How clean is your office?

Just wondering what everyone’s office looks like these days. Mine is a mess currently because we just got VoIP phones (yes you read that correctly) and I had a graveyard of old Toshiba phones. Plus, exchanging old laptops for new and some other things.

https://redd.it/1o8j2r0
@r_systemadmin

I'm going through the account lockout from Hell

I've been doing IT in one form or another for 30 years. I've never had a lockout problem like this. This is happening to my admin account, and it gets locked out just about constantly all day. I know the server that the locking out is happening on because of the lockout events on the DC.

Server 2022 Datacenter running on VMWare
This server runs our Azure AD sync
This server is our PDQ Deploy and Inventory machine (Those services are stopped)
Double and triple checked that there is NOT a service or scheduled task using my creds
This has been going on for two weeks now
It seems like a service, but I can NOT figure out which one.
With PowerShell I wrote a noscript to find all .ini, .cfg and .xml files on my c: and search those for my username. It found two xml files that were task manager exports. The username was just a refernce to <owner> and </owner>, not using my creds.
I've cleared credential manager and Windows Vault
There are no mapped network drives,
Backups are hypervisor based so there's nothing running in the guest OS in that regard
I've tried the Netwrix Account Lockout Examiner and it didn't find anything useful.
I've search all running services and asked Perplexity which ones might be using user impersonation. It gave me a list. I stopped the ones that it would let me stop, but that didn't have any affect.

As you can tell, I'm getting a bit desperate. I could really use a Reddit hive mind miracle.

Thanks!

https://redd.it/1o8oxe7
@r_systemadmin

Struggling to host my own game server need some direction

Hey everyone

I have been experimenting with hosting my own game server at home. I have got Truenas running smoothly, but I am getting stuck while setting up pterodacty for a valheim server inside an ubuntu container. the guides I have followed so far feel a bit incomplete, and I keep hitting roadblocks midway.

I am open to suggestions  should I try a different setup or panel, or just spin up a vps instead and host it there? I am mostly doing this to learn but I would still like it to run reliably without constant restarts.

Would appreciate any advice detailed walkthroughs or even alternative setups that worked for you.
Thanks in advance



https://redd.it/1o8uah6
@r_systemadmin

Chronic headaches from being a One man IT

I was managing 4 windows servers, 8 switches, fortigate, 110 systems, responsible for building website designs, ui/ux, and developing asset mgmt sys nas for my org. Few months in I started having mild headaches to sharp headaches which became chronic. Quitting the job had made me feel immensely peaceful. These jokers didn't have a single backup in place for anything. I basically had to replace hdds to all sata and nvme whenever a drive failed for over 20 systems. 400 cat6 terminations and 200 keystone what a pain. The previous IT guy didn't even know how to CLR bios, replace the dead ram and reinstall the corrupt os hence they kept the system aside. They never invested in IT and they don't respect IT. I really wish I didn't do like 5 years worth of work in such a short span of time. Only leading to severe burnout. And amount of trauma I have from this job jeez.

https://redd.it/1o8uo3z
@r_systemadmin

Weekly 'I made a useful thing' Thread - October 17, 2025

There is a great deal of user-generated content out there, from noscripts and software to tutorials and videos, but we've generally tried to keep that off of the front page due to the volume and as a result of community feedback. There's also a great deal of content out there that violates our advertising/promotion rule, from noscripts and software to tutorials and videos.

We have received a number of requests for exemptions to the rule, and rather than allowing the front page to get consumed, we thought we'd try a weekly thread that allows for that kind of content. We don't have a catchy name for it yet, so please let us know if you have any ideas!

In this thread, feel free to show us your pet project, YouTube videos, blog posts, or whatever else you may have and share it with the community. Commercial advertisements, affiliate links, or links that appear to be monetization-grabs will still be removed.

https://redd.it/1o8x88e
@r_systemadmin

Some Simple Tips Every SysAdmin Should Know

As a sysadmin, there’s always something new to learn, but sometimes the basics are what save us the most time and headaches. Here are a few quick tips that every sysadmin should keep in mind:

1. Document Everything This one can’t be stressed enough. Whether it’s a simple configuration change or a full system overhaul, documenting every step makes life a lot easier down the line. It’s also a huge help for troubleshooting when you or someone else comes across an issue months later.
2. Backup, Backup, Backup Always have a backup strategy in place. And no, a single backup doesn’t count. Having multiple copies, preferably stored in different locations (e.g., local and cloud) is essential. And remember to periodically test your backups to ensure they actually work.
3. Automate Where You Can Manual processes are error-prone and time-consuming. Whether it’s using noscripts to automate server deployments or using tools like Ansible, SaltStack, or Puppet, automating your tasks will save you countless hours. It also reduces the risk of human error.
4. Keep Security Tight This might seem obvious, but ensuring your systems are secure is always a priority. Regularly patch your software, review access logs, and use strong, unique passwords (or better yet, a password manager). Also, implement the principle of least privilege—only give users the permissions they absolutely need.
5. Plan for Disaster Recovery Things will break. Servers will crash. It’s just a matter of when, not if. Having a solid disaster recovery plan is crucial. Make sure you know exactly what steps to take when things go south. And don’t forget about regular testing to ensure your recovery process works smoothly.

Sysadmins are the unsung heroes keeping things running behind the scenes. These tips are just the start—never stop learning and improving your skills!

https://redd.it/1o8ybg9
@r_systemadmin

Ransomware-Proofing your organization and customers

Always worth asking what steps people are taking to try to improve their ransomware stance in their org and/or customers.

We typically deploy NetApps so we're using snapshots and trying to get more and more "file" type backups on CIFS shares so they have SnapMirror protection where hopefully unless someone gets the NetApp admin credentials and goes in via OOB management there is no way to remove those snapshots.

We've using Veeam hardened repos for virtual machine backups where the hope is that unless someone gets physical or OOB management access they can't get to the backups.

We keep around 30 days depending on disk space on the physical repos.

I am interested how you're backing up Active Directory other than virtual machine backups of the domain controllers.

I've used Windows Backup before to schedule a backup to a UNC share on one of the NetApps.

I'm coming at this more from a infra/servers angle right now so what other things are you doing to try to prevent issues and to try to make sure you at least have backups and copies of data that can't be changed unless you can get OOB access to the physical hardware it sits on?

Jas

https://redd.it/1o8xcku
@r_systemadmin

Phish Resistant MFA - Tricky Authentication Contexts

We've implemented phish-resistant MFA for our cloud admin accounts, using the passkey option which is set up in our authenticator app on our phones. For 90% of scenarios this is working flawlessly. We are however having trouble with some tricky authentication contexts which are forcing us to temporarily bypass admin's from the phish-resistant MFA CA policy (falling back to our standard MFA CA policy). Examples are:

* Autopilot Hash Upload during OOBE - the authentication box which pops up when doing an online upload doesn't support the Bluetooth passkey method.
* Potential workarounds: provide staff with a USB hardware token as their phish-resistant factor, staff copy the hardware hash to a USB to upload from their workstation.
* Authenticating using 'New-AzureADSSOAuthenticationContext' - we need to run this on our server running Entra Connect Sync, which is an Azure VM accessed using RDP. Our phone passkeys are unable to connect to this VM via Bluetooth so can't authenticate. I haven't found a secure workaround for this one (yet!)

Generally, how are you all dealing with the usage of phish-resistant MFA? What challenges are you facing, and what solutions have you found to them? Especially anything relating to the examples above!



https://redd.it/1o8wid2
@r_systemadmin

Teams Crashing Windows 11

I'm pushing this out to the ether in hope that a fellow sys admin does not have to suffer like I did. I Reset/wiped machines then re-imaged, obviously deleted teams and re-installed but the below is the only fix that worked.

The devices in question for me where a number of Dell Latitudes 5550 I purchased for my org (all remote users)

After a few weeks all users started reporting an issue with teams crashing in different ways when joining calls/ meetings. In our case teams is loaded with an Office Package, I have searched around different forums and tried all sort of fixes but here's a centralised fix.
1. Disable Hardware acceleration Team-Settings- General - disable hardware acceleration. Or run this in cmd setx WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS --disable-gpu - can be ran without admin privileges

2. Set Power Mode to best performance instead of balanced on user machine

3. Clear cache - in %appdata%\\Microsoft\\Teams or if installed with office package clear out %localappdata%\\Packages\\MSTeams_8wekyb3d8bbwe\\ delete all from local cache folder.

If anyone has come across this and has found other fixes do reply !



https://redd.it/1o91cny
@r_systemadmin

Our developer says they still do not officially support server 2022 and are still testing. Isn't this a bit long to be testing?

I don't want to be unreasonable, but isn't this a long time to wait for a developer to test their software? Is there a standard as far as when a developer of an app should be compatible with the current version of Windows Server?

https://redd.it/1o934jb
@r_systemadmin

Are you guys experiencing issues with the latest patch that breaks localhost?

https://www.techpowerup.com/341976/microsoft-breaks-localhost-with-windows-11-october-update-users-forced-to-revert Getting ready to see what this actually does -- does it break just https://localhost or all bindings against localhost. UGH UGH thanks MS

https://redd.it/1o917ou
@r_systemadmin

Are Your Windows 10 Extended Software Updates (ESU) Keys Working?

Hello everyone,

Did some searching in r/sysadmin before posting this, so apologies if there is another thread that deals with this specific topic.

We have purchased Windows 10 ESU licenses for our Windows 10 workstations. All of them are running Windows 10 Enterprise - activated via volume licensing using an on-premise KMS server. Testing the activation of these MAK keys using the documentation here:

https://learn.microsoft.com/en-us/windows/whats-new/enable-extended-security-updates

I was issued 5 MAK keys to use, which I'm told have a large number of activations available to them - at least more than we will ever need for our environment. My two test workstations are clean freshly imaged systems running Windows 10 Enterprise build 10.0.19045.6456 which I believe is latest available from Microsoft Update. This also means the workstations have satisfied the requirement of patch KB5046613 being installed. Verified this by trying to manually trying to install that patch and receiving the error that the computers are not eligible to install the MSU.

I've attempted to activate all five of my MAK keys using the following command:

slmgr.vbs /ipk xxxxx-xxxxx-xxxxx-xxxxx-xxxxx

(where xxxxx would be my MAK keys)

I'm receiving the following errors on all the keys:

Error: 0xC004E016 On a computer running Microsoft Windows non-core edition, run 'slui.exe 0x2a 0xC004E016' to display the error text

I proceed to run the command in that message, and receive the following additional error output:

Code: 0xC004E016

Denoscription: The Software Licensing Service reported that the product key is invalid

I have verified the volume licensing contract that the licenses were purchased through is valid and active. There's one other thread where I found similar errors posted, but it looks like it may have been a conflict between different times of Windows licenses already activated on the workstations in question. Our fleet runs entirely on Windows 10 Enterprise via KMS activation.

Has anyone experienced this issue? Is the only solution here a Microsoft Support ticket to verify the keys are valid and activated? I'm unable to get past this step on two different workstations that by all accounts and research should be able to activate the MAK and receive the updates.

At a minimum, I'm posting here to journal my experiences as I'm assuming I'm not the only one working through this now that October 14 has past...

UPDATE 10/17/25 11:15 AM EDT

So I learned that our organization has multiple volume licensing contracts and "License ID" associated with our volume licensing - we have two that are active. To make sure there weren't any conflicts I removed KMS license activation from the Windows 10 Enterprise devices and instead activated with MAK license for Windows 10 Enterprise on the same active contract number/License ID as our "Windows 10 Supplemental Servicing MAK" that I have been unsuccessful in activating. Unfortunately that did not work, and I received the same errors, so a Microsoft Support Ticket is being opened.

https://redd.it/1o90ktw
@r_systemadmin

Audit alerting for privileged user change

OK where did Microsoft move the creation of alerts when a user is given an elevated account? We should add a Flair for MS moved something again!!!

https://redd.it/1o9a24m
@r_systemadmin

Barracuda spam appliance whitelist question

I know of all the ways I can whitelist things from senders, but I have a construction client that is having issues with bid invitations being blocked, which is a critical thing since bid invitations are how they get jobs and make money.

And the ones getting blocked are from companies remailing things thorough third party mass mailing systems, so nothing actually comes FROM sender@company.com that's always just the reply to field. The sending addresses are randomly generated and often using multiple domains.

I'm not about to simply whitelist a remailing domain for this, and for ones that always use the same subject line, that's a piece of cake to get in the filter. But ones that are random email sending addresses and random subjects, there's not a good way to whitelist as I've not found a way to whitelist something based on the reply:to field.

What I would like to do is take a single RECIEVING address (i.e. the bidinvitations@ address for this company) and exclude that from the spam scanning. But I'm not finding a place to do so. I had hope that the "recipient filters" would do that since it's the RECIPIENT, not the SENDER, but when I do google searches on that, the things all point to that just being another email for a SENDER not who is receiving.

I'm going to do some testing but that may take a bit before I see any definitive results, was hoping someone in here may have barracuda spam appliance experience and could immediately give me a go/no go answer about if it's possible to simply exclude a single address being sent TO from span scanning.

Thanks for any info, so far all my searching online is turning up blank...

https://redd.it/1o9aecj
@r_systemadmin

Fake domain close to our domain name and sending emails to people. What can we do?

Someone registered a domain with ourdomainHR.com and has been finding users on linked in with "OpenToWork" that matches our job denoscription and reaching out to them and scamming them with a job offer. These are people we have never had any connection with.

Going through legal and they are saying it could take months to take that down. Anything else we can do?

https://redd.it/1o9bnp5
@r_systemadmin

I need to prevent all users (including admin users) from deleting Windows event logs.

I have an application that write logs to Windows Event Logs. As part of some company wide data integrity requirements, all users (including admin users) should not be able to deleting these logs, however users can in Event Viewer.

I don’t want to block all users from all logs, just that application’s logs, fyi.

What would be the best/easiest way to do that?

https://redd.it/1o9drse
@r_systemadmin

“The Encryption Type requested isn’t supported by the KDC”

So kind of a long story or I’ll try to make it as short as possible but I’m just a lowly Service Desk Analyst still at my company technically, but my org recently has been getting this exact error message every time a user tries to reset their own Windows password ever since we went through AD migration and I literally remember bringing this up to Windows Server Support the first day we encountered it, which was the first day of AD Migration, and resetting the password in AD obviously fixed it and the user could reset their own password 24 hours later. Now almost a year later, I found out it’s been coming back and I thought they were one off situations or something but no it has been happening to literally ~every single user~. I obviously took the liberty of at least googling that dumbass error message and yeah lo and behold if I read it right it’s an Encryption type discrepancy when a user tries to reset their own password. Now my question is, Windows Engineering and all of 3rd level said to us that the only way to fix it is by resetting everyone’s password?? Am I just stupid or isn’t it literally just as easy as setting the account properties for all the affected users to enable resetting passwords using AES 256 Encryption and running a Group Policy Update on all users?

https://redd.it/1o9h5ua
@r_systemadmin

Whoops, wrong terminal again.

Is there a term for that? When you have several ssh sessions going and you run the command in the wrong server?

https://redd.it/1o9hep2
@r_systemadmin

How much longer do you think sccm will be around?

I know in this field there are ancient systems and such but im curious as to how long sccm will be around in corporations vs flipping to azure/intune.


https://redd.it/1o9kbx3
@r_systemadmin

Professional cheap NAS solution

Edit: I'll dig into the UNAS entity endpoint (not high hopes), Terastation (meh), TrueNas prebuilts (thanks for that idea), and if all else fails cry and bare metal windows 17 times. Thank you all.



We've used Windows hosts, on an ESXi mini stack at every (17 different) locations, with the windows VM playing SMB host.

We've dumped the need for VM's at the locations, but still need the network shares, and still have these capable HPE servers at each location. So installing Windows baremetal is an option, but I'd love to kill Windows even as well.

I'd prefer to simplify and get rid of Windows as well. I know TrueNAS is an option, but my superiors fear the phrase 'open-source' based (don't get me started, I know). Are there any closed source bring-your-own-hardware NAS solutions?

If I have to replace them (they're old-ish servers anyways), are there reliable NAS units that aren't $3000+ each? Synology and QNAP seem like cheap garbage, Ugreen is too new to trust in a sensitive environment, and Unifi UNAS doesn't support Active Directory without a crazy subnoscription (I bought one and tried, no dice).

Edit: we don't want/need virtualization, or even Windows anymore if possible. Just basic SMB shares.

https://redd.it/1o9j9q1
@r_systemadmin

Automated Password Reset OKTA

Is there a way I can automate Password Reset for users. Okta is used in our org.
The reason I want to automate password reset is our Service Desk is outsourced and most of the time they don't even check basic things and straight away reset (which goes to their personal email (secondary email)) or give the password to the user over call (I think there was one instance)

https://redd.it/1o9q7ql
@r_systemadmin