Windows 10 Extended Support Subnoscription - Updates - How?

If you buy the $61 USD Subnoscription to extend support for Windows 10 for 12 months, will the updates turn up when you do a windows update from the computer (or via the API in an RMM situation), or, is it a case of it having to be enrolled into the cloud management console and managing updates via that? I am trying to make sure that our RMM will be able to update Windows 10 who have a subnoscription or will it need to be done via Azure Arc?

TIA


https://redd.it/1nh9t00
@r_systemadmin

Oracle Exadata

Hello. So my one of my company's client recently got their hand on some Oracle Exadata X10M, and my managers decided that it's up to me to get them up and running. Config the server, storage tuning, tshoot etc. I haven't even seen the server up close, yet I'm supposed to know how it work. I've worked with Sparc series and know my way around them, but from what I've heard Exadata is a whole different beast.
So my question is have you worked with it? If so, Can you give me some pointers on what should i do or where should I begin? Any help would be appreciated. Thanks in advance

https://redd.it/1nheztv
@r_systemadmin

How do small companies without a SOC team handle cybersecurity?

I’ve noticed that most small and mid-sized businesses don’t have the budget or people to run a full-fledged security operations center.

For those of you managing IT/security in small teams:

What are your biggest security pain points (phishing, ransomware, insider misuse, cloud misconfigurations)?

Do you currently use any tools (SIEM, endpoint detection, log monitoring)?

If not, what’s stopping you — cost, complexity, or lack of time/people?

Curious to hear real-world experiences. This will help me understand how smaller companies actually tackle security day-to-day.

https://redd.it/1nhfmj4
@r_systemadmin

Moronic Monday - September 15, 2025

Howdy, /r/sysadmin!

It's that time of the week, Moronic Monday! This is a safe (mostly) judgement-free environment for all of your questions and stories, no matter how silly you think they are. Anybody can answer questions! My name is AutoModerator and I've taken over responsibility for posting these weekly threads so you don't have to worry about anything except your comments!

https://redd.it/1nhhoyc
@r_systemadmin

local AD Password Complexity Error

Hi fellow Microsoft people,

I have a local AD running on Functional Level 2016, main DC Server 2016, secondary DC 2019.
Last week, my users started getting errors when changing their passwords - the classic "password does not meet complexity standards".
I just have the default complexity standards applied with a GPO, unchanged for years now - used to work pretty well.
Even when testing myself, I get hit with this error message, despite the new, randomly generated passwords, which definitely meet the complexity requirements.

Has anyone seen this problem before and has any tips for me?

https://redd.it/1nhh5q4
@r_systemadmin

O365 to O365 Migration

Hey, I've done these in the past for smaller companies (20-30 users, max, they work less than 5 days a week so the migration was even easier). However, now I'm up against a 200 user beast, well established on O365, however, we need to move over to a new tenant due to some billing issues. Is BitTitan still the best option for these migrations? Anything new I should know? (havent done one since 2020)

https://redd.it/1nhiwd8
@r_systemadmin

Do you let employees DM IT, or force a structured intake?

1. One of the biggest debates we see:
Allow DMs (easy for users, chaos for IT)
2. Force tickets/requests in a structured way (less chaos, more complaints from users)
Which side are you on?

https://redd.it/1nhlc2d
@r_systemadmin

Looking for Cheap (free) Ticketing system

I'm a one man shop, internal IT for about 200 people and growing. I'm at the point where email/text/phone calls is getting cumbersome to manage. I don't think I'm busy enough to justify spending thousands of dollars either yet.

Anyone know of a cheap, preferably free IT Ticketing system to help manage IT issues? I've never really used any in the past so I don't even know where to start looking.

https://redd.it/1nhk8wm
@r_systemadmin

Controlling Chrome extensions in schools?

i m ed tech coordinator. Teachers love installing free grading helpers but most ask for sensitive permissions and access. Is there a tool to whitelist only safe extensions?



https://redd.it/1nhj9pz
@r_systemadmin

I'm shocked at how bad GoDaddy is

GoDaddy are our domain registrar and they host a managed WordPress site for us

About a month ago, we moved name servers and updated them in GoDaddy - everything was working fine after the TTLs expired (nothing has changed in DNS either - this was just some shuffling around for better DNS management)

Today we find that the WordPress site is dead with an SSL error

This is entirely managed by them, and when I log into our account, I don't see any errors or issues - nor can I get to the WordPress admin page as it's behind the dead site

So I call their support - first red flag - they asked me for my MFA code

No not the support PIN on my account, my MFA code from my authenticator app

You know, the thing we train users to NEVER GIVE TO ANYONE

And what do they tell me? The name server change somehow caused them to change the IP of the WordPress site, so we're pointing at the wrong place

Did they inform us of this change? Nope - no emails or anything

They give me the new IP and I update our DNS and try it again on my machine using Cloudflare DNS since CF don't seem to care about TTL

Nope, same error - so this new IP has the same problem

Next thing they tell me is domain verification is failing because our name servers are 3rd party and not hosted with them (as is best practice)

They then recommend transferring our name servers back to them

Just what the fuck? Our name server change was just a recreation of the zone in another RG in Azure using IaC to configure it - and it's a direct match to what it was before

I genuinely don't understand how they've shit the bed so hard here

https://redd.it/1nhojjb
@r_systemadmin

Does Barracuda Email Firewall Suck?

I use Barracuda for my email firewall for all of my clients and I'm pretty much constantly having issues with it. Important emails getting blocked, lots of stuff (that's clearly spam) getting through, support that doesn't seem to have any solutions. Needless to say, I'm starting to get fed up with it and so are my clients. I've only ever used Barracuda, is this a problem you guys see with your firewalls as well? Should I think of switching? If so, what are some good alternatives?

https://redd.it/1nhpb32
@r_systemadmin

Blocking Tor IP Ranges through Conditional Access

Howdy,

I wanted to see if I could block TOR (specifically the exit nodes) by using conditional access in Entra. I have a few security layers for our corporate devices (Defender XDR, Applocker, managed through Intune) but that doesn't extend to personal devices accessing 365. The native functionality comes from Cloud App Security and requires an E5 Security license and a AAD P2 license. MAM could be an option too, but it requires an AAD P2 license in addition to an Intune license. The bulk of our user base doesn't have any of these licenses assigned, so I figured I'd try and do it on a budget.

I found the TOR exit nodes were publicly available (v6 was not available from the Tor Project) so I just grabbed those and noscripted out the updates through Azure Automation.

The noscript itself will download the IPv4 and IPv6 lists, format the response and then either create a new IP Location range if one doesn't exist or update an existing one.

As I mentioned above, the IPv4 exit node list is provided publicly from the TOR Project but the IPv6 (also includes IPv4) exit node list is from www.dan.me.uk \- Thanks Dan!

The IPv4 exit node list is official and provided by the Tor project so I opted to use that for IP4 and the other for IPv6.

Tor Exit Nodes

IPV4 - https://check.torproject.org/torbulkexitlist

IPV4/IPV6 - https://www.dan.me.uk/torlist/?exit (You can only hit this every 30 minutes or else it can block you)



Script

https://github.com/clocktowerletter/hellclock/blob/main/Tor%20Exit%20Node%20CA%20Policy%20Update.ps1

NOTE: Whenever the noscript updates the IPv4 and IPv6 Tor ranges, it wipes out the existing CIDRs within the policy, so it will always be current with the public lists. If no response is returned when pulling the IPv4 or IPv6 list, the noscript will stop. More error checking could and should be added.


The noscript is using a managed identity to sign into Microsoft Graph and I'm leveraging Azure Automation on a twice-daily schedule to run it. The permission assigned to the managed identity is "Policy.ReadWrite.ConditionalAccess.

It will create/update two named location IP range policies. You will still need to link this to a blocking policy in Conditional Access but I omitted that part as it can be done through the portal. If you want to run it locally, you could utilize interactive based sign-in for Microsoft Graph. Just to remove the "-Identity" switch from the second line and for best practice replace with "-Scopes 'Policy.ReadWrite.ConditionalAccess'". Azure Automation was being quirky with the newer Graph modules but YMMV.

https://redd.it/1nhp33m
@r_systemadmin

Proxmox ceph failures

So it happens on a friday, typical.

we have a 4 node proxmox cluster which has two ceph pools, one stritcly hdd and one ssd. we had a failure on one of our hdd's so i pulled it from production and allowed ceph to rebuild. it turned out the layout of drives and ceph settings were not done right and a bunch of PGs became degraded during this time. unable to recover the vm disks now and have to rebuild 6 servers from scratch including our main webserver.

the only lucky thing about this is that most of these servers are very minimal in setup time invlusing the webserver. I relied on a system too much to protect the data (when it was incorectly configured)..

should have at least half of the servers back online by the end of my shift. but damn this is not fun.

what are your horror stories?

https://redd.it/1nhtj2l
@r_systemadmin

Solarwinds, I'm out.

I have defended this company's on prem solutions for years, and today is the day I am done. I have already put the replacement in place, that's how easy it was to get rid of them.

They took $119/year product and started charging $999/year. The DPA product was pretty good for quicky troubleshooting, but not a $500/year product to $2500/year. Now you are getting $0.

Good job, private equity firm. You have killed another one.

https://redd.it/1nhxgg0
@r_systemadmin

Server 2025 DC - Clients randomly unable to log in until they restart

We've been struggling to get all the issues ironed out of a Server 2025 DC deployment. There is a 2nd DC in place still running 2022, so we can demote the 2025 if we absolutely have to.

At first, everything seemed okay, but recently we've been having issues where a client PC will boot up in the morning, they enter their credentials, and are told the username or password is incorrect. Even if we confirm that the credentials ARE correct, they cannot log in. They do not get a domain trust error, just that the password is incorrect.

If they reboot their workstation, they are then able to log in on the subsequent reboot.

I'm not sure if this is a 2025 DC issue, or a W11 24H2 issue. I've found other references to the same problem, but nobody has posted about a fix.

There have been so many issues with 2025 DCs that it can be somewhat difficult to find information on the specific one you're dealing with. Searching for this issue tends to bring up posts about the earlier problem where rebooting a DC would cause its network profile to change and then computers couldn't authenticate, but this is not the same issue.

I'm currently in the process of installing the September cumulative update on the DC, but I don't think that's going to change anything.

If anyone has any suggestions, I'd love to hear them!

https://redd.it/1nhtlx7
@r_systemadmin

ScreenConnect/Control new policies

I LOVE the fact they are making a paywall to stop these idiots from using a free service to hack the less techie folks. I would like to see all the other products follow suit. I also noticed that Control implemented a real warning that says "You are letting someone control your computer. DO YOU REALLY CONCEDE?"

https://redd.it/1ni2jvp
@r_systemadmin

Am I Overreacting About Our MSP Deploying a VM Without Telling Me?

I’m the sole IT/ERP Manager for a small business with around 60-70 employees spread across four locations. We work with an MSP under a co-management agreement to help support our environment.

Last Thursday, I had a meeting with their Director of Customer Service because I was frustrated — they were making changes without properly informing me and weren’t holding up parts of their support agreement.

Later that day, I met with their lead technician, who walked me through some new software tools they’re planning to roll out for us. One of the tools mentioned was Nodeware. During that 15-minute conversation, multiple tools came up, and they made it sound like Nodeware was a cloud-based solution. Regardless, all of these tools were supposed to be in a test enviorment. Nothing should be on our production hyper v host.

Fast forward to tonight — I was doing some off-hours work on one of our Hyper-V hosts and noticed a VM that I didn’t recognize. After digging in, I found it’s a Linux server running Nodeware.

To say I’m frustrated would be an understatement. This is the first time they’ve deployed a VM directly on my production host — without notifying me. Every other tool we've deployed through them has been cloud-based. If they had just told me ahead of time, I probably wouldn’t have had an issue. But dropping a VM into my production environment without a heads-up? That feels like crossing a line.

I plan to bring this up with our COO tomorrow. But before I do, I’d like to check in with you all — am I overreacting here?

(And just in case I do show this to him — hey Mike 👋)

https://redd.it/1ni32db
@r_systemadmin

4 years in IT and I still can’t believe some of the requests I get from management

Been working in sysadmin for 4 years now. Thought I had seen it all… until last week.

Boss comes up with a “brilliant” idea: let’s let interns have full root access on production servers for a week, because “they need to learn fast”. Yep. I stared at him like 🤯.

Spent the next few hours adding firewall rules, writing monitoring alerts, and praying nothing blew up. Meanwhile, he’s bragging about being a hands-on leader…

4 years in, and honestly, some days I wonder if management should be required to take a week of IT training before issuing directives.

Fellow sysadmins — what’s the dumbest request you’ve ever had to deal with?

https://redd.it/1ni6uz9
@r_systemadmin

It finally happened. I drove 3 hours to tell a user to log off.

My team spent hundreds of dollars on a rental car because they couldn't get this guy on the phone. They neglected to mention this is why I was being sent on-site

https://redd.it/1niaalr
@r_systemadmin

Samsung DeX in Enterprise


Our leadership team is exploring whether we could move to a single-device workflow, specifically using the Galaxy Fold 7 with Samsung DeX, for both office and remote work.

We’re planning to trial DeX in a real-world enterprise setting, but I’d love to hear from anyone who’s already done this at scale.

Our current setup:
- Each desk has a conference monitor connected via USB-C, daisy-chained to a second monitor using DisplayLink.
- Users frequently use webcams and conferencing monitors for Teams calls.
- Application suite comprises largely of online SaaS applications and Microsoft 365

Concerns we have before committing:
- DisplayLink isn’t officially supported, meaning we may need to replace dual-monitor setups with a single large curved monitor just to make DeX viable. (Have heard this is coming at some point though…)
- Webcams on conference monitors reportedly don’t work properly in DeX mode.
- We worry this could push more people onto VDI (CloudPCs), frustrating users and driving up costs.

Questions for the community:
- Have you deployed DeX in an enterprise environment? How did users respond?
- What hardware setups worked best (single vs dual monitors, docks, webcams)?
- What were the biggest limitations or deal-breakers you encountered?
-Any tips or lessons learned that made adoption smoother?

We really like the idea of a “single device for everything” approach, but my gut feeling is that DeX might not quite be mature enough for enterprise workflows yet. I’d love to hear your real-world observations, good or bad, before we invest heavily.

Thanks in advance!

https://redd.it/1nia5dy
@r_systemadmin

Finally got hired after a 6 month non-paid internship as a Microsoft Security Analyst/sysadmin. Where to go from here?

Hey there everyone.

So back in April I started this non-paid internship at a company that offers a varied catalogue of IT services.
I was put in a team that focuses on Microsoft related stuff and learned a lot of stuff.

As of today, I've officially been hired to work as an analyst (using the microsoft defender suite)/sysadmin (with intune).
I've also begun studying and working on GRC projects (with intune) and started dipping my toes into more infrastructure related projects ( azure, hybrid servers, AD and so on).

While I do like the job and what I do, I feel that, on the long run, only focusing on one tech stack will not improve my skills all that much.

I do like studying and working on the cloud, as a field, and will definitely start focusing on AWS and GCP in the future but was wondering how I could improve myself if I ever wanted to focus on something else.
I'm quite interested in doing some pentest work in the future and I wanted some advice on how to advance my career and on what I could focus on in the future base on your experiences.

As of now I have these certifications:

\- sc-200

\- md-102

\-sc-401

thanks for your help and sorry for all my rambling

https://redd.it/1nibhvk
@r_systemadmin