Allow only Teams but but block SharePoint/OneDrive on unmanaged devices

We’re in the process of setting up a conditional access policy to block access to OneDrive and SharePoint on unmanaged devices.

The problem is that this policy ends up blocking Teams as well, since Teams relies on SharePoint in the backend. That means users on mobile or unmanaged PCs can’t even use Teams for communication, which isn’t what we want.

Has anyone here successfully implemented a setup where:

Teams chat/communication is allowed on unmanaged devices (mobile or PC), but SharePoint/OneDrive is completely blocked?

Please help.

https://redd.it/1ng8yay
@r_systemadmin

Is mixing 1Gbps and 10Gbps links in an iSCSI MPIO setup ever acceptable?

I’m a Systems Administrator at my company, and our IT Director insists it’s fine to have an iSCSI multipath configuration where one path is 10Gbps and the other is 1Gbps. He believes MPIO will “just handle it.”

Everything I’ve been able to find in vendor docs, whitepapers, and community discussions suggests this is a **very bad idea**—unequal links cause instability, latency spikes, and even corruption under load. I’ve even reached out to industry experts, and the consensus is the same: don’t mix link speeds in iSCSI multipath.

I’m looking for:

* Real-world experiences (good or bad) from people who’ve tried this.
* Authoritative documentation or vendor best practices I can cite.
* The clearest way to explain *why* this design is problematic to leadership who may not dig into the technical details.

Any input, war stories, or links I can use would be greatly appreciated.

xposted

https://redd.it/1ngh4em
@r_systemadmin

Another week, another massive leak… are we failing at cybersecurity or just making it too complex?

NPM hack a few days ago and now today the GFW leak. Feels like we are just stacking up incidents one after another. The scary part is most of these come down to the same thing, messy networks with too many tools, configs, and blind spots.

If attackers get hold of firewall rules, logs, or internal configs it is basically like handing them a map of every road into your system. At this point I do not even know if the problem is hackers getting smarter or if we have just made our environments too complex to secure properly.

So what is the actual way out? Consolidation, zero trust, something else?

https://redd.it/1nghuay
@r_systemadmin

from UAT to PROD to PREPROD to DEV !


i work as a system admin but as usual i handle other roles out of my scope like application installation and implementation until it goes live.

so Have you ever seen an application rollout that went completely against the usual SDLC flow?

I recently faced a case where an application with compliance implications was installed in a very unusual order:

1.UAT first loaded with customer data cloned straight from production databases.

2.Then cloned into Prod, manually tweaked to make it work.

3.Another clone from Prod to Pre-Prod, reconfigured again to be compatible with the environment configuration.

4.Finally, a clone from UAT to Dev so essentially dev env got created after the application went live for more than 6 months and we still getting major incidents Tickets from end user.

Normally, i expect environments to follow a flow like: Dev to Test to UAT to Pre-Prod to Prod, with increasing stability and stronger controls.

It made me wonder is this just a one-off, or do other organizations also end up making these kinds of “reverse” environment decisions under pressure?

Have you ever experienced something like this in your organization?
How did you handle it?

https://redd.it/1ngn08a
@r_systemadmin

eWaste frustrations due to lack of asset management

I work for a global company, and I was put in charge of eWaste. The last guy didn't do it for over a year, and we literally have over 400 laptops to get rid of.

Our company uses D3LL for eWaste and they charge us $25 per piece of equipment we get rid of! I have several sites in the US, and some send all their crap back to our office, and some collect their own eWaste and I schedule a pick up for their site... but to me, it's diabolical to spend money to get rid of a device, and to have sites pay shipping to send things back to our office (some numb nuts ship using overnight for this, which blows my damn mind even more)

With Windows 10 support ending soon, we have SO MANY PCs that have been replaced in the last few months, it's crazy. Basically after 3 years support/warranty is up they get replaced is supposed to be our policy but we have people who keep their laptops much longer. An end user can have a laptop for 6 years and you tell them it's end of life, and suddenly they say the laptop is slow, broken, etc and start belly aching about wanting a new one right NOW.

Anyways, I wish I could have a few of these PCs being returned, but we can't take them. They are all SSDs with Bitlocker so no one's getting the data anyway. I proposed a local nonprofit but was told it's in our global contract with D3ll to use them for eWaste. They do give us some credit for the laptops but it's pennies on the dollar of what they're worth. AND I just found out they require us to sort, separate and lay out everything for pick up, which is impossible with the amount that we have. We can sign a waiver and they will pack and take it all but we lose so many rights and protections with that it's risky to me.

What does your company do for eWaste and asset management? I'd love to hear others experiences.

https://redd.it/1ngmmm8
@r_systemadmin

Most efficiënt remote workplace?

Hi all,

I have a client who wants a server environment. He wants a server where he and 8 to 10 other employees will work. His goal is to work centrally, but currently they all work locally.

I was thinking about offering him the serverless solution with Entra, SharePoint, and Intune. But he insists on a server environment.

I'd like to know if my plan is the most efficient.

I thinking of:

• ⁠one RDS (?) server, identity management via Entra, and storage (Azure Blob), then connecting that to the RDS server.

His ultimate goal is:

• ⁠A remote workspace with authentication and policies.
• ⁠Remote working, and keeping data secure within the environment.

They also want to work remotely. What's the best solution for that?

They don’t have on-premise applications, all applications are SaaS (via webbrowser)

The plan must be cost efficient and fulfill its purpose

What would you do ? ;)

https://redd.it/1ngnfsk
@r_systemadmin

Anyone else getting false positives on PurpleKnight?

I'm getting NTLM V1 enabled and LDAP channel binding not required, which obviously isn't true. Maybe it's the context or the location I'm running from?

https://redd.it/1ngoat8
@r_systemadmin

How do fellow sysadmins relax after (or during) work?

I'm genuinely curious — as a system administrator, what do you do to relax after long working hours or even while you're on the job during a quieter moment?

Personally, whenever I need to unwind and feel truly calm, I just fill my bike with a full tank of petrol, head far outside the city, and reach the most peaceful spot I can find—where vehicles are few and far between. I park my bike by the roadside, lie back to watch the stars above, and listen to people passing by, overhearing their conversations. It’s actually funny to hear how everyone has their own problems and is rushing through life in such different ways. Somehow, that whole experience helps me disconnect and find real peace.

What helps you feel calm and recharged? Do you turn to hobbies, music, gaming, small breaks, or something totally different?

I’d love to hear what makes your soul feel lighter and happier outside (or in between) all the troubleshooting and firefighting of our workday

https://redd.it/1ngth6g
@r_systemadmin

windows Server 2016 azure VM Stuck in Reboot Loop after Sept9th updates - any ideas?

HI,
Yes, I'm aware I should not be running 2016 still, but that's besides the point ;)

We have an RDS farm in Azure and all our servers took the update fine, except our RDS Broker which seems to be stuck in an infinite reboot loop.

We had to roll it back to a previous backup, but when the updates went on again, to no surprise, the issue returned.
I cannot find anything out there about this issue (checked the megathread), so I"m hoping for any ideas here.
We can't really get on it to check logs. We don't have Bastion setup so can't really connect to it upon bootup unfortunately.

The updates it's trying to install are below.

2025-09 Servicing Stack Update for Windows Server 2016 for x64-based Systems (KB5065687)
2025-09 Cumulative Update for .NET Framework 4.8 for Windows Server 2016 for x64 (KB5065749)
2025-09 Cumulative Update for Windows Server 2016 for x64-based Systems (KB5065427).


The one thing I thought of doing was changing the underlying server hardware (moving it from a Bseries to a Dseries) though I don't really get why I'd need to do that either though...

Kinda running blind here...looking for ideas. Thanks!

https://redd.it/1nguilz
@r_systemadmin

InTune Migration

Hey, everybody.
My organization is currently using hybrid AD. We have an on prem domain controller in both locations which replicate to Azure. We are setting up InTune to take over device management and group policy.
Any recommendations as far as best practices or pitfalls to be aware of? What was the your best method for joining existing devices to InTune?
Thanks!

https://redd.it/1ngu50b
@r_systemadmin

Windows 10/11. A service added by a Software kill/Stop Events

Hey Team,

I've been banging my head on where are the events in the Event Viewer.

I did a quick test to see if any service stop events can be seen; I did

sc stop spooler

but in the Event Viewer > System > No logs are generated.

Can anyone help please!!?????

https://redd.it/1ngyu9c
@r_systemadmin

I am so confused is a Corporate Intranet still called an 'Intranet' or are we now using language like 'Digital Workplace', 'Employee engagement platform' etc

After 25 year in what I have always called the "Intranet" Software Industry, I'm finding that since the Pandemic and subsequent work from home phenomenon prospective customers are now using new terms for the platform. How do I square this when I'm trying to put together our marketing plans for next year. Can anyone help clear this up? Is this a generational language shift?

https://redd.it/1ngz72i
@r_systemadmin

I've taken on a monster....

I've just left a long term job for an organisation where I'm now in charge of the following disaster.

- most devices Windows 10
- all devices have no encryption
- all servers haven't had an update in multiple years and all have out of date OS's
- each device user is a local admin and that's how they want to keep it
- switches all have default credentials
- one of the servers has a hardware fault
- they are using Access databases and pivot tables for crucial systems

There's no processes, no helpdesk, and there's politics to get through before I can even begin to form a plan.. And the team is comprised of.... Just me!
My first week and a half was comprised of writing a report to make them away.

Do I run?!



https://redd.it/1nh0g7z
@r_systemadmin

new to all this

hi folks
so i am new to this space (being called a sys admin when i only have 6mths of soc experience under my belt) or ill say the noscript and well the work too. I’ve been tasked to create a firewall through microsoft 365s suite of tools and i’m
not sure where to start. Yes i am new to any type of computer or admin work like this. i was inspired when i had a SOC internship opportunity and saw how that company worked with endpoint and SIR. so

Objective: create a filtering system where this wall can monitor the entire domain network from phishing attacks and other iocs like that so that as this business is growing it will have some form of security infrastructure.

what i think id have to do: create a baseline so that there’s a basis for what regular traffic looks like. i can have access to the ceo’s credentials (at least my thought process would be if he’s the one probably getting the most traffic he would have a more wide range of incoming and outbound emails)

i know that they are using azure for mdm and i want to be able to spread that security around to the devices as well since they are all being monitored through apple business management and azures MDM.

im not gonna lie i am kinda stuck i have multiple tabs open trying to understand submitting things, about copilot and just where to go from here to be honest. i would appreciate no malicious feedback back telling me find another job or something because i believe i can do this im just stuck and could really use some help cause the “zero to hero” videos on youtube for azure aren’t really helping. i hope i don’t sound to pessimistic just overwhelmed with the task but working my way through and utilizing any resource i can except chatgpt (unless that would help just haven’t tried that either)

thanks

https://redd.it/1nh3a1d
@r_systemadmin

Greybeards - What is the plan for when you can't/wont retire and you are inevitably pushed out of SysAdmin?

40 years under the yoke. Linux and storage admin. Still current, still learning the new stuff. I will get RIF'd eventually and dread the job search. Hiring Managers gonna take one look at the grey hair, the stress lines and nope right out. Did the Management track for 20 years and hated it. Much happier as an individual contributor. Thought about going into teaching, but I hate people (Linux guy! Duh). What's the next phase for us to earn a paycheck until they find us dead at the wheel?

https://redd.it/1nh4i80
@r_systemadmin

Starwind Vsan questions regarding SRV-IO

Hey fellow sysadmins,

Im currently setuping a two node starwind vsan (CVM based) system, that uses Windows clustering to provide high availability file servers. Everything is running under Hyper-V. I'm having trouble getting SRV-IO to work. When I use a VF interface within the CVM, I get not connection between nodes or the hosts. I am using Intel x540 10gb network cards for my replication and ISCSI networks. Two questions:

1. Will i really notice much of a perfomance gain with SRV-IO vs the normal virtual interface and virtual switch in this use case?

2. If so, any suggestions to get this working? Good places to start for troubleshooting?

Thanks yall!

https://redd.it/1nh7xjf
@r_systemadmin

Dell Smart Docks and Dell Device Management Console

I am tearing my hair out with this one.

I cannot get my laptop or any smart dock to register with the Dell Device Management Console. The DDMA Console is blank, like shown here in the Dell guide https://www.dell.com/support/kbdoc/en-au/000348677/host-does-not-appear-in-dell-device-management-console-after-installing-dell-device-management-agent

I've removed the agent several times and re-ran the CLI with the group ID but still the PC wont register.

The smart docks also will not check in either. I've set option 180 and 190 as described here: https://www.dell.com/support/manuals/en-au/device-management-console/peripheral_mgmt_1.x_rn/configuring-dell-pro-smart-docks?guid=guid-17712791-e4c2-4dfe-a19b-c5d27f766686&lang=en-us and have used wireshark to verify both options are appearing. I've confirmed the key several times and tried also making custom groups as well.

Where am I going wrong here??

https://redd.it/1nh9dty
@r_systemadmin

Windows 10 Extended Support Subnoscription - Updates - How?

If you buy the $61 USD Subnoscription to extend support for Windows 10 for 12 months, will the updates turn up when you do a windows update from the computer (or via the API in an RMM situation), or, is it a case of it having to be enrolled into the cloud management console and managing updates via that? I am trying to make sure that our RMM will be able to update Windows 10 who have a subnoscription or will it need to be done via Azure Arc?

TIA


https://redd.it/1nh9t00
@r_systemadmin

Oracle Exadata

Hello. So my one of my company's client recently got their hand on some Oracle Exadata X10M, and my managers decided that it's up to me to get them up and running. Config the server, storage tuning, tshoot etc. I haven't even seen the server up close, yet I'm supposed to know how it work. I've worked with Sparc series and know my way around them, but from what I've heard Exadata is a whole different beast.
So my question is have you worked with it? If so, Can you give me some pointers on what should i do or where should I begin? Any help would be appreciated. Thanks in advance

https://redd.it/1nheztv
@r_systemadmin

How do small companies without a SOC team handle cybersecurity?

I’ve noticed that most small and mid-sized businesses don’t have the budget or people to run a full-fledged security operations center.

For those of you managing IT/security in small teams:

What are your biggest security pain points (phishing, ransomware, insider misuse, cloud misconfigurations)?

Do you currently use any tools (SIEM, endpoint detection, log monitoring)?

If not, what’s stopping you — cost, complexity, or lack of time/people?

Curious to hear real-world experiences. This will help me understand how smaller companies actually tackle security day-to-day.

https://redd.it/1nhfmj4
@r_systemadmin

Moronic Monday - September 15, 2025

Howdy, /r/sysadmin!

It's that time of the week, Moronic Monday! This is a safe (mostly) judgement-free environment for all of your questions and stories, no matter how silly you think they are. Anybody can answer questions! My name is AutoModerator and I've taken over responsibility for posting these weekly threads so you don't have to worry about anything except your comments!

https://redd.it/1nhhoyc
@r_systemadmin