r/sysadmin

I was recently made redundant.

I been in the game for like 13 years from Australia!

Just started the job hunt and I can't even get an interview!

Anyone facing this?

So there I was, googling solutions for a certain issue we have in my organization.

The AI recommendations we all know and adore came up first, and one of the top solutions looked extremely familiar. I asked it for its source for that solution and it directed me to a writeup on r/sysadmin written by…me.

Cue the Leonardo DiCaprio pointing meme.

I shouldn’t be surprised, everybody knows Reddit's role in LLM training these days, but it still feels surreal.

If you’re wondering why I was looking for solutions if I’d written a whole-ass post about a solution I’d already come up with, I was looking for ideas to improve it.

The AI overlord thinks I’m funny and informative. Maybe it will wait to throw me into the soylent machine last.

Anyone thought of starting their own small MSP? That's the only 'transferrable skill' that would not have me just having another job as a contractor. I need a real business I can grow.

For context I've in in IAM, sysadmin and the moved up to being an engineering manager. I love helping customers and no longer have to be the most technical person in the room.. that ship sailed a few years or decades ago.

In my 50s I'm riding the edge of burnout.

Open to ideas

I honestly did not know this feature existed until recently, but we have noticed a significant uptick in users complaining about a Chrome feature called "split view." We ran a basic analytics report from our ticket submissions, and this appeared as a complaint that has come up a lot lately.

From what I can see, there is no way to disable this feature. The closest I have seen is configuring "Allow split view drag-and-drop on left or right edge of window" to Disabled.

Has anyone else seen this as a trend from their users?

Hi!

I'm currently an IT doing sysadmin stuff, kinda. I have been working for a company for 1 year and I did like 3 years of intership as a low level IT. My job currently has no intune and their AD and GPOs are minimals, I'm planning on using intune soon and cleaning up said AD.

I'm learning sysadmin stuff and I work with an external IT company. When I meet a problem I can't solve and I seem to not find the solution, I reach them and ask them to help me out while explaining me the solution.

I'm learning fast and I would like to do some certifications. I would like to do more cybersecurity stuff but I would also like to learn more as a sysadmin. Is it a good idea to do certifications on both domains or should I really just do one and focus on one path?

This is probably more suited for MSPs, but I think relates to really anything business related. Software wise anyway. Think VoIP, backup, CRM, etc.. I kept this kind of vague since I think the guy I talk to lurks the forum.

I was talking to an MSP partner that was telling us about a new software that their CTO previously worked on/helped create that they’re starting to resell, and really talked it up. Now I know this org already sells a different software for this need, tho not as robust. I asked if they were going to implement it at their org since it seems so great and he was like ah no we actually just switched to another 3rd party solution, but they’re going to absorb that new tool and replace the more basic one they’ve been selling.

This is so funny to me, and maybe there is rationale that I just don’t get, but I have seen this in different places too. If your company sells, supports, or creates a software, what is the rationale to not using in your own org? Wouldn’t there be some kind of cost savings potentially as well as you knowing the product well for those that you’re supporting or selling to?

The only thing I could think of is if there’s an outage it doesn’t bring you and your customers down, but I’m not sure if that’s always matters depending on the tool. Like email services? Sure makes sense. Some sort of saas app though? Idk if that matters as much?

Hi everyone,

We have hundreds of Samsung HG55AU8000AUXUE (HAU8000 Hospitality) TVs running Tizen OS, all connected to an Ethernet network.

Our main challenge is controlling TVs individually. In some areas, we have 30+ TVs close together, and using a Samsung IR remote to turn off one TV causes multiple TVs to turn off.

Samsung offers LYNK Cloud for centralized management, but licensing hundreds of TVs would be very expensive.

We're exploring whether we can replace Tizen with an open-source OS, allowing us to install a management agent and control all TVs from a self-hosted, browser-based dashboard.

We're looking for:

• An open-source OS compatible with Samsung hospitality TVs.
• An open-source alternative to Samsung LYNK Cloud.
• A way to control individual TVs (power, volume, inputs, etc.) over Ethernet.
• A self-hosted solution without per-TV licensing fees.

Has anyone worked on something similar? Is replacing Tizen possible, or could we build an open-source management solution using the existing OS?

Any GitHub projects, technical documentation, or suggestions would be appreciated!

Thanks!

​

Hi all,

I'm a IT at a UK organisation with approximately 570 employees, supported by a relatively small IT team of four people, including myself.

We're exploring how to align our existing information security governance, policies and operational practices with ISO 27001:2022, with the longer-term ambition of achieving formal certification.

We already have an overarching Information Security Policy with supporting policies, standards and procedures, alongside established technical security controls. However, we haven't previously implemented a full ISO 27001 ISMS and we're also doing large scale, organisation wide projects (new networks, new erp system, and the entire team being less than 6 months in).

My biggest concern isn't necessarily the technical controls, but understanding how to structure and manage the implementation alongside our existing responsibilities.

I'm particularly interested in hearing from people who have implemented ISO 27001 within similarly sized organisations, especially those with small internal IT teams.

A few questions:

Where would you start? Would you begin with a formal gap assessment, defining the ISMS scope, reviewing existing policies or something else?

(Every other thing at this organisation has been poor so I've taken a clean slate approach to everything so far, e.g. new desktops/OS, new servers, new networks).

How would you structure the project? Would you approach it in phases, allocate specific workstreams to individuals or appoint a dedicated internal lead? If a dedicated lead, who - we don't have certified ISO implementers.

How much resource is realistically required? Can a four-person IT team deliver most of the implementation alongside BAU responsibilities, or should we consider additional resource or external consultancy?

How many hours does an audit take from IT staff ?

How do you distribute responsibility? Given that ISO 27001 covers much more than IT, how did you involve HR, Finance, senior leadership and other departments?

We don't do software development so I plan on excluding any mentions of that in the SoA.

How did you manage documentation and evidence? Did you use dedicated ISMS software, SharePoint, spreadsheets or a combination?

How did you avoid creating unnecessary administrative overhead?

What would a realistic implementation timeline look like? Particularly if the initial objective is ISO alignment, followed by certification.

What would you do differently? Any lessons learned, common mistakes, training recommendations or things you wish you'd known before starting?

I'm not looking to simply produce documentation for an audit, although that is nice to do.

I'd like to build a functioning, sustainable ISMS that genuinely improves the standard at the organisation, so that the rest of the business can also improve too "hey, look at IT, they're ISO27001 certified, we should aim for something similar" type of rhetoric so that the standard across the organisation raises. (It's a badly optimised workplace.)

I'm also keen to develop the knowledge internally rather than becoming completely dependent on consultants.

I'd really appreciate any practical experiences, recommendations or examples of how others have approached this.

I appreciate it's a lot to read so thanks if you got this far.

Thanks in advance!

Cursed idea:

​PAM module that using an LLM with the power to overrule your sudo privledges.

Example scenarios:

• "Why do you need root?"
• "Why are you on a Vietnamese IP?"
• "Convince me of your identity."

To the more cursed:

• "Okay, but first solve this riddle...."
• "Public key checks out, but it's 3am. It's time to go to bed."
• "Nginx has been running for 71 days now, I think ​it deserves a nap."
• "Keystroke dynamics suggest you are drunk. Sudo denied."​

​

I am working on a system design for a wireless internet overhaul in a condominium building. The physical overview consists of an enterprise gateway, such as Omada or Ubiquiti, with an SFP connection to a managed PoE switch feeding access points. It is a four-story building with five units per floor, totaling twenty units. For bidding purposes, I am assuming one available repurposed phone Cat5e cable per unit. The current incoming WAN is terrible, and having twenty basic ISP-provided routers running in close proximity heavily compounds the issue. The condo association is open to making quality wireless internet a complex-wide amenity provided by the association, replacing the current poor subscription model.

​No major commercial ISPs service the complex, so my current plan is to deploy one Starlink kit per building to serve twenty units. The Starlink unit would be placed in bridge mode, feeding an enterprise gateway followed by enough access points to ensure adequate coverage in all units. My LAN and RF strategy is to broadcast individual SSIDs for each unit, assigning each unit to its own isolated VLAN with a bandwidth throttle. I intend to deploy Wi-Fi 7 access points with maximum channel separation. Spreading out channel congestion while introducing a vastly superior base network speed should dramatically improve performance, as my assumption is that the core issue right now is twenty consumer routers clashing on overlapping channels.

​While this isn't an ideal network topology, residents are desperate for a working solution. My walkthroughs showed almost zero wired connections in use, and the demographic here largely doesn't care about a wired drop. However, if a wired requirement does arise, I can pivot to one access point per unit utilizing at least one built-in Ethernet port on the chosen access point model.

Furthermore, this complex houses a large population of elderly residents, and over the last several months there have been multiple instances where people could not reach emergency services due to network failures. Simply being able to access wifi calling and/or utilize network based monitoring equipment would be a massive relief. Solving this reliability crisis is the primary driver behind this bid.

​TLDR: I want to use one Starlink satellite linking an enterprise gateway to provide twenty condos with a segregated VLAN SSID each, then extrapolate that concept across eight additional identical buildings. Is it a violation of Starlink's terms of service to provide internet to twenty condos per satellite, given that roughly half to three-quarters are lightly used vacation homes? Assuming proper access point placement and RF distribution, is channel diversity coupled with VLAN per-unit isolation a reasonable angle of attack to deliver usable Wi-Fi to twenty condos over a single shared connection?

Hi everyone,

I got tired of deploying my customized Windows image (built with NTLite) via USB stick, so I started looking into PXE boot and network-based OS deployment. Honestly, I'm pretty frustrated by now.

I tried WDS, but as far as I can tell, Windows 11 deployment with boot.wim is blocked, MDT is retired, and WDS itself is being deprecated.

So how are you guys doing this nowadays? What's your setup for deploying a custom Windows 11 image over the network?

Thanks in advance!

Hi, my wsus servers has stopped receiving new defender definition updates. Last was 06.10 and no clients receive updates because of this. From what i can see there has been no change on the wsus or config anywhere else.

Has anyone seen this behavior before?

Last synced version i can see on my wsus is 1.459.588.0

Edit: Last synced version i can see on my wsus is 1.459.576.0

Edit2: Its solved, syncing now

We have a client thats wants to label document libraries in sharepoint but when this happens only any new documents add to this library get the sensitivity label.

Is there a way of doing existing documents in the library? Basically documents that where in the document library before the sensitivity label was applied?

I think there might be something in preview that will do this but unsure.

Thanks

Let’s be honest, not all company policies are well thought out or allign with workers needs. What’s the stupidness that you either had to enforce or got enforced on?

I’ll go first:
Working for a huge IT company, in the MSP department, our department was around 15% of the total employees, and the 3rd biggest department. Suddenly a policy that all mobile phone numbers were to be in the signature of all emails you send. Suddenly all emails we sent out to one or all of our customers 10 000+ employees included our mobile phone number. And for most of us, that ment it was also our personal mobile phone numbers. No one noticed this before people were getting calls and texts after hours and weekends. It started slow, but after a few weeks, people started getting annoyed and we figured it out of course. All technical staff agreed on this being bad, and stopped responding on all mails until we got exemptions, which took another week or two.. 😂

Hey everyone, I need a reality check because I’m starting to second-guess myself. I honestly don't know if I'm the one being difficult or if I've just landed in an absolute clown show.

I work as a systems administrator. Overall, I actually like the company I'm at. The environment is fine, I get along with my coworkers, and I genuinely enjoy my actual job. The issue is that the company also sells a SOC (Security Operations Center) service.

Up until now, this entire SOC has been run by a single guy. He's completely on his own and hasn't received a shred of proper training from the company (whatever he knows, he learned on his own or at previous jobs). On top of that, the platform we use (an XDR) is a total janky workaround—it's a mono-tenant solution that we are forcing to run as multi-tenant to manage multiple clients, with all the massive limitations and data risks that come with it.

The owner finally realized the SOC isn't working like this, but instead of hiring dedicated personnel, he decided that "we need to make what we already have work with internal resources." Translation: he decided to draft me and another sysadmin to force us into doing SOC shifts. The plan is a weekly rotation where each of us spends one full week a month, 8 hours a day, glued to the dashboard monitoring security alerts.

The problem is, I don't like cybersecurity, I know nothing about it, and it's not my job. Taking me away from my actual department for a whole week every month just means my own clients and sysadmin projects are going to pile up and fall behind.

A few days ago, we had a "training" session with the owner. I was hoping he’d actually walk us through step-by-step procedures on how to handle alerts. Instead, he just pulled up a bunch of logs and asked us, "What would you guys do here?". In my head, I was literally screaming, "How the fuck should I know? You tell me! I'm here because I've never done security in my life!". I felt like a newborn baby; I literally understand nothing of what I'm looking at.

Seeing how things went, I went to talk to my direct manager to tell him I'm seriously struggling and that I don't have the skills for this. The result? He got incredibly pissed off. He told me "we are only at the beginning of the training" and that if I have a problem, I should go talk to the owner directly (basically passing the buck so he doesn't have to deal with it). Both my manager and the owner are completely aligned on this: there's no escaping it, the shifts have to be done.

I didn't have the guts to tell my manager that I absolutely hate the idea of doing security, especially since he blew up over a simple vent. But I'm genuinely anxious. If a piece of ransomware gets through during my shift week and I miss it because I don't have the trained eye for it, whose fault is it going to be?

Am I crazy for pushing back on this? Is it normal for a company to expect to completely alter a employee's role overnight just to save money on a new hire? How can I stand my ground with the owner without starting a war, considering I actually want to stay at this company for everything else?

Thanks to anyone who can give me some advice.

This may not affect many people, but we have an on-site mail archive server that we have Google forward all incoming and outgoing mail to in order to preserve the mail records. To restrict external access we limited SMTP access to the Google IP ranges for their SMTP servers. This has worked for years, when suddenly a couple weeks ago we started getting smart host failure message from Google about undeliverable mail. After going back and forth with support I confirmed the supposed full list of IP ranges they are using for SMTP for Google Workspace at least. This is what I was given:

35.190.247.0/24
64.233.160.0/19
66.102.0.0/20
66.249.80.0/20
72.14.192.0/18
74.125.0.0/16
108.177.8.0/21
108.177.96.0/19
142.250.0.0/15
142.251.0.0/16
172.217.0.0/19
172.253.0.0/16
173.194.0.0/16
209.85.128.0/17
216.239.32.0/19
216.58.192.0/19

There was one IP range on that list that I did not have, so I though that would resolve the issue. When it didn't, I changed our setup to allow all external access over SMTP and then set our mail server with the same IP ACL list. The mail server will log a denied connection in the syslog when any IP outside those ranges attempts to connect. Sure-enough, Google was using a new IP range to send SMTP messages to our server:

108.177.16.xxx

If you run into a similar situation this might be helpful to you. If you're comfortable with it, it appears Google owns the entire 108.177.0.0/17 range if you trust adding that to any ACL.

Just a heads up because sometimes we totally forget this step.

New Windows 11 26H2 GPO Templates are available and can be found here: https://www.microsoft.com/en-us/download/details.aspx?id=108847

I have not yet found a spreadsheet showing the new settings like the "Policy Settings Reference Spreadsheet for Windows 11 2025 Update (25H2) V3.0"

Found the 26H2 spreadsheet here - https://www.microsoft.com/en-us/download/details.aspx?id=108849

These are backward compatible with 25H2.

Additional 26H2 info - An IT pro’s guide to Windows 11, version 26H2

And of course you should at a minimum make a copy of your existing PolicyDefinition folder as a backup, Ex: "PolicyDefinition-25H2"

Hi, we're seeing a strange permission/access behavior on some of our Windows Server 2022 file servers and I'm trying to figure out what could be causing it. We're running an AD domain environment. My account is a member of an AD security group, and that security group is a member of the local Administrators group on the file servers. Administrators have Full Control on the relevant NTFS folder structures. When I access a file server from my workstation through Windows Explorer using \\fileserver\share\folder, I can browse through the entire folder structure without any issues. However, when I'm logged onto the file server itself and try to access the same folders locally through Windows Explorer using D:\share\folder, Explorer denies access unless my user account is explicitly added to the folder permissions. The strange thing is that the permissions themselves clearly work. On the same server I can access the folders via CMD without any problems, applications such as our backup software can access them, and remote SMB access from my workstation works as expected. The issue seems to affect only Windows Explorer when it is running locally on the affected file server. I compared this with one of our web servers. The AD group membership, local Administrators setup, NTFS permissions and UAC level are essentially the same there, but local Explorer access works normally. One additional difference that might or might not be relevant is DFS. The affected file servers are using DFS, while the web server obviously isn't. I'm not sure yet whether DFS itself is involved, but since this is one of the differences between the affected file servers and the unaffected server, I thought it was worth mentioning. I vaguely remember this behavior appearing after a Windows Server update, possibly around the move to Server 2022, but unfortunately I can't say for certain when it started. Has anyone seen this specific behavior before, where access granted through the local Administrators group works via CMD and remote SMB but fails specifically in the local Windows Explorer? I'm particularly interested in whether there was a Windows Server 2022 security change/update, a DFS-related behavior, or a specific UAC/security policy that could cause this. I'd rather understand the underlying cause than work around it by explicitly adding individual admin accounts to the NTFS permissions.

I used ChatGPT to help structure and phrase this post so that the issue is described clearly and coherently. Apologies if the wording comes across a little too polished or AI-assisted.

In Entra, we have a pre-existing enterprise app for SAML authentication.

We are trying to allow a new user to log into that app but it is not working.

Looking at the logs, it seems to pass all of the conditional access policies.

The logs say it fails because the user isn't allowed to use the app.

When I go to the Enterprise app and look in users and groups, that user is listed (directly, not part of a group).

Any idea how to troubleshoot this issue?

I looked at the settings of the web based app and everything is set up like other users. I looked at the attributes and it is referencing user principal name and that user account has that in the same style as all other users.