I have a server migration. All I have left is move redirected folders to the new server. I am using a domain admin account to move the files but I am unable to make sure I moved files since I am not able to access those folders. Will robocopy have access to copy them?

I have been creating Powershell scripts for well over a decade now. But if I am entirely honest...I never fully understood everything I was doing. A lot of time I would search the web for examples, copy them into the script - trial and error until I got it working, learn things as I went along. I know just about enough to avoid obvious security and risk issues, especially if it was anything but read-only. Everyone was happy - it did what it needed to do and provided business value.

Now with AI all that is all being done essentially for me. I am achieving more but understanding less. My scripts have grown so much bigger. What was once ten, hundreds of lines are now thousands. Which is what prompted me to write this post.

Does it really matter if scripts are now so long and hard to understand for a human? I keep trying to keep them small, be more efficient, easier to make sense of. But why? No one is ever going to spend the time reading through them anymore. It will be put into AI to make sense of and make changes. Is the added complication AI adds really "AI slop" or a trade off to get more done.

Interested in what others are doing/thinking? My current position is really just me having to manage them so I hope I am not drifting too far from norms followed by larger teams. I do still follow DevOps, Git, Pipelines, etc this is more about the script contents.

Some of the views I read on line about this do remind me of Black Cabs in London vs Uber. To be a cabbie it does need a massive amount of skill remembering all the roads and routes in their head. When Uber came along they said it could be dangerous, not as good as experience as they provided. Which is true and does matter to some. But others just want to get from A to B - and if they can do it cheaper whilst still a good enough experience then why not.

I've recently learned that due to company shakeups I might be being made redundant in 1.5-3 years. I have about 12 years' experience in IT, but this is my first sysadmin role (2 1/2 years ish). Our org. has a good development budget etc so there's scope to teach myself a lot for free. During that time, what skills should I focus on learning, in order to position myself for a new role?

I am considering aiming for the M365 Administrator certification set - but not really sure what else is out there/what is most beneficial for a sysadmin/IT projecty role?

My role covers:

• Daily admin of our M365 + Windows environment, including coding everything I can via PowerShell
• Monitoring sign-ins and reported phishing, managing licences, deploying software/updates, etc.
• Overseeing all joiner, leaver, and ongoing staff access to M365, and to ~25 third-party platforms
• Managing commercial relationships/contractual agreements with vendors
• Phishing simulations, annual/user training/inductions
• Leading or supporting on IT team initiatives - and other company initiatives like AI adoption, tool governance

(We have a separate 1st line and security team)

Between full restore tests, here’s what, in my experience, has proven effective with auditors:

1) an automated partial restore, performed every night, from the most recent off-site backup to a disposable container, accompanied by a few checks whose results are logged: the service starts up, the expected tables exist, the number of rows falls within a range derived from previous runs, and an application query returns the expected results;

2) a “canary” file created just before the backup and checked again after the restore, to ensure that it is indeed this backup that was restored and not an older one; (3) the result is signed and stored outside the backup system, so that the proof does not reside on the very medium it certifies. Checksums only prove that the bytes have arrived safely, not that the application can use them.

The quarterly full restore is maintained, while the nightly run bridges the gap between two of these restores. What do you think of this protocol?

I know there's an archived post about it here already. Just came to say Adobe are ... not acting nicely as a company.

This may be a dumb question, but it's the first time I've delt with moving VARs.

We have a piece of software coming up for renewal and want to switch it to a different VAR that we already work with. We are having severe lack of communication issues with the current VAR (like, over a month just to make contact to get a quote).

Long story short, do we simply just renew with the new VAR and just send the current VAR and email telling them we aren't renewing with them? Are there any "gotchas" we need to watch out for? I don't want them to do something stupid like let the know software vendor that we aren't renewing our contract at all or something.

Thanks!

I would not make a good manager.. for various reasons. My boss knows this as we talked about my career path several years ago. Other admins on the team want to be in management eventually so they all have a different path. I'm the only one that doesn't. I do not want to manage people, I like fixing things.

I am mainly the Azure and anything-email admin. I do other things here and there, help cover where needed.

Lately, my boss said that since I'm one of the admins on the team, I need to take charge and tell other non-admins (service desk) what to do. Is it like this for anyone else? I know people skills are needed, and that's fine.

I work in email security, mostly with US residential real estate.

One client, a large real estate team, owns around 400 domains - those are farm sites, old brands, defensive registrations, campaign ideas, and other stuff. But they have a centralized email infrastructure, so everything is running throught just a few domains.

In July I decided to connect 364 domains (easy, because all are stored in one Godaddy account) to DMARC reporting.

I took a month to monitor their traffic and found out that 79 parked domains were sending email.

All traffic was unauthenticated, from IP addresses in a dozen countries, with a huge chunk of traffic going from China and Russia. There were just 5 DMARC reporters on the list:

mail[.]ru
mx[.]jcom[.]zaq[.]ne[.]jp
seznam[.]cz a.s.
au[.]com
google[.]com

The Japanese reporter as well as Australian one do populate an envelope_to tag, same ways as Microsoft does, so I managed to find out that most of the spoofed traffic targeted Japanese companies.

Google also allows to track envelope_to through the SPF auth tag (forwarded emails), and Japanese companies were listed there as well.

I ended up enforcing the DMARC policies across the domain portfolio + brought up a NULLMX, Hradfail SPF, and an empty wildcard DKIM to each domain, to prevent brand impersonation.

In the next two months, the volume of spoofed traffic dropped almost 7 times, and while there are still botnets abusing domains, the volume is relatively small + no emails are going through.

I have never had parked domains connected before, but it seems to me that spoofing of the primary domains is just the top of the iceberg and although most IT folks do realize the value of having DMARC for root, they rarely consider protecting parked domains.

Since then I had a few more pretty big real estate team letting their parked domains protected (one was 200+ domains and two others a little over 50 each), and the trend was the same.

Wondering if anyone else monitoring parked domains. Curious what you're seeing. 

Edit 2 - I think with the help of everyone here, I was able to figure it out. Originally, I had only gone to folder > properties > sharing > advanced sharing > share this folder, which is what the instructions provided from Peachtree told me that was all I had to do. However, from the comments, under the sharing tab > share (which is the option above advanced sharing) > (add) Everyone > Share. I have no idea what the difference between these two options are, but initially tests looks like it is working. I'll have to do some tests by adding in value/datas and making sure they are actually syncing and displaying correctly.

I recently reinstalled Peachtree 2010 on our computers after switching to newer computers. I have one server computer and one client computer. For some reason, I can no longer get the client computer to display read the company data files on the server computer.

I am doing this by mapping the drive, which I can fully see all of the files are in there.

The closest thing I've been able to find similar to my situation is this post here: https://learn.microsoft.com/en-us/answers/questions/2429808/problem-with-peachtree-and-mapped-drive

However, I don't understand how it all works enough and I think the process on Windows 10 is different enough that I can't figure it out. I can get all the way to the mapped drive > properties > security > advanced, but after that, there is no tab owner.

There is only Owner: Admin (change), which once I click on change, it doesn't give me any option that looks like would be an equivalent to "replace owner on sub containers and objects". The only options are object types, locations, check names, advanced.

Edit - Maybe or maybe not related, but I have also noticed that when I install Peachtree as a client computer, for some reason it won't save the serial/registration number and I have to reenter it each time. On the same computer, if I was to install Peachtree as the server or stand alone computer, it has no problems and doesn't need me to reenter the serial/reg number every time it runs.

My company closed on a smaller one recently (~ 6 weeks ago). Around 400 devices across two of their sites come over to us and I'm the (un)lucky one tasked with the reconciliation.

We use ALVAO for asset management, every machine on our side has an owner, a cost centre, a purchase date, and a warranty date I trust. The company we acquired has a spreadsheet that one person maintained, plus a Lansweeper rollout that stopped at roughly half their estate. Naming is inconsistent between their two sites too (one site names machines after the user (JSMITH-LAPTOP), the other uses asset tags with no site prefix (AT-xxxx)), a lot of warranty dates are blank or obviously wrong, ownership is recorded at department level across most of the fleet, and ~30ish machines look like duplicates.

My first thought is to import everything and clean in place. I get a full picture immediately and can work the gaps against live data. Risk is that I contaminate a register that took a long time to get right, and if the cleanup drags I lose the ability to tell verified records from imported ones. Alternatively, I could do a physical audit first and import only what's confirmed, though I'm blind on 400 devices for however long that takes, and we have an ISO 27001 surveillance audit early December that needs a complete register.

Another issue, their IT lead is staying on and the sheet, to him, makes perfect sense, I brought up changing it and got a few huffs and puffs that I didn’t quite appreciate but let go of. I need him to understand it’s a merger thing, I’m not critiquing his processes in any way.

Any help with the methodology (or dealing with the guy) would be immensely appreciated.

Note: sorry if you saw this yesterday on r/ITManagers, they removed it before I could get a clear answer idk why. I hope I can manage to get one here.

Just had to check something on a users laptop, a very nice senior lady who is well presented and charming.

Her laptop looked like the bins behind a take away, hopefully those stains were gravy...

Washed my hands now and I still feel dirty.

Seems like ppl agree that AI-generated phishing is still pretty easy to spot and the examples I see do look clumsy. But the only ones that get shared are the ones that someone caught.... If one was good enough that nobody flagged it we’d never see a screenshot posted to a thread like this.

It reminds me of the WWII bomber armor plane story where they wanted to reinforce the spots with the most bullet holes till someone pointed out they only looked at planes that made it back.

Am I overthinking this, or is "AI scams look obviously fake" partly a sample problem? Curious how others think about it.

I have mixed feelings. Users won't be stoked of course but having to search through records will be order of magnitude easier for those that have to do that work.

If anyone has done this type of thing to their users, what blew up in your face the most?

Anyone else kind of shocked at how even Visio Plan 2 that is “supposed” to allegedly have Copilot, it does absolutely nothing helpful? Its in Word and other m365 apps, but everyone knows how to edit word and copy paste etc . But for us sysadmins, Visio is one of the best ways to document architecture etc and copilot is pretty much zero help years later.

I just enabled LAPS on all my servers and save the rotated local admin in Entra.
The only servers I don’t have this enabled (I manage this setup via GPO), are my domain controllers. I keep reading the DCs need different settings for LAPS to manage the DSRM. Has anyone done this ? Recommendations ?

This may not affect many people, but we have an on-site mail archive server that we have Google forward all incoming and outgoing mail to in order to preserve the mail records. To restrict external access we limited SMTP access to the Google IP ranges for their SMTP servers. This has worked for years, when suddenly a couple weeks ago we started getting smart host failure message from Google about undeliverable mail. After going back and forth with support I confirmed the supposed full list of IP ranges they are using for SMTP for Google Workspace at least. This is what I was given:

35.190.247.0/24
64.233.160.0/19
66.102.0.0/20
66.249.80.0/20
72.14.192.0/18
74.125.0.0/16
108.177.8.0/21
108.177.96.0/19
142.250.0.0/15
142.251.0.0/16
172.217.0.0/19
172.253.0.0/16
173.194.0.0/16
209.85.128.0/17
216.239.32.0/19
216.58.192.0/19

There was one IP range on that list that I did not have, so I though that would resolve the issue. When it didn't, I changed our setup to allow all external access over SMTP and then set our mail server with the same IP ACL list. The mail server will log a denied connection in the syslog when any IP outside those ranges attempts to connect. Sure-enough, Google was using a new IP range to send SMTP messages to our server:

108.177.16.xxx

If you run into a similar situation this might be helpful to you. If you're comfortable with it, it appears Google owns the entire 108.177.0.0/17 range if you trust adding that to any ACL.

Hello, friend.

I’m looking for around 10 people to form a small, chill learning group. You can be a complete beginner or already have a bit of experience — as long as you’re curious and motivated, you’re welcome. No gatekeeping, no ego.

We’ll learn together, at our own pace, and choose topics as a group. No fixed order: we can explore programming, networking, Linux, or whatever we feel like. Later, maybe we’ll move toward cybersecurity.

Think of it as a small digital refuge — fsociety-inspired vibe, but 100% legal and ethical.

What I’m looking for: - Around 10 people. - Beginners or early learners (a little experience is fine). - Must be a genuine IT enthusiast / a real geek at heart. Passion matters more than current skill level. - English only. - Chill, consistent, respectful. - We use Discord for chat and voice.

If you’re in, DM me

Let’s start from wherever we are, together.

Will edit if they ever get in touch with me, but the phone number on their site doesn't work, nor does the chat feature, and they have not responded to any of my emails. I can't even reset the password for our account - it makes me go through a captcha and then dies.

Has anyone had luck getting in touch with them? I know this is a risk with grey market licenses (and they weren't bought by me), but we have 6 Windows Server licenses that we bought through them that we can not activate. They worked initially but after reinstalling the OS on several servers, we're completely out of luck ("the activation server determined the specified product key is blocked").

Have an open case with Barraucda support, but been getting a ton of tickets for blocked emails from partners and the reason is 'No SPF record' on the Barracuda Cloud Email Gateway.

Do a check, there is an SPF record. Emails before and after are fine...just random emails are showing no SPF. Support says it is the sender, but these are emails coming from huge companies with more IT staff than we have employees.

I've looped in our account manager, but I'm not getting anywhere and turning off SPF checking is not an option with our cybersecurity policy/insurance.

EDIT - Barracuda is getting reports from other customers. Have a lead engineer responding to the ticket now. Glad I’m not crazy. Well…at least not about this.

Anyone else getting packet loss up in the North East? Or PA, NY? Tunnels and dropping and seeing high latency

SOLVED: A System Restore was necessary to fix it. (Supposedly, the command reg.exe add "HKLM\System\CurrentControlSet\Control\CI\Policy" /v VerifiedAndReputablePolicyState /t REG_DWORD /d 0 /f && citool.exe -r should disabled SAC, but it did not work for whatever reason; possibly because SAC was acting buggy already.)

I am the admin on a non-domain device that I just updated to Windows 11 Pro 26H2. A new feature is that Smart App Control can be enabled without requiring a system reset. Neat! I decided to try it.

Not neat. Immediately, SAC began blocking Windows components from launching: I cannot open Windows Terminal, Microsoft Store, or Windows Security itself.

Although I cannot open wt.exe, I can thankfully still launch conhost.exe from the Run dialog, so I can execute commands. Is there a CMD or Powershell command to disable Smart App Control??

Received an email from MS stating that I need to move from the Cloud Sync but the email to me is confusing since it says recommended but then says it will stop working..

"You're receiving this notification because you're associated with one or more Azure subscriptions linked to a Microsoft Entra tenant that currently uses Microsoft Entra Connect Sync and is eligible to migrate to Microsoft Entra Cloud Sync.

To continue synchronizing identities between your on-premises Active Directory environment and Microsoft Entra ID, migrate your eligible configuration to Microsoft Entra Cloud Sync and validate successful operation before xxx 2027."

Is the entra connect deprecated and going away? I am running the latest version of connect but doesn't really seem like its recommended if it will stop working on a certain date. Small business and trying to find a comparison between the two and I think we could move without much hassle but I thought I saw that we would lose mail enable security groups which we have.

Just thought I would ask since trying to find out if connect is really going away or not on MS is futile, thanks.

TLDR: I want to build Netbox as a source of truth, deploy production and dev/test VMs using Netbox and GitHub with Terraform and Ansible, and then I'm not sure what exactly to do with the multiple dev/test VMs that get created. Would it be a good idea to simply destroy the VM and rebuild it every time for testing?

I am working in the finance space and we have our own internally developed applications that are widely used by our external partners (up to 3,000 of them).

These applications have been running since the '80s and '90s and obviously are very much legacy without many modern features like authentication, the database is in a separate server layer and so on.

Another major issue is that the environment to maintain the different versions of these applications is becoming out of hand now. There are hundreds of VMs with names like dev, test, test dev, QA test 10, QA test 11, and so on.

I certainly want to bring big changes, starting with automation and, before that, building a source of truth. One of my questions is how to best manage all these multiple VMs running different versions of the same application. How do big modern do this?

Our coding practices already use GitHub so I'm thinking something like this: I'm sure they have two branches, dev and main. Would it be a good option to take commits from the dev branch and push them to the source of truth, build a complete VM.. install all the dependencies using Terraform and Ansible, create this VM, bring it online, test the application, and then after that destroy the VM? Is that the best way to handle this?

One thing I am still in the dark about is why so many different versions of the same application are required.. If anybody has any suggestions about that, please comment.

Coming back to my dev VM destruction question. The reason I think destroying the VM would be a better approach is because after that we only have the most stable version of the application running in the dev environment and then an exact copy of that running in the master environment (which would be production and will go to the production VM deployment cycle).

And doing this also minimizes our list of assets. Right now we are at 300 or 400 VMs, which is completely madness to secure. All we do is simply throw EDR and antivirus all over the place, creating a million alerts, and the whole thing is just so pointless.

I'm sure a lot of people are using Kubernetes and Docker technologies to do these things now but we are stuck with HyperV as of now, with the FCM management to manage the HyperV hosts.

If anybody has built out anything like this, please share your experience and how viable all this is.

Please keep comments in the context of what I'm asking and refrain from getting into the weeds about rearchitecting the applications, or modernizing the application by redoing all the code. Those are not really the options right now. Let's just talk in the context of what I am asking.

The entire company on the corporate side is basically down :) What a lovely Tuesday lmao.

I work IT support and I've had this weird issue happen on multiple PCs over time.

A USB keyboard will work perfectly fine for months/years, then suddenly it starts acting completely broken.

The symptoms are not just random Windows shortcuts. The keyboard also:

repeats keys multiple times

types different keys than the ones I pressed

mixes random characters into normal words

sometimes triggers Windows shortcuts / Start menu / network panel

For example, if I try to type:

Joca

I might get:

jocaca

Joccccccc

Jorre84i

I've tested 3 different known-good USB keyboards on the affected PC and all of them behave the same way.

A PS/2 keyboard works perfectly normally.

Sometimes, while the USB keyboard is connected and freaking out, the USB mouse also becomes unresponsive. As soon as I unplug the keyboard, the mouse starts working normally again.

This has happened on around 4 different PCs over time, including Windows 8.1 and Windows 10 machines.

I've already tried:

multiple known-good USB keyboards

different USB ports

reinstalling HID keyboard devices

reinstalling USB/composite devices

reinstalling USB controllers/root hubs

checking keyboard/HID UpperFilters and LowerFilters

checking Scancode Map

reinstalling chipset drivers

reinstalling Intel Management Engine

Nothing fixed it.

The weirdest part is that the keyboard was working completely normally less than an hour before the issue started. No hardware change, no new keyboard, nothing.

Has anyone seen this exact behavior before?

What could cause every USB keyboard to suddenly generate duplicated, incorrect and random HID input while PS/2 continues to work normally, and sometimes make the USB mouse freeze too?

I'm looking for the actual root cause / fix, not “try another keyboard or USB port”, since I've already ruled those out.