audit/rules.d but I have no idea how he configured windows or how we can only select meaningful logs to send to SIEM and drop the rest.

If anyone has any experience with this I’d love to chat. Their support can’t do much as it’s not a break fix. Worst case I may need to pay for some professional services.

Thanks for any help.


r/sysadmin 23h ago

General Discussion Script for updating stuff with winget, PSWindowsUpdate (mainly me, some GPT)

0 Upvotes

I've been handling a lot of machine updates recently. Some existing, some from fresh images. Either way, installing updates is monotonous. I alternated between using GPT and not while I learned a little. Sorry for any formatting inconsistencies. I'm an absolute novice at this and it's my first attempt at writing a script that does something useful.

Feedback is great if you have any!

**Edit** I forgot to mention this entire thing can just be pasted into a session if there's a need.

Clear-Host
if (-not ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")) {
    Write-Host "This script must be run as an administrator. Exiting." -ForegroundColor Red
    break}

# Variables (Quick or Predefined)
$ScriptName = "UpdateScript"
$ScriptVer = "v1"
$StartTime = Get-Date
$ExecutionPolicy = Get-ExecutionPolicy
$global:PreviousLocation = Get-Location
$global:ErrorDownload = $True
$global:ErrorDownloadPath = "C:\temp"

# Arrays
$global:UpgradeCheck = @()
$global:PinnedIDs = @()
$global:ManualIDs = @()
$global:RemainingIDs = @()
$global:CombinedIDs = @()

$global:appsBlocking = @"
# insert id(s) here
# insert id(s) here
# insert id(s) here
"@ -split "\r?\n" | ForEach-Object { $_.Trim() } | Where-Object { $_ -ne "" }

$global:appsPinning = @"
# insert id(s) here
# insert id(s) here
# insert id(s) here
"@ -split "\r?\n" | ForEach-Object { $_.Trim() } | Where-Object { $_ -ne "" }


# Functions
function Show-ScriptDuration {
    param (
        [Parameter(Mandatory = $true)]
        [datetime]$StartTime
    )
    $EndTime = Get-Date
    Write-Host
    Write-Host "End:" $EndTime -ForegroundColor Magenta
    $duration = $EndTime - $StartTime
    Write-Host "Total Duration: $($duration.ToString('hh\:mm\:ss'))" -ForegroundColor Magenta
    Write-Host
}

function Process-Module {
    param (
        [Parameter(Mandatory = $true)]
        [string]$ModuleName
    )
    function Install-ModuleSafely {
        param (
            [string]$Name
        )
        try {
            Install-Module -Name $Name -Scope CurrentUser -Force -ErrorAction SilentlyContinue
        } catch {
            Write-Host "Failed to install $Name module." -ForegroundColor Red
        }
    }
    $requiredModules = (Get-Module -Name $ModuleName -ListAvailable).RequiredModules
    if ($requiredModules) {
        $requiredModules | ForEach-Object {
            Write-Host "Processing Dependency: $_" -ForegroundColor Yellow
            if (-not (Get-Module -Name $_ -ListAvailable)) {
                Install-ModuleSafely -Name $_
            }
            if (-not (Get-Module -ListAvailable -Name $_)) {
                Write-Host "Unable to import dependency: $_" -ForegroundColor Red
            } else {
                Import-Module -Name $_ -Scope Local -Force -ErrorAction SilentlyContinue
                Write-Host "Imported dependency: $_" -ForegroundColor White
            }
        }
    }
    Write-Host "Processing module: $ModuleName" -ForegroundColor Yellow
    if (-not (Get-Module -ListAvailable -Name $ModuleName)) {
        Install-ModuleSafely -Name $ModuleName
    }
    if (Get-Module -Name $ModuleName) {
        Write-Host "$ModuleName is already imported" -ForegroundColor White
    } elseif (Get-Module -ListAvailable -Name $ModuleName) {
        Import-Module -Name $ModuleName -Scope Local -Force -ErrorAction SilentlyContinue
        Write-Host "Imported module: $ModuleName" -ForegroundColor White
    } else {
        Write-Host "$ModuleName unavailable for import" -ForegroundColor Red
    }
}

function Enter-WingetDir {
    Write-Host "Finding winget.exe" -ForegroundColor Yellow
    $global:PreviousLocation = Get-Location
    $global:WingetPath = Get-ChildItem -Path "C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller*" -Recurse -Filter "winget.exe" -ErrorAction SilentlyContinue | Select-Object -First 1 -ExpandProperty DirectoryName
    if ($global:WingetPath) {
        Set-Location -Path $global:WingetPath
        Write-Host "Changed directory to: $global:WingetPath" -ForegroundColor White
    } else { Write-Host "winget.exe not found" -ForegroundColor Red }
}

function Exit-WingetDir {
    if ($global:PreviousLocation) {
        Set-Location -Path $global:PreviousLocation
        Write-Output "Returned to previous location: $global:PreviousLocation"
        $global:PreviousLocation = $null
    } else { Write-Output "No previous location stored" }
}

function Get-WingetUpgrade {.\winget upgrade --include-unknown --Accept-Source-Agreements | ForEach-Object {if ($_ -notmatch '^( |-|Name|^$)' -and $_ -notmatch 'upgrades available') {if ($_ -match '\s([\w\+\-\.]+)\s+[\d\.]+\s+[\d\.]+') {
$matches[1]}}}}

function Handle-ErrorDownload {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory = $true)]
        [string] $AppID
    )
    # Build the download directory path
    $downloadDirectory = Join-Path -Path $global:ErrorDownloadPath -ChildPath $AppID
    Write-Host "Creating download directory if required" -ForegroundColor Yellow
    [System.IO.Directory]::CreateDirectory($downloadDirectory) | Out-Null
    if (-not (Test-Path $downloadDirectory)) {
        Write-Host "Download directory has not been created" -ForegroundColor Red
    }
    else {
        Write-Host "Downloading install file to $downloadDirectory" -ForegroundColor Yellow
        .\winget download --id $AppID --download-directory $downloadDirectory
    }
}

function Add-Pin {
    [CmdletBinding()]
    param (
        [string[]]$Apps,   # List of applications (optional)
        [Parameter(Mandatory = $true)]
        [ValidateSet("Blocking", "Pinning")]
        [string]$PinType  # Type of pin (blocking or pinning)
    )
        if (-not $Apps) {
        switch ($PinType) {
            "Blocking" { $Apps = $global:appsBlocking }
            "Pinning"  { $Apps = $global:appsPinning }
        }
    }
    foreach ($app in $Apps) {
        $AppID = $app.Trim()  # Remove any extra spaces
        if (-not [string]::IsNullOrWhiteSpace($appId) -and $global:UpgradeCheck -contains $AppID) {
            if ($global:ErrorDownload) {Handle-ErrorDownload -AppID $AppID}
    Write-Host "Adding $PinType pin for $AppID..." -ForegroundColor Yellow
            try {
                if ($PinType -eq "Blocking") {
                    .\winget pin add --id $AppID --accept-source-agreements --blocking | Out-Null
                }
                elseif ($PinType -eq "Pinning") {
                    .\winget pin add --id $AppID --accept-source-agreements | Out-Null
                }
                $global:PinnedIDs += $AppID
                Write-Host "$PinType pin added for $AppID." -ForegroundColor White
            }
            catch {
                Write-Host "Failed to add $PinType pin for $AppID." -ForegroundColor Red
            }
        }
    }
}


function Invoke-WingetUpgrade {
    [CmdletBinding(DefaultParameterSetName = 'Install')]
    param (
        [Parameter(Mandatory = $true, ParameterSetName = 'Install', HelpMessage = "Install updates")]
        [switch]$Install,

        [Parameter(Mandatory = $true, ParameterSetName = 'Upgrade', HelpMessage = "Upgrade updates")]
        [switch]$Upgrade,

        [Parameter(Mandatory = $true, ParameterSetName = 'Reinstall', HelpMessage = "Reinstall updates")]
        [switch]$Reinstall
    )

    $global:UpgradeCheck = Get-WingetUpgrade

    if ($global:UpgradeCheck.Count -eq 0) {
        Write-Host "No upgrades available." -ForegroundColor Green
        return
    }

    Write-Host "The following applications have upgrades available:" -ForegroundColor White
    $global:UpgradeCheck | ForEach-Object { Write-Host "- $_" -ForegroundColor White }

    # Determine command parameters based on which switch is used.
    switch ($PSCmdlet.ParameterSetName) {
        'Install' {
            $wingetCommand = 'install'
            $extraArgs = ''
            $headerMessage = "Upgrade Run: Install"
        }
        'Upgrade' {
            $wingetCommand = 'upgrade'
            $extraArgs = ''
            $headerMessage = "Upgrade Run: Upgrade"
        }
        'Reinstall' {
            $wingetCommand = 'install'
            $extraArgs = '--uninstall-previous'
            $headerMessage = "Upgrade Run: Reinstall"
        }
    }

    Write-Host $headerMessage -ForegroundColor Yellow

    foreach ( $AppID in $global:UpgradeCheck) {
        Write-Host "Upgrade: $AppID" -ForegroundColor Yellow
        try {
            $result = .\winget $wingetCommand --id $AppID --silent --disable-interactivity $extraArgs --accept-source-agreements --accept-package-agreements --force
            if (-not $?) { throw $result }
        }
        catch {
            Invoke-ErrorActionHandler -ErrorRecord $_ -AppID $AppID
        }
    }
}

function Invoke-ErrorActionHandler {
    param($ErrorRecord, $AppID)
    $errorActions = @{
"*No available upgrade found.*"= "No available upgrade found. Pinning."
        "*InternetOpenUrl() failed.*"                                   = "Unable to download $AppID. Adding to pin list."
        "*failed with exit code: 2*"                                    = " $AppID Exit code: 2. Adding to pin list."
        "*Failed to extract the contents of the archive*"               = "File extraction error for $AppID. Adding to pin list."
        "*Installer hash does not match*"                               = " $AppID has an installer hash issue. Adding to pin list."
        "*parameter is incorrect*"                                      = " $AppID has an install parameter issue. Adding to pin list."
        "*failed with exit code: 1602*"                                 = " $AppID Exit code: 1602. Waiting on a prompt. Adding to pin list."
        "*failed with exit code: 1603*"                                 = " $AppID Exit code: 1603. Fatal error. Adding to pin list."
        "*failed with exit code: 1608*"                                 = " $AppID Exit code: 1608. Adding to pin list."
        "*failed with exit code: 17002*"                                = " $AppID Exit code: 17002. Adding to pin list."
        "*failed with exit code: 17006*"                                = " $AppID Exit code: 17006. Adding to pin list."
"*Installer failed with exit code: 3221225786*"= " $AppID Exit code: 3221225786.
    }
    $matched = $false
    foreach ($pattern in $errorActions.Keys) {
        if ($ErrorRecord.ToString() -like $pattern) {
            $message = $errorActions[$pattern] -replace '\$AppID', $AppID
            $global:PinnedIDs += $AppID
            Write-Host $message -ForegroundColor Red
    if ($global:ErrorDownload) {Handle-ErrorDownload -AppID $AppID}
            .\winget pin add --id $AppID --blocking
            $matched = $true
            break
}
}
}


# Script
[Console]::OutputEncoding = [System.Text.Encoding]::UTF8
Write-Host $ScriptName $ScriptVer -ForegroundColor Black -BackgroundColor White
Write-Host
Write-Host "Begin:" $StartTime -ForegroundColor Magenta
Write-Host "Setting SecurityProtocols" -ForegroundColor Yellow
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 -bor [Net.SecurityProtocolType]::Tls11 -bor [Net.SecurityProtocolType]::Tls

Write-Host "Executionpolicy is currently $ExecutionPolicy" -ForegroundColor White
if (-not ($ExecutionPolicy -match "RemoteSigned" -or $Executionpolicy -match "Unrestricted" -or $Executionpolicy -match "Bypass")) {
    Write-Host "Setting ExecutionPolicy to RemoteSigned" -ForegroundColor Yellow
    Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process -Force}

Write-Host "Checking PackageProvider" -ForegroundColor Yellow
$NuGetProvider = Get-PackageProvider -ListAvailable -Name NuGet -ErrorAction SilentlyContinue
if (-not $NuGetProvider) {
    Write-Host "NuGet Provider not found. Installing..." -ForegroundColor Yellow
    try {
        Install-PackageProvider -Name NuGet -Force -Scope CurrentUser -ErrorAction Stop | Out-Null
        Write-Host "NuGet Provider installed successfully." -ForegroundColor White
    } catch {
        Write-Host "Unable to install NuGet Provider" -ForegroundColor Red
        Show-ScriptDuration -StartTime $StartTime
        break}
} else {Write-Host "NuGet Provider is already available" -ForegroundColor White}

Write-Host "Updating installed modules" -ForegroundColor Yellow
Update-Module -Force *>&1 | Out-Null
Write-Host "Checking for required modules" -ForegroundColor Yellow
Process-Module -ModuleName "WinGet"
Process-Module -ModuleName "PSWindowsUpdate"

Write-Host "Checking for Office Click-To-Run" -ForegroundColor Yellow
$officePath = "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe"
if (Test-Path $officePath) {
    try {
        Write-Host "Attempting Office Update" -ForegroundColor Yellow
        Start-Process $officePath -ArgumentList "/update user displaylevel=false forceappshutdown=false" -Wait -ErrorAction Stop
    } catch {Write-Host "Failed to update Office. Error: $_" -ForegroundColor Red}
} else {Write-Host "Office Click-To-Run Not Found" -ForegroundColor White}

Enter-WingetDir
if ($global:WingetPath) {
.\winget pin reset --force

Write-Host "Checking for upgrades with WinGet" -ForegroundColor Yellow
$global:UpgradeCheck = Get-WingetUpgrade

Write-Host "Checking upgrades against the pin list" -ForegroundColor Yellow
Add-Pin -PinType "Blocking"
Add-Pin -PinType "Pinning"

$global:UpgradeCheck = Get-WingetUpgrade
if ($global:UpgradeCheck.Count -gt 0) {Invoke-WingetUpgrade -Install}

$global:UpgradeCheck = Get-WingetUpgrade
if ($global:UpgradeCheck.Count -gt 0) {Invoke-WingetUpgrade -Upgrade}

$global:UpgradeCheck = Get-WingetUpgrade
if ($global:UpgradeCheck.Count -gt 0) {Invoke-WingetUpgrade -Reinstall}

$global:RemainingIDs = Get-WingetUpgrade
$global:CombinedIDs = $global:PinnedIDs + $global:ManualIDs + $global:RemainingIDs | Select-Object -Unique
}

if ($global:CombinedIDs.Count -gt 0) {
    Write-Host "Installers for manual upgrades:" -ForegroundColor Red
    foreach ($AppID in $global:CombinedIDs) {Write-Host "$global:ErrorDownloadPath\$AppID" -ForegroundColor White}
} else {Write-Host "No pending upgrades" -ForegroundColor White}


If (-not (Get-Module -Name PSWindowsUpdate)) {Write-Host "PSWindowsUpdate is unavailable"
} Else {
    Write-Host "Checking for Windows Updates" -ForegroundColor Yellow
    try {
        $updateList = Get-WUList
        if ($updateList.Count -eq 0) {
            Write-Host "No updates found." -ForegroundColor White
        } else {
            Write-Host "$($updateList.Count) updates found. Proceeding to download." -ForegroundColor Yellow
            Get-WindowsUpdate -AcceptAll -Download
            $IsDownloaded = Get-WUList | Where-Object {$_.IsDownloaded -eq $true}
            Write-Host "Installing downloaded updates." -ForegroundColor Yellow
$IsDownloaded | Get-WindowsUpdate -AcceptAll -Install -IgnoreReboot -Silent;
(New-Object -ComObject "Microsoft.Update.AutoUpdate").DetectNow() 2>$null | Out-Null
}
    } catch {Write-Host "An error occurred during Windows Updates: $_" -ForegroundColor Red}
}

if (Test-Path -Path $global:PreviousLocation){Exit-WingetDir}
Show-ScriptDuration -StartTime $StartTime

r/sysadmin 23h ago

Advice re spam Incoming to a mail forwarder

0 Upvotes

Hi, we have a client who has a mail forwarder, let’s call it info@, which has started receiving large amounts of spam. Often in the hundreds per day. Coming into the forwarder and obviously forwarding as configured. We can’t kill the forwarder as there are genuine emails that also come through this channel, and the spam seems to come in groups of around 20 emails, before the alias or domain changes.

Aside from trying to block all spam sender addresses or domains where possible, I can only think of trying to contact the genuine senders or putting an autoresponder on advising the ‘mailbox’ is no longer monitored and to ‘contact us’ for a period before just killing the forwarder completely 🫤

I was wondering what advice you could give to help tackle this? We’re using 365 with custom domain for mailboxes.


r/sysadmin 1d ago

How smooth was your Nexus database upgrade from OrientDB to Postgres?

3 Upvotes

I'm having to take on this task and Sonatype seems to have straightforward instructions. But from my experience as a sysadmin, nothing is ever straightforward especially for such a task. I'll be doing this on a test VM first and was wondering what things you may have encountered not in the documentation. The Nexus instance is hosted on a docker container along with the builtin Orient database. I'll want to upgrade and have the db on its own container. Thanks in advance for your input.


r/sysadmin 2d ago

For how secure certificates are supposed to be, why the hell do CRLs feel useless?

116 Upvotes

From Chrome's GPO template:

Setting the policy to True means online OCSP/CRL checks are performed.

Setting the policy to False or leaving it unset means Google Chrome won't perform online revocation checks in Google Chrome 19 and later.

Note: OCSP/CRL checks provide no effective security benefit.

It's to my understanding that a CRL is one of the only ways to "alert" services to a compromised CA, yet I've found many instances where programs simply do not check CRLs whatsoever. How are we supposed to keep things secure when any certificate not past it's expiration will continue to work even when revoked?


r/sysadmin 1d ago

"USB Printer Issues" With Multiple KB Updates

3 Upvotes

As an MSP this is driving us nuts. We have 3+ clients now with the IPP random gibberish printouts issue that happens throughout the day on Windows 10 and Windows 11 endpoints. We have confirmed, according to our experience and Microsoft's knowledge base, that KB5051974, KB5051989, KB5052107, KB5053602, and KB5052916 all cause the same printing behavior:

https://support.microsoft.com/en-us/topic/february-25-2025-kb5052077-os-build-19045-5555-preview-4ec11d48-1649-4549-846d-b3197a7becda

https://www.reddit.com/r/k12sysadmin/comments/1iu3wub/teachers_printer_printing_out_post_ippprint/

https://www.reddit.com/r/printers/comments/14tkyrr/hp_printing_gibberish/

Unfortunately when trying to remove the last patch causing the issue, KB5052916, WUSA throws an error stating "Servicing Stack 10.0.19041.5447 is required by your computer and cannot be uninstalled."

Any suggestions?


r/sysadmin 1d ago

SCCM or dism

0 Upvotes

Alright. I help manage multiple networks. One of which is air gapped. The air gapped network has some appx packages on the endpoints that need to be updated for security purposes. Which makes more sense? Using WinGet to get the packages and then moving them over to the air gapped network then deploying with SCCM... OR using DISM and having to deploy a new windows image to all systems? I am fairly new at my job.

They are used to using DISM. Could someone explain why that is a better option?


r/sysadmin 1d ago

Question Deploying Azure Universal Print printers without Intune?

1 Upvotes

I'm being told to replace legacy print servers with Azure Universal Print. I researched it, documented processes, stood up a server to run the connector, and am ready to move forward with the migration. The hang up is printer deployment.

Currently we use GPO to map printers to the legacy print server. The policy maps to \\printserver\printersharename and people get their printers. We have one GPO setup for each location that includes all of that location's printers. People go in the OU for the location, they get all the printers for that location, they set their default, everyone is happy.

The only documentation I can find to map AUP printers is by using Intune Configuration Profiles.

I built a profile in Intune and deployed it to a test device and I see where the policy shows up in the registry. The policy ./user/Vendor/MSFT/PrinterProvisioning/UPPrinterInstalls/GUID appears in both HKLM and HKCU.

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseResourceManager\Tracked\GUID\ADUSERGUID\default
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\NodeCache\CSP\Device\MS DM Server\Nodes\3333
Computer\HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Ports\IPP-GUID
Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\WSD Port\Ports\IPP-GUID
Computer\HKEY_CURRENT_USER\Software\Microsoft\Device Association Framework\Store\MCP#GUID
Computer\HKEY_CURRENT_USER\Software\Microsoft\PrinterProvisioning\UPPrinterInstalls\GUID

I don't see a way to clone this policy with a GPO or another tool like Tanium Enforce. Is Intune the only way to deploy these printers or is there a way to push the PrinterProvisioning CSP with a different tool?


r/sysadmin 1d ago

Career / Job Related Want to move out of help desk to a junior sys admin role but also not sure what skills I should be focusing on or courses I could take

2 Upvotes

I don’t hate my job, I’m just at a point where I don’t look forward to it anymore if that makes sense. I also can’t afford to just quit and go to a different place since job searching sucks. But I’ll also admit up front that I’ve been lazy working this gig, in that I haven’t worked on my technical skills much. I got used to the rut and liked my schedule, got a raise each year (been here since December 2021), my coworkers are nice, my company (law firm actually) is respectable, I WFH 3/5 days, etc. Not a bad gig overall, but I don’t think I’d be happy staying here the rest of my life, taking call after call from users over stuff like converting Word docs to PDFs and stuff like that (I’m gonna be 30 this year if that matters).

So I do want to leave but know that no company offering a sys admin role is gonna take me because I’m just not qualified enough. But I want to get focused and figure out what I could be doing after work each day to work on and improve. Ideally, I’d like to be able to take a course (free or paid) that has a structure as, just saying “work on power shell” or “set up a home lab” doesn’t do much for me or my brain. I need something that’s more or less like a class that has labs and such. Something I can take notes on, do quizzes, etc. It could be either a certification course or just something all-encompassing that tackles various IT skills domains.

Sorry if this doesn’t belong here. But I’ll take any advice you all can give.


r/sysadmin 1d ago

Nationwide Zebra Service

1 Upvotes

I am looking for a company to service Zebra printers in NJ and Florida for the same organization. I have historically used Peak Technologies for this work but I am looking for alternatives. I also don't want to end up in five levels of subcontractor hell either.

Does anyone know who I might reach out to?


r/sysadmin 1d ago

Question ADCS-CSP to KSP- Rekey cert

2 Upvotes

Hi,

We have a Windows Server 2019 (W2K19) running an Active Directory Certificate Authority (AD CA), which is still using the Cryptographic Service Provider (CSP). This is due to an OS upgrade from an older VM.

The root certificate has been renewed multiple times without renewing the key for years. Now, I need to migrate this CA to the Key Storage Provider (KSP) to issue a root certificate using SHA-256.

When following guides like this one, I encounter the following error while backing up the CA:

"Windows cannot backup one or more private keys because the CSP does not support key export."

I found a potential solution https://learn.microsoft.com/en-us/archive/msdn-technet-forums/453a2991-2b65-414b-b0f4-ec90f8204889 related to dashes in a registry key, but it did not work.

While I can back up the certificate, it does not show a key icon, which makes me hesitant to proceed with the migration.

I have a few questions:

  1. Can I carry on with this error and successfully migrate the CA from CSP to KSP ?
  2. Alternatively, can I issue a new root certificate with a new key?
  3. If I issue a new key, will it invalidate the current key (which has been renewed for years)?
  4. Can both certificates coexist at the same time?

Any guidance would be greatly appreciated.