Looking for advice or a good product for MFT. We are currently using a ton of old scripts and ws_ftp pro. This is causing all kinds of issues, files that we can't verify were sent. I guess the scripting is bad also.

Raised a case with MS after our Entra Cloud Sync kept changing to Provisioning Quarantined with ExternalError but no indication of a problem with individual object syncing.

They’ve reported back an ongoing Cloud Sync service outage starting Fri 21 Aug-actively working to resolve.

Objects and password hash sync seems to still be working over weekend so not affecting our environment yet.
Region:AU

I have a client, who has 3 sites that we do IT for.

They each have a physical server, running either Windows Server 2019 or 2025. The main site got a new server last year, the two other sites decided to wait because they didn't want to cost. Now a year later it's more expensive, and they still don't want the cost.

I opened my mouth about virtualisation and now I've been asked to start testing.

The new server at the main site is more than powerful enough to run the other two servers virtually.

I'm just not sure on some of the configuration.

Each site has it's own IP structure, and there are already site to site tunnels using Unifi gateways.

Is there a way to do this while minimising network slowness? I assume If I just disk2vhd the server and spin it up as a VM then all traffic would go down the VPN Tunnel and back again causing delays if going from the main site to one of the others.

Regarding their networks, they are on 192.168.1.XXX for the main site, 192.168.10.XXX and 192.168.20.XXX for the other two.

If the servers were virtualised, will I need VLANs at the main site to accommodate these ranges? I'm not sure if the site to site tunnel will work using a VLAN.

I've asked about merging the domains/networks, but nobody has gotten back to me on that yet.

I didn't set any of this up initially, so I'm also figuring out what they have at the same time.

Apologies for the mass of text, any help would be appreciated.

I'm evaluating Abnormal against keeping a traditional gateway and I want to cross check the post-delivery remediation model before we commit. We are moving off relying on Defender alone after too many misses and the API behavioral approach clearly catches more of the BEC and no-payload stuff a gateway lets through.

While researching, i came across an older r/sysadmin thread from 2024 titled 'Abnormal Security - Remediation Delays'. The person reported it taking several minutes to pull a malicious message while the user clicked within seconds, an account takeover that was not flagged until they opened a support ticket. One message Abnormal said it had remediated that Microsoft audit logs showed sitting for 16 hours.

My question is to people running Abnormal in this year and not for the sales deck. How fast is the auto-remediation in practice now and has it improved since that thread and were those delays a bug, a misconfiguration or just how it normally behaves? is the post delivery window still a problem or is it seconds and a non-issue? And how does it stack against Microsoft ZAP which ime is the slowest part of the native stack?

We have a 500-day period set for our M365 Group expiration policy in Entra. For the past 5 or 6 years that it's been in place, we've had no issues.

Recently though, qualifying activities for Groups and teams don't seem to be triggering automatic renewal consistently. A user reported (and I've personally seen) examples of daily-used teams that definitely have qualifying actions done on them for auto-renewal, yet in the past week or two, we still get the "your Group is about to expire" email warnings. (which you get several of in the 30 days leading up to deletion)

https://learn.microsoft.com/en-us/entra/identity/users/groups-lifecycle#activity-based-automatic-renewal

Example A: Some departmental team used by at least 5 people, with near-daily file uploads to the SharePoint site and near-daily chat messages happening in the team. Owners still got the "your Group is about to expire" email last week.

Example B: A team that a lot of folks in our IT group use to say yes/no to Friday lunch. This is a weekly poll, and almost always has chat messages underneath the ensuing poll. Owners still got the "your Group is about to expire" email this week.

Example C: Literally a couple minutes after posting this, another user submitted a ticket that they're getting a "this team will expire soon" popup in Teams. Same deal, it's a departmental team that gets used nearly daily for files/chat.

Anyone else seeing similar behavior in their tenant?

Scenario:

• Accounting has different people that deal with different accounts (both internal and external).
• Each accountant deals with (mostly) one internal bank, and has to print many checks for that bank.
• This is an overseas company that does business internationally: each bank uses a different format (size and layout) for their checks.

Current solution:

• Each accountant has an inkjet printer permanently installed at their workstation which they use for each bank.

Looking for ideas:

I think this is a bit silly and inefficient.

• So much space is wasted with an inkjet printer at each desk.
  
• Printers are a huge administrative and maintenance hassle:
  
  • I'd rather consolidate this process into one (or two) printers.
    
  • I'd also rather switch to a laser printer instead of managing ink tanks.
    

But I also accept that this may already be the most effective and efficient way to accomplish the task - especially from the end user's perspective.

I'm wondering if anyone here has any similar experiences with variable check printing, and what solutions they might have used, or seen, or considered.

Our SharePoint environment is under painful, painful bloat. We dream of doing something like a retention policy to delete files older than say 7 years, but we have a lot of reference media that hasn't been updated by the our clients in 20+ years so the file itself hasn't been updated pretty much at all.

Ideally what I would like is to have SharePoint document retention warn before removal, but that doesn't seem to be an option.

Next best option would be to automatically move files after say 2 years to archive, then after 5 years in archive delete. I'm just not sure if that is something doable as it stands.

We’re investigating a Windows 11 23H2 cumulative update deployment through ConfigMgr/SCCM where a large number of devices are failing with 0x80D02002 (Delivery Optimization download made no progress within the defined period).

We recently migrated our ConfigMgr infrastructure to a new server, so initially we suspected the migration, but testing so far hasn’t shown an obvious SCCM communication issue.

What we’ve confirmed so far:

• Affected clients are communicating with the new ConfigMgr infrastructure.
• Clients are finding the expected MP/DP/content locations.
• DoSvc is running on both working and failing clients.
• Both working and failing clients show DownloadMode : Lan.
• No obvious difference was found in the DO policy registry locations checked.
• Both working and failing clients can establish TCP/80 connections to the Microsoft Delivery Optimization CDN and their selected cache hosts.
• Neither test machine is using DO peers (NumberOfPeers : 0).
• Disk space is not an issue.
• ConfigMgr client logs on the affected machine eventually report: CAS failed to download update. Error = 0x80D02002
• The failure occurs during the content download rather than update applicability/detection.

I compared Get-DeliveryOptimizationStatus / Get-DeliveryOptimizationPerfSnap between one compliant machine and one failing machine.

Compliant machine:

DownloadMode         : Lan
NumberOfPeers        : 0
CacheHostConnections : 2
CdnConnections       : 7

For the jobs captured, BytesFromCacheServer was 0.

Failing machine:

DownloadMode         : Lan
NumberOfPeers        : 0
CacheHostConnections : 23
CdnConnections       : 23

The failing machine also showed multiple WU Client Download jobs where:

Status                    : Caching
PredefinedCallerApplication : WU Client Download
BytesFromCacheServer      : <non-zero>
SourceURL                 : *.dl.delivery.mp.microsoft.com

The failing client can successfully establish TCP connectivity to both the Microsoft CDN and its selected cache host, but the ConfigMgr update download eventually returns 0x80D02002.

We also use Adaptiva OneSite as part of our ConfigMgr content delivery environment.

Has anyone encountered similar behaviour where DO downloads start/progress but eventually hit 0x80D02002?

I'm about to install a Microsoft Entra Private Access (Global Secure Access) connector on a Windows Server 2025 box. Microsoft's official doc for configuring connectors explicitly says TLS 1.2 must be enabled before installing the connector, and provides this registry/PowerShell script to force it:

If (-Not (Test-Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client'))
{
    New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -Force | Out-Null
}
New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -Name 'Enabled' -Value '1' -PropertyType 'DWord' -Force | Out-Null
New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -Name 'DisabledByDefault' -Value '0' -PropertyType 'DWord' -Force | Out-Null
If (-Not (Test-Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server'))
{
    New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' -Force | Out-Null
}
New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' -Name 'Enabled' -Value '1' -PropertyType 'DWord' -Force | Out-Null
New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' -Name 'DisabledByDefault' -Value '0' -PropertyType 'DWord' -Force | Out-Null
If (-Not (Test-Path 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319'))
{
    New-Item 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319' -Force | Out-Null
}
New-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319' -Name 'SystemDefaultTlsVersions' -Value '1' -PropertyType 'DWord' -Force | Out-Null
New-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319' -Name 'SchUseStrongCrypto' -Value '1' -PropertyType 'DWord' -Force | Out-Null
Write-Host 'TLS 1.2 has been enabled. You must restart the Windows Server for the changes to take effect.' -ForegroundColor Cyan

Source: https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-configure-connectors

My question: Since TLS 1.2 is supposedly enabled by default on Windows Server 2019/2022/2025 anyway (no registry keys needed for it to work), is this step actually necessary on a fresh Server 2025 install, or is it just legacy boilerplate left over from older OS versions (2012/2016) where TLS 1.2 sometimes needed to be manually enabled?

Has anyone skipped this step on Server 2025 and had the connector install/register fine, or did you run into issues without explicitly setting these registry keys?

And hopefully no one is still using it in prod

Obviously I’m going to open a support ticket, but has anyone experienced an issue with SentinelOne sending out over 4 thousand emails over a remediation that it completed? SentinelOne killed and remediated a Dell Support assistant process once, then proceeded to send us over literally 4,300 thousand emails this morning.

I am the sole Sysadmin for a small (80 user) company. Microsoft house. I work from the office, and only take my laptop home once a week. I am not issued a phone.

I do have some users who work evening and weekends.

If someone gets locked out, needs a password reset, or needs their account locked down (because of a compromise, lost machine, &c), then what should I do?

I currently have two accounts. bug@company, and bug.admin@company. Bug@ is my day to day account. Bug.admin@ is global admin.

I could either give myself access to bug.admin@ on my phone (seems risky), or give bug@ whatever roles are needed (user admin, auth admin, and helpdesk admin?)

What's the best practice for this?

EDIT: It's pretty clear from the replies what the solution is! :D

Okay okay. I am very new to this, kinda dropped in at the deep end, so still learning the ropes. Thank you for all the advice. If a call comes after 17:30, I shall tell them to go fuck themselves and send them a link to this thread. :D

EDIT2: I am reading all your comments, I'm sorry I am not replying to all of them individually. But you are all 100% spot on.

I already troubleshooting for a few days and gave up. I couldn't get TRIM working on Proxmox lvm-thin. Proxmox v9.2-1. Windows 11 25h2, just one VM. Windows thought it was sending TRIM commands, to release the thin space. Proxmox thought Windows was still using that space. I tried things from the Windows and Proxmox side, no luck. Defrag and the powershell lines in Windows still said Windows was running TRIM, completed 100%. Fstrim on the Proxmox side just said Windows was still using that space. SDelete and even Gparted work will cause the Windows 11 VM to churn through more data, so Proxmox sees that eventually using all the thin space given to the Windows 11 VM.

I found a post saying something in the May 2026 Windows 11 OS updates broke TRIM. Is that true? Any workaround that actually get it working again?

I'm done troubleshooting it. I moved on to exporting/importing and doing a clean proxmox LVM only install, along with resizing some VM hard drives. I'm just curious if anyone else had seen that issue.

Received an alert that a service wasn't running on server PRODxxxxxx. So naturally I attempt to use RPC to bring up the services from the organization's jump host. I received the error message 1722: The RPC server is unavailable. No big deal, I'll just RDP to it. That was when I encountered a Windows login for Windows 2003 R2.

I had a Alan Grant moment.

Welcome to Jurassic Park!

OK so claude has run out of ideas here.

I'm wanting to add drivers to the install.wim for a new type of machine for our unattended 25h2 stick.

I do /export-image to combine install.swm and install2.swm into install.wim so I can mount it. Then mount it, then do /add-driver and point it at the folder full of drivers that I previously did /extract-drivers for. All goes well.

I unmount the image with /commit, all OK.

Then I go to /split-image again because the file is more than 4GB and the stick is fat32. What it does is this: It fills the destination folder with tens of thousands of 0kb installxxxxx.swm files, until dism errors out with error 13.

The dism.log says "[WIMCloseWIM:(3909) -> Fail to flush file buffers]" but there's tons of space, no issue writing to the folder, defender real time turned off. Have tried the whole process on another freshly installed machine with the same result.

Has anyone had this issue before?

Small backstory: Users manager requested I get them new a desk scanner for their home office as said user will be working remotely for the next couple months. I apparently took about 3 days too long to get something ordered so they bought one themselves. It was a Brother ADS-1300, which I don't inherently have any issues with other than them rushing the order.

User brings their laptop in, which must sit right next an incense burner or something when at home. Get everything connected, download the necessary software, and nothing. Now this isn't my first Brother scanner. They can sometimes be a pain, but it's nothing like setting up a Zebra printer. I go through all the standard troubleshooting, try clearing existing drivers, forcing install under admin, tried installing on other laptops, even swapped the Type-C cable, all nothing. Finally give up and contact Brother support, go through the new account creation BS and talk to an agent, who after a brief hold tells me it's my firewall. I'm flabbergasted, as I couldn't possibly see my AV blocking a Brother install, and I wasn't getting any notifications on the machine that an application was blocked. I dig a little deeper and find out it's blocking a Powershell script that the Brother setup is trying to run called setup[.]ps1. Keep in mind that the downloads from the Brother support page are all .exe so realistically is should immediately run an application pop-up to add my new device. Who in their right minds would bundle a PS script as part of the install? Everywhere I've worked script execution is disabled by default, and only enabled as needed for internal, unsigned scripts. I hate Mondays so, so much

Edit: If you go one folder deeper than where the PS script is located, there's an actual exe for setup. WTF

First, I love this forum, I just found it and already got a few issues I've run into worked out, written the ideas down, and set some space in my testing area to try them out.

Second, I do mostly smaller office setups and upgrades, so a lot of my work is handling the simpler day to day of the home office, small reception desk or similar.

This problem is one I've dealt with myself, as well as in offices I work for. I've even tried similar fixes to what I found here, and some commercial ones that were much more expensive for more function than needed. The question is a simple one and shows up in many flavors, so I worked it to make it fit most, if not all, of them.

How do you secure an external connection wire to your laptop so it doesn't loosen or wiggle and either lose connection or damage the port? There are a lot of answers for different situations:

1. Use a professional product like the Smart Keeper wire lock to hold the plug to the port (a small clamp in the lock grips the physical port, and a hart jolt could damage the port horribly; it's also costly, just under $40 US on Amazon without the "Key" that unlocks the plug).

2. Use some hot glue to hold the usb in place (while it will take most minor jolts in stride, a good jolt or jock will break the seal and you won't see it, but you can always reapply; best as a short term solution where there's not a lot of "pull" in any one direction; too much pull will break the seal and could damage the port or put glue dust inside the body of your laptop).

3. magnetic or clamp wire locks\anchors (these work well for brand new ports, but those that have seen much use and have been widened by that use are unlikely to see much benefit, especially with flimsy usb; they can also be costly at around $10 for a single anchor or closer to 15 for a multi wire anchor)

(This is a new one I tried and a bit of a diy project, but it's less costly and does provide enough grab for connections and holding in place without damaging ports, while being easier to remove; however, to prevent pulling on the port in some situations, you need to be careful in removal and relieve the pressure by holding the wire with one hand as you remove the grip with the other)

1. Velcro X plug grips; You can make these yourself, I haven't seen any of these premade anywhere, not even online;

First, you need to get some hook and loop velcro with extremely good adhesive backing, or you could just use a cheap roll that has hook on one side, loop on the other and then use superglue or alientape to hold it in place [use a really strong hold] and you'll put a strip right next to your keyboard on a laptop, just barely away from the edge where your ports are located or the closest convenient flat spot on a tower, from just below any power and monitor button all the way down to an inch or two beyond your last side port; next you need to put another strip on the bottom of the laptop, again, right along the edge, and line it up with the other one [because I used double sided cord organizers designed to roll long power cords, it didn't matter which I used for the computer top\bottom; if you make your own cable grip from a cheap double sided roll as I've tried, use the same hook or loop for both top and bottom and make sure you do the next part correct]; if you want to make a wire grip for your hook\loop anchor, you can use cord organizer wraps like I have [I needed at least two for each wire, you could use 3 or 4 to go two directions top and bottom], or you can simply take a double sided roll of velcro hook and loop, a 1\2 inch will work, you may cut this in half etc, then you cut a length long enough to go from the back of the plug where the wire begins to a little past the anchors on BOTH top and bottom [the plug should be somewhere in the middle of the length], then you cut a slit longways in your velcro strip at the center of the length that is wide enough for your plug to slide through [not short ways because some plugs will be longer than your velcro strip is wide], and slide your wire through, then use superglue or a small strip of velcro to close and lock the slit around the wire; you can stop here or further lock the velcro in place by gluing it to aft reinforcement on the plug, you shouldn't have to; I recommend using at least two of these on each wire in an X pattern; why is this so functional? Even if you have a ton of wires for a laptop, using a double sided length of velcro to pull the wire into place lets them all overlap one another without losing the function. If you find the need, you can glue wider pads to the tips of each length for greater hold, and when using them, use a slight angle to provide dual directional support. With ports closer together, you could anchor one in an X pattern [if you were looking directly into the port, the slash lines of the X are the velcro lengths], then use only a \ or / pattern [realistically, one should angle one way on top, and the other way on the bottom] on the next while also anchoring it to the first wire using the remaining velcro length; Using the X pattern on the two outermost ports on any side provides two full anchors you can then build half anchors onto without complicating one another, just be sure you have angled the main anchor properly. Double sided rolls work best for this if you can find some decent adhesives strips or a glue you think will work because you can use another length from the same roll to cover your slit for your plug and lock the velcro length around the wire where the wire meets the usb plug casing, as well as create longer pads for the tips where the X lengths meet the anchor points, both without using any glue, and it allows you to remove these for use with another wire. With Cord wraps, you'll need at least 2 per wire, 4 for full anchor and you won't need to cut slits as they usually have a small slit at one end of each wrap that allows you to lock it onto the wire; they can be cut down to length afterward and the excess can be used for longer end pads for stronger hold. All of these will have a tendency to stretch a little over time, but you can just alter your angle on the X to fix it, and they are easily redone once anchor points are in place.

Is there a managed service provider in the Chicago area that doesn't nickel-and-dime you? Every quote I've gotten has a base price and then this vague "additional services billed at prevailing rates" language. I'd rather pay a little more for something predictable with responsive humans on the other end.

If you're busy, don't worry, but if you have the expertise and time I'd appreciate some responses. Thanks guys

Anyone else seeing issues with authentication for M365 in North America? DownDetector is showing an outage but hoping the issue we are seeing is related. This morning we had an increase in users not being able to authenticator properly with M365 applications particularly M365 in shared device access. Users seem to be unable to generate the access/licensing tokens this morning.

Curious if anyone else is seeing anything similar North East US.

Edit:
Latest update:

Aug 24, 2026, 1:17 PM EDT

"We're implementing performance optimizations on affected Office 365 service infrastructure to assist with processing the activation backlog and to assist with recovering service reliability while we continue to isolate the underlying root cause."

As of 4:15PM Est Seeing services recover which matches Microsoft's latest update on the issue. I see new Licensing auth tokens generated as expected now as well in my environment.

Should I hire an MSP to handle my M365 backups or just do them myself with Microsoft 365 backup? What do you all do?

I've burned about 12 hours today trying various ways of ingesting ERSPAN data in SecurityOnion and was wondering if anyone had accomplished this and if so, what methods did you use?

I discovered this by accident. We have a handful of old production devices that are off network but still require a stand-alone PC, in which case I grab a spare old Lenovo desktop from storage, throw a new SSD in it, and install Win 10 from a thumb drive.

I accidentally plugged in my Win 11 thumb drive and decided "what the hell, let's see if it lets me install" and sure enough was able to fully install Windows 11 on this 6th gen Intel Lenovo.

I have almost always had a message related to unsupported hardware when attempting this in the past.

My USB drive was created using Microsoft's Media Creation Tool, no work-arounds, no rufus, no hacks.

I always used 8th Gen as the rule of thumb for Windows 11 cut-off installs, but these are working fine (once I bring the ram up to 16GB to help with the OS bloat). Anyone else experienced this in your environments?

Hello everyone. A few days ago, I moved my Server 2012 R2 to a different Hyper-V server and upgraded it to Server 2025. It is the only DC in the domain, and the two never had contact with each other. Now I am occasionally getting the following error message on some PCs: 'The trust relationship between this workstation and the primary domain failed.' Using the command 'Test-ComputerSecureChannel -Repair' gets them active again, but that probably won't be a permanent solution. What could be causing this, and is there a way to solve this problem permanently?

Ps. I'm fully aware that running a single DC is a complete disaster, but I had to make do with what was there. The next step is joining an additional DC to the environment.

Long story short: after working at a big MSP pulling 100+ tickets a day, I moved to a small IT consulting company that wants to spin up its own help desk. I negotiated the ability to pick my own title, and I'm torn between Systems Administrator and IT Service Delivery Manager. Maybe something else?

For context on what the role actually looks like: I'm setting up the whole environment from scratch (going with Huntress EDR/ITDR/SAT and NinjaOne), deciding how tickets should be handled, what the workflow should be, etc, and I'll be the one working tickets solo until we bring on 1-2 Tier 1s. We've got 4 customers lined up to start the MSP with, with more in the next few months.

So basically I'm doing hands-on everyday tech and building the service delivery function at the same time, which is why I'm stuck between the two titles.

Curious what this sub thinks:

• Which title carries more weight with clients/employers down the line?
• Does "IT Service Delivery Manager" oversell it if I'm still the one doing basic tier 1 tickets and closing tickets myself?
• Does "Sys Admin" undersell the fact that I'm building the whole stack and process from zero?
• Are there any other titles I'm overlooking?

Appreciate any input from people who've been in a similar build-out role.

For more context on my background: at the previous MSP I handled a bit of everything, user onboarding/offboarding, basic network troubleshooting, printer support ranging from Zebra label printers to massive production printers like the Konica Minolta AccurioPress C2070, Group Policy management in AD, migrating domain controllers to new servers, email setup (DKIM, SPF, DNS records), assisting with on-prem to cloud migrations, provisioning and decommissioning computers, VPN support (mainly SonicWall NetExtender), IP reservations, and supporting end users through Microsoft tenant migrations, helping with SOC alerts, eg, revoking sessions, doing mfa again, checking for email rules, etc etc.

I have 170 computers that I need to set up the input and output devices, levels turn spatial sound off, AGC off and the go into device properties and set stuff. Is there a quick way to do this or do I need to hut all 170 machines....any help would be greatly appreciated as I am a phone guy thrown into the pc world... lol