https://www.bleepingcomputer.com/news/microsoft/september-windows-server-updates-break-remote-desktop-services/

Came in to work today and coworkers were scrambling through event viewer and regedit, doing reboots to no evail. I did a quick search and found windows bunged up our RDS.

Turns out this update was from last week and the workaround was rolling back a version to a 9.8 CVE. Fortunately, Microslop issues an OOB fix literally this morning so we could use that.

Frickin Windows man.

Seeing lots of internet problems through LAX/Downtown datacenters. Spectrum traffic heavily affected but not exclusively.

Monthly updates for Windows and other microsoft software include critical patches. https://www.bleepingcomputer.com/news/microsoft/windows-11-kb5121003-and-kb5120240-cumulative-updates-released/

Crossposted from https://thebrainbin.org/m/[email protected]/t/1840283

Which approach do you think is better, and why?

1. FIDO2
2. HMAC-SHA1
3. OpenPGP (alternative guide)

Or do you think there is an even better way to use a hardware security token to unlock drives having LUKS full disk encryption?

I'm a junior-ish sysadmin with 3 years of experience and I just got my RHCSA. I want to get more experience with Kubernetes, Terraform and DevOps in general and a colleague of mine recommended KodeKloud. Is it worth it? Do you guys ever tried it and can share your experience with it?

I wanted to disable the prompt and button for new Outlook. I found this guide and wrote a few lines of PowerShell to automate it and wanted to share.

# Source https://edi.wang/post/2025/1/20/how-to-stop-automatically-switching-to-new-outlook
$path='HKCU:\Software\Microsoft\Office\16.0\Outlook'

# Remove and create to ensure correct data type
Remove-ItemProperty -Path "$path\Options\General" -Name 'NewOutlookAutoMigrationStage' -ErrorAction SilentlyContinue
New-ItemProperty -Path "$path\Options\General" -Name 'NewOutlookAutoMigrationStage' -Type DWord -Value 1
Remove-ItemProperty -Path "$path\Options\General" -Name 'NewOutlookAutoMigrationStage'
Remove-ItemProperty -Path "$path\Options\General" -Name 'NewOutlookAutoMigrationType'
Remove-Item -Path "$path\NewOutlook"
# Remove and create to ensure correct data type
Remove-ItemProperty -Path "$path\Preferences" -Name 'UseNewOutlook' -ErrorAction SilentlyContinue
New-ItemProperty -Path "$path\Preferences" -Name 'UseNewOutlook' -Type DWord -Value 0
Remove-ItemProperty -Path "$path\Preferences" -Name 'NewOutlookRenudgeStartDate'
Remove-ItemProperty -Path "$path\Preferences" -Name 'NewOutlookRenudgeStartDate'

Hey everyone,

Today I'm sharing a project I initially built to solve a personal problem that has quickly been picking up traction: HoneyWire v2.0. Hopefully it will help you out as well!

I wanted to run high-fidelity network canaries in my network, but I couldn’t justify enterprise pricing, and I wasn’t a fan of managing custom orchestration across all my VMs to make available OSS solutions work.

So, I built HoneyWire. It’s a completely free, open-source distributed deception platform.

It uses a point-in-time CLI wizard to deploy hardened, distroless Docker traps. You run the command once, it spins up the decoy, registers it to your centralized Hub dashboard, and the setup agent completely exits. No persistent background daemons.

Main Features:

Zero-Agent: No ongoing background overhead on your hosts.

Centralized UI: Manage fleet settings, deployments, View fleet health, uptime, and lateral movement alerts.

Alerting: Built-in push notifications and SIEM forwarding.

Privacy: 100% free, open-source.

UX: 60 seconds from a fresh Linux box to an active cyber canary.

GitHub Repo: https://github.com/andreicscs/HoneyWire Landing Page: https://honeywire.dev/

Would love to hear your thoughts on the architecture or any feedback if you test it out!

AI Disclosure: As a student and solo developer/maintainer, I used AI as a “junior dev” during project development to help accelerate boilerplate writing and documentation. All core architecture, system structure, and security logic were fully designed and implemented by me.

Hello all,

I have recently joined a company as a system administrator and I am in a dire need of advice.

In the interviews we discussed how it is needed for the company to manage Windows endpoints, apply policies, patch them and make sure that they comply with new regulations.

They told me the RMM that they will use and I took for granted that I will have an AD or intune as a tool along side it.

Apparently all I will have is the RMM tool, nothing else, which I think is insane. They expect me to manage the local policies through scripts that I will push through the RMM.

I have told my supervisor that this is not a good idea because the endpoints will basically be unamanged devices, scripts are not reliable and tend to break with updates, they won't stack well... etc. The response was: "this is how we were advised to proceed" (probably by the RMM company, I did not ask), with automations and scripts. I asked for a possibility for an MDM but they will have to check the cost of that.

Now the colleague (field tech) that was starting the project before I came along is fine with it somehow, and I had a look into a script that will set the password "policies". It is a combination of "net" and changing the local security database of windows.

Am I out of touch? I have to admit that I am relatively new to the field and my scripting skills are not good. I am writing a report about this which I am not sure if I should send or not.

What would you do here? Do I need to skill up and take it on?

Hello!

Sorry in advance for quite a long post but I am unsure how to explain everything without writing it all down here... so thank you and please bare with me! :)

I've just started a new job as junior IT sysadmin and am trying to figure out whether my worries are normal or if this is just what some smaller companies are like and everything is ok.

During the hiring they've told me they have no internal IT department and relies only on 2 external IT people: -1 consultant who sometimes helps with sharepoint -1 sysadmin who manages everything but also works fulltime for another company They've also mentioned they had recently migrated to M365 and that the migration has caused all kinds of issues with permissions, access rights, and overall administration. It sounded very messy but also interesting, so I still accepted the offer thinking I will have to deal mostly with M365.

Now I've started this job and got to know that comany's CEO is apparently quite controlling and wants to know and see everything. He is also a Global admin in M365 and has additional high privilege roles assigned. I've also learned that the expectations now seems much bigger than what I would normally think that only a junior sysadmin alone should do since they expect me to: -help with sharepoint administration and it's structure -manage and redesign existing M365 permissions and access -communicate with all departments to understand their workflows, requirements and software that they use -review entire companys IT infrastructure -potentially introduce company wide AI and security policies -work with and administrate MS Dynamics and PowerBI (I told them that I have no or almost no experience with those) -work with integrations between sales platforms and internal systems -participate in and maybe even lead future CRM migration (no more info) -help with creating a document management system because they currently don't have it -potentially introduce on prem servers in future

At this moment I have only sharepoint permissions in M365, which are nowhere near enough for many tasks I'm being asked to help with not to mention that I have no admin access in my computer either. I've requested necessary access to actually do tasks they're expecting from me from the external sysadmin. I asked for global admin and local admin rights, providing detailed info in an email for why I need them. I've also cc'd my manager (that's not even related to IT) to document everything. The external sysadmin just sorta ignored me by only replying that they wish to meet up sometime later so I still have no access. I honestly don't get how I'm supposed to manage systems if I cannot even access them or see what's inside normally...

I also asked my manager a fairly direct question the other day: 'If the company needs all of this why did you hire specifically just a junior sysadmin instead of an experienced IT manager or some senior sysadmin?' The answer I got was that they want to 'grow a person internally alongside the company needs'... Then I pointed out that someone with more experience would make less mistakes and be able to set everything properly. The response then was basically that they are not afraid of mistakes because they're an RnD company where mistakes are normal. They also said that they didn't want someone who would come in and 'do everything their own way'.... like wtf..? That answer then left me confused and speechless because things like permissions, security, infrastructure and stuff already have best practices for a reason!

So...is this a normal situation for smaller companies that are building their internal IT for the first time? Is this an actual growth opportunity and I'm just worrying for nothing..? Would you guys be concerned and think about exiting already? I'm simply very confused on what's the right thing to do...

Currently working at a small manufacturing business that is drowning in the "we've always done it this way..." mentality and I just hope I can get out of here before it bites them in the ass.

Anyone got experiences with technical debt or outdated IT practices snowballing into a complete disaster? Surely companies can't limp along indefinitely... right?

Update: lmao since I made this post, I've found out about A LOT OF SUS SHIT beyond our IT practices. Would love to spill the tea but there is no series of vagueries I can say beyond "the fact that we hired a pedo is the last of our worries" without doxxing myself :|

We’re currently implementing additional security controls for our hosting platform, and one of the biggest challenges we’re encountering involves customers connecting over mobile networks. As users move between towers or regions they are frequently assigned different IP addresses within very short timeframes, which complicates IP-based allow-listing.

Is there a reliable way to obtain and maintain up-to-date CIDR ranges for major mobile providers such as AT&T, Verizon, and T-Mobile?

For reference, we currently use this from Starlink that provides a public feed of their IP space.

Great example of why using placeholders like [email protected] is a bad idea.

Hello all! We're starting a platform co-op that offers alternatives to big tech services. What are your thoughts on the following operating philosophy? (any other advice/recommendations is appreciated too)

Operating Philosophy

Choose the most boring option that meets business needs. This has several reasons:

• We're providing services, not learning or playing.
• Boring works. They're either battle tested or stupidly simple.
• Much easier to maintain and onboard.
• We're not a FANG company; we should just do what everybody does and call it a day.
• Easier to debug.
• More portable if we ever need/want to switch VPSs.

Case study

Debian with Docker containers reverse proxied through NGINX

• Debian -- very boring; not even Ubuntu
• Docker -- boring. not even Podman, and certainly not Kuberneties
• NGINX -- boring. most widely used reverse proxy by a long shot

Using Debian means that we will have very long term support, which means less downtime and easier maintanence . Also everything is available for Debian, whereas [obscure distro] won't have a broad application support.

Docker has been the de-facto standard for a long time. It's portable and has widespread application support, and it's scalable. We don't actually need swarms of instances running everywhere communicating with each other, so Kuberneties would be overkill. Docker allows us to have an instance running and create a second instance when upgrading to avoid downtime.

NGINX is extremely common. It's battle tested, and it's so widely deployed that if there's a security vulnerability there will be many bigger fish to catch than us. Also most sysadmins will have experience with NGINX, so onboarding and maintaining will be easy.

Going to be working on refactoring an ISP's webmail application. After some study, I really do like Roundcube and was wondering what kind of plugins you offer clients? What's your preferred topology?

We use an email gateway for spam, but is there anything to help with unsubscribe automation that is proven?

He notado que algunos mensajes desaparecen sin dejar rastro en intervalos irregulares.

No hay logs visibles, no quedan registros en caché y tampoco hay evidencia de eliminación manual.

¿Alguien más está observando este comportamiento? ¿Puede ser un sistema sin persistencia o estamos viendo filtrado activo en tiempo real?

I do a lot of hosting migrations and got tired of checking DNS records across multiple tools every time. So I built my own.

No signup, no ads.

Feedback welcome.

Thank you for sharing your experiences :)

cross-posted from: https://lemmy.zip/post/61407838

Made this post on forum.mikrotik.com and it's awaiting approval from moderation, figured I'd try here...

Hey everyone!

Been running into an issue the last few weeks with trying to setup a VLAN on my home network.

Hardware/OS/IP:

Router (R) = GL.iNet GL-MT6000 (Flint 2), OpenWrt 25.12.1, 10.1.10.1
Office switch (O) = CRS310-8G+2S+, MikroTik SwOS 2.18, 10.1.10.2
Living room switch (LR) = CSS610-8G-2S+, MikroTik SwOS Lite 2.21, 10.1.10.3

Followed a few different guides on the OpenWrt side of the house, primarily this one

During my multiple attempts I have wiped all devices and started fresh a few times and I always end up in the same situation…

VLAN appears to be working on the LR switch (CSS610)

VLANs tab
    Port 1 is my trunk and a member of all 4 of my VLANs
        10 = LAN (Used for network devices and maintenance)
        20 = IoT
        30 = Guest (not configured on the switch, only for WIFI)
        40 = Main (Primary VLAN for my network)
        50 = Servers
    Ports 2-5 are members of VLAN 40
    Port 6 is a member of VLAN 10
VLAN tab
    Port 1 = Strict, Only tagged, Default ID 1
    Port 2 -5 = Strict, Only untagged, Default ID 40
    Port 6 = Strict, Only untagged, Default ID 10

This seems to work great, devices will get 10.1.40.x IP addresses and I can connect to port 6 and get 10.1.10.x IP address. Confirmed that my firewall rules also seems to work (although I’ll probably want to run this past OpenWrt forum as well).

But when I go to look at the O switch (CRS310), I’ll mirror this configuration, I’ll get DHCP and DNS, but I can’t reach the WAN or ping any other devices apart from the network equipment. Most recently I tried just VLAN 10 because I figured it would be using the LAN firewall rules and work correctly, but I get the same issue… correct IP address but no traffic.

Note: These screenshots are from last attempt to get something to work, when I mirror the CSS610 setup, I get the same results.

I had to follow these steps to get the SwOS boot to work on the CRS310

Curious if either…

• Have I configured the CRS310 incorrectly and something needs to be different vs the CSS610 which seems to work?
• Is there is a known VLAN related bug with the CRS310 & SwOS?

Any advice and guidance would be appreciated, feel like I am going in circles at this point.

Happy to share any outputs or screenshots from my OpenWrt router if it’ll help, but the issues do seem to be related directly to this CRS310 switch.