The cut a hole into the box with a box cutter, deep enough to go through the cardboard, through the plastic memory tray, and scored the pins on 14 modules in a tray of 25. Thankfully they didn't "inspect" the other two memory trays. 56/68 modules survived the trip.

https://imgur.com/a/1XerHh0

Disclaimer: The goal of this post is not to bring the pitchforks out and talk about CyberSecurity vendors and their security based on CVEs. No, I do not think Cisco is an insecure company and I do think they are doing a great thing for the community by being up front, disclosing and fixing vulnerabilities discovered in their products.

This is in direct reference to the following post in r/sysadmin about 2 weeks ago:

https://www.reddit.com/r/sysadmin/comments/1wwlgqq/todays_reminder_that_every_security_appliance_is/

You will notice in this post that I made one of the top comments to bring awareness to the lack of attention that is given to CVEs when it is a non-Fortinet product. Well, it just happened again.

Cisco released a 9.8 CVE for their Secure Mail appliance on October 14. The details are available at the following link:
http://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp

The content in this is important but irrelevant to my point. In the release of this vulnerability, there are only 4 mentions (by my search of "CVE-2026-76519") of this:

https://www.reddit.com/search/?q=%22CVE-2026-76519%22&cId=3d232678-6f60-4ffb-940a-de3665695be1&iId=6d9cd08d-e00c-46e4-bae4-638f39723fe0

If you do a search of the FortiMail CVE, you will see there are 17 mentions.

https://www.reddit.com/search/?q=%22CVE-2026-104286%22&cId=0e04f247-a490-4114-a405-b6ccfac473ce&iId=fd67515e-4b1e-44cd-bc8f-a4bc68fb59f2

And within some of these posts, you will see the "insecure CVE brigade" coming in force.

Now I know some time has elapsed over the results of this search, but they all happened within 4 days of each other while the vast majority of these mentions happened within 2 days (the same time period was this Cisco search).

All that being said, my point is that it is very interesting that the same level of coverage is not being extended even when on paper, the two vulnerabilities being compared look very similar. Also, you would think it is more coverage worthy when a second critical CVE was found in the same product within the same month.

Putting on my tin foil hat, I will say, I believe there are other powers at work (besides just the goal of sharing information) to target certain vendors for whatever reason to paint them in a worse off light than others.

However, the important piece in all of this, is to reiterate that the companies who are transparent about CVEs and actually fix them, are the ones who deserve the trust of protecting the digital assets we need to secure.

Thank you for coming to my TED talk.

EDIT: More Skykick enterprise apps being exploited https://www.reddit.com/r/sysadmin/s/M6iilUpoJl

Skykick, the SAAS backup and migration tool now owned by Connectwise (May be called Connectwise Cloud backup) has been breached and active exfil of tenant data is ongoing, disable the Entra enterprise application immediately and check your logs for the IP here. Check for skykick access from previous MSPs.

https://www.reddit.com/r/msp/s/ieagdCmOBb

The IP in your logs doesn't necessarily mean exfil has started as they seem to be mass scanning tenants presumably for high value targets but exfil has been confirmed already in some tenants.

IP: 144.172.64.128

APP ID: 506e08f9-6e9a-4da4-942b-a099a03644ae

Other skykick app IDs are below (there are more than listed below so do a manual check), no reports of access on these but threat hunt. Check the APP ID and not the Object ID on the enterprise app.

2399d300-6fca-4e6a-a686-399fefe75b83 fc2bedd5-450f-4d3c-a2e5-96d2465574d6 ccd0fb86-b4b4-48f1-a3c4-28bd1baeae6e 7441fd5e-1d54-4465-8e18-8f5208c48256 0de14c77-b9b0-4137-9360-34878a929827 2568dd75-4f97-46c4-9235-ff6bcb68557c

This one is also skykick but not mentioned in the title. "0365 Backup Self Service - Customer Access" 59c003ad-130e-4c4c-9796-f0c13cbd7952

Report of suspicious activity with the app making changes to permissions 2 days ago, see comments on the Reddit link above

Keep an eye on activity for activity related to any CW app to be safe.

Legal is involved as they say no backup data was accessed - because they accessed your live data directly. Disingenuous. https://www.connectwise.com/company/trust/advisories

I dug around the internet for a solution and couldn't find anything worth diving into. Even the one "paid" solution (Files App) that I read might be able to do it, didn't seem like it could when I tested it and it also would be a pain to deploy at any scale but your own computer.

So I did what any developer minded IT person would do and dug through open source solutions, still nothing but one for the completely wrong OS (https://github.com/bewithdhanu/office-online-bridge-macos). This project gave me the idea to try porting the same work around to Windows. I sort of did it. Basically the same idea but used the existing "View Online" function from the context menu and wrote a PowerShell script to execute it. The script was then improved with an exe wrapper to make it more user friendly.

I am pretty surprised this solution hasn't been made before, but here it is now!

https://github.com/Fireant456/M365-Bridge

It is bundled with an installer that can be deployed silently. Only requirement (at the moment) is that your files you are attempting to open must be in a OneDrive synced folder. If they are not an error will tell you they need to be. I might work to add automatic handling of uploading files to a temporary OneDrive directory and writeback to the original location in order to seamlessly handle non-synced file editing, but I don't require that in my use case. Happy to take pull requests if anyone wants to give it a shot.

Would love any feedback. Enjoy!

Right out of college I started working at a major insurance company helping them prep for Y2K and worked my way up as high as one could go without being in management. I loved digging into the details and figuring things out. I worked overtime and volunteered for any project. As the years went by and we were sold and then sold again to private investors, my interest waned and management progressively got worse. Now it’s the age of AI and I am staunchly anti-AI. We were mandated to use it for our job duties and mgmt tracked our usage. Scolded or written up if we didn’t use it enough.

Due to my seniority I was able to work remote for several years prior to COVID and then during COVID everyone got to work remote. You know where this is going - now it’s return to the office time as well as mandating the specific days for in-person days. Unrealistic deadlines for complex projects are set by out of touch upper mgmt with no concept of the scope.

I’ve saved money and have nice investments as well as passive income. It was time to go. Years ago I told myself I’d love to retire at the age of 50 and I’ve finally realized my dream. Zero notice given and zero regrets. I feel so good. Goodbye to IT.

Advice to young people just starting out: word hard, save your money and make good investments. Retire early and enjoy your life.

Not unique to our field, but I genuinely really enjoyed this job. It was fully remote, paid well, my boss was a true sysadmin in that as long as I got my work done he didn’t care how I spent my time. I had near full autonomy. Minimal meetings. It was 14 months of the IT job I’d always dreamed of.

My boss resigned earlier this week; the company was going in a direction he didn’t agree with and they were expecting him to fudge the attestation of some compliance reports. With him gone, upper management decided to include our department in the wave of layoffs rather than find a replacement for my boss.

So today I got the calendar invite for a five minute meeting. Exec read the script in 60 seconds flat and sent me on my way. Currently waiting on a follow up email to see if I get a severance or not (please god). Spent the afternoon updating my resume and filling out applications.

I’m bummed. But life goes on. Hopefully I’ll find a similar job (and soon)!

Anyone else getting reports from users on Windows 11 24H2 Enterprise that after getting this month’s cumulative update, whenever they restart or shutdown, they get presented with the message below?

“Someone else is still using this PC. If you restart now, they could lose unsaved work.”

We’ve confirmed that there are no other users on these laptops and I am able to reproduce it too.

Uninstalling KB5127648, the message goes away. Reinstalling it makes it come back.

We are advising users to ignore it, but the false positive message is definitely making people feel uneasy.

I’m curious if anyone has some insights and are seeing the same thing in their environment. Thanks!

I'm the only internal IT person at a company of about 165 people (M365, Intune, around 55 SaaS tools), and for the last three months I've run most of the daily work through a self-hosted AI agent that's wired into our stack via MCP.

It does the read-only digging on every ticket, prepares onboarding, offboarding and license changes, and answers plain how-to and hardware questions directly. Anything that changes a system still waits for my explicit yes, and that's enforced in the agent harness, not just in the prompt.

My rough estimate is that about 20% of my week is still real work, the rest is reviewing and saying yes or no. Curious if anyone else here runs something similar, and where you draw the line on what an agent may do without approval.

Hi everyone,

I recently bought a used Dell PowerEdge R610 and have been trying to get the iDRAC6 remote management working, but after like 2 hours of trial and error I'm running out of ideas.

iDRAC6 is enabled and obtains an IP address via DHCP. It currently shows an address in my local network but I cannot access it through a browser or ping it.

I have also configured the Lifecycle Controller through the Unified Server Configurator (USC). Its network interface has a separate IP address, and that address responds to ping successfully. However, this does not help me access the iDRAC6 web interface.

Things I've already tried:

- Enabled and disabled DHCP and checked the iDRAC network settings.

- Tried the available NIC selection modes: Shared, Shared with Failover LOM 2, and Shared with Failover All LOMs.

- Connected network cables to all four onboard Ethernet ports.

- Disabled VLAN.

- Performed a complete power drain by disconnecting both power supplies and holding the power button for at least 10 seconds.

- Reset the iDRAC configuration to factory defaults, but the attempt failed with “Failed to reset to default values.”

- Initially, the server displayed “iDRAC6 not responding. Rebooting.” After the power drain, that particular error stopped appearing.

- The Lifecycle Controller can now retrieve the iDRAC configuration, and the iDRAC displays an IP address, but I still cannot reach it.

I also noticed a BIOS battery warning in the system event log, although I'm not sure whether that is related.

My questions:

1. Does this sound like a failed iDRAC6 controller, or could it still be a firmware or network configuration issue?

2. Is there a reliable way to recover or reflash the iDRAC6 firmware on an R610?

3. Is there anything else I should check before assuming the hardware is faulty?

I'd really appreciate any suggestions. I've tried quite a few things already, and I'm not sure what to do next.

Thanks!

Sharing a critical threat notice for those using BeyondTrust. It's a critical improper origin validation vulnerability in Remote Support that has been confirmed as actively exploited by a suspected China-nexus nation-state threat actor, ARMORY CASTLE since August 2026. Here's their advisory for reference BeyondTrust Advisory: https://www.beyondtrust.com/trust-center/security-advisories/bt26-05

Not sure if this is allowed, but we currently use MaaS360 to manage iOS devices. It is expensive and the support stinks. Otherwise, it works for us.

I have been thinking about moving to InTune for a few different reasons. Cost - for us, InTune would be about 50% cheaper, and to have things on one platform.

Wondering if anyone else out there has made this switch and, if so, do you regret it or have any suggestions?

It is hard to really compare platforms. I am going to try a trial but that is going to take some effort to get up and going.

Thanks,

Received three bare metal servers recently and the manufacturer self test tools keep crashing after half a day of running.

It's been a while since I had my own usb for testing servers so what live bootable or otherwise do you normally use to automatically perform testing?

Manufacturer of said equipment is of no help.

I have created smallstep + keycloak.
So i thought I could create keycloak for handling SSO to our users through oidc and that I could use smallstep to generate shortlived certs for users so they can ssh to any server without having to create an user account. I have realised thats not the case with smallstep

I need to create an ldap directory but the thing is I have introduced 2 servers already that needs to be maintained and now I need to add an openldap server + ldapaccount manager server + sssd. So I do not have to create 50 users everytime I add an server.

Should I have just used AD? Feels like my design is bad.

Trying to get clarity from the source because I’m getting figures all over the place.

Brought to you by r/sysadmin Trusted VAR: u/SquizzOC with Trusted Telecom Broker u/Each1Teach1x27 and u/Necessary_Time Trusted VAR in Canada

Happy to answer in the thread or via PM if you don't want to post details like service locations publicly.

This BI-WEEKLY thread is here for you to discuss vendor and service provider expectations, pricing, and quotes for network services, licensing, support, deployment, and hardware.  

Required Info for accurate answers:

• ⁠Part Number
• ⁠Manufacturer/vendor
• ⁠Service Type and Service Location (DM Service Location)
• ⁠Quantity (as applicable)

All questions are welcome regarding:

• ⁠Cloud services, security, configurations, deployment, management, and migrations
• ⁠Storage vendor options, alternatives, details,
• ⁠Software licensing: This includes Microsoft CSPs
• ⁠Connectivity, single-site, and multi-location. DIA, Broadband, 5G, datacenter connectivity, site serviceability checks for fiber/broadband
• ⁠Voice services, SIP, UCaaS, Contact Center, POTS (Analog line) replacement
• ⁠Network infrastructure - overlay software, segmentation, routers, switches, load balancing, APs
• ⁠Security, access management, firewalls, MFA, cloud DNS, layer 7 services, antivirus, email, DLP

Can someone let me know why trusted tech is so cheap and if they’re legit? Wondering if this is a too good to be true situation or if its actually good. 

Not trying to talk bad or good about them, just legit wondering. My grandpa always said “If its too good to be true, it’s a lie!” And I aint tryna get lied to lol. Thanks for any help given in advance, I know I can look up reviews but Reddit is my best friend

I haven't really seen any posts about this but it seems to be affecting a lot new servers we've deployed over the last couple of years. I have a feeling I'm going to be spending the rest of my day dispatching Lenovo hardware techs.

https://datacentersupport.lenovo.com/us/en/products/servers/thinksystem/sr250v3/7dcl/7dclcto1ww/jz018e0b/solutions/tt4152

We had a working inventory management setup at my last company, built on Airtable. Did the job for about a year and a half. Our ops lead decided we needed "full control" because it was getting expensive, so we spent three months having a contractor build a custom version. Within six weeks of launch, the warehouse guys were back to texting stock counts to the ops lead because the tool double-counted returns and nobody trusted it. We quietly went back to a paid setup.

Then this year, different job, same conversation. We're about 40 people, paying for inventory management, a CRM and support tools, and the idea was to replace the whole lot with one app. Inventory first, then sales and support, all working with the same data instead of moving things between systems.

This time the argument was "we can build it with Codex." Which, honestly, sounded reasonable to me too. Fewer subscriptions, no upgrading Airtable plans because we'd hit a record limit, and we could change things ourselves instead of waiting on a vendor. I just didn't want to repeat the warehouse situation.

Then we started listing what this thing actually needed. Warehouse staff should be able to update stock without seeing everything sales can see. Support needs customer history, but probably shouldn't be able to change every field in it. Someone needs to know who changed a number when it looks wrong. Then there's SSO, removing access when people leave, and checking that the permissions actually hold up outside whatever buttons we've hidden in the UI.

Suddenly we're discussing how to build and test our own permissions system before we've even replaced the inventory tool. Codex might help us write it, but somebody still has to check it, maintain it and deal with the consequences when it's wrong. None of that was in the original "look how much we'll save on subscriptions" conversation.

So I started looking at databases and app builders that already had those pieces together. We wanted one place to build our own workflows, with permissions, audit logs and login handled, rather than another project just to make the first project safe to use.

We ended up deciding to try Jet Admin because it connects to Airtable and has permissions, audit logs and SSO built in. We can start with the data we already have, test the inventory workflow, and work out the database move separately. Obviously, keeping Airtable underneath doesn't make its bill disappear. But it lets us try the app before moving everything and committing sales and support to it too.

Now we're back to considering a paid platform after starting this whole thing to get rid of paid platforms. I'm fine with that if it saves us months of rebuilding the boring stuff. I just wish we'd included that work in the comparison from the beginning.

Has anyone actually managed to replace inventory, CRM and support with one in-house app? Where did you draw the line between building it yourselves and paying for the parts you didn't want to maintain?

We bough several new servers last month. Today I racked over $60 grand (USD) worth of hardware. Probably closer to $70 Grand... It was only 3 servers.... 5 years ago, it was only around 20k. It's crazy....

Now to throw down with the boss on not putting VMWare on them. As much as I can anyway

We have several Zebra printers at our company. We’re based in Europe, and due to legal requirements, all logs are disabled by default and must be enabled using a script. We’ve set up our script so that everything is enabled and Protected Mode is disabled.

The problem is that the first printer has different passwords than all the others. So my question is, is this a problem? Will I ever need the passwords I set again once I’ve opened all the protocolls?

Basically the title - nobody in my small team can use RSAT tools (any of them, from ADUC to WSUS) on their management workstations immediately after the 2026-10 CU reboot. I'm just wondering if it is something we're doing in combination with network security or if it was just another F-U from MS.

Job A: IT Specialist, $35/hr
Contract, 6+ months. The recruiter was vague about extension ("there's a possibility"), with no specifics.
Hands-on tech work supporting Macs and Windows (I did a similar role for 7 months and enjoyed it)
Would sometimes have to travel to a client site about 1.5 hours each way, and I'd pay for the transit pass myself. The recruiter was vague on how often.
Other days at an office in my city, which I'm fine with
First told I'd be the only technician, then told someone else is there too. Still unclear who covers when I'm absent.
1-hour technical interview, and a polished, client-facing environment (VIP/white-glove support)
**Job B: Service Desk, $29/hr**
Close to home, short commute
Recruiter confirmed it becomes permanent after 6 months
Likely less stressful, and it's the type of work I'm used to
Lower ceiling, and I'm not excited about service desk long-term
**The trade-off:** About $1,000 more per month and better career experience (Job A) vs. confirmed stability, a short commute, and less stress (Job B).
**My questions:**
Which would you take?
How much weight should I give a vague "possibility of extension" from a recruiter?
Is vague communication about travel frequency a red flag, or normal for contract roles

Also. Help desk job is hybrid

OK. That's not entirely true.

We allow Salesforce's ~13,000 users to send emails out of Exchange Online. We also temporarily allowed some accounting software used by three people at a company we acquired, while we wait for them to onboarded onto SAP. And we allow Power Automate to send emails through Exchange Online.

We also have some internal IT automation that has permission, but scoped through ExO RBAC to dedicated mailboxes, and we have mail flow rules to prevent those mailboxes from sending emails to externals.

For everything else, we have published policies that state that requests for Mail.Send permissions have a 100% rejection rate.

If an internally hosted application needs to send emails, we provide an internal SMTP relay. If a cloud application needs to send emails, and it cannot do so natively, we provide a cloud SMTP relay. Many internal applications and every cloud application gets its own dedicated sending subdomain so we know which application sent the mail. In the case of larger cloud applications, they get dedicated IPs to help with sender reputation isolation.

Our reasoning for this policy, I think, it quite varied:

• We have limited monitoring of Exchange activities performed by external applications; we have our OfficeActivity logs passed through Sentinel and into Log Analytics, but we lack the resource or in-house knowledge to actively review these logs, or develop monitoring and detection systems to identify and alert for abnormal sending patterns.
  
• Because of this, in the event of a misconfiguration o the cloud application, or third-party application compromise, we are not sure we would be able to detect and respond to it in a reasonable time frame.
  
• The policies and controls we have in place help us identify which emails came from which application, and provide sender reputation isolation; sending through Exchange Online using our internal mail domains bypasses these controls.
  
• Emails sent through these systems would also bypass our inbound mail-security stack. Incoming emails are checked by our secure email gateway, while a second API-based tool checks emails in mailboxes post-delivery, but this tool does not have automatic remediation active for internal domains.
  
• From a compliance and audit perspective, at least where application permissions are granted, it can cause challenges in identifying who actually triggered the sending of the email from the third-party application.
  
• We have employees in over 100 countries and, with quite a decentralised IT operation model. If we permit Mail.Send permissions for one local application, it makes it harder to reject similar requests elsewhere. We could effectively find ourselves opening pandora's box.

And that last point is why we basically have a zero-exception policy in place and have put time and effort into providing alternatives. We don't prevent cloud applications from sending emails. We just don't allow it to happen through Exchange Online.

How do the rest of you handle this? Do you allow cloud applications to have Mail.Send permissions in your environment? And, if you do, would you prefer it if you didn't?