Windows 11 Pro RDP not working

I have a single Windows 11 Pro machine (24H2) that will not allow RDP connections. I've enabled RDP, changed the port, disabled the firewall, and rebooted several times, but I'm unable to connect. Netstat -a shows nothing listening on port 3389, which likely explains why I can't connect. The machine is fully patched. Does anyone have any suggestions for something I haven't tried?

Thanks


EDIT: Finally found a solution here

https://redd.it/1pjhqkh
@r_systemadmin

Infuriating - User tried to tell me I was wrong by using ChatGPT

So how many have had this happen to you? Does it drive you insane?

A lab at our facility was having a problem with a lab instrument (ICP-MS) that had lost connection to the computer that was controlling it (via ethernet). It turns out that they were using samples prepared with acid-digestion that were very corrosive, and the computer's connections had corroded to un-usability due to inadequate venting.

This instrument is quite old, and the software cannot run on Windows 11. I explain to him that we can't really purchase new computers with Windows 10, and that new computers don't support Windows 10. I did mention that driver support was the main issue, but didn't get into the details.

He then proceeds to argue with me and insist that we can install Windows 10 on a new computer, and *asks ChatGPT* while on the phone with me! Of course ChatGPT says it can be done, and he basically says, "See, I was right!". Of course then he reads further and at least ChatGPT then notes "you may run into problems with driver support and full functionality of the computer" (duh!), which was my point in the first place.

It drove me insane, it felt *so* disrespectful. I managed not to lose my temper, but I did politely ask him not to doublecheck me against ChatGPT in the future, that if I'm not confident in my knowledge of something, I won't hesitate to tell him.

What especially drives me nuts about this is that they will make decisions based on ChatGPT, but then expect us to *fix* the issues after. I'm fully confident that if he had gone ahead and done this, they would have complained to us if the network ports or sound didn't work due to driver failures.

https://redd.it/1pjn20e
@r_systemadmin

Any newsletters y'all follow?

Know any newsletters or creators that gives good, underrated IT advice? Maybe even some pro tips, basically something that makes me stand out?

https://redd.it/1pjnkow
@r_systemadmin

Built a VPN manager using pure wireguard and iptables (multi-node, fault-tolerant)

Blog

I built a full VPN management system for our internal infrastructure for my internship. The idea was to create a single, secure entry point into all private services without exposing anything to the public internet. Users authenticate with a pre-auth key, get their WireGuard configuration automatically, and the system handles the entire lifecycle of provisioning, routing, and restricting what each user can access.

The backend is written in Go and controls everything: generating keys, assigning IPs, applying firewall rules, adding and removing WireGuard peers, and managing role-based access. The VPN servers run with a strict iptables setup where nothing is allowed by default. Each user’s access is explicitly granted based on their role, and all forwarding rules are created dynamically.

The cluster itself runs in a high-availability layout with one master and multiple slave servers behind a virtual IP. Because the servers communicate through a WireGuard overlay instead of a physical LAN, normal failover mechanisms do not work. So the client takes responsibility for detecting which server is active and switches automatically.

I also added support for dynamic subnet advertisement and VPN-only ports, so new internal networks and restricted services can be exposed to the team instantly. The goal was to make the VPN the single gateway to everything private, while keeping the setup predictable and secure for the developers using it.

Read the blog and share your thoughts guys.

https://redd.it/1pjosnn
@r_systemadmin

Best junior system admin pathway

If you had to start from zero. No degree no certificate - where would you restart, timeline, and how would you reproach it all?

Catch is you have 1 year to land your that role. As a reminder, no it work experience and certs / volunteer work are your way in.



https://redd.it/1pjpsl9
@r_systemadmin

The AppStack Was Pirated.

In a previous role, I worked for a large healthcare company running a VMware Horizon non-persistent VDI environment.

If you’ve ever managed Horizon in a healthcare setting, you already know how “fun” that combination can be – duplicate sessions, pool unavailability, network issues, and the constant battle of keeping clinical staff happy without breaking anything.

VMware Horizon in Prod

Our setup was pretty complex: Windows 10 virtual desktops, a stack of AppVolumes packages, and a plethora of departmental customizations sprinkled across different user groups.

Most users lived their entire day inside a session that was completely wiped the moment they logged off. Everything they needed had to come from Network storage, logon noscripts, or an attached AppStack.

One of those AppStacks was Adobe Acrobat.
In fact, we had four different versions of Adobe Acrobat:

# How did we handle licensing?

We had a poorly documented process for each:

Adobe Reader free – the standard version of Adobe that all users got by default. No purchase/approval needed.
Adobe Acrobat Standard DC – subnoscription-based, assigned only to admin or power users who actually needed editing capabilities. We’d raise a ticket to procurement who would buy a license in the Adobe portal, and we’d make the user an Adobe Account and assign the license \+ appstack.
Adobe Acrobat Pro – subnoscription-based, used by executives and operational teams. We would pass these straight to our procurement team, they’d then purchase a license and assign it through an internal system, [then pass the ticket back](https://blog.chrispro.live/wp-content/uploads/2025/12/image-8-768x512.png) so we can update the users appstack.
Adobe Acrobat 2017 – perpetually licensed version that some operational teams used, because they had old licenses for it. We’d keep the licenses attached to tickets within our ITSM system, which made them easy to find – yeah…

# What went wrong?

Well, it all started on a Monday morning when I came into the office and saw an influx of tickets regarding Adobe being “broken”.

It turns out, our VDI guys had pushed new appstacks for Adobe Reader/Standard, updating them to the latest version – which had quite a different user interface from what they were used to.

Not much was actually broken, users just saw the app looking a bit different and got scared, the only real issue was that one of the PDF editing tools wouldn’t load correctly because it relied on a DLL or something that was omitted from the appstack.

So we got that sorted and thought all was well, but then we started to see some more tickets come in, from all over the business, about a licensing error.

Huh, nothing changed with licensing, what’s going on here?

# Where did our licenses go?

So it turns out that alongside Adobe Reader and Standard, Adobe Pro was updated as well.

Normally, this would be fine, however it revealed something rather scary, nobody knows where the Adobe Pro licenses for all of these users are, we only have the tickets with approvals from our procurement team, so we asked them about it.

>Oh, we have no action needed on our end for these, we just review the request and assign back to you guys for the technical work.

Well, that tells us exactly what I was afraid of, we had dozens of users without valid licenses for Adobe Pro, and they need it now.

And so began a procurement spree, getting a list of users that need Adobe Pro and actually buying licenses this time.

# Our packaging guy had a well-kept secret

The guy that actually packaged all our apps, for both VDI and non-VDI, was an older gentleman, who very much wanted to

retire, but he was just “too good” at what he did.

Arthur, was our (illustrative purposes only) app packaging engineer.

I had a chat with him after we figured out what the issue was, and he told me that the Adobe Pro appstack was basically built for 2 specific VIP’s in the company.

I let him know that there were about 50 users in it right now, and he proceeded to get very pissed off at us/SD.

In the end, someone from management got through to him, and found out that Adobe’s DRM had been bypassed when appstacking Adobe Pro – meaning we were effectively running a pirated Appstack for months.

# Well, that was fun.

Yep, the business sort of turned this into a bit of a cost-saving opportunity as well.

None of the managers wanted to use their IT budgets on this issue so we were advised to only procure a license if someone explicitly raised a ticket about it.

In the end, everyone already hated VDI, and we had a bad reputation because of it – so it didn’t really impact us all that badly.

Adobe, if you are reading this, know 2 things:

Our company paid for licenses immediately after identifying the issue.
I no longer work for this company, you could probably find out where I worked pretty easily, but know this issue was years ago, and I was just in a standard L2 role, not at all in a position where I could be accountable for this.

Hope you enjoyed!

https://redd.it/1pjrwbu
@r_systemadmin

what is the best heatmap tool for a beginner?

so i’m trying to get a better understanding of how users interact with my website, and i’ve heard heatmaps are a good way to visualize all that. i’ve never used one before, but i’m really interested in seeing where people click the most, how far they scroll, etc. i’ve done some research and there are a ton of options out there, but i’m not sure which one’s worth the investment.

i’m looking for something that’s fairly easy to set up and doesn’t require too much of a learning curve, since i’m not super techy. also, i’m on a bit of a budget, so if there are good options that aren’t too pricey, that’d be a bonus.

a few things i’m wondering:

* are heatmap tools pretty accurate, or should i be using them alongside other analytics to get a fuller picture?
* do the free versions of heatmap tools actually give you enough data, or is it worth it to pay for a more robust plan?
* if you’ve used any heatmap tools for your website, which one has been the easiest to use and most helpful?

i’ve heard about a few like hotjar and crazy egg, but not sure if there are better alternatives out there. looking forward to hearing what you guys think

https://redd.it/1pjpnoq
@r_systemadmin

Thickheaded Thursday - December 11, 2025

Howdy, /r/sysadmin!

It's that time of the week, Thickheaded Thursday! This is a safe (mostly) judgement-free environment for all of your questions and stories, no matter how silly you think they are. Anybody can answer questions! My name is AutoModerator and I've taken over responsibility for posting these weekly threads so you don't have to worry about anything except your comments!

https://redd.it/1pjtu3w
@r_systemadmin

How I nuked the network at a small gaming facility with one line.

[There was a post requesting horror stories from helpdesk and my story was swept away by a sea of comments, please enjoy.\]

There was a general data segment for most of the computers at a small gaming facility i worked for before we granulized our segmentation. On this data segment you could find the computers for all of the departments and the POS up front. Printers, servers, switches, ATMs, gaming machines, phones, cameras and a few other devices were excluded from this segment and had their own. The departments affected were generally security, surveillance, cashier cage service counter, player club service counter, food services, counting room, gaming inspection, slot mgmt, tables mgmt, operations mgmt, facilities mgmt, custodial services, receiving and IT helpdesk.

Some context, the previous IT administrators were actually an outside consulting firm that came out and did IT work for both sites. Needless to say, they were great at talking up large goals for infrastructure change and development, and had absolutely zero follow through, ending up in a spaghettified network full of crap configurations, SPOFs, and general lack of foresight and ability. Only the main-site gaming facility a few cities away had a de facto network administrator, an overworked sysadmin who managed basically every application and server and the network configuration cleanup after that firm was terminated. The company would not approve a network technician for the off-site smaller gaming facility only a couple years after parting with that disaster.

I was working on helpdesk and was a fairly new unofficial off-site network technician working with approval and under the discretion of the main-site IT director. I was working on organizing and relabeling the IDF cables with verbally approved minimal downtimes for each endpoint, manually clearing out bad switch configuration lines and replacing them with our preferred agreed upon configurations, and in general documenting the wild frontier we were stuck with. These were the first major change these switches had seen in years, and it was clear that they had been manually configured at different times with different intents. Many also had common bad practices security holes that are easily fixed with a line or two. At this point too the IT budget was abysmal so there was no good remote management solution aside from the singular SecureCRT license afforded to the department, or custom PuTTY configs shared amongst us.

Well, one unlucky day on the gaming floor working on one unlucky access switch in particular, i was clearing the vlan database of unused entries. At this point, I was new and self-taught mostly alone, and I was unaware of a certain unpopular protocol that would be my ultimate doom. Did i mention our enterprise was Cisco? well, i was just getting started and picked the first vlan to clear - the data vlan. On this access switch, for its purposes of connecting slot machines back to the distribution layer, it did not need this one. So i simply did my thing as i had on a few other switches beforehand, getting the hang of it, and entered the command “no vlan <num>” and saved. I didn’t notice any immediate change. I didn’t even notice my Wi-fi went.

Away from me all around the gaming facility, departments erupted into chaos. Although the slot machines kept going so the patrons were mostly unphased, all the customer-facing service counters, the point of sales, the back of house, security and surveillance, gaming operations, even our helpdesk lost network connectivity. The phones worked. And i soon found out so did everyone’s legs and voices, as the IT office was swarmed a few moments after my return. I assured everyone I would look into the issue and get it resolved immediately, and I called up the IT director, who at this time was the best network engineer I knew with 20 years of experience, and I explained what happened and what I had been doing.

He instructed me to go to core switch at our site and manually connect to

it, and check the VLAN database. Checking, I found that the entry for data vlan <num> was missing from the core switch. He instructed me to put it back and once I did and saved the config, everything came back up. He informed me that I had fallen prey to the aforementioned consulting firm’s sloppy management practices. They had VTP still on site-wide, and even worse was that some of the access-layer switches were in server mode. What I had so innocuously done from the access switch on the gaming floor brought down pretty much the whole site in a moment. Luckily the core switch was also in server mode, so once I put it back the change was basically undone. At that point we made it a policy to never allow VTP on the network.

Morals of the story/tldr

1. ⁠unnamed consulting firm sucks.

2. ⁠VTP bad.

3. ⁠trial by fire is the best way to learn.

4. ⁠thanks for not firing employees for mistakes like this.

https://redd.it/1pjtn4g
@r_systemadmin

Reset KRBTGT Key - Which noscript

Hi!


I want to reset the KRBTGT-password on an old domain. There are so many noscripts and manuals out there - which one would you recommend?


This one here did not get any updates since 2020:

https://github.com/microsoftarchive/New-KrbtgtKeys.ps1/blob/master/New-KrbtgtKeys.ps1


This one is newer, but not the "Microsoft-one":

https://github.com/zjorz/Public-AD-Scripts/blob/master/Reset-KrbTgt-Password-For-RWDCs-And-RODCs.ps1


Best wishes

https://redd.it/1pjuy61
@r_systemadmin

Windows Admin Center 2511 generally available

Microsoft announced the release of Windows Admin Center 2511

https://techcommunity.microsoft.com/blog/windows-admin-center-blog/windows-admin-center-version-2511-is-now-generally-available/4477048



https://redd.it/1pjvzk8
@r_systemadmin

Windows server ignores primary DNS, only queries secondary

Strange situation, at least to me.

A Windows Server 2019 has primary DNS set to the DC (which also has DNS role) and secondary DNS to a public DNS provider.

Now this server in question doesn't resolve any name that the primary DNS could answer for, because apparently it only queries the secondary DNS.

So for example

nslookup windows.domain

states that the secondary DNS has been queried and couldn't resolve the query.

If I however do

nslookup windows.domain IP.OF.PRIMARY.DNS

so that I force nslookup to query the primary DNS, then it will resolve just fine.

So apparently the server can reach the primary DNS without problems and the primary DNS would also resolve queries for the server without problems.

Still the server choses to only use the secondary DNS and ignores the primary DNS (unless I specifically force it to use the primary DNS when doing a nslookup).

Any idea how to troubleshoot this?

https://redd.it/1pjw1bn
@r_systemadmin

Server disappearing from Hyper-V

This morning a bunch of our servers disappeared from Hyper-V. There was no security alerts from huntress so I don’t think there is anything malicious going on.

We had to restore them from Veeam and now everything is ok. Has anyone run into this before? I’m not sure to be worried or not lol.

How do I prevent this from happening again?

https://redd.it/1pjyyuk
@r_systemadmin

Anyone else noticing that vendor support doesn't read tickets these days?

Yesterday, a support case was submitted to a certain Cloud AP Controller company. Can can put my APs on a certain firmware in their old portal, but their new one throws a specific error suggesting they need to enable that feature for me. So, I put in the details necessary so that they can just press the buttons they need to press on their end to enable a feature, or tell me what I need to do to make it work on my own - though Google Fu has me thinking it's the former.

Case arrives with the first technician and they basically reply: "Hello. Can you please provide details of the problem?"
In fairness, this case was opened as a courtesy by another tech after we resolved a different problem, and maybe they didn't relay all the info. So I go back to that email, copy the contents and paste them into this new email.
Ticket is transferred to another tech.
"Hello. What seems to be the problem?"
Copy/paste
Ticket is transferred to another tech.
"Hello. Please share any troubleshooting you have done."
Copy/paste

Now, I'm waiting on a yet another reply, but this is starting to get really old, and it's not just this company. Truthfully, it seems only Cisco is capable of reading ticket history before asking me any questions.

https://redd.it/1pk1buu
@r_systemadmin

How often do you expire MFA tokens on mobile devices?

We recently migrated our O365 tenant into our parent company. Their cybersecurity posture is much more strict than ours was previously. I now have execs complaining that they have to log into their email/calendar/teams on their phone every 7 days. I'm told this was a compromise because the standard is every 24 hours (mine is every 24 hours since i have a privileged account).

Is this true? Are you making people log into their office applications on their phones every day?

I feel like the MFA fatigue is setting in and people are starting to just respond to any prompt they see now since they get them all the time.

https://redd.it/1pk1zsv
@r_systemadmin

What's the biggest outage you caused?

I'll start.

Job 1: At a college, took down the student management systems in the middle of class enrollment. 15,000 students.

Job 2: Took down the HR systems in the middle of open enrollment. Thankfully it was back up inside of 10 minutes. 45,000 employees.

I sense a theme...

To be fair though, job 2's outage I and others honestly thought what I was doing would not have caused an outage. We even told our contact in HR "just in case". Job 1 was a "oops, wrong window" scenario.

https://redd.it/1pk274p
@r_systemadmin

Those out there that still use/capture golden images for deployments... How do you handle updating of the golden image?

As the noscript suggests... I'm mostly asking about how to handle the golden image. You only get 4 SYSPREPs so how often and/or what do you do? It's been ages and we had too many "different" systems to do it properly so we just had one image per system type and we would just run updates after imaging which back then still cut tons of time off just having software pre-installed etc.

I believe technically I could do this:

1. Create my image
2. Clone it, set aside
3. SYSPREP image
4. GRAB the SYSPREPed image and deploy that
5. When Time comes to update the image, use Step 2 and start at Step 1 again, always keeping a 0 count SYSPREP image that I am working off of.

This also ensures that its the same drivers from the jump etc.

https://redd.it/1pk3f22
@r_systemadmin

LDAPS with Microsoft AD CS: Should applications trust Root CA or Intermediate CA?

Hi,


Let’s assume I need to configure LDAPS for an application, and a certificate is required for this purpose.
We are using a Microsoft two-tier Certificate Authority infrastructure.
On the Domain Controllers, the Kerberos Authentication certificate template is used for LDAPS.

My question is: Which certificate should be used on the application side in this scenario?

Additionally, for applications or appliances, should the Root CA certificate or the Intermediate CA certificate be used?

https://redd.it/1pk7dv0
@r_systemadmin

Free Windows post-install noscript generator for reproducible setups (+100 apps, configs, debloat)

I maintain a reproducible Windows post-install noscript.
It uses batch and bash for faster, drift-free provisioning.

Eventually, I packaged it into a public, free generator so teams and individuals can export their
own standardized .bat noscript without editing anything.

The generated noscript handles:

• 100+ application installs (winget-based)
• Performance defaults & tuning
• Privacy/telemetry settings
• Explorer/taskbar/UI configuration
• Optional bloatware removal
• Reversible changes
• Zero dependencies — just run the .bat on a fresh Windows install
• Generator runs entirely client-side

It’s not meant to replace enterprise tools like MDT/Intune, but for small teams, home labs, or
personal reproducible setups, it works surprisingly well.

How do you automate turning a fresh Windows image into a usable machine? Is there anything else you’d like to add?

Tool: https://kaic.me/win-post-install/
GitHub: https://github.com/kaic/win-post-install

https://redd.it/1pk8sds
@r_systemadmin