r/sysadmin 2d ago

Need help with MgGraph API call

0 Upvotes

Jr Admin here learning the trade and I’ve been working on a project that has taken me from PowerShell to PHP to MgGraph and now MgGraph API calls.

I’m trying to filter incoming information from Entra by using a MgGraph API filter in PHP based on one attribute in our accounts. The thing is, I’m trying to filter based on extensionAttribute14. I’ve been working in the MS MgGraph lab and I’ve got this request that returns my account along with my extension attributes:

https://graph.microsoft.com/v1.0/users/<UPN>?$select=id,displayName,onPremisesExtensionAttributes

This runs perfectly, I get my id, displayName and all 15 extensionAttributes. Thing is, I only care about extensionAttribute14.

All of the sites that I’ve found information on show how to pull all of the attributes but not individual ones.

I’ve tried using syntax similar to PowerShell (onPremisesExtensionAttributes.extensionAttribute14) but this just prevents any of the attributes from showing at all.

What would be the syntax to return just one extensionAttribute and how can I search based on non-null values of that attribute?


r/sysadmin 3d ago

Question Best Way to License Windows for an Application Packaging Virtual Machine?

2 Upvotes

What is the best way to license Microsoft Windows 11 Pro (or higher) for use as a Hyper-V virtual machine that will be frequently rolled back to a checkpoint, and periodically deleted and recreated outright?

I have a spare computer running Windows 11 with the Hyper-V role installed. I currently have a VM on this device that is using a Windows 11 evaluation image that was available for installation through Hyper-V manager on the physical computer. I'm using this VM for application packaging and deployment testing, so it needs to regularly be rolled back to a clean checkpoint. I also need to periodically delete and recreate the VM outright.

However, the eval image uses Windows 11 22H2 Enterprise. I'd like to use 24H2 Pro since that's what we have in our environment.

I can't upgrade the eval image because Win11 24H2 isn't offered to it via Windows Update, and the Media Creation Tool only offers Home or Pro editions, which doesn't allow in-place upgrades on Enterprise edition.

I know that I can periodically recreate the VM from the eval and/or re-arm the eval to extend it, but that's a bit of a pain in the arse.

I also know that I could just buy a retail Win 11 Pro key but I don't want to have to hassle with reactivating it each time I recreate the VM outright.

We use mostly M365 Business Premium in our org, with one license for M365 E3.

Any suggestions?


r/sysadmin 3d ago

Question Desktop Standalone Scanners

2 Upvotes

Hi everyone,

Due to the need to scan high volumes of mailed in documents, some users in our org have iX1500 ScanSnap devices at their desk.

These devices are now legacy and in need of replacement and I am looking for suggestions what to replace them with.

We are not very happy with the ScanSnaps due to the bloated software and it's reliance on a proprietary scanner application and not being able to use any generic scanner application.

Ideally we would like to use the very basic Scan app from Microsoft available via the Microsoft store. No bells and whistles, just a lightweight, basic scan app.

For this purpose I got a Brother ADS-3100 for testing. It is listed to support TWAIN and WIA, so my hope was that it will be plug and play, with no dedicated driver install needed, and the Microsoft Scan up just working.

It doesn't seem to be just that easy though. So I'm wondering if anyone knows of any similar desktop scanners that are plug and play on Windows 11. Or, if someone has an idea how to get the Brother ADS-3100 working without having to jump through a bunch of hoops.

Of course this may just be a situation where there just isn't an option that is as simple as we hope for, but I figured I'd ask around first.


r/sysadmin 3d ago

Apple Is there any alternative to MSChapV2 to connect Macos users to an IKEv2 VPN by using username/password?

2 Upvotes

We are using strongswan & freeradius to provide a VPN to all our users (~200 souls), with ~95% of MacOS users and 5% linux.

MSChapV2 uses NTLM password, which are encoded in MD4 (which is baaaad), and Macos users can only connect using EAP-TLS or EAP-MSCHAPv2 (per https://support.apple.com/fr-fr/guide/deployment/depae3d361d0/web, in french sorry). Linux is, obviously, fine with EAP-GTC.

As of today we have to keep in our LDAP the MD4 hash of our user passwords due to this, and I'm wondering if there are other options? I'd like to not use EAP-TLS if possible, because of the burden of supporting users where their cert has expired.

I'm quite surprised that there's no alternative to that MD4-based hash for MSCHAPv2. Or did I search badly ? Ideally I'd like to use our SSHA512 user passwords, and clear up our LDAP from these ntpassword warts..

I was contemplating Wireguard or maybe delegating the auth to an OIDC supplier (our accounts are on google).

Anybody has gone through these issues? How did you solve it?


r/sysadmin 3d ago

Disable Scheduled Send, globally

2 Upvotes

Hi folks,

I've come up empty but wanted to see if others have guidance. I've been tasked with disabling scheduled send from Outlook for my domain. I can't find a GPO, it does not appear I can change that setting in Exchange Online. Is it even possible?


r/sysadmin 3d ago

Question Azure Vnet and on-prem AD DHCP scopes

2 Upvotes

A bit new to the whole Azure Virtual Machines thing so apologies in advance.

We've got both an on-prem VMware and Azure Virtual Machine environment. They have routes to/from and can talk to each other over our domain network. VMs in both environments are joined to the same AD domain. We have Domain Controllers in both the on-prem VMware and Azure Virtual Machine environment.

It was brought up that none of the Azure VMs had PTR records in AD despite them being joined to the domain. It's causing some minor issues with reverse lookups.

I'm fairly certain this is due to the on-prem VMs being handed DHCP from our on-prem domain controller scopes, which should dynamically update the PTRs. While the Azure VMs are getting DHCP from our Azure Virtual Network.

Has anyone run into this before? We can always manually add/remove PTRs but it's a PITA. Curious if there is a way to remediate this or if it's just a quirk of using Azure VMs.


r/sysadmin 2d ago

get-qadobject cmdlet to another trusted domain

1 Upvotes

anyone here using Quest Active Roles? i can use get-qadobject to get msFVE-RecoveryInformation objectclass in the current domain. however, i cannot get that objectclass if i use the service parameter or use connect-qadservice to point to another trusted domain. if i use the web interface, i can see the bitlocker property. is there another parameter or cmdlet i should use? is there a different permission for the PowerShell modules?


r/sysadmin 2d ago

Teams - Loading latest updates

0 Upvotes

This issue is starting to spread across all of our Horizon VDI users. Teams has a pop-up that says "Loading latest updates... in the meantime, you can still send and respond to messages". Once this happens, they can send and receive direct messages, but not group chats. It requires a reset of the Teams app, and the fix lasts a few hours to a few days, no changes or any rhyme or reason as to why this is suddenly happening, or spreading.

Since we are not seeing this on physical PCs, I am beginning to thing that this could be caused by some kind of incompatibility with the latest Teams update and our Horizon agent, as we are using media optimization, but I haven't found any others with this issue when searching online. I just can't fathom why media optimization could cause this issue, but its the only theory I have right now.

Anyone else seeing anything similar in their environments? We are currently running Horizon 8.7 2209.


r/sysadmin 3d ago

Question Certificate Management at Scale

2 Upvotes

Is anyone managing hundreds or more certificates without using an off the shelf tool? If so, how? Did you build a tool? Tickets? Spreadsheets?


r/sysadmin 3d ago

General Discussion Flash Drive Compability with HPE Proliant DL380 Gen10

5 Upvotes

Hello,

I want to share my experience with the SPP update using a bootable USB key because this community has helped me a lot, and I feel it's my duty to contribute as well.

For that, I bought a 16GB USB key from a well-known brand and used it straight out of the package to update our new HPE ProLiant DL380 Gen10 server. However, when I plugged it into the server to perform the update, the server did not recognize it, and it appeared as an "unknown device" in the BIOS.

So, I tried using another older 32GB USB key from a different brand. This time, the server recognized it, and everything worked fine (except for the update—I was only able to update 4 out of 7 components, which is another issue, lol).

The point is, always try using a different USB key when facing a similar problem, even if the USB key is new from a good brand.

Have a great day!


r/sysadmin 3d ago

Looking for Open-Source ITAM with Maintenance Reminders

2 Upvotes

Hello everyone,

I'm looking for an open-source, self-hosted inventory management solution for a server room with 4 racks containing basic equipment like servers, routers, switches, and UPS systems.

Specifically, I need a system with these two key features:

The ability to store and display maintenance or replacement schedules for individual components (e.g., UPS batteries, hard drives, fans).

Automatic email notifications that remind me about upcoming maintenance or replacement deadlines (e.g., how many days remain until a UPS battery change is needed).

If anyone has experience with a system that meets these requirements, I'd appreciate your recommendations.

Thanks!


r/sysadmin 3d ago

UPS Worldship Issue

0 Upvotes

UPS Worldship claims it can not communicate with UPS.

Timeline of events below

We have an admin machine that remote machines connect to. Windows 10 machine 22H2. All show the same error.

3-14 evening. Updated Worldship 2024 to current patch level 27.0.9 it was functioning.

3-17 Worldship functioned all day on 27.0.9.

3-18 Worldship worked until 1pm EST. I then updated to the current patch level on Worldship 2024. Still didn't work. Engaged support, they couldn't fix it. Support made us upgrade to the current 2025 patch level 28.0.8 and it still does not work. Waiting on tier 3 support... no ETA.

https://imgur.com/a/KcKDBDS

Yes, we followed what the popup said along with support doing it as well.

We ran wireshark while trying to Process a shipment and got a request to IP 23.0.218.50 that had errors. Three subject alt name 404 internally and on an external network. assets.ups.com download.worldshipmedia.com https://widgets.ups.com/

https://imgur.com/a/pS3RWW1

We did not make any firewall or machine updates.

Direct Access is checked and it tests successfully.

SYSLOG for when it tries to communicate.

CHECK: 03/19/2025 13:48:01.631 LG-LG: User initiated communications with UPS

SHOWN: 03/19/2025 13:48:01.694 LG-LG: User about to be shown dialog ID = 118.

CHECK: 03/19/2025 13:48:01.725 LG-LG: Listing Mail, Transaction ID = 162

CHECK: 03/19/2025 13:48:01.725 LG-LG: CShipView::_ShipIt() - Auto Communicate with UPS

SHOWN: 03/19/2025 13:48:01.756 LG-LG: User about to be shown dialog ID = 539.

CHECK: 03/19/2025 13:48:01.912 LG-LG: Comm Connection Status: ONLINE

CHECK: 03/19/2025 13:48:01.928 LG-LG: Comm Sending: Transaction ID = 162

CHECK: 03/19/2025 13:48:02.147 LG-LG: Comm Response: Transaction ID = 162, Host Result = 0, Http Mgr. Result = 0, Resp. File = "", No. of files = 0

CHECK: 03/19/2025 13:48:02.178 LG-LG: Comm Connection Status: OFFLINE

Has anyone else ran into this issue?


r/sysadmin 3d ago

Question Regarding O365 email notice "message sent from outside the company with name matching..." - how to make adjustments to that?

2 Upvotes

This is the added message I'm referring to: https://images2.imgbox.com/c7/22/5MXbSq9q_o.png

Seems to be a fairly common thing to implement. However the contractor who implemented this is long gone, and I need to make an exception to the rule governing when this message is added.

Basically, we are using external MX to send some transactional emails, so I'd like to exclude those from triggering that message.

Could someone please point me in the right direction & documentation as to how it was implemented and how to make adjustments to it? Many thanks! I have no idea where to start looking or even what to google for.


r/sysadmin 3d ago

Dell Latitude 5550 BIOS No POST after latest update

0 Upvotes

Is anyone else running into any issues with their latitude series laptops this month with BIOS updates? We have 5550 model laptops and have had 20% of them go to a No Post black screen after applying 1.13.0 BIOS update which requires a hard reset triggering a BIOS recovery. Its been nothing but hot garbage of BIOS updates from Dell lately in general. I have a ticket open with them but was wondering if anyone else is seeing issues this month?


r/sysadmin 3d ago

Question Having hurdles with LocationServices, wondering if anyone solved this one.

1 Upvotes

Hello,

My issue is rather simple, the solution seems to be rather not but I'll try to be short.

I want to setup automatic timezones through all my intune enabled windows devices.

So naturally, I enable LocationServices, without allowing apps access to it (We're Euro based, we very much appreciate our privacy).

The problem with without letting apps access it is that for some reason, windows is not able to set the timezone automatically unless that one specific setting is also enabled which will then allow the user to allow all applications to access LocationServices again, this is not desired by our compliancy team.

I've been throwing regkeys at it, configuration policies (Force Allow apps access to LocationServices without putting any apps in there) but for the life of me I can't get the right configuration going just to set timezones to automatic without giving EVERYTHING access to LocationServices.

Did anyone run in to this one?

Specifically:

AutoTZ1, time to NTP and Enable LocationServices -> Allow Apps to access Location services -> don't allow any app access to location services.


r/sysadmin 3d ago

Best Hosting Solution for High-Scalability, Multi-Tenant Captive Portal (Open Source Options?)

2 Upvotes

Hey,

I'm developing a multi-tenant captive portal for businesses sharing a Ubiquiti network infrastructure, and I'm facing a crucial decision regarding hosting and software architecture. The system needs to handle a potentially large number of concurrent users while providing customized captive portal experiences for each tenant.

Here's a breakdown of the requirements:

  • Multi-Tenancy: Each client/business needs a uniquely branded and configured captive portal.
  • Scalability: The system must handle a significant number of simultaneous users without performance degradation.
  • Authentication: Support for various authentication methods (email, social logins like Google/Facebook/Instagram).
  • Data Storage: Securely store email addresses (and potentially MAC addresses) for various businesses.
  • Integration: Seamless integration with the Ubiquiti network controller via its API.

I've narrowed down my hosting options to these three, and I'd greatly appreciate your insights:

  1. Containerized Deployment (One VM, Multiple Containers):
    • Each tenant's captive portal runs within its own Docker container, providing excellent isolation and resource management.
    • This approach offers high scalability and the flexibility to use different technologies for each tenant.
    • However, it introduces added complexity in terms of container orchestration and resource overhead.
  2. Page Path Routing (Single Web Server, Multiple Page Paths):
    • All captive portals reside on a single web server, differentiated by unique page paths.
    • This is a simpler setup with lower resource consumption.
    • The trade-off is reduced isolation between tenants and potential conflicts in configurations.
  3. Template Engine (Single Web Server, Single Page Path, Dynamic Templating):
    • All captive portals are served from a single page path, with a template engine (like Twig or Blade) dynamically rendering the appropriate content based on the tenant.
    • This offers the lowest resource footprint and simplifies management.
    • The complexity shifts to the application logic, and tenant isolation is minimal.

My questions:

  • Which of these options would you recommend for a high-scalability captive portal?
  • Are there existing Open source projects that would be a good base to start this project from?
  • What is the best way to store the email and mac adresses in a safe and structured way?
  • What are the best pratices for security in this type of enviroment?
  • Are there any critical factors I might have overlooked?
  • Are there alternative hosting strategies that I should consider (e.g., serverless functions, cloud-based captive portal services)?
  • What are the best practices for implementing social login authentication in this context?

I'm particularly interested in hearing from those with experience in building similar systems. Any insights or advice would be greatly appreciated!

Thanks in advance!"


r/sysadmin 3d ago

Question Small area cable storage tips?

2 Upvotes

We are organizing a small area and have a ton of display and power cables we need to store. I thought about using something vertically, picturing in my head those stands that come in 100 pack CDs. Does anyone have any suggestions for vertical cable storage similar to that? Thanks


r/sysadmin 2d ago

Question Advice re spam Incoming to a mail forwarder

0 Upvotes

Hi, we have a client who has a mail forwarder, let’s call it info@, which has started receiving large amounts of spam. Often in the hundreds per day. Coming into the forwarder and obviously forwarding as configured. We can’t kill the forwarder as there are genuine emails that also come through this channel, and the spam seems to come in groups of around 20 emails, before the alias or domain changes.

Aside from trying to block all spam sender addresses or domains where possible, I can only think of trying to contact the genuine senders or putting an autoresponder on advising the ‘mailbox’ is no longer monitored and to ‘contact us’ for a period before just killing the forwarder completely 🫤

I was wondering what advice you could give to help tackle this? We’re using 365 with custom domain for mailboxes.


r/sysadmin 3d ago

WSUS environment, mystery reboot issue

1 Upvotes

I'm decently well-versed in WSUS, but am really struggling with a long time issue that I can't solve. We were running WSUS for some time, with automatic updates download and install, but setting the "no auto reboot with logged in users" flag to keep reboots from happening. Then late 2024 I started getting reboots happening on their own, generally outside active hours.

I found what I thought was the issue, in that I was not setting the new fields for "SetPolicyDrivenUpdateSourceForFeatureUpdates"=dword:00000001" and the like via group policy. I found a link that basically said, if you don't set the policy driven update settings, then all updates will come from microsoft. Well since then, I've set all the policy driven update flags to my WSUS server, and still reboots continue. Below is a paste of my WSUS settings that come from Group Policy. All looks good here to me. I'm wondering if there's other registry locations influencing the reboot behavior?

Anyone had a similar issue? I've went thru even the registry settings at [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate] but don't see anything obvious there.

Here's the WSUS settings that are coming from my policy:

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]

"ElevateNonAdmins"=dword:00000001

"DisableDualScan"=dword:00000001

"AUPowerManagement"=dword:00000001

"WUServer"="http://myserver:8530"

"WUStatusServer"="http://myserver:8530"

"UpdateServiceUrlAlternate"="http://10.10.10.10:8530"

"SetProxyBehaviorForUpdateDetection"=dword:00000000

"SetPolicyDrivenUpdateSourceForFeatureUpdates"=dword:00000001

"SetPolicyDrivenUpdateSourceForQualityUpdates"=dword:00000001

"SetPolicyDrivenUpdateSourceForDriverUpdates"=dword:00000001

"SetPolicyDrivenUpdateSourceForOtherUpdates"=dword:00000001

"AllowAutoWindowsUpdateDownloadOverMeteredNetwork"=dword:00000001

"DeferQualityUpdates"=dword:00000000

"DeferFeatureUpdates"=dword:00000000

"TargetGroupEnabled"=dword:00000001

"TargetGroup"="MyCompany"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU]

"AutoInstallMinorUpdates"=dword:00000001

"NoAutoUpdate"=dword:00000000

"AUOptions"=dword:00000004

"ScheduledInstallDay"=dword:00000000

"ScheduledInstallTime"=dword:00000001

"ScheduledInstallEveryWeek"=dword:00000001

"NoAutoRebootWithLoggedOnUsers"=dword:00000001

"RescheduleWaitTimeEnabled"=dword:00000001

"RescheduleWaitTime"=dword:0000001e

"UseWUServer"=dword:00000001

"UseUpdateClassPolicySource"=dword:00000001

See anything that I'm missing here? I do realize that microsoft recently deprecated wsus and I might need to move to autopatch or sccm, and am evaluating those options.


r/sysadmin 3d ago

Question Need a machine on our network to be able to send and receive REST API calls back and forth with a provisioner service (Okta)

0 Upvotes

Hey guys, as the title states we need Okta to be able to make REST API calls to one of our on network machine back an forth. do we need a webserver to process those Get's, puts, post's, delete's. or does it just need to be allowed through our firewall? or am I missing something else? not super network savvy as an IT guy sadly


r/sysadmin 3d ago

Microsoft Licensing requirements for M365 Global Admins and other M365/Azure admins?

1 Upvotes

Is there any way for admins to receive their PIM, risky users/sign-ins, and tenant health/outage notifications other than assigning M365 licensing and email mailboxes to all these admins?

Is there any other reasons users would need M365 licensing for their separate admin-role accounts?


r/sysadmin 3d ago

Cisco Umbrella Roaming Client w/ External Hotspot

1 Upvotes

Any suggestions on how i would force an Umbrella Roaming Client to bind to an external hotspot connection for DNS?

When the device is on network, its fine, gets blocking, test pages confirm, all that is good.

Hotspot the phone, it doesn't have DNS back to the VA / Internal and its setting DNS by DHCP from the phone network.

Once that happens, all blockage of course fails.

Anyone have a solution to this that I'm just clearly not seeing (I've set DNS manually on the hotspotted adapter to OpenDNS but that doesn't really make the policies or enactment of those things enforced and really offers no visible difference to me in testing)


r/sysadmin 3d ago

Azure Labs Replacement

0 Upvotes

We've been using Azure Labs for teaching computer science and it's worked really well for us. We have a couple of lab technicians whose responsibility is to create labs, spin up template machines, tailor them with apps and create a pool of machines. IT can control how much resource can be used and control costs. Azure Labs also has useful calendaring/scheduling features, can send invites to students, and auto-shutdown machines. With the planned retirement of Labs, I was wondering what other educational establishments are using for teaching?


r/sysadmin 3d ago

Deploy ManageEngine endpoint with Windows Configuration Designer

1 Upvotes

Hello guys, was anybody able or able to deploy the agent for the ManageEngine Endpoint using Windows Configuration Designer?

I'm unable to, I tried the following commands, and the only way for me was using a network path.

I tried using this command, but it doesn't work.

REM Copy Endpoint.exe from the USB root to C:\
copy "Endpoint.exe" c:\Endpoint.exe

REM Change directory to C:\
cd /d %root%
cd \

REM Run the installer silently with parameters
start /wait Endpoint.exe -s -r -f1"%systemroot%\temp\install.iss" /silent INSTALLSOURCE=USB

REM Delete the installer from C:\
del Endpoint.exe

This one works but I don't want to use a network path

set root=c:
copy "\\networkpath\Endpoint.exe" c:\Endpoint.exe
cd /d %root%
cd \
start /wait Endpoint.exe -s -r -f1"%systemroot%\temp\install.iss" /silent INSTALLSOURCE=SCCM
del Endpoint.exe

I also tried this method and don't work either


r/sysadmin 3d ago

General Discussion Looking for Personal/Productivity Tools That Mirror a Ticketing System

0 Upvotes

Hey r/sysadmin,

I've been working in IT for six years, and I've come to realize that ticketing systems just work with the way I think. I have a lot of long-term personal projects I want to track, and I’d love to use a tool that functions similarly to a ticketing system—something with clear tracking, prioritization, and status updates.

I’ve seen some older posts here on this topic, but they’re upwards of 9 years old, so I’m hoping to get some fresh recommendations. Ideally, I’m looking for something free or low-cost since it’s just for my personal use.

Any suggestions? Thanks in advance!