u/EducationAlert5209

Hi All,

We have a 10 file servers and 15 SQL servers, 70 Apps servers

We have a production subscription.

And planning to put any production servers over there.

SQL and Apps are for Dev/Sit so

Do we setup dev/test subscription?

Planning on lift and shift.

We have 50TB Archive files but need to access time to time. What is the solution for that?

Hi All,

We're looking for some advice on the best way to structure our situation.

We own a few investment properties, but they're becoming increasingly difficult to hold due to rising principal and interest repayments and land tax.

One of the properties was our principal place of residence for 22 years. We moved into our current home about three years ago. That property is now valued at approximately $1.8 million with an outstanding loan of $280,000.

We're considering transferring this property to our elder daughter. Based on her income, she should be able to obtain a loan of around $650,000.

What would be the most suitable and tax-effective approach to achieve this? We'd appreciate advice on the potential implications, including capital gains tax, stamp duty, refinancing, and whether there are better options to help her acquire the property while minimising costs for the family.

Thank you in advance for any guidance or experiences you can share.

Hi We are trying to inplace upgrade 2016 to 2025 OS.

This is only server for the hybrid sync and IAM process.

If I paused and upgrade will that sync back or any better options?

Hi Team,

We have 8 sites and 2 Data centres.

We are replacing 2016 DC's to 2025.

SDC and one of the Branch Site DC cannot replicate.

Ping is blocked but all the AD ports are allowed in both ends.

Network is hardened but they cannot see any blocking.

Port 135 and dynamic Port range allowed. But still getting RPC errors

Hi All,

I'd appreciate some opinions from those with experience in property investing.

We have an investment property in South East Melbourne. It's an older 3-bedroom house currently valued at around $1.1M–$1.2M. We purchased it in 2011 for $480,000, and it's currently rented for $575 per week.

Here are the numbers:

Current loan: $567,000

Annual rental income: ~$22,000

Annual expenses: ~$50,000

Pre-tax loss: ~$28,000

After-tax loss: ~$20,000

We also own three other investment properties, and this property is attracting a significant amount of land tax.

If you were in this position, would you:

Keep holding the property for long-term capital growth?

Sell it now and redeploy the equity into a better-performing investment?

Or consider another strategy?

I'd really value hearing what others would do and whether you think this is a good time to sell.

Hi All,

I would like to get some advice and recommendations on the best approach for removing Domain Controllers (DCs) from our remote offices.

Our current environment:

Azure hybrid environment with on-premises Active Directory

10 remote offices and 2 data centres

All sites are connected via dual SD-WAN links (500 Mbps)

Office 1: ~800 users

Offices 2–5: ~200–350 users each

Offices 6–10: <100 users each

Current AD design:

2 Domain Controllers deployed in each remote office

2 Domain Controllers in each data centre

3 Domain Controllers hosted in Azure

We are planning to remove the branch office DCs and centralise authentication through our data centres and Azure DCs.

I would appreciate advice on:

What is the recommended approach to safely remove branch DCs without impacting users?

Should we remove one DC at a time and monitor before removing the second DC?

What testing/monitoring process would you recommend before and after demotion?

Are there any common issues to check beforehand (DNS, DHCP, GPO, Kerberos, applications, services, etc.)?

With dual 500 Mbps SD-WAN connectivity, are there any concerns with user authentication latency for larger offices (800 users)?

Would you recommend keeping any DCs in larger branch offices or moving completely to centralised DCs?

Any guidance, lessons learned, or recommended migration steps would be greatly appreciated.

Thanks.

Hi All,

We have a few servers with Fales. As mentioned in one of the post, will this work?

If the output is false, run these two commands in powershell as admin

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x5944 /f

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

Hi Team,

&#x200B;

Create a fabric vnet gateway and trying to connect to a mondodb.

&#x200B;

Connection cancelled but no meaningful error.

&#x200B;

We have enabled Db TLS mode to require but no public ssl installed.

&#x200B;

I can ping and port test the db server from the vnet subnet VM.

&#x200B;

&#x200B;

Hi Team,

We have not set the encryption via GPO. So when i run one of the detection script. Noticed the below issues and i need your recomendation.

1. Remove RC4 encryption from 5 Domain Controllers? So Configure encryption types allowed for Kerberos' = AES128 + AES256 + Future encryption types?

2. KRBTGT password is 280 days old - Need to reset?

3. 1000 computer(s) have OS-default encryption (0x1C = RC4+AES) - So deploy AES-only GPO?

4. 4 account(s) may be missing AES keys (will break after enforcement): -Reset the password?

Has anyone aligned the ASD Blueprint for Secure Cloud – Intune Policies with OpenIntuneBaseline (OIB)?

Did you use OIB as the primary baseline and then layer ASD Blueprint controls on top?

We are currently using Intune with Autopilot deployments and receiving a vanilla Windows 11 25H2 image directly from the vendor.

We also have old laptops to redeploy

Hybrid joined.

In this scenarios, do we still need to use OSDCloud?

Also, what is the best approach to manage and update new HP or Dell drivers through Intune?

Hi All,

We are planning a family trip to Switzerland with our family of four. What would be the best time of the year to visit, and what are the must-see places and experiences you would recommend?

Thanks.

&#x200B;

Hi All,

Currently we have Entra branding configured, but I’m looking at changing the sign-in page so it looks different from the default Microsoft page.

Before making any changes, I’d like to understand what impact this could have in production and the best way to approach the design and rollout.

If anyone has experience with Entra custom branding/sign-in page changes, please share any recommendations, lessons learned, or best practices.

Thanks in advance.

Hi Team,

We have a hybrid environment and are not planning to remove our on-prem DNS at this stage because we still have dependencies with on-premise.

We have Fortinet firewalls across all branch offices. Would it be a good approach to use FortiGate as the DNS server for Entra-joined endpoints?

My main question is:

What is the best way to reduce or remove on-prem dependency for Entra-joined endpoints while still maintaining access to these on-prem resources?

Hi All,

I’m planning to standardise and rename all our Intune groups. looking at the best naming convention for application user groups.

CompName-App-AdobeReader-U-Enable ?

Currently my Device naming

CompName--Win--D-Test

CompName--Win--D-Kiosk

Just wanted to check if anyone has a better or recommended approach before I proceed.

Hi All,

Currently, we have 430 controls that match the 25H2 baseline. When we create the Autopilot configuration for the new SOE, would you like us to apply these 430 matching controls?

Current devices are comply with ISO27001 and RFFR audits.

What is the best way to approach?

Do you apply these baseline to the Autopilot all dynamic root leavel group?

Hi Team,

We’re running a hybrid environment whfb with certificate trust (no Kerberos Cloud Trust). WHfB PIN works fine on most devices.

However, in the last few weeks, about 5–10 devices are failing with error 0xc0000a100. On those devices we see:

Event ID 7001 – Certificate trust auth failure

Event ID 6010 – Self-signed certificate rejected

Most devices are unaffected.

AzureAdJoined : YES

 EnterpriseJoined : NO

DomainJoined : YES

NgcSet : YES

AzureAdPrt : YES

EnterprisePrt : NO

EnterprisePrtAuthority :

OnPremTgt : NO

CloudTgt : YES

Has anyone seen this recently? Any updates or changes that could break certificate trust? What’s the best way to fix affected devices?

Thanks in advance.

Hi everyone,

I’m planning to transition our environment from Hybrid Azure AD Join to Entra ID joined devices using Autopilot, starting with a clean approach rather than carrying over existing hybrid policies.

At the moment, we don’t have Security Baselines applied, but we do have a number of Settings Catalog policies configured for Windows 11 24H2. I’ve noticed that the available baseline templates are aligned with 25H2, so I’m trying to understand the best way to compare our current configurations against the baseline and determine what should be carried forward for new Autopilot devices.

In parallel, I’m planning to implement a new structure for groups, tags, and policies. We also want a naming convention that supports future mergers or multi-entity environments, while still keeping the current company identity clear for day-to-day management.

I’d really appreciate any guidance on:

Approaches/tools to compare existing configurations with Security Baselines

Best practices for transitioning to a clean Autopilot setup

Recommended naming conventions for groups, tags, and policies in scalable environments

Thanks in advance for your help!