The cut a hole into the box with a box cutter, deep enough to go through the cardboard, through the plastic memory tray, and scored the pins on 14 modules in a tray of 25. Thankfully they didn't "inspect" the other two memory trays. 56/68 modules survived the trip.

https://imgur.com/a/1XerHh0

Disclaimer: The goal of this post is not to bring the pitchforks out and talk about CyberSecurity vendors and their security based on CVEs. No, I do not think Cisco is an insecure company and I do think they are doing a great thing for the community by being up front, disclosing and fixing vulnerabilities discovered in their products.

This is in direct reference to the following post in r/sysadmin about 2 weeks ago:

https://www.reddit.com/r/sysadmin/comments/1wwlgqq/todays_reminder_that_every_security_appliance_is/

You will notice in this post that I made one of the top comments to bring awareness to the lack of attention that is given to CVEs when it is a non-Fortinet product. Well, it just happened again.

Cisco released a 9.8 CVE for their Secure Mail appliance on October 14. The details are available at the following link:
http://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp

The content in this is important but irrelevant to my point. In the release of this vulnerability, there are only 4 mentions (by my search of "CVE-2026-76519") of this:

https://www.reddit.com/search/?q=%22CVE-2026-76519%22&cId=3d232678-6f60-4ffb-940a-de3665695be1&iId=6d9cd08d-e00c-46e4-bae4-638f39723fe0

If you do a search of the FortiMail CVE, you will see there are 17 mentions.

https://www.reddit.com/search/?q=%22CVE-2026-104286%22&cId=0e04f247-a490-4114-a405-b6ccfac473ce&iId=fd67515e-4b1e-44cd-bc8f-a4bc68fb59f2

And within some of these posts, you will see the "insecure CVE brigade" coming in force.

Now I know some time has elapsed over the results of this search, but they all happened within 4 days of each other while the vast majority of these mentions happened within 2 days (the same time period was this Cisco search).

All that being said, my point is that it is very interesting that the same level of coverage is not being extended even when on paper, the two vulnerabilities being compared look very similar. Also, you would think it is more coverage worthy when a second critical CVE was found in the same product within the same month.

Putting on my tin foil hat, I will say, I believe there are other powers at work (besides just the goal of sharing information) to target certain vendors for whatever reason to paint them in a worse off light than others.

However, the important piece in all of this, is to reiterate that the companies who are transparent about CVEs and actually fix them, are the ones who deserve the trust of protecting the digital assets we need to secure.

Thank you for coming to my TED talk.

EDIT: More Skykick enterprise apps being exploited https://www.reddit.com/r/sysadmin/s/M6iilUpoJl

Skykick, the SAAS backup and migration tool now owned by Connectwise (May be called Connectwise Cloud backup) has been breached and active exfil of tenant data is ongoing, disable the Entra enterprise application immediately and check your logs for the IP here. Check for skykick access from previous MSPs.

https://www.reddit.com/r/msp/s/ieagdCmOBb

The IP in your logs doesn't necessarily mean exfil has started as they seem to be mass scanning tenants presumably for high value targets but exfil has been confirmed already in some tenants.

IP: 144.172.64.128

APP ID: 506e08f9-6e9a-4da4-942b-a099a03644ae

Other skykick app IDs are below (there are more than listed below so do a manual check), no reports of access on these but threat hunt. Check the APP ID and not the Object ID on the enterprise app.

2399d300-6fca-4e6a-a686-399fefe75b83 fc2bedd5-450f-4d3c-a2e5-96d2465574d6 ccd0fb86-b4b4-48f1-a3c4-28bd1baeae6e 7441fd5e-1d54-4465-8e18-8f5208c48256 0de14c77-b9b0-4137-9360-34878a929827 2568dd75-4f97-46c4-9235-ff6bcb68557c

This one is also skykick but not mentioned in the title. "0365 Backup Self Service - Customer Access" 59c003ad-130e-4c4c-9796-f0c13cbd7952

Report of suspicious activity with the app making changes to permissions 2 days ago, see comments on the Reddit link above

Keep an eye on activity for activity related to any CW app to be safe.

Legal is involved as they say no backup data was accessed - because they accessed your live data directly. Disingenuous. https://www.connectwise.com/company/trust/advisories

Right out of college I started working at a major insurance company helping them prep for Y2K and worked my way up as high as one could go without being in management. I loved digging into the details and figuring things out. I worked overtime and volunteered for any project. As the years went by and we were sold and then sold again to private investors, my interest waned and management progressively got worse. Now it’s the age of AI and I am staunchly anti-AI. We were mandated to use it for our job duties and mgmt tracked our usage. Scolded or written up if we didn’t use it enough.

Due to my seniority I was able to work remote for several years prior to COVID and then during COVID everyone got to work remote. You know where this is going - now it’s return to the office time as well as mandating the specific days for in-person days. Unrealistic deadlines for complex projects are set by out of touch upper mgmt with no concept of the scope.

I’ve saved money and have nice investments as well as passive income. It was time to go. Years ago I told myself I’d love to retire at the age of 50 and I’ve finally realized my dream. Zero notice given and zero regrets. I feel so good. Goodbye to IT.

Advice to young people just starting out: word hard, save your money and make good investments. Retire early and enjoy your life.

Not unique to our field, but I genuinely really enjoyed this job. It was fully remote, paid well, my boss was a true sysadmin in that as long as I got my work done he didn’t care how I spent my time. I had near full autonomy. Minimal meetings. It was 14 months of the IT job I’d always dreamed of.

My boss resigned earlier this week; the company was going in a direction he didn’t agree with and they were expecting him to fudge the attestation of some compliance reports. With him gone, upper management decided to include our department in the wave of layoffs rather than find a replacement for my boss.

So today I got the calendar invite for a five minute meeting. Exec read the script in 60 seconds flat and sent me on my way. Currently waiting on a follow up email to see if I get a severance or not (please god). Spent the afternoon updating my resume and filling out applications.

I’m bummed. But life goes on. Hopefully I’ll find a similar job (and soon)!

Anyone else getting reports from users on Windows 11 24H2 Enterprise that after getting this month’s cumulative update, whenever they restart or shutdown, they get presented with the message below?

“Someone else is still using this PC. If you restart now, they could lose unsaved work.”

We’ve confirmed that there are no other users on these laptops and I am able to reproduce it too.

Uninstalling KB5127648, the message goes away. Reinstalling it makes it come back.

We are advising users to ignore it, but the false positive message is definitely making people feel uneasy.

I’m curious if anyone has some insights and are seeing the same thing in their environment. Thanks!

Not sure if this is allowed, but we currently use MaaS360 to manage iOS devices. It is expensive and the support stinks. Otherwise, it works for us.

I have been thinking about moving to InTune for a few different reasons. Cost - for us, InTune would be about 50% cheaper, and to have things on one platform.

Wondering if anyone else out there has made this switch and, if so, do you regret it or have any suggestions?

It is hard to really compare platforms. I am going to try a trial but that is going to take some effort to get up and going.

Thanks,

Sharing a critical threat notice for those using BeyondTrust. It's a critical improper origin validation vulnerability in Remote Support that has been confirmed as actively exploited by a suspected China-nexus nation-state threat actor, ARMORY CASTLE since August 2026. Here's their advisory for reference BeyondTrust Advisory: https://www.beyondtrust.com/trust-center/security-advisories/bt26-05

Job A: IT Specialist, $35/hr
Contract, 6+ months. The recruiter was vague about extension ("there's a possibility"), with no specifics.
Hands-on tech work supporting Macs and Windows (I did a similar role for 7 months and enjoyed it)
Would sometimes have to travel to a client site about 1.5 hours each way, and I'd pay for the transit pass myself. The recruiter was vague on how often.
Other days at an office in my city, which I'm fine with
First told I'd be the only technician, then told someone else is there too. Still unclear who covers when I'm absent.
1-hour technical interview, and a polished, client-facing environment (VIP/white-glove support)
**Job B: Service Desk, $29/hr**
Close to home, short commute
Recruiter confirmed it becomes permanent after 6 months
Likely less stressful, and it's the type of work I'm used to
Lower ceiling, and I'm not excited about service desk long-term
**The trade-off:** About $1,000 more per month and better career experience (Job A) vs. confirmed stability, a short commute, and less stress (Job B).
**My questions:**
Which would you take?
How much weight should I give a vague "possibility of extension" from a recruiter?
Is vague communication about travel frequency a red flag, or normal for contract roles

Also. Help desk job is hybrid

I have created smallstep + keycloak.
So i thought I could create keycloak for handling SSO to our users through oidc and that I could use smallstep to generate shortlived certs for users so they can ssh to any server without having to create an user account. I have realised thats not the case with smallstep

I need to create an ldap directory but the thing is I have introduced 2 servers already that needs to be maintained and now I need to add an openldap server + ldapaccount manager server + sssd. So I do not have to create 50 users everytime I add an server.

Should I have just used AD? Feels like my design is bad.

Trying to get clarity from the source because I’m getting figures all over the place.

Brought to you by r/sysadmin Trusted VAR: u/SquizzOC with Trusted Telecom Broker u/Each1Teach1x27 and u/Necessary_Time Trusted VAR in Canada

Happy to answer in the thread or via PM if you don't want to post details like service locations publicly.

This BI-WEEKLY thread is here for you to discuss vendor and service provider expectations, pricing, and quotes for network services, licensing, support, deployment, and hardware.  

Required Info for accurate answers:

• ⁠Part Number
• ⁠Manufacturer/vendor
• ⁠Service Type and Service Location (DM Service Location)
• ⁠Quantity (as applicable)

All questions are welcome regarding:

• ⁠Cloud services, security, configurations, deployment, management, and migrations
• ⁠Storage vendor options, alternatives, details,
• ⁠Software licensing: This includes Microsoft CSPs
• ⁠Connectivity, single-site, and multi-location. DIA, Broadband, 5G, datacenter connectivity, site serviceability checks for fiber/broadband
• ⁠Voice services, SIP, UCaaS, Contact Center, POTS (Analog line) replacement
• ⁠Network infrastructure - overlay software, segmentation, routers, switches, load balancing, APs
• ⁠Security, access management, firewalls, MFA, cloud DNS, layer 7 services, antivirus, email, DLP

Can someone let me know why trusted tech is so cheap and if they’re legit? Wondering if this is a too good to be true situation or if its actually good. 

Not trying to talk bad or good about them, just legit wondering. My grandpa always said “If its too good to be true, it’s a lie!” And I aint tryna get lied to lol. Thanks for any help given in advance, I know I can look up reviews but Reddit is my best friend

I haven't really seen any posts about this but it seems to be affecting a lot new servers we've deployed over the last couple of years. I have a feeling I'm going to be spending the rest of my day dispatching Lenovo hardware techs.

https://datacentersupport.lenovo.com/us/en/products/servers/thinksystem/sr250v3/7dcl/7dclcto1ww/jz018e0b/solutions/tt4152

We had a working inventory management setup at my last company, built on Airtable. Did the job for about a year and a half. Our ops lead decided we needed "full control" because it was getting expensive, so we spent three months having a contractor build a custom version. Within six weeks of launch, the warehouse guys were back to texting stock counts to the ops lead because the tool double-counted returns and nobody trusted it. We quietly went back to a paid setup.

Then this year, different job, same conversation. We're about 40 people, paying for inventory management, a CRM and support tools, and the idea was to replace the whole lot with one app. Inventory first, then sales and support, all working with the same data instead of moving things between systems.

This time the argument was "we can build it with Codex." Which, honestly, sounded reasonable to me too. Fewer subscriptions, no upgrading Airtable plans because we'd hit a record limit, and we could change things ourselves instead of waiting on a vendor. I just didn't want to repeat the warehouse situation.

Then we started listing what this thing actually needed. Warehouse staff should be able to update stock without seeing everything sales can see. Support needs customer history, but probably shouldn't be able to change every field in it. Someone needs to know who changed a number when it looks wrong. Then there's SSO, removing access when people leave, and checking that the permissions actually hold up outside whatever buttons we've hidden in the UI.

Suddenly we're discussing how to build and test our own permissions system before we've even replaced the inventory tool. Codex might help us write it, but somebody still has to check it, maintain it and deal with the consequences when it's wrong. None of that was in the original "look how much we'll save on subscriptions" conversation.

So I started looking at databases and app builders that already had those pieces together. We wanted one place to build our own workflows, with permissions, audit logs and login handled, rather than another project just to make the first project safe to use.

We ended up deciding to try Jet Admin because it connects to Airtable and has permissions, audit logs and SSO built in. We can start with the data we already have, test the inventory workflow, and work out the database move separately. Obviously, keeping Airtable underneath doesn't make its bill disappear. But it lets us try the app before moving everything and committing sales and support to it too.

Now we're back to considering a paid platform after starting this whole thing to get rid of paid platforms. I'm fine with that if it saves us months of rebuilding the boring stuff. I just wish we'd included that work in the comparison from the beginning.

Has anyone actually managed to replace inventory, CRM and support with one in-house app? Where did you draw the line between building it yourselves and paying for the parts you didn't want to maintain?

We bough several new servers last month. Today I racked over $60 grand (USD) worth of hardware. Probably closer to $70 Grand... It was only 3 servers.... 5 years ago, it was only around 20k. It's crazy....

Now to throw down with the boss on not putting VMWare on them. As much as I can anyway

We have several Zebra printers at our company. We’re based in Europe, and due to legal requirements, all logs are disabled by default and must be enabled using a script. We’ve set up our script so that everything is enabled and Protected Mode is disabled.

The problem is that the first printer has different passwords than all the others. So my question is, is this a problem? Will I ever need the passwords I set again once I’ve opened all the protocolls?

Basically the title - nobody in my small team can use RSAT tools (any of them, from ADUC to WSUS) on their management workstations immediately after the 2026-10 CU reboot. I'm just wondering if it is something we're doing in combination with network security or if it was just another F-U from MS.

OK. That's not entirely true.

We allow Salesforce's ~13,000 users to send emails out of Exchange Online. We also temporarily allowed some accounting software used by three people at a company we acquired, while we wait for them to onboarded onto SAP. And we allow Power Automate to send emails through Exchange Online.

We also have some internal IT automation that has permission, but scoped through ExO RBAC to dedicated mailboxes, and we have mail flow rules to prevent those mailboxes from sending emails to externals.

For everything else, we have published policies that state that requests for Mail.Send permissions have a 100% rejection rate.

If an internally hosted application needs to send emails, we provide an internal SMTP relay. If a cloud application needs to send emails, and it cannot do so natively, we provide a cloud SMTP relay. Many internal applications and every cloud application gets its own dedicated sending subdomain so we know which application sent the mail. In the case of larger cloud applications, they get dedicated IPs to help with sender reputation isolation.

Our reasoning for this policy, I think, it quite varied:

• We have limited monitoring of Exchange activities performed by external applications; we have our OfficeActivity logs passed through Sentinel and into Log Analytics, but we lack the resource or in-house knowledge to actively review these logs, or develop monitoring and detection systems to identify and alert for abnormal sending patterns.
  
• Because of this, in the event of a misconfiguration o the cloud application, or third-party application compromise, we are not sure we would be able to detect and respond to it in a reasonable time frame.
  
• The policies and controls we have in place help us identify which emails came from which application, and provide sender reputation isolation; sending through Exchange Online using our internal mail domains bypasses these controls.
  
• Emails sent through these systems would also bypass our inbound mail-security stack. Incoming emails are checked by our secure email gateway, while a second API-based tool checks emails in mailboxes post-delivery, but this tool does not have automatic remediation active for internal domains.
  
• From a compliance and audit perspective, at least where application permissions are granted, it can cause challenges in identifying who actually triggered the sending of the email from the third-party application.
  
• We have employees in over 100 countries and, with quite a decentralised IT operation model. If we permit Mail.Send permissions for one local application, it makes it harder to reject similar requests elsewhere. We could effectively find ourselves opening pandora's box.

And that last point is why we basically have a zero-exception policy in place and have put time and effort into providing alternatives. We don't prevent cloud applications from sending emails. We just don't allow it to happen through Exchange Online.

How do the rest of you handle this? Do you allow cloud applications to have Mail.Send permissions in your environment? And, if you do, would you prefer it if you didn't?

We've been using EfficientIP SOLIDserver for over 20 years. EfficientIP recently informed us that support for our perpetual licenses will end in August 2027. Their replacement subscription quote triples our annual cost (a 200% increase), with no protection against further increases at renewal.

We're evaluating alternatives and would appreciate recommendations from others with similar environments.

Our requirements include:

• Recursive and authoritative DNS with geographically distributed BGP anycast (currently three nodes, expanding to five).
• IPv4/IPv6 IPAM, including customer allocations and reverse DNS management.
• Self-hosted deployment on our own infrastructure.
• Reliable commercial support, strong APIs, and predictable long-term licensing costs.

We're considering Micetro, PowerDNS with NetBox, and BIND/Unbound-based solutions, but are open to other options.

Has anyone migrated away from SOLIDserver or operated these alternatives in an ISP anycast environment? Particularly interested in reliability, IPAM integration, migration experience, and ongoing costs.

Appreciate any firsthand experience or recommendations.

Test

User said they forgot their password.

I offered them to change it.

They accepted.

I told them to note their new password.

They said it's done.

I am now waiting for them to change it.

Few minutes later, another user messaged me saying that the password I gave (they wrote it plain to me, meaning they now know the password of another user) is not working.

They sent me the password they tried. The user noted the password without noting the uppercases and mixed the numbers.

I love my blue collar users.

My employer has recently decided to hire a new IT support person for our helpdesk; I found the position on indeed and was surprised to see the top of the pay range is about $10k more than I am currently making.

I have taken every challenge on headfirst and really grown our current IT department. However, I do not know how to bring up the subject of a raise/increase. Should I send an email to my boss or have an in-person conversation? They have me reviewing resumes for this position that could potentially pay more than mine, and its rubbing me the wrong way.