How does IT typically handle a mass layoff?

Few months ago we had a round of mass layoff that pretty much caught everyone by surprise. One random morning all of us got pulled into a pre-recorded “meeting” with the CEO, who announced the layoff. Immediately after the meeting everyone received an email which either says you’re fired or you’re not affected, and by the end of the day those laid off were already removed from all our systems.

According to some of my sources there’s gonna be another round of layoff coming very soon, and it kinda got me curious: From a sysadmin standpoint, how are mass layoffs (and subsequent mass offboarding) typically done and how much time is needed for the planning and coordination? Also are there any places where I can find “clues” about who’s affected (e.g., Active Directory, distribution groups, etc)?


https://redd.it/1nyhu8p
@r_systemadmin

Oracle EBS CVE-2025-61882

Oracle sent an email a few hours ago about a new critical vulnerability in EBS that seems to be related to the Cl0p extortion emails. More info here -> https://www.oracle.com/security-alerts/alert-cve-2025-61882.html

https://redd.it/1nyk62q
@r_systemadmin

Is KodeKloud platform worth it for the Cloud Engineer path, and If not, what are better alternatives and why?

Hey everyone, hope yall doing great.

I’m currently learning Cloud Engineering and have been considering KodeKloud to strengthen my hands-on skills, especially for AWS, Linux, Docker, and Terraform.

I’ve seen mixed opinions online — some say it’s amazing for labs and practical DevOps/cloud experience, while others suggest there are better (or cheaper) options out there.

So I wanted to ask those of you already working in cloud or DevOps roles:

* Is **KodeKloud** actually worth the subnoscription for someone on the **Cloud Engineer track**?
* If you’ve used it, what did you like or dislike about it?
* And if not KodeKloud, what other platforms would you recommend instead (like A Cloud Guru, Coursera, Skill Builder, or others) — and why?

I’m mainly focused on getting real hands-on experience and eventually landing a Cloud Engineer role, so any advice or personal experiences would be really helpful

Thanks in advance!

https://redd.it/1nyllml
@r_systemadmin

What do you consider normal SLA for a p1/p2 ticket ?

Do you consider same day (8 hours) solution for p1/ p2 tickets reasonable ? As production floor down or major systems not available .How do you usually track your tickets SLA and what do you do to improve them ?

https://redd.it/1nyouf9
@r_systemadmin

Any good events or meetups for sysadmins in Berlin?

I’ve been trying to find more local events for sysadmins and IT people. Always nice to exchange ideas with people who actually keep systems running :)

Only one I have seen so far is Infra Night Berlin mid of October.

https://redd.it/1nyqmcq
@r_systemadmin

Roll call - Windows 10 EOL

I run IT for a small (<100 person) org. With a week and change to go, here’s where we are:

- 50% of our machines are on Windows 11
- 20% of our machines are on Windows 10 but will (hopefully) be upgraded to 11 by Oct 14
- 20% can’t make the jump and will be replaced in the next week or so
- 10% can’t make the jump and will get ESU because they either (a) run well as is and this is a cost effective way to extend their life, or (b) are hooked up to ancient but critical hardware and it’s just easier to let those sleeping dogs lie

How are you doing?

https://redd.it/1nyrz0k
@r_systemadmin

PSA for non-profits: Windows 10 extended support is $2 for the first year on Tech Soup

This was discussed in the comments of another thread, but thought it deserved its own post.

Microsoft is not offering discounts on extended support for Windows 10, just a $61 fee through their volume licensing program that goes up in the second and third year. I just found, though, that Tech Soup has the licenses for $2/machine/year (going up to $3 and $5 in the second and third years). Not bad!

https://www.techsoup.org/products/windows-10-extended-security-updates-l-60323-

https://redd.it/1nyu08m
@r_systemadmin

Cleaning up a mess-where to begin?

Asking for a friend, I promise 😉

Context: outgoing CIO focused entirely on supporting staff using insanely complex, industry specific software while a lowly IT Director did sysadmin, helpdesk, cyber security, and damn near everything else. The IT Director is a hero, but spent years just trying to keep the place afloat. New CIO reached out for advice and… my head hurts.

Among the challenges:
- No role-based anything, everything done ad-hoc
- No documentation or written protocols for anything
- Rampant password and license sharing
- No updated list of machines
- SharePoint sight with twice as many sites as employees (when they migrated from on-prem, it looks like they created a site for every folder in their main directory)
- All SharePoint site access configured as-hoc
- Intune, Defender, etc never fully implemented, still on default/out-of-the-box configuration
- Global Admin access handed out like candy
- No realization that anything is wrong because, technically, “everything works”

Where would you start? Is there a framework to use for triage/prioritization in situations like this?

All advice (except where to look for a new job) is appreciated!

https://redd.it/1nysm9r
@r_systemadmin

samba file server not working with short dns name

hello. i have 2 domains test.domain.com (AD) and test2.domain.com (samba AD DC) they have trusted relationshit
i had fileserver on windows server (joined test.domain.com and trying to migrate to debian (joined test2.domain.com) i succesfully configured all
i can connect to shares only using FQDN, and short name not working from both domains clients
\\\\srv-share.test2.domain.com\\ === works
\\\\srv-share === not works

dns suffix is configured
ip address the same and resolving correctly
date/time is ok

what should i do?

i can see in smbd.log

GENSEC backend 'fake_gssapi_krb5' registered

[2025/10/05 21:20:00.483077, 1] ../../source3/librpc/crypto/gse.c:712(gse_get_server_auth_token)

gss_accept_sec_context failed with [ Miscellaneous failure (see text): Failed to find cifs/srv-share@TEST.DOMAIN.COM(kvno 145) in keytab MEMORY:cifs_srv_keytab (aes256-cts-hmac-sha1-96)]

[2025/10/05 21:20:00.483197, 1] ../../auth/gensec/spnego.c:1242(gensec_spnego_server_negTokenInit_step)

gensec_spnego_server_negTokenInit_step: gse_krb5: parsing NEG_TOKEN_INIT content failed (next[(null)]): NT_STATUS_LOGON_FAILURE

[2025/10/05 21:20:00.483320, 3] ../../source3/smbd/smb2_server.c:3961(smbd_smb2_request_error_ex)

https://redd.it/1nytd64
@r_systemadmin

What is better for mdm? Jamf or addigy?

Been watching videos on apple support to get a better idea since I never had to use mdm for apple . Not even in intune.

But I figured id ask this group sinxe some use either and would like some feedback.

https://redd.it/1nyuy29
@r_systemadmin

Crestron UC system with no vendor documentation

We have a Crestron teams room setup installed by a vendor who has since closed down. It's a Crestron UC system with an OptiPlex 7080 as the MTR device, Crestron TS-1070, Crestron UC Soundbar and Crestron Touchpanel-770-T.

The password on the touch panel has been set to an unknown value and the default Admin password on the UC system has also been set to an unknown password.

Teams Pro Portal has recently started giving us warnings about low disk space, time sync issues and USB Peripheral Power Drains so I figured it's time I reset these units, enroll them into Intune and start managing them properly.

I know how to do a factory reset on the Touchpanel-770-T, for the UC system, can I boot that into Windows Recovery mode and do a software reset on that (and then configure and enroll in Autopilot)? Ideally I'd prefer to reload the OS from scratch but I don't have access to the Win 11 24H2 iOT ISO (working on it) so is this my only option?

https://redd.it/1nyz2v4
@r_systemadmin

Hostname conflict killed DNS/AD - Now the original IP Addr is unusable on the AD. Ideas?

tl;dr hostname conflict spanned across two FQDN's and now DNS breaks if the IP of the device that lost the hostname fight is in use.

Long story short I have been slowly picking apart a mess of a network and some fun nonsense happened this evening. We have $DC1.domain.com (DC1) and $DC2.domain.com (DC2)- both also acting as primary and secondary DNS. DCname1 suddenly stopped reporting to our antivirus dashboard and an uptime indicator. Got into it with vcenter thinking it was powered off. It was on. Ran dcdiag and found an alert that $IPaddr is preventing $dcname1 hostname from being claimed by this PC(DC1).

Tracked down that IP and it was not supposed to be connected - but located it, We have an older network on an isolated subnet that is also $DC1.differentdomain.com (DC3) and $DC2.differentdomain.com (DC4), and I knew this may bite us eventually but them being in different subnets in different buildings and different FQDNs, and domain.com only having servers that are static IP assignments I was sort of putting it off.

Fearing that $DC2 would do the same thing if it conflicted with $DC2 I quickly renamed the differentdomain DC's (3&4) using netdom and verified they stayed working.

Now back to the main domain, I rebooted DC1.domain and still no dice. It throws a tantrum with nbtstat but other devices now properly ping and it returns expected results with tracert. DNS is acting like it is still dead though, and all reporting tools that use hostname for identification report the server as offline. I really don't want touch anything else until Monday, but if I give DC1 a different static IP and reboot it, nbtstat works, and every hostname based dashboard shows the device as online again. If I put it back to its correct IP that it had before this mess started, everything breaks. I also re-registered the DNS on DC1 and still nop dice.

What am I missing here? Any ideas on google paths to go down on Monday?

https://redd.it/1nz1dt4
@r_systemadmin

Audit and revoke all existing accounts that currently have add/remove computer permission

Hey everyone,

I am looking for some advice on how to properly audit and lock down who can add or remove computers from an Active Directory domain. I want to make sure only a dedicated service account (used by MDT for workstation deployments) has the ability to join or remove machines, and that no other users or groups can do it. I’m mainly trying to figure out the best way to audit all existing accounts that currently have this permission, whether it’s through Group Policy (SeMachineAccountPrivilege) or delegated OU permissions for creating/deleting computer objects.

I’d also like to know how experienced sysadmins typically implement this restriction—should I rely entirely on GPO, or also check and remove any inherited or delegated ACEs in Active Directory? Basically, I want a clear and repeatable way to identify every account or group with join/remove rights and then enforce a least-privilege setup using MDT.

Any recommended noscripts, best practices, or methods to audit and tighten this would be greatly appreciated.


Thank you.

https://redd.it/1nz48ue
@r_systemadmin

Bob quit, now step up !

I can't be the only one in this situation.

Working for a very large IT firm for the past 20 years. Been doing all kind of things, but one thing is always the same.

When I transitioned into the storage team, there was Bob and a junior responsible for an extreme SAN, multiple PB serving thousands of servers,

I learn fast, and am quite good with IT in general, but I am no Bob, I can't be Bob, some people just have it all and no amount of studying will get you there.


Problem is, Bob quit, he will be leaving in 1 month.

I tell management, you have to find another Bob.

Their response is that there is no Bobs available in the market. We will promote a guy from servicedesk who is hungry to learn. You will now be Bob..


In my opinion that is a horrible choice, I do NOT have the knowledge to run this complex setup. Sure, I can probably keep it afloat but if A or B happens we are SOL and it will affect thousands of people and the money lost can't be counted.


What are the options, just move and hope the next place have a Bob ?

https://redd.it/1nz9vty
@r_systemadmin

Am I being exploited for my job noscript?

First of all, I'm from Brazil and work on-site on a medium legacy garments ERP system, on-premises.

February I got my first job which is this one that I'm right now, labeled as a IT Support Analyst Jr.

However, I get paid a net salary of roughly 1250, which is lower than the minimum wage, because I have to get a bus to work, so they gave me a pass card that gets discounted drom my salary.

Almost 8 months in I already started feeling down due to me being able to do tasks ranging from simple things like user counseling to hard ones like major incident, DBA monitoring, elaborating complex SQL queries (yes, I do use AI, but more as a means of learning and a tool). There's little to no documentation whatsoever so when an incident happens, I do have to figure out how the system routine works before writing a ticket, and that's very time consuming and stressful and if I happen to write a ticket with information that's not worthwhile or worthless (don't know the exact word for this) the QA lead gets mad about that, and always keep flaming our support team. They hate our sector, for some reason.

The thing is, I can learn pretty quickly, can multitask pretty easily nowadays and also went through major incidents, like helping migrate our company server to the cloud, but I feel that all my opinions on a subject, they seem to just blush off, and guess what? shit happens and I go like "well, I warned you."

I just I could land a remote job because this is pretty depressing and always feeling down after work, no motivation whatsoever to study, I have no money because I'm the one who's putting food on the table at our parent's house, can't get certifications due to me having this shitty wage. And yes, I have no college, just a self-taught guy from Brazil.

My CSAT score is pretty good with over 90% rating and that keeps me happy. But damn, I really hate on-site jobs. Things in Brazil are chaotic and feel unsafe everyday I leave my home to the office just to turn a PC, something I could do at my house.

https://redd.it/1nzaoko
@r_systemadmin

Anyone else notice clients are getting way stricter about how we access their systems?

recently i landed a contract and instead of giving me a VPN login, they made me install a special chrome profile with restrictions. No copy/paste into google docs, can’t even upload files to dropbox from that tab. Its kinda nice because it does not mess with my laptop like some heavy MDM software, but it did feel like big b watching. Are other freelancers seeing this trend?

https://redd.it/1nzdm8w
@r_systemadmin

Moronic Monday - October 06, 2025

Howdy, /r/sysadmin!

It's that time of the week, Moronic Monday! This is a safe (mostly) judgement-free environment for all of your questions and stories, no matter how silly you think they are. Anybody can answer questions! My name is AutoModerator and I've taken over responsibility for posting these weekly threads so you don't have to worry about anything except your comments!

https://redd.it/1nzevwd
@r_systemadmin

How to deal with a colleague

Lately I made a post but I expressed myself badly and my English is poor people made fun of me.

I have a new job as a sysadmin.
120 users 130 to 140 computers. I don't know the number of servers because my colleague refuses to give me this information. My colleague uses the norms and standards that he invented according to his logic. He's doing computing with his own rules. He doesn't know ITIL and he doesn' tcare about mister cybersecurity. I am lost.
I would like to know what are the best practices to have and to deal with him.

He doesn't want software to do the inventory. He doesn't want centralized authentication, no LDAP and no active directory. He doesn't want antivirus. He doesn't want remote control software. He doesn't want software deployment software. He doesn't want ticketing software.

I am a system administrator engineer. He has the same job.

He regularly takes me for a technician who has neither skills nor experience. For example, he gave me a how to install Windows 10 step by step.He constantly criticizes me for not understanding my French. I'm French, born in France, and my mother tongue is French. He's the only one at work who doesn't understand my French. How to avoid having problems with him??


https://redd.it/1nzciwu
@r_systemadmin

What’s your best strategy for safely giving non-technical teams access to server resources without compromising security?

What’s your best strategy for safely giving non-technical teams access to server resources without compromising security?

https://redd.it/1nzgtvp
@r_systemadmin

Any experience with private backbone VPNs for lower latency

We have teams in EU and North America, but most of our infrastructure is hosted in the US. Users in EU are experiencing high latency around \~90-110ms over VPN,which is hurting productivity for real-time apps.

I am looking into private backbone options to improve routing between regions and reduce dependency on the public internet. Ideally, something that can reliably cut latency.

Has anyone tried routing traffic through a cloud region closer to users in Europe and then exiting in the US over the provider’s internal network? I am considering AWS, Azure, or GCP, but I am concerned about egress costs scaling with traffic.

I’d love to hear your recommendations for SD-WAN or private backbone solutions to optimize cross-region performance. I’m open to any suggestions that could help us get those ping times down, ideally under 60ms. Thanks.



https://redd.it/1nzeuv8
@r_systemadmin

Gifs in Teams on latest mobile version

I recently got a complaint from a department that they no longer had the ability to send gifs in Teams and that the internet had told them that we had shut it off (IT here is not some weird cartoon villain so I know it was nobody in my department). I don't some troubleshooting and find the solution by creating a policy in app admin center enabling optional connected experiences, which Microsoft recently changed to be off by default.

Every PC can send gifs again, but only some mobile users can. I did a little digging and I realize those with older versions of Teams on mobile are able to send them again, but those who have updated to the latest version cannot. I updated my own app to test this theory (I never use them anyway) and confirmed this feature is not working on the latest mobile version. I am trying to troubleshoot but all results I am getting are referring me to a policy I already have enabled. So hail Mary time - has anyone else noticed this issue? Have you managed to find a way to fix it?

TL;DR: how do I fix Teams not sending gifs in the newest version of mobile? The policy is already enabled for allowing optional connected experiences.

Edit: options for sending through keyboard are greyed out, sending through built in emoji tool is just not there

https://redd.it/1nzjh25
@r_systemadmin