Moronic Monday - September 22, 2025

Howdy, /r/sysadmin!

It's that time of the week, Moronic Monday! This is a safe (mostly) judgement-free environment for all of your questions and stories, no matter how silly you think they are. Anybody can answer questions! My name is AutoModerator and I've taken over responsibility for posting these weekly threads so you don't have to worry about anything except your comments!

https://redd.it/1nnicdy
@r_systemadmin

September '25 Security Updates on DCs - secure certificate mapping enforcement - effect when DC is 2016 still

regarding "KB5014754: Certificate-based authentication changes on Windows domain controllers" -

Can anyone tell me please what the effect is on endpoints that have had a renewed certificate (with tag in san) that try to authenticate to a 2016 Domain Controller that has been patched to September 2025 level where strict checking is enforced?

I *think* it's that the DC will ignore and allow auth still, but I'm not sure I'm reading the resources right.


cheers

https://redd.it/1nnj8ij
@r_systemadmin

Mailbox Creation in the UAE - Microsoft 365

Anybody else having issues creating mailboxes in MS 365? Created a user hours ago and came back to see that his account gives me this: We are preparing a mailbox for the user.


Can see the account in Azure which tells me the account was created, but can't see it in Exchange. Licence used was MS Business Standard.

https://redd.it/1nngfld
@r_systemadmin

Is noscripting a mandatory skill for sys admins?

I graduated college with a degree in Computer Science and instead of going into programming, i veered off into IT and being a sys admin, so I have a pretty good understanding of noscripting and being able to follow code and logic in a noscript and assumed that was a fairly standard skillset for sys admins. Talking to other sys admins, aspiring sys admins and other general IT pros it seems like being able to write noscript is a fairly niche skillset and most do not want to touch any kind of noscript at all. Am I wrong in thinking that being able to read/write a noscript should be a standard practice for anyone involved in systems administration?

https://redd.it/1nnlhe1
@r_systemadmin

Audit didn't like "customer" access touching internal network while sharing AP's - does it matter?

We are using Ubiquiti access points with a Cisco 9x00 at the top of the stack in each office doing the inter VLAN routing. Access points broadcast a SSID for customers/vendors, a SSID for internal users, and a SSID for a handful of wireless printers and approved IoT devices (cameras, wireless displays, etc). Each is assigned a different VLAN, each VLAN has it's own subnet.

When I initially set everything up I didn't want a separate DHCP server for customers so I used our existing DHCP server. I put in a ACL on the switch relaying port 67 from the customer side directly to the DHCP server on the secure side so customers would get a IP from our standard DHCP server and we could manage everything from one place. I also put in a deny all ACL after that rule for both incoming and outgoing traffic from that subnet. DNS on the customer side is 1.1.1.1/8.8.8.8 and the gateway is directly out our firewall. It's been setup like this for 13+ years now. We did extensive testing initially to make sure the two sides didn't "touch" other then for DHCP.

They would like us to have a separate DHCP just for customers/vendors or even a entire separate system for it. I asked if they found any actual vulnerabilities. They said no but we should have it separate. I feel with proper ACL's on the Cisco switches, and the fact they couldn't actually show me a vulnerability that adding another DHCP is just to check a box without actually making things any better. And currently we have multiple branch offices that get DHCP from our HQ so it would add a lot of complexity for what I feel is no good reason.

Is my thinking wrong? I just want a sanity check before I push back against their recommendation.

https://redd.it/1nnmo6s
@r_systemadmin

Centralized management of retail POS endpoints across multiple regions

Hi everyone, I'm overseeing operations at 30+ retail locations in the US. Endpoint management and compliance are some of our biggest challenges, especially with distributed POS systems and mixed Windows and Linux environments. I'm posting here to find out how sysadmins in retail or similar distributed enterprises are handling secure configuration, automated patching, and remote support at scale. If you can share any hacks that will save us time and resources, it would be greatly appreciated!

https://redd.it/1nnoxle
@r_systemadmin

When Your Brain Goes Foggy at the Worst Moment: How Do You Snap Back?

What do you do when your mind feels foggy just as you need to solve a critical problem? Or when your brain is racing with distracting thoughts, and you can’t focus on the task right in front of you—especially when everyone is watching and expecting you to perform?

I’m sure this has happened to all of us at work at some point. How do you manage your focus and calm your mind in those moments? Please share your best strategies!



https://redd.it/1nnrh6g
@r_systemadmin

So what are you guys ACTUALLY noscripting?

This post from earlier today got me thinking on this question I've often considered but never bothered asking. What is it you guys are actually noscripting? Maybe it's due to my environment/industry but whenever posts like that one get traction I can never actually think of what it is I'd use noscript for that often.

Bit of background/context, I've been a Sysadmin for only like 4 years now (5 years helpdesk before that) and in small-medium orgs, always been internal and in blue collar office type industries, construction company or a fabrication shop for example. My current environment is \~60 or so office workers joined to our local domain, then a few hundred random people on different jobsites that aren't on the domain. Bunch of mobile devices in the MDM, then our servers (File, print, DCs, a few application servers) and that's about it. We don't have an RMM and don't really plan to get one, most remote workers just VPN in and work in RDP sessions if they need to do anything beyond email checking.

So maybe it's a result of a smaller environment without many controlled machines, but I feel like a majority of my workload is one-off things. User needs X license assigned, User needs to be added to X group in domain, X service needs a reboot on the server, etc. Things I don't see immediate value in noscripting, as I rarely am repeating the same action twice, nor is there really a template to apply to our users in AD to automate creation there.

I ran through the Powershell in a Month of Lunches book a few months ago, and got the basics down and at least have a basic grasp on the concepts. Even then, I struggle to find anything to actually noscript. I made one to automatically transfer some custom Adobe stamps into the relevant folder as that needs to be done for most of our users, but beyond that I haven't really found a use and have already started to forget a lot of what I learned.

So am I missing something here? What is it you all are actually noscripting so often? Is this something that's just less applicable because of my environment here? Would love to hear everyone's thoughts, especially advice on how to get over the initial learning of something like Powershell and into actually implementing it in meaningful ways. Seems the consensus on the other post was that noscripting is something most Sysadmins should be capable of so I don't want to get left behind!

https://redd.it/1nntghi
@r_systemadmin

Hey all, reminder that Apple Business Manager terms updated today. Make sure to accept them before trying to add new devices or apps.

Terms need to be accepted before managing new devices.

https://redd.it/1nnvgtk
@r_systemadmin

Required MFA for O365

Hello,

I'm getting mixed reports on if this is a requirement going forward on 9/30 or not. I work at a small construction company, and all of the office workers are setup for MFA for email, but the out in the field guys that never touch computers and just have email on there phone are not setup. I have about 30 guys that never come into the office that just use email and have no computers to really use. Never thought it was a big deal since they only use email to communicate with each other. If this is going to be a requirement, what would be the easiest way to authenticate for MFA then?



https://redd.it/1nnvkt2
@r_systemadmin

File share sync between NetApp and file share

Currently lab machines interacting with batch and some config data is accessing a NetApp CIFS share between the lab network (no AD, has Internet) and our share on the production network.

We were going to Robocopy, but the needs assessment from the lab rats came back as needing bidirectional.. so a "sync" rather than just a replica.

I currently have a VM terminated into that network running Windows Server as workgroup.. but am not counting out a Samba share etc for the lab machines to connect with.

We are solving the issue where the firewalls between environments have holes like swiss cheese.. every machine has a drive mapping into the production environment. We want to consolidate that to "one" file share and just sync the data between environments.

Cloud options are an option.. but we can get direct connectivity between environments.

I've used SyncThing in another life before the pandemic.. but was lone wolf and not subject to a SOC probably outlawing a p2p option directly.

There is apparently also a need to have the intervals (if defined) be less than five minutes.

Feels like rsync may fit the bill best here.. where the "lab share" machine hosting the file share within the lab can maintain the sync with the CIFS share on the Netapp, using Debian/RHEL/whatever. Permissions propagation isn't something at the forefront.

Any good ideas here? The folder within the share is maybe 4GB.. not a huge sync payload tbh. Lab batch runs and batch results would be the data deltas.. and again I can't imagine these are huge.

https://redd.it/1nnz144
@r_systemadmin

How can iLO alerts be simulated?

I have a fleet of HP Proliant servers with licensed iLO. All servers have email alerting configured exactly the same, and are scheduled to stagger their monthly reboots during maintenance windows, during which they email various alerts like NICs going offline. But four of them only email out when testing the email alerting but not during the reboots. I've gone back to verify the configuration and it all checks out.

Short of disconnecting network cables or unplugging storage drives, how can ILO alerts be simulated so I can troubleshoot this issue during the workday?

https://redd.it/1no260q
@r_systemadmin

Built a tool that generates autounattend.xml + ISO files dynamically—no image mods, no XML edits

Hey folks,
I’ve been building a deployment tool that i would like to call DeploySmart. It’s designed to generate Windows autounattend.xml files and autounattend ISOs on the fly, but with a twist:

You can manage multiple companies or deployment profiles without ever touching the XML
App installation list are loaded dynamically—no need to bake applications into the image
No cloud dependencies, no Intune, no SmartDeploy licensing
Just a clean web interface, some PHP, and a bit of ISO wizardry

It’s multi-tenant, supports per-user company access, and lets you generate deployment-ready configuration ISOs for vm deployment/test in seconds. Mostly built for the laughs and the challenge, but it’s surprisingly useful.

Currently i only have about \~20 useful applications that can be selected to the applications list, but im looking to add more (silent installations trough PowerShell). The users/admins are also able to setup their own custom noscripts that is only visible for them selves.

If anyone’s interested in testing it or wants to peek under the hood, I’m happy to share more.

Edit:

Didn't expect this much interest, so first of all thank you!

Im going to publish my creation here: https://github.com/mattish91/DeploySmart

As im not really friends with github just yet, ill probably take me some time \^\^

Also, you can see the live version here: https://deploysmart.dev.mspot.se

https://redd.it/1no4zk7
@r_systemadmin

Heads up Dell Display & Peripheral Manager 2.1.1.12 breaking dual-monitor setups

If you’re running Dell Display and Peripheral Manager (DDPM) 2.1.1.12, watch out. We’ve confirmed across multiple sites that it causes both external monitors to drop out every \~15 mins (integrated laptop screen unaffected).

# Impacted setups:

Dual Dell P2723DE in daisy-chain
Laptops:
Dell Latitude 5320 / 5330 / 5350
HP models (confirmed)
Lenovo models (confirmed)

# Symptoms:

Monitors black out briefly, then recover.
Only started after upgrading to DDPM 2.1.1.12.
Rolling back / uninstalling fixes it immediately.

# Notes:

Logged with Dell, but support is not acknowledging yet.
Looks like a regression in DDPM, not hardware.


👉 Workaround for now = uninstall DDPM or roll back.

https://redd.it/1no5she
@r_systemadmin

Do you have any browser Zero Trust solution? need advice

600 employees, not very tech like company.. wondering if we should go for zero trust policy or should we find some other solutions in the middle. I would love to hear from those who have either fully embraced zero trust or found alternative approaches that actually work. including products to stay away from…

https://redd.it/1noa52n
@r_systemadmin

Google indexed my website under a different domain (boot-phone.com) — why does this happen?

Hi everyone,

I’m facing a strange issue and I’d really appreciate your advice.

My actual website is (running in a Docker container with Apache, behind an Nginx reverse proxy + Let’s Encrypt).

But recently I discovered that some random domains like `boot-phone.com` and `mail.kulturplaner.org` were showing my website content — even though I never configured these domains.

When I checked Google Search Console, I found that Google did not index my real domain . Instead, it indexed the duplicate domain (boot-phone.com) as the canonical version of my content.

I have since fixed my Nginx config:

Added strict `server_name`
Added a default_server block that forces 301 redirects for all other domains → my Domain

Now my questions are:

1. Why would someone point their domain to my server IP?
2. What benefit do they get from this? (SEO spam, phishing, something else?)
3. Could this have damaged my SEO since Google indexed the wrong domain instead of mine?
4. Now that I’ve forced 301 redirects, am I safe?
5. Is there a way to monitor if new domains start pointing to my IP in the future?

Thanks a lot for your help!

https://redd.it/1nob3xq
@r_systemadmin

Hey, I made an article about LVM

Hello folks,


I'm a junior Network Engineer and I have a few things running at home : about 25 vms & 25 containers, some storage & network equipements. I've recently started a blog of my own, documenting things, trying things and playing with my homelab.

I just posted my first article about LVM and migrating to it / using it and I would like to know what I could do better. Please be kind and keep in mind that this is my first one, thanks.

https://blog.interlope.xyz


If this is not allowed by the TOS (advertising is not allowed but i'm not here to sell anything, there's no ads or whatsoever, simply IT), please remove it.


Thanks for reading me

https://redd.it/1noc1x0
@r_systemadmin

Is it just me or a "sys admin" now needs to be licensed in literally everything in existence and beyond nowadays JUST to be employed with an inhumane workload?

I can't even get a job that doesn't require 5 different certifications with 10 years of experience. What the fuck is this? I was an intern for 2 weeks once and they asked me to do literally everything related to the IT department, including programming. I had to speedrun python while managing the entire server alone. I didn't get a position, obviously. Couldn't keep it.

Honestly I'm a labyrinth right now, continuing studies and trying to get more licenses like the Oracle Databases one which is apparently important for most jobs I've seeked.

https://redd.it/1nocs17
@r_systemadmin

Why is Unifi gear not suitable for enterprise?

Hi everyone,
I’m new here and still learning, hoping to break into the sysadmin field soon. Up to now, I’ve mostly been the “friends & family IT person,” but I really enjoy this work and want to understand the industry better.
I’ve noticed in many threads that UniFi gear often gets a bad rap for enterprise use. People seem fine with using their access points, but rarely recommend their gateways or switches for serious deployments.
Could someone help me understand why? On paper, UniFi advertises a full “enterprise” lineup with high-availability options and centralized management, so I’m curious why it’s often dismissed in professional environments. Are there reliability issues, missing features, or something else that makes admins stay away?
I’m not trying to start a vendor war - just looking to learn from real-world experience. Thanks!

https://redd.it/1nodkip
@r_systemadmin

Trying to pick a SASE vendor, what’s your experience?

Hey everyone,



We're currently evaluating different Secure Access Service Edge (SASE) providers and are finding the marketing materials a bit... generic.  Has anyone here had practical experience with a few of the major players?  I'm curious about the actual day to day usability, especially concerning things like integration complexities, management console intuitiveness, and the overall performance in a real world environment.



Specifically, what are some of the hidden costs or unexpected challenges you've encountered?  Were there any features advertised that didn't quite live up to expectations?  Any insights you could share on different vendor strengths and weaknesses would be invaluable.



https://redd.it/1nogvjr
@r_systemadmin

Laptops won't take image from server

I hope this is the right group and I'll try to keep this short. The company I work for recently bought new laptops to replace the old ones. We use PXE Boot to pull an image from our server using Windows Deployment Toolkit. The old ones worked fine, running Win 10, the new ones, running Win 11, connect to the server but always end in the same error: "A connection to the deployment share (local\server) could not be made. The following networking device did not have a driver installed. PCI\VEN8086&DEV550A&SUBSYS0CB91028&REV20". I don't believe the OS has anything to do with it but I felt it was important to mention it.

I may be wrong but I suspect a driver issue (probably obvious). The only thing is I cant find any driver other than the exe or msi files and those don't work.

The laptops are Dell Latitude 5550. Any help or advice would be greatly appreciated.

https://redd.it/1nogm7x
@r_systemadmin