Reset KRBTGT Key - Which noscript

Hi!


I want to reset the KRBTGT-password on an old domain. There are so many noscripts and manuals out there - which one would you recommend?


This one here did not get any updates since 2020:

https://github.com/microsoftarchive/New-KrbtgtKeys.ps1/blob/master/New-KrbtgtKeys.ps1


This one is newer, but not the "Microsoft-one":

https://github.com/zjorz/Public-AD-Scripts/blob/master/Reset-KrbTgt-Password-For-RWDCs-And-RODCs.ps1


Best wishes

https://redd.it/1pjuy61
@r_systemadmin

Windows Admin Center 2511 generally available

Microsoft announced the release of Windows Admin Center 2511

https://techcommunity.microsoft.com/blog/windows-admin-center-blog/windows-admin-center-version-2511-is-now-generally-available/4477048



https://redd.it/1pjvzk8
@r_systemadmin

Windows server ignores primary DNS, only queries secondary

Strange situation, at least to me.

A Windows Server 2019 has primary DNS set to the DC (which also has DNS role) and secondary DNS to a public DNS provider.

Now this server in question doesn't resolve any name that the primary DNS could answer for, because apparently it only queries the secondary DNS.

So for example

nslookup windows.domain

states that the secondary DNS has been queried and couldn't resolve the query.

If I however do

nslookup windows.domain IP.OF.PRIMARY.DNS

so that I force nslookup to query the primary DNS, then it will resolve just fine.

So apparently the server can reach the primary DNS without problems and the primary DNS would also resolve queries for the server without problems.

Still the server choses to only use the secondary DNS and ignores the primary DNS (unless I specifically force it to use the primary DNS when doing a nslookup).

Any idea how to troubleshoot this?

https://redd.it/1pjw1bn
@r_systemadmin

Server disappearing from Hyper-V

This morning a bunch of our servers disappeared from Hyper-V. There was no security alerts from huntress so I don’t think there is anything malicious going on.

We had to restore them from Veeam and now everything is ok. Has anyone run into this before? I’m not sure to be worried or not lol.

How do I prevent this from happening again?

https://redd.it/1pjyyuk
@r_systemadmin

Anyone else noticing that vendor support doesn't read tickets these days?

Yesterday, a support case was submitted to a certain Cloud AP Controller company. Can can put my APs on a certain firmware in their old portal, but their new one throws a specific error suggesting they need to enable that feature for me. So, I put in the details necessary so that they can just press the buttons they need to press on their end to enable a feature, or tell me what I need to do to make it work on my own - though Google Fu has me thinking it's the former.

Case arrives with the first technician and they basically reply: "Hello. Can you please provide details of the problem?"
In fairness, this case was opened as a courtesy by another tech after we resolved a different problem, and maybe they didn't relay all the info. So I go back to that email, copy the contents and paste them into this new email.
Ticket is transferred to another tech.
"Hello. What seems to be the problem?"
Copy/paste
Ticket is transferred to another tech.
"Hello. Please share any troubleshooting you have done."
Copy/paste

Now, I'm waiting on a yet another reply, but this is starting to get really old, and it's not just this company. Truthfully, it seems only Cisco is capable of reading ticket history before asking me any questions.

https://redd.it/1pk1buu
@r_systemadmin

How often do you expire MFA tokens on mobile devices?

We recently migrated our O365 tenant into our parent company. Their cybersecurity posture is much more strict than ours was previously. I now have execs complaining that they have to log into their email/calendar/teams on their phone every 7 days. I'm told this was a compromise because the standard is every 24 hours (mine is every 24 hours since i have a privileged account).

Is this true? Are you making people log into their office applications on their phones every day?

I feel like the MFA fatigue is setting in and people are starting to just respond to any prompt they see now since they get them all the time.

https://redd.it/1pk1zsv
@r_systemadmin

What's the biggest outage you caused?

I'll start.

Job 1: At a college, took down the student management systems in the middle of class enrollment. 15,000 students.

Job 2: Took down the HR systems in the middle of open enrollment. Thankfully it was back up inside of 10 minutes. 45,000 employees.

I sense a theme...

To be fair though, job 2's outage I and others honestly thought what I was doing would not have caused an outage. We even told our contact in HR "just in case". Job 1 was a "oops, wrong window" scenario.

https://redd.it/1pk274p
@r_systemadmin

Those out there that still use/capture golden images for deployments... How do you handle updating of the golden image?

As the noscript suggests... I'm mostly asking about how to handle the golden image. You only get 4 SYSPREPs so how often and/or what do you do? It's been ages and we had too many "different" systems to do it properly so we just had one image per system type and we would just run updates after imaging which back then still cut tons of time off just having software pre-installed etc.

I believe technically I could do this:

1. Create my image
2. Clone it, set aside
3. SYSPREP image
4. GRAB the SYSPREPed image and deploy that
5. When Time comes to update the image, use Step 2 and start at Step 1 again, always keeping a 0 count SYSPREP image that I am working off of.

This also ensures that its the same drivers from the jump etc.

https://redd.it/1pk3f22
@r_systemadmin

LDAPS with Microsoft AD CS: Should applications trust Root CA or Intermediate CA?

Hi,


Let’s assume I need to configure LDAPS for an application, and a certificate is required for this purpose.
We are using a Microsoft two-tier Certificate Authority infrastructure.
On the Domain Controllers, the Kerberos Authentication certificate template is used for LDAPS.

My question is: Which certificate should be used on the application side in this scenario?

Additionally, for applications or appliances, should the Root CA certificate or the Intermediate CA certificate be used?

https://redd.it/1pk7dv0
@r_systemadmin

Free Windows post-install noscript generator for reproducible setups (+100 apps, configs, debloat)

I maintain a reproducible Windows post-install noscript.
It uses batch and bash for faster, drift-free provisioning.

Eventually, I packaged it into a public, free generator so teams and individuals can export their
own standardized .bat noscript without editing anything.

The generated noscript handles:

• 100+ application installs (winget-based)
• Performance defaults & tuning
• Privacy/telemetry settings
• Explorer/taskbar/UI configuration
• Optional bloatware removal
• Reversible changes
• Zero dependencies — just run the .bat on a fresh Windows install
• Generator runs entirely client-side

It’s not meant to replace enterprise tools like MDT/Intune, but for small teams, home labs, or
personal reproducible setups, it works surprisingly well.

How do you automate turning a fresh Windows image into a usable machine? Is there anything else you’d like to add?

Tool: https://kaic.me/win-post-install/
GitHub: https://github.com/kaic/win-post-install

https://redd.it/1pk8sds
@r_systemadmin

Urgent: Important Security Update for ScreenConnect (Email sent out on December 11, 2025 at 14:46 GMT)

Dear Partner,

ConnectWise has issued a Security Bulletin on our Trust Center regarding a security update for ScreenConnect™ versions prior to 25.8.

This update addresses issues that, under specific conditions, could expose configuration data or allow authorized or administrative users to upload untrusted extensions. The ScreenConnect™ 25.8 patch includes enhancements to how ScreenConnect manages and validates extensions to ensure that only trusted components can be installed.

We strongly recommend that all partners: Upgrade to ScreenConnect™ version 25.8 as soon as possible. Cloud-hosted ScreenConnect instances have already been updated to the latest release. ScreenConnect On-prem partners will need to update manually to 25.8. Visit Download | ScreenConnect page to download and apply the update (access requires a valid on-premises license). If your license is out of maintenance, you must upgrade your license before installing the latest supported release of ScreenConnect.   For instructions on updating to the newest release, please reference this doc: Upgrade an on-premise installation - ConnectWise  Automate partners with a ScreenConnect integration should verify that their Automate ScreenConnect Extension is updated to version 4.4.0.16 before upgrading to ScreenConnect 25.8. Once the extension is confirmed, partners can visit the Automate Product Updates page to download and apply the ScreenConnect 25.8 update. For instructions on updating to the newest release, please reference this doc: Upgrade an on-premise installation - ConnectWise  Link to release notes: ScreenConnect release notes - ConnectWise Review the Security Bulletin for additional details. For help with upgrading visit ConnectWise Chat to open a case or email help@connectwise.com for additional support.

ConnectWise Security Bulletin Please refer to the Security Bulletin posted to our Trust Center regarding this vulnerability for more detailed information.    

Stay informed  We are committed to transparency and will keep you informed of any further developments. For real-time updates, please subscribe to the ConnectWise security bulletin RSS feed.  

Report a security incident  To report a security or privacy incident, please visit the ConnectWise Trust Center.  

We appreciate your continued partnership and trust in our products and services.    

Thank you,  ScreenConnect Team 

https://redd.it/1pka0f9
@r_systemadmin

Do you enjoy your job?

With all the “I’m burnt out” notions going around in tech, is there any positivity to go with this?

Are you able to work from home if you choose? Can you go into the office jf you choose?

Do you clock in at 9 and out by 5? Or are you on call?

Do you feel you have job security or always on edge?

Is AI going to be the I ROBOT sequel and take over our roles?

Now I hope this doesn’t turn into another IT hate thread, aiming for some good vibes

https://redd.it/1pkaaah
@r_systemadmin

Large company culture

So I took a senior admin job with a large company. Over 10k employees and a worldwide place etc.

Well, so far ive been there a month and am not really happy. Let me explain.

1. Keep being treated as if im new to IT. No access to half of the systems I need to work with.

2. Gatekeeping team. "Oh, well only bill does that. If you get a ticket on it just re assign. No we cant give you access to x systems.

3. Given 0 projects. 0 tickets. Month in. Literally today someone told me I could grab a ticket if I wanted. The tickets I can actually do with the access I have would be stupid things like expand a disk or add someone to a group.

4. Teams for every little thing. There is an o365 team. An iam/sso team. Phones team. Helpdesk line team. Desk side team. Network team. Security team. Ass wipe team. Piss team. You want to do anything nope... that's x team.

5. It doesnt make a difference if im there or not. Nothing is expected of me. No one cares how long your lunch is. Or when you start and stop.

6. Manager keeps saying how there is sooooo much work. OK where the fuck is it? Then im told they will get it going this week. Nope....

7. Im probably more experienced and capable at various things on my team yet im not allowed to even participate in any of it.

8. Again I was hired as a senior level admin making well over six figures and this company is completely wasting their money. I've never seen anything like this in my career. Im 40.

People who went to a big Corp after smaller or medium size places where you actually..... worked..... and fixed things.... does it get better? I hear some like and prefer this. I don't understand how you do? Im going to try to give it more time. One month is not enough. But I mean it feels like im going to end up being just a tier 3 helpdesk or some weird shit. Or like this is all an elaborate scam but my checks are still clearing.

https://redd.it/1pkd55q
@r_systemadmin

Reminder that AI can cause outages

Not an anti-AI post. I use it too. But I’ve now seen multiple cases where people blindly followed AI advice and it directly caused outages.

The core issue is simple: AI really wants to be helpful and sound correct. It does not like saying “I don’t know,” and it usually doesn’t lead with “this depends” or “check the vendor docs.” Instead, it gives very generic, confident-sounding answers that might apply… or might be completely wrong for your environment.

What I’m seeing lately is people using AI as a replacement for vendor documentation instead of a supplement. They’ll skip official docs because “AI already explained it” and then go change something in prod.

That’s how you end up breaking things.

AI doesn’t know: your firmware versions, your licensing, your exact product SKU, your vendor’s weird limitations, the 20-year-old legacy system someone put in place and never documented.

It just predicts an answer that sounds right.

Some patterns I’ve personally seen:
- generic registry or firewall changes applied without understanding side effects
- assumptions that features work the same across different vendors or versions
- config changes that directly contradict the vendor’s own “do not do this in production” notes
- people trusting AI output more than official documentation because it’s faster to read

AI is fine for:
- explaining what something does
- summarizing docs you already trust
- helping you think through risks
- sanity-checking an idea

AI is dangerous for:
- “tell me exactly what to change”
- “this is faster than reading the docs”
- production changes without validation

Treat AI like a junior admin who’s confident but doesn’t know your environment. Useful, but you still check their work.

Curious if others are starting to see this pop up too.

https://redd.it/1pke3mb
@r_systemadmin

The Server Was “Obstructed”

Another story from Healthcare IT, in a previous role of mine.

We were going through our regular maintenance tasks, and noticed an alert in Dell OpenManage about a failed CMOS battery for one of our clinic’s servers.

[that looks like this](https://www.experts-exchange.com/questions/29133977/The-system-board-battery-has-failed-on-DELL-Poweredge-T320.html).

For context:

* Each of our clinic locations had 2 HyperV servers, setup to replicate to each other every few minutes.
* One of the servers was generally fairly modern and powerful, while the other was whatever we could scrap together to run legacy clinic VM’s, and be a replication partner – so we could fail over to it if something went bad.
* Each clinic had zero onsite IT staff, and often the nearest IT person was an hour drive away, they also had really dated Network links – I’m talking 10-20Mbit (in 2022).
* In many cases, the hardware was 10+ years old and EoL, and the software usually was too, we had plenty of 2008R2 and 2012R2 hosts/VM’s out there, so things broke regularly – the business was well aware of the risks of this.

Anyway, because we had servers in so many locations, we contracted out an external vendor to complete our hands on server maintenance tasks, let’s call our vendor **Outeractive**.

So when we saw the server alert, we followed our usual process:

* Log the issue on our maintenance tasks board.
* Fail-over any virtual machines from the problematic host to the replica, outside hours (this needed a change request).
* Create a service request to **Outeractive** on the following day, who would usually provide an ETA.
* Contact the clinic manager to let them know someone would be coming in to access the server room.
* Respond to any calls from **Outeractive**, providing them directions to the clinic site if needed (yes, we actually had to do this).
* Shutdown the affected host as **Outeractive** arrive onsite (so we have the most up-to-date possible replicas).
* **Outeractive** replace the required part.
* We do a final health check, and then schedule to fail back over the VM’s outside hours again.

# So our vendor arrived onsite…

We received a call from **Outeractive** as they arrived and were about to start the work, all was going well, and we left them to it.

Then they called back 10 minutes later.

>We can’t access the server.

Huh, what do you mean you can’t access the server?
Do you need us to speak to the clinic manager for the key?

>No no, we physically can’t get to the server, it’s obstructed.

It should be in the rack, able to slide right out, can you send us a photo of what you mean?

>Yep

[https://imgur.com/ZdoOQGx](https://imgur.com/ZdoOQGx)

This photo got shared around the office pretty quickly, and is pretty funny now that I’m seeing it again.

So the server that **Outeractive** needed to get to was wedged in between the UPS and another server/shelf.

So the only way to get to it safely, would be to somehow suspend the newer server that’s above it, and then lift out the older server from underneath.

To be clear, this is the server **Outeractive** had to replace parts in, and they needed clear access to the side panel, not just the front or back.

[Here’s another image](https://imgur.com/7iwWHiT) of all this, but from the side, the server in the middle, is basically unable to be safely removed/reinstalled without impacting the server above it.

# What do we do next?

Well, the most important thing anyone in Healthcare IT will say to you, is that we can **never** lose patient/clinical data.

This made any further actions from our **Outeractive** technician extremely high risk, so we organized with him to reschedule, and attend the site ourselves.

# Why was it high risk for a vendor to touch?

Remember earlier when I said our clinics only have 10-20Mbit links? – Yep, that applies to this site, and limited our offsite backup capabilities, you should know:

* The live database for this entire \~15 staff clinic was running on the top server. The clinic is currently trying to operate, seeing patients,

updating records, billing people, etc.
* The latest backup (replication point) was on the server below it, with the bad CMOS battery.
* The 2nd latest backup was stored offsite, which would only have data from the previous day (since we can only backup nightly).
* If anything got unplugged right now, it would be an immediate interruption to the whole clinic, and if we needed to recover data it would be a minimum of 10 minutes of data loss. Our users will not tolerate this.

# We were sent onsite to handle it.

After a discussion with the Operations manager, it was agreed that myself and one of my beloved colleagues would head to the clinic ourselves after hours to “remediate the issue”.

This was also an opportunity to replace the UPS that was installed onsite, which for whatever reason didn’t have its battery connected.

Sidenote, our business loved to spend money replacing UPS’s for some reason, they were one of the few things we kept current.

We [grabbed a new UPS ](https://imgur.com/BurlthS)from nearby, as well as some cage nuts, a new rack shelf, screws, and anything else we might need.

It was getting dark by the time we reached the clinic, the carpark was empty, and it was just the clinic manager there waiting for us, so we started to unload our gear through the back door, and they headed home shortly after.

Inside the place felt a bit eerie, with the smell of disinfectant, the automatic front door randomly clicking to open from the wind and failing because it was locked, it was kind of surreal.

We were in the middle of this place, at like 7PM, on a Friday night, with nobody else around.

When we got to the server room, though, you could clearly see that someone opted to save renovation costs and kept the original wallpaper and flooring in there, the rest of the building looked much more modern.

My and my colleague were standing there, thinking about how to approach this, we had already shutdown the servers remotely on the road trip here.

We just kind of agreed, one of use would lift the top server while the other person screws in a new cantilever shelf.

So we eventually got the shelf in, and moved the modern server onto it, we had to place it vertically in the end because the rack was just too shallow.

We had to do a similar thing when removing the old UPS, since all the weight of the lower server was sitting on it.

We got the old UPS out, the new one installed, started to power everything on and things were looking good.

We, applied the new UPS config pretty quickly, updated the firmware, then tested a few clinic machines to make sure they could login to the practice software just fine, and print things.

That was about it, we just did some extra cable management to make sure that each server can be pulled out easily for maintenance, and we organized for **Outeractive** to come back.

# How did this happen in the first place?

That’s perhaps a better story for another time, but in short:

* We had basically 2 guys in the company that would build these clinic servers, 1 of which only ever worked from home, basically making it 1 guy for all the hardware installs.
* This individual, while rather talented, was what I can only describe as a bit mischievous, money-motivated, and funny (always in a dark way).

The story he told was that he went there to install the new server, and nothing else. There were issues with the rack, but not enough hardware nearby for him to properly fix them, and he just couldn’t be fazed.

In the end, this clinic location actually closed, after I left the company, so the servers were reused elsewhere.

Hope you enjoyed!

Sidenote, I'll be crossposting this in tales from tech support, but they don't allow images, which you kind of need here.

To mods: I've uploaded all images to imgur, instead of hosting them on my own webserver for this post.

Again, if people reckon this doesn't fit this sub, yell at me I guess and I'll find somewhere else to post, I just like seeing people share similar experiences here.

Edit: reddit keeps removing quoted

text

https://redd.it/1pkhny4
@r_systemadmin

Weekly 'I made a useful thing' Thread - December 12, 2025

There is a great deal of user-generated content out there, from noscripts and software to tutorials and videos, but we've generally tried to keep that off of the front page due to the volume and as a result of community feedback. There's also a great deal of content out there that violates our advertising/promotion rule, from noscripts and software to tutorials and videos.

We have received a number of requests for exemptions to the rule, and rather than allowing the front page to get consumed, we thought we'd try a weekly thread that allows for that kind of content. We don't have a catchy name for it yet, so please let us know if you have any ideas!

In this thread, feel free to show us your pet project, YouTube videos, blog posts, or whatever else you may have and share it with the community. Commercial advertisements, affiliate links, or links that appear to be monetization-grabs will still be removed.

https://redd.it/1pko7cm
@r_systemadmin

What are some of your favorite sysadmin tools/programs?

Some of my favorite tools are

- memtest86
- disk genius
- wiztree
- tcpview
- wireshark




https://redd.it/1pkn54e
@r_systemadmin

created a print server but everone else can add the printer?

yesterday i created a print server, i linked the GPO to my dept group and started adding specific departments based off the printer location, however all of the other computers can still see and add it if they click add device. They dont get automatically installed like the members ive added do, but they still see it as a shared network name.

how do i turn this off or prevent them from seeing it, we dont want the whole plant seeing a sales copier when its no where near them.

https://redd.it/1pkqeyu
@r_systemadmin

Graybeards i summon thee - Windows XP Remote Backup at scale

Hi there,

i'd need some input for quite an ancient problem.

I'm working at MSP and i have a particular customer that has about 15 machines (the likes of robots and cnc machines and stuff).

Currently we have an approach that's working but ultimately leaves me with a bad stomach everytime it's done:

the machines all have full fledged windows xp pro installations (no embeds) being able to alternatively boot into freedos. Currently the approach is to boot them into freedos twice a year, use norton ghost to dump cold backups onto the hard drive and carry the backups away with an usb stick.

Since this coming up soon (we do this usually on the last day before they close down for christmas) i came to wonder if there might be a better solution for this.

With all of the machines running on ide drives you can imagine that quite a lot of the drives failed already, and i had to restore those machines from the ghost backups that we did. So i'm at least confident that the current approach is working as intended.


But even though it's working as of now i think there might be a more elegant solution that can automate at least the backup process.

Furthermore even though i try to train new staff each time this comes up, i'm not as confident in younger people's skills to actually pull of the recovery if one of the drives fails again and i can hardly blame them. Those skills are basically useless nowadays and hardly transferable to other things one might do in todays day and age


We do have Veeam B&R and a branded carbonite backup agent for doing cloud backups.


I must confess that i never tried to backup a physical Windows XP via Veeam before (XP was going pretty much EOL by the time Veeam came to my attention so there never was reason for me to try).


If i were to configure this in my usual way, i'd create local admin accounts on the xp machines, create some firewall rules, create a protection group in Veeam, add all machines to that protection group and add a backup job for that protection group.

This way i could get daily backups (with monitoring via veeam) and at the same time get isos that i can use for bare metal recovery when the next ide drive dies. This would make the handling of the recovery process a lot easier for new/younger people since that is part of our basic training and quite foolproof compared to the ghost approach....


so, anyone got some input into that?


additionally:

the ide drive situation is really, really bad. Costumer sniped quite a few on ebay over the years and still has working (they're tested when we do the cold backups) 2,5 and 3,5 drives as backups. But ultimately this is a lost battle. I have made some bad expiriences with ide sata adapters so i've held off from actually migrating everything to sata drives

can someone shed light on possible problems using sata ssds --> sata ide adapter to run on old hardware? (Aside from things like, disable defrag and not having trim on Windows XP)

https://redd.it/1pkljub
@r_systemadmin