What’s the biggest pain point of using a bunch of local, ad-hoc IT contractors?

We've had to rely on a handful of local contractors and freelancers to help with our on-site IT needs in different cities. While it's better than nothhing, it's a huge headache to manage. For those of you who go this route, what's your biggest frustration? For us, it's teh inconsistent pricing, the varying skill levels, and the time it takes to find and vet a new person every time we have an issue. It feels like we spend more time managing the people than getting the work done. I'm interested to hear if this is a common experience or if there’s a better way to handle

https://redd.it/1ne84uu
@r_systemadmin

Saved a user from spreadsheet-induced despair by introducing them to the mystical art of "Ctrl+F"

So the user walks in, eyes glazed, soul half-evaporated. They've been manually scanning a 12,000-row Excel sheet to find entries with a specific client name. One. Row. At A. Time. Like some kind of medieval monk transcribing sacred scrolls.

They say, “I’ve been at this for two hours and I’ve only found 8 matches.”

I blink. “Wait… you know you can just press Ctrl+F, right?”

Them: “Ctrl what?”
Me: “Ctrl+F. It opens a search box. Type the name. Boom. It jumps to every match. You can even highlight them all.”

It was like I had just summoned a productivity demon from the depths of the IT underworld.

User reaction: stunned silence
My internal soundtrack: Eye of the Tiger
Time saved: conservatively 3 hours, 1 existential crisis, and a potential keyboard smash

https://redd.it/1ne9c5a
@r_systemadmin

Whats this massive feeling about being inadequate all of a sudden.

Hey all,
I’ve posted here a few times before. I’m currently the sole IT person at a small tech company that focuses heavily on software development and managing databases for clients. It’s been about a year and a few months, and while I’ve learned a lot, I’m starting to feel like I’m hitting a brick wall.

\*\*I think this feeling really sank in after I saw a new DBA we hired speak so confidently and effortlessly with an external client. He was calm, direct, and probably secured a new deal for the company within minutes. Meanwhile, I just sat there thinking, “I could never do that.” I’m not a strong speaker, and I don’t have that kind of presence or self assurance. It made me question whether I’m really cut out for this path, or if I’m just pretending to keep up.\*\*

I’ve been trying to level up into a Junior DBA role (even going through Oracle learning materials/Udemy videos and labs), at the moment ive only built an internal Oracle 19c test environments from scratch (installing on Oracle Linux and install the database on Docker thanks to Network Chuck awsome video on this, configuring pluggable databases, automating backups via RMAN, etc.) but honestly… it’s starting to feel a bit anticlimactic with all the SQL queries i have to remember. I don't know if it's burnout or just the reality setting in, but the idea of grinding out that certification feels less exciting by the day.

That said, I’ve done a ton on my own here:

* Migrated our on-prem infrastructure from VMware to Proxmox VE, including critical production VMs.
* Replaced our legacy OpenVPN setup with modern alternatives (currently testing NetBird).
* Implemented/Coordinate firewall upgrades (FortiGate)
* Contributed to our successful ISO 27001 certification thus handled internal backup policy drafting, logging requirements, and infrastructure documentation.
* Managed AWS cost optimization by cleaning up snapshots, right-sizing instances, and coordinating with dev teams on resource usage.

I’ve been wearing every IT hat you can think of: sysadmin, network guy, backup guy, Oracle DBA-in-training, compliance tech, etc. But i have the feeling that im being seen as just the IT guy sitting and doing nothing and being billable for the company.


Im thinking to search for a position at a bigger company but im having the feeling that it would be the same, or maybe i should directly search for a company that delivers sysadmin like services to other cleints so i can be off site at clients most of the time.


Any one hitting the same wall as me? Man i want to just sit at the beach and watch a nice sunset now....

https://redd.it/1neay9h
@r_systemadmin

Employee passed away, can't open his Access database

An engineer reached out to me to help open an Access database that was managed by an employee who passed away. Said employee was the only one who maintained it and did not leave any documentation about his process. There is no password on the file itself, but when attempting to open the file as the former employee's user, it prompts for a password. We are assuming this is an old, cached password in the database.

I've tried to recover passwords using both Passware Kit Forensics, which finds no passwords on the file, and using Thegrideon Access Password, which was helpful to display the User and IDs, but didn't retrieve any passwords.

Has anyone ever delt with this issue on old Access Databases? We are kind of stuck and I guess this is a fairly important database (although why is there no documentation if it is so important...)

Any ideas would be helpful as I am stuck trying to find a working solution.

https://redd.it/1necrj9
@r_systemadmin

SecureBoot Certificate will expire today September 11th 2025

Microsoft Secureboot signing certificate will expire today, September 11, 2025

When I was checking something for a customer regarding the SecureBoot change in 2026, I noticed that the SecureBoot boot manager certificate for digital signatures expires on September 11, 2025 (tomorrow) on the client. I then checked this on various other clients with different manufacturers and operating systems and found that it was the same on all devices (except those purchased this year). According to Microsoft Support, it could be that these clients may no longer boot up - starting today after expiration.

This fix should apparently resolve the issue, but it is very risky and only works if the latest updates and firmware updates have been installed:

How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support

I believe this affects thousands of devices.. Because multiple devices I checked, whether client or server, was affected. Newer Clients (purchased in 2025) and Serves seem to be fine.

Here's how to check:

mountvol S: /S
Test-Path "S:\\EFI\\Microsoft\\Boot\\bootmgfw.efi"
(Get-PfxCertificate -FilePath "S:\\EFI\\Microsoft\\Boot\\bootmgfw.efi").Issuer

$cert = Get-PfxCertificate -FilePath "S:\\EFI\\Microsoft\\Boot\\bootmgfw.efi"
$cert.Issuer
$cert.GetExpirationDateString()

Output:

CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Expiring date: 11.09.2025 22:04:07

Has anyone else noticed that?!

https://redd.it/1nedey1
@r_systemadmin

How do you handle service accounts and password rotation? (Disable "password never expires" + longer policy)

We’re running into an issue with our service accounts. Right now, they are all set to **"password never expires"**, which we know is a security risk.
The problem is: as soon as we turn that off, the accounts are immediately forced to change their password — which risks breaking services.

What we’d like to achieve:

* **No more "password never expires"**, but with a **longer password lifetime** than regular user accounts (e.g., 1365 days).

We already looked into Windows LAPS, but that’s mostly for local admin accounts and doesn’t solve this problem for domain-based service accounts.

Curious to hear your approaches — especially how you handled the migration without accidentally taking down services. 🙏

https://redd.it/1ne8p21
@r_systemadmin

spent 3 hours debugging a "critical security breach" that was someone fat fingering a config

This happened last week and I'm still annoyed about it. So Friday afternoon we get this urgent slack message from our security team saying there's "suspicious database activity" and we need to investigate immediately.

They're seeing tons of failed login attempts and think we might be under attack. Whole team drops everything. We're looking at logs, checking for sql injection attempts, reviewing recent deployments. Security is breathing down our necks asking for updates every 10 minutes about this "potential breach." After digging through everything for like 3 hours we finally trace it back to our staging environment.

Turns out someone on the QA team fat fingered a database connection string in a config file and our test suite was hammering production with the wrong credentials. The "attack" was literally our own automated tests failing to connect over and over because of a typo. No breach, no hackers, just a copy paste error that nobody bothered to check before escalating to defcon 1. Best part is when we explained what actually happened, security just said "well better safe than sorry" and moved on. No postmortem, no process improvement, nothing.

Apparently burning half the engineering team's Friday on a wild goose chase is just the cost of doing business. This is like the third time this year we've had a "critical incident" that turned out to be someone not reading error messages properly before hitting the panic button. Anyone else work somewhere that treats every hiccup like its the end of the world?

https://redd.it/1neixob
@r_systemadmin

A hard lesson was learned this week.

On Monday, I logged in at 8:00am like I normally do with my full cup of coffee ready to tackle the day. What I came to find out later that morning what happened ruined my week.

In our environment, we utilize Privileged Identity Management to grant us the Global Administrator role on a need basis. Now going back in time a couple months in June, we shifted all of our Microsoft 365 licenses from E5's to Business Premium and Business Basic. I stressed to senior management it needed to happen - being it was a huge waste of money since we didn't utilize all of the features. Inevitably, those licenses expired as they should of. This ended breaking PIM because I didn't take into realization that we needed additional Entra ID P2 licenses for PIM to work. Boom, PIM is broke. No big deal, right? I'll just login to our break-glass global admin account and temporarily assign us the global admin role while we work on fixing PIM. Little did I know that our global admin account was in a disabled state and we didn't have the password on file.... Thus - unable to do anything in our 365 tenant.

There was a hard lesson learned here today.... To all of you 365 admins out there, ensure you have a break-glass account, and you are able to log in.

Thanks to my stupid mistake for not checking on this, I am now waiting on Microsoft 365 Data Protection services to unlock and reset the password - and we all know how Microsoft support can be sometimes.

Once we can get logged back in, I am making sure that this never happens again and it's going to be apart of our DR testing every quarter, making sure we have the password, and we can get logged in.



https://redd.it/1nejbri
@r_systemadmin

Going to crash out over AutoDesk -SEND HELP

I work for a school district and we use SCCM still. We are moving to AutoDesk 2026 from 2023. It took a consultant to figure out an install application in SCCM. We now need to figure out how to uninstall AutoDesk from computers with SCCM.

I can’t figure it out. I followed the steps that AutoDesk lists for a clean uninstall and noscripted them all in PowerShell and then some. Nothing I do gets it to actually fully uninstall. I try deleting every folder I can find, but nothing gets rid of the icons. I noscripted the deletion of registry keys, every uninstall.exe that I can find, all the adskuninstallhelper.exe that I can find, deleting all the folders. IT WONT GO AWAY.

Does anyone have experience with this? I figured the steps for a clean uninstall would make it work. Also, why the hell does AutoDesk not make this fucking easier- I mean I am going to lose it.

https://redd.it/1nel5if
@r_systemadmin

After almost a decade of recovery, I'm back to being a sysadmin and I think I like it...

I thought I'd finally recovered and managed to fully join the ranks of recovered sysadmins when I finished my PhD and was made redundant from the software house I was worked for. Honestly it was a bit of a relief as I'd been ramping things down while I was studying - I'd gone from network administration to remotely babysitting the monthly M$ patch cycle for the servers we couldn't tolerate unplanned downtime on. Really I wasn't a sysadmin at this point, so I was thankful for the push.

I embraced the fresh start in academic life and jumped into research, working on a series of projects where the only admin I was doing was my own systems. No demands, no users, no on-call. Aside from the subtle battles with university IT to get what I needed (Yes I really do need that many systems, yes I do need IPv6, no you can't take my network ports...), life was bliss. Someone else was responsible for managing the big compute, I was "just" a user.

Then I made a mistake. As I moved up the greasy pole of academic positions, I started planning research and was pulled into teaching. Given my background, networking and computer architecture were the obvious specialities. Given how esoteric and experimental some of the technologies are, no one else knew how to manage them so I ended up admining a couple of systems with some fun FPGA accelerators in them. No big deal I thought, a little bit of automation and I can make this pretty painless.

That was a bit over three years ago and as you are probably expecting because I'm posting here, it didn't stop at a just a couple of systems. As the frequency of posts on alt.sysadmin.recovery diminished, my admin responsibilities increased. My colleagues realised I knew what I was doing and could get things done with University IT that they couldn't, and now I'm now responsible for managing multiple compute clusters that support several million $ of academic research. The sort of systems that corporate university IT don't want to touch with a barge pole, but are needed to make the research and teaching happen.

The shift back to being a sysadmin was inevitable I suppose, but the difference between then and now is that instead of business-critical Windows servers, I'm managing Linux systems with esoteric hardware that's held together by custom drivers I have to maintain. What does the future hold though?

University IT seems to go through cyclical phases of being more and less corporate. When it gets more corporate, the shadow IT run by academics increases, coalescing on a few who try to do it properly. My experience placed me perfectly for this downfall, but how far am I going to fall? Departments may even end up with their own pseudo-IT team to work around the central bureaucracy, only for these teams to be subsumed by central IT when it goes through a phase of being less corporate. Unfortunately the pendulum swings the other way and as things get more corporate, and the people who get pulled in like this often leave as the transition happens and they are tasked with more mundane responsibilities. Is this my destiny? To be dragged kicking and screaming back into corporate IT as I clutch to the weird and whacky, only to be cast out when I won't conform?

For now I seem to be embracing the life of a sysadmin again. I picked up some stickers at a recent open-source conference, and one of them (Moss in the fire) is proudly stuck on my office door proclaiming my place as a sysadmin. My beard even seems to agree with this path as I've started finding the occasional grey hair, my journey to a greybeard looks to be a certainty.

Despite falling out of recovery, I'm still an academic and I find myself wanting to know the truth: Is permanent recovery possible? Can one ever escape the life of a sysadmin? Or is it just an illusion? Do we become too used to having the power to do what we need to do, struggling to conform with the systems others force upon us, always destined to fall back

into the patterns of old. How many of you have un-recovered after so long?



https://redd.it/1nesbza
@r_systemadmin

Hiring folks: why do you ask "tell me about yourself "

Im always torn on how to respond to this aside from answering it like John madden mixed in with Tony Romo.

What are you looking for? What is ai looking for?

https://redd.it/1neskw0
@r_systemadmin

How do you deal with incident amnesia?

Hey everyone,

I’ve been thinking about this problem I’ve had recently. For teams actively facing multiple issues a day, debugging here and there, how do you deal with incident amnesia? For both major and micro-incidents?

You’ve solved a problem before, it happens again after a span of time but you forget it was ever solved so you go through the pain of solving the issue again. How do you deal with this?

For me, I have to search slack for old conversations relating to the issue, sometimes I recall the issue vaguely but can’t get the right keywords to search properly. Or having to go to Linear to comb through past issues to see if I can find any similarities.

Your thoughts would be much appreciated!

https://redd.it/1nesw3j
@r_systemadmin

Weekly 'I made a useful thing' Thread - September 12, 2025

There is a great deal of user-generated content out there, from noscripts and software to tutorials and videos, but we've generally tried to keep that off of the front page due to the volume and as a result of community feedback. There's also a great deal of content out there that violates our advertising/promotion rule, from noscripts and software to tutorials and videos.

We have received a number of requests for exemptions to the rule, and rather than allowing the front page to get consumed, we thought we'd try a weekly thread that allows for that kind of content. We don't have a catchy name for it yet, so please let us know if you have any ideas!

In this thread, feel free to show us your pet project, YouTube videos, blog posts, or whatever else you may have and share it with the community. Commercial advertisements, affiliate links, or links that appear to be monetization-grabs will still be removed.

https://redd.it/1nez4pk
@r_systemadmin

Blocked password list - does it impact current passwords?

Morning all,

Finally got approval to put a blocked password list in place, recent pentest showed loads of people with the most basic passwords known to man.

Question is, say I add "Password12345" to the blocked password list, does this just impact future passwords going forward, or will it cause problems for any users with "Password12345" as their password?

Obviously I am forcing password changes etc, but just curious as to how the blocked password list works for currently set passwords.


We're Hybrid, so will be set in AD and synced over to 365.

https://redd.it/1neyiry
@r_systemadmin

C-suite has 12,000 Outlook folders and Outlook is eating a whole i7 alive

One of our execs has built his “system” in Outlook. The result:

12,000 folders
\~90,000 emails
50GB OST
Cache already limited to 6 months

Every 3 minutes Outlook Desktop spikes CPU to 100%, happily chewing \~40% of an i7 with 32GB RAM while the machine sits otherwise idle. This seems to close down other programs, making the computer basicly useless.

Normal exports die (even on a VM). Purview eDiscovery is the current desperate experiment. He refuses OWA. He insists on Outlook Desktop.

I feel like we’ve hit the actual architecture ceiling of Outlook, but I’m still expected to “fix it.” Has anyone here ever dragged a setup like this back from the brink? Or do I just tell him his workflow is literally incompatible with how Outlook/Exchange works?

https://redd.it/1nf1sm6
@r_systemadmin

MFA Entra AD - Break Glass Account

Hey guys,

today I received a message that Microsoft is enforcing MFA for Admin-Portals.
Which in itself is nothing new, I already configured CA for every Admin Account.

But the Message itself says, that every Admin needs it and that this rule will overwrite any CA-Rule.

>Notes:

>You can revisit this page to select a future enforcement date up to September 30, 2025 UTC.

>The portal enforcement will bypass any MFA exclusions configured via Conditional Access policies, security defaults or per-user MFA.

>You can determine if there are any users accessing these portals without MFA by using this PowerShell noscript or this multifactor authentication gaps workbook.

If I understand this correctly my Break Glass Account needs MFA aswell then? I always thought this was supposed to be the account to have direct access if everything else fails.

How do you guys do this?



https://redd.it/1nexxtw
@r_systemadmin

How should critical vulnerabilities be handled?

Another subreddit suggested I come here for advice on this.

Backstory:
I know it's probably different from company to company but I'm hoping to get some insight on this process. I'm in a support role for a mid-size company. It's unique in that it's tier 1/2 support but also some system administration. They're trying to squeeze all the work they can from their underpayed employees across the board, but it's getting me some valuable experience so I'm okay with it. For the most part. The Sr System Engineer is "retiring" soon. He wants to go 1099 and only work 20 hrs a week on certain projects. He's trying to unload this work on me in preparation of his retirement. I don't have an engineering background. Quite the opposite. I fell into IT and have no real technical education.

Here's the rub, Security will create Vulnerability Management tickets. It looks like they just copy/paste text from cve.org or Defender. It's usually a lot of information referencing several possibly affected programs requesting an update or patch to the affected program. I'm then expected to go in and update whatever needs to be updated. It usually involves a developer or analyst's laptop with non-standard software. I try to do my best and determine what software needs to be updated but 80% of the time the user will push back saying they don't have it or it will already be updated to the current version. If I don't see it listed in their programs I have to take their word for it. Or, for example, if it involves Apache Commons Text, I don't even know what that is or how to find it so if the user pushes back I have no choice but to take their word fur it. If it's already the current version, I don't what else I'm supposed to do. I can try to use AI for help but that involves a long remote session with the user while I troubleshoot and it rarely ends in success. The retiring engineer (who is actually a generally nice guy) will tell me I need to figure these things out because he's retiring soon and won't be around to do this. I don't feel like I have the education, experience, or knowledge to complete most of these tickets.

I also feel like the Security team is abdicating their responsibility to some degree on this. It's not the first time I've felt this way about Security. When I ask if software is security approved they tell us to search cve.org but when I come back and tell them that it says the program is high risk and I should deny it, they say it's not that simple and other factors need to be taken into consideration but they don't elaborate or follow-up on it. I'm not a security guy. I don't know how to make these determinations.

Is this how it's supposed to work? Am I just supposed to figure it out or just fail at the job? In short (too late for that I suppose, haha) am I the problem?

https://redd.it/1nf57a2
@r_systemadmin

Critical Cursor AI Flaw Allows Silent Code Execution via Malicious Repositories

**Date:** September 12, 2025

**TL;DR:**

* Cursor AI ships with Workspace Trust disabled by default, creating a silent code execution risk.
* Attackers can weaponize malicious repositories to run arbitrary code as soon as a folder is opened.
* Users must enable Workspace Trust and audit repositories to mitigate potential supply chain attacks.

A serious security flaw has been disclosed in the AI-powered code editor Cursor, a fork of Visual Studio Code. The vulnerability allows attackers to execute arbitrary code when a developer opens a maliciously crafted repository. The issue arises because Cursor ships with Workspace Trust disabled by default, which lets .vscode/tasks.json auto-run commands without user consent.

This flaw poses a significant threat to developers and security teams by opening the door to supply chain attacks. Sensitive credentials could be leaked, files modified, or systems compromised. To protect themselves, sysadmins and developers should enable Workspace Trust in Cursor, use alternative editors for untrusted code, and carefully review repositories before opening them.

**Full Story:**

[https://thehackernews.com/2025/09/cursor-ai-code-editor-flaw-enables.html](https://thehackernews.com/2025/09/cursor-ai-code-editor-flaw-enables.html)



https://redd.it/1nf7mhh
@r_systemadmin

Asked to be a guest speaker on IT security for individuals/micro businesses

Hello friends,

A client of mine asked me to be a guest speaker at an event in a very specific trade. Effectively, it's a bunch of micro businesses (1-2 employees), and they want me to offer advice on cyber security/etc.

I've never done this before, do you guys have any tips? She wants a 50 minute presentation but I don't know if I can blather about stuff that long, so I was thinking maybe a 30 minute session covering 6 topics at 5 minutes each, with 20 minutes of questions/answers.

She also asked me how much I would charge for this, but since I've never done this I don't know what to answer. I would think my hourly rate to prepare the presentation and the time to do the presentation.

https://redd.it/1nf6396
@r_systemadmin

MSP fixing vulnerabilities on our network - should fixes be included in our SLA or be chargeable?

It's not exactly clear if they are included in our SLA but you would imagine if our MSP is in charge of setting up and securing our network, that they would fix whatever vulnerabilities they find. How is this generally handled in other orgs who have an MSP? Thanks

https://redd.it/1nf6tf1
@r_systemadmin