Found out an employee is on OF from MS Defender

I thought I have seen it all until the other day.

I found out an employee is on OF from reviewing the spam/phising email reports.

An employee reported an email from Onlyfans as phising.

Subject: A new login on your Onlyfans account
DMARC: Pass
MS Defender Checks: No threats found
To: employee@company dot com
From: noreply@onlyfans dot com

Craziest part is no one would have ever known if he didn't report that email as phising. I kindly marked it as "No threats found" lol

Has anyone seen anything crazier than this?

https://redd.it/1pooa3l
@r_systemadmin

KnowBe4 alternatives

We’re looking at refreshing our security awareness setup and KnowBe4 keeps coming up just because it’s the familiar name, but I’m trying to get a better sense of what else is actually working for people. I’m mostly interested in tools that feel realistic in day to day use, keep users engaged without burning them out and don’t require constant handholding to get useful reporting out of them. If you’ve moved away from KnowBe4 or tested other platforms how did they hold up in a real environment?

https://redd.it/1povudy
@r_systemadmin

What is the best way to monitor browser risks (extensions, data exfil) without crossing into invasive surveillance?

In environments with remote/hybrid teams on Windows/Chrome/Edge, how to handle the growing risks from unauthorized browser extensions and potential data leaks (e.g., sensitive info posted to external domains or copied into shady AI tools)?

Specifically looking for approaches that provide event-level visibility/alerting...things like:

* Detecting extension installs
* Flagging uploads or POSTs to non-approved domains
* Blocking or alerting on high-risk browser activity

...but without resorting to full surveillance tactics like keystroke logging, screen recording, or constant session monitoring.

https://redd.it/1povgo7
@r_systemadmin

Why are internal/business applications so far behind public applications in terms of user experience?

I work in system implementation, and have been directly involved with SAP, Oracle, and Siemens Teamcenter transformations, and have been a stakeholder for MS Dynamics, Salesforce, and similar transformations.

One of my biggest continuing complaints is how bad the user interface/experience is for these tools, especially those that aren’t customer facing. Teamcenter, for instance, is incredibly unintuitive to new users and is prone to long loading times; Oracle is a bit more user friendly, but still looks like it was built in 2003 out of the box and its OOTB reporting is stuck in 1994.

So what is it that’s driving this? Is it a lack of investment in UX by the creators? Lack of investment from my employers when planning their implementations? Or simply a byproduct of the highly customizable nature of this kind of application? All 3? None of the above?

https://redd.it/1poyaxy
@r_systemadmin

Looking for a way how to block AI mode in Google Search?

Hi everyone,
i am seeing in most of educational settings, students are relying on Google Search’s AI Mode to get instant summaries instead of doing proper research. While AI Mode provides quick answers, it can contain inaccuracies and may lead students to copy content without verifying it. This reduces critical thinking and research skills.

Has anyone successfully disabled AI Mode in Google Search for students?

https://redd.it/1poz954
@r_systemadmin

Is a bachelors degree in Information Systems still worth it?

Hello, i am a 27 year old struggling between going back to school to finish my bachelors in information systems or getting into the trades for electrician. For context i have roughly 1.5 years left of classes to finish. I took a 2 year break and need to make a decision now.

I know the market is saturated with people trying to get IT jobs and outsourcing. I would have about 14k of school debt when i finish. By that time i could be making decent money as an electrician.

For anyone in IT do you still recommend going into this field?

Any regrets?

Thanks.

https://redd.it/1pp0fok
@r_systemadmin

W365 - 24H2/25H2 - Performance hit

We have several hundred Windows 365 CPCs across different customers. In the majority of cases, they run 2CPU, 8GB, 128GB - and workloads are M365, Edge and a couple of Line of Business apps.

When these were 22H2/23H2, the performance was reasonable. Not mind-blowing, but for your average knowledge-worker, it was fine.

Since 24H2/25H2, poor performance is increasingly becoming one of our top support tickets.

Upgrading to 16GB alleviates much of the issues, but it's quite a costly jump for several hundred systems.

I know 8GB is not great with W11 - but it *was* functional.

I'm debating A/B testing a 25H2 gallery image with WDOT, with/without our security tools, etc. Equally, dropping it - and using ZTNA/Global Secure Access and long-lining into Azure instead.

I'm interested in other people's recent experiences. W365 started out great for us and our clients, but it's increasingly becoming a pain in the arse.

https://redd.it/1pp5d0k
@r_systemadmin

ISP Line termination

I was planning to switch ISPs for my organization in lower Manhattan. Everything was set until the new ISP told me they would only connect to the building’s phone closet on the 4th floor. To run a line up to our floor (24th), they said it would cost an extra $4,000.

We don’t change ISPs often, but I honestly don’t remember ever having to pay extra just to get the line into our network room. Am I forgetting something, or does that seem excessive

https://redd.it/1pp5mx9
@r_systemadmin

Windows 11 Settings Menu Will Not Launch

Omnissa Horizon VDI Environment
Windows 11 25H2

Over the past several months, I have run into a number of users who cannot open the settings menu for some reason. After they click the icon, you can see the window with the cog in the center pop up but then it disappears before moving any further. If you search for specific settings and click the option in search, those do not launch either.


If I have the user log out and I log in as myself (non-admin/elevated creds), I am able to launch settings without issue. Once the user logs back in, the issue is resolved for them. A normal reboot/logout does NOT resolve the problem. Another user must log in and launch settings to fix the problem.


I've done some googling without much success. All the recommendations suggest running sfc /scannow, which does not resolve the problem in my case. I've also seen several other reddit threads on the issue, so it seems to be a somewhat common one, but in those cases it's usually a single person having the issue, not someone who has seen it in an enterprise environment.


Has anyone else seen this issue? Did you find a fix that doesn't involve logging in as another user? If this were one or two cases, I probably wouldn't care enough to post about it, but I've seen it enough that it has become a serious annoyance.


All of my systems get the same set of policies, so I do not believe it's related to any weirdness there.

https://redd.it/1pp4hge
@r_systemadmin

Windows failover cluster setup questions.

We are going to deploy a 3 node Windows server 2025 failover cluster for VMs and file shares on HCI hardware. I read that Scale-out file server (SOFS) role is not needed in Hyperconverged deployment. But then there is also reference about enabling SOFS in Hypercoverged setup. Are they for specific setup? For the file shares, should we enable the general File server role on the host instead of using the VM for file sharing to avoid overhead? Thanks

https://redd.it/1ppbpuc
@r_systemadmin

Docusign Question

My employer is implementing basic Docusign for its Procurement Department. The end users need to be able to:

(1) send a document to supplier for signature, (2) have the supplier sign, and
(3) countersign and download the fully executed document WITHOUT it being sent back to the supplier.

This is because the fully executed document is then attached to a PO in my employer’s ERP, and only released when the PO is approved.

Is anyone aware of a workaround to get this outcome? Looking for a solution that is workable on the most basic version of Docusign.

Thanks!

https://redd.it/1pp6ijh
@r_systemadmin

You disabled NTLM across all of your workstations. What problems did you not account for?

Disabling NTLM across all workstations has been added to 2026 roadmap, and I have been doing some research on potential impact.

In our case, out of 1000 workstations, only 10 might be impacted due to legacy processes/workflow. Business will be addressing those so nothing for IT to worry about there.

Windows 11, Entra joined, no on-prem, no hybrid. Reviewing past 30 days of logs shows NTLM being used on those 10 workstations only.

A bit shocked, I thought this would be more cumbersome to prep for, so I must be missing something.

Did you disabled NTLM? What did you miss so I don’t have to?

https://redd.it/1ppeuhv
@r_systemadmin

In your organization, who is the authority that decides what gets posted in your SPF record?

In your organization, who decides what gets to send email as your organization?

We are limited to 10 records in a domain's SPF record. Let's say 9 of your slots are used and there is 1 left, who makes the judgement call on using that last available record?

What happens if there is a future ask/need to allow yet another application/vendor send email on your behalf?

Just curious. Is it the team that manages Exchange? The team that manages DNS? Infrastructure Team? InfoSec Team? A CISO? The jack of all trades that's carrying IT?


https://redd.it/1ppe0d6
@r_systemadmin

I’m burnt-out

I’m slowly realizing that there’s a leadership/management/culture issue at work because my coworker, whose supposed to have shared responsibilities as me, isn’t even doing half his work, so a majority of it falls on me. And has been falling on me, for months.

I “spoke up” for myself, already, this past late spring and was given a near 10% salary increase, but that feeling of dread is creeping up on me again, and I don’t think any pay increase is going to shake it off. It’s obviously the dynamic.

I think I need a separation from this coworker. I can work with the most difficult person, easily, but I cannot work with someone who doesn’t even do their work.

I’ve been talking to my manager about “change” amongst us for the last 2 months, but it doesn’t sound promising or enthusiastic because my manager isn’t bringing any ideas to the table.

I told him that I’d wish they’d promote my coworker to some other area, to slack off over there, while I can do my thing and train someone that actually wants to work, collaborate, and work as a team. I just don’t have that with my current coworker, and after nearly 3 years of this, I know that it’s never going to happen.

Edit: also, before anyone says, “bring it up to your manager” - it’s not necessarily professional for me to criticize my coworker’s performance because that’s not under my role and/or functions of my job. That’s up for my manager to do, and that’s wherein the problem remains. If my manager can’t acknowledge his shortcomings, they’re going to eventually promote this guy to leadership/management and make this org a true shitshow. If that happened anytime soon, I would easily be looking for my exit plan because he is not leader material (at least not from what I’ve seen)

https://redd.it/1ppi42x
@r_systemadmin

Degree vs. Experience: Which would you rather have?

I’m currently in a position where I have the noscript and the experience, but no degree. I’m curious about the trade-off in today’s market.

* Which candidate is more valuable long-term?
* Does the degree eventually "expire" if there's no experience to back it up?
* For those who took the experience-only route, have you hit a ceiling?

https://redd.it/1ppgy2n
@r_systemadmin

Thickheaded Thursday - December 18, 2025

Howdy, /r/sysadmin!

It's that time of the week, Thickheaded Thursday! This is a safe (mostly) judgement-free environment for all of your questions and stories, no matter how silly you think they are. Anybody can answer questions! My name is AutoModerator and I've taken over responsibility for posting these weekly threads so you don't have to worry about anything except your comments!

https://redd.it/1ppn4n8
@r_systemadmin

Refurbished vs new networking gear in 2025?

With budgets tight, I’ve been looking at used switches and routers like Juniper and Arista. Has the used market gotten better in terms of reliability and support, or is it still risky?



https://redd.it/1ppo25k
@r_systemadmin

Microsoft has finally added a native tenant-to-tenant migration option in M365.

It’s honestly something that should’ve existed years ago.

With this update, we can move:

* Exchange Online mailboxes
* OneDrive data
* Teams chats and meetings

between tenants directly.

Curious how well it handles real-world scenarios like coexistence, staged migrations, and post-move cleanup. Has anyone here started testing it yet, or planning to use it in a real M&A scenario?

https://redd.it/1ppmraq
@r_systemadmin

Windows keeps autodestructing ... i'm so fed up with it.

I'm so tired of it all ...
I used DOS as a kid, it had many issues, everything was manual but once it was set up it was all good.
Fast forward to windows 11, this thing keeps killing itself.
My work PC is online 24/7 and reboots every week or so. As an admin i only install what i need at the start when i installed my pc, nothing more, nothing less.
But the last few months/year nothing changes on my pc softwarewise except for the inevitable windows updates.
Lately it keeps having issues, start menu not working, search in start not reacting or reacting after a minute, network settings menu crashes the settings app, Windows update suddenly can't even search for updates etc ...

Now it happened AGAIN, it keeps indicating it can't download updates (not even search for them without an error.)
I tried the troubleshooting tool ... it's an online application now and ofcourse it cannot even launch that.
Now i'm running the usual stuff, SFC, DISM etc. and sure enough, files corrupt, component store corrupt.

How on earth does a computer that ONLY does it's windows updates keep having issues so much.

I checked the disk for actual errors but the disk is 100% ok.

I have another laptop here, similar issues. I reinstalled it from a fresh windows 11 25H2 image, it does everything, gets to the last step where it tells you to wait a bit, updates are applying and ... it just stays there.

Our internal exchange server (hybrid setup) bricked itself after normal windows updates, rolling them back didn't work, now we had to reinstall it completely.

I feel like nothing works correctly anymore lately and it's sucking the soul out of me.
I started working on MAC and Linux at home and both have their issues but on MAC a reinstall (if needed) takes 15 minutes and all is ready, same on linux.
On windows it can take an eternity.

I know it's a rant but i feel MS really dropped the ball and only care about this stupid AI stuff.
God i hate today's trend of shoving AI down your throat by any means necessary but neglecting just about anything else.

Cheers.

https://redd.it/1pppkwv
@r_systemadmin

You can now lock Windows 11 from Android remotely, send files to PC, share clipboard, mirror screen, and more...

I mean... did MS go to DEF CON and ask "What can we do to make this easier for you?"



https://redd.it/1ppq5d1
@r_systemadmin

How to Prevent IT approval Workflows from getting Stuck or lost in the shuffle?

I'm in a mid-sized IT team (around 100-200 users across the org), and we're constantly dealing with approval workflows that just... disappear. Whether it's access requests, change approvals, new software...
we tried some automated solutions but nothing really worked as there's no clear tracking when multi-level approvals are needed (e.g., manager + security + finance).

How to handle this to keep things moving?

What processes or setups ensure approvals don't get lost?
Any ways to improve tracking and escalations without constant manual follow-ups?

https://redd.it/1ppnqlw
@r_systemadmin