https://www.hp.com/us-en/shop/pdp/hp-elite-sff-805-g9-desktop-pc-b0qu0ua-aba

I never had anything HP except a crappy printer years ago. How are they vs Dell optiplex?

DreamHost's status page logged the first problem at 2:20 PM PDT on October 23, with connectivity issues on the panel File Manager. By 5:20 PM it was resetting some email passwords as a precaution. At 10:13 PM the resets covered FTP and SFTP users too.

Four days on, DreamHost still hasn't named a cause. BleepingComputer asked how many accounts were hit and whether files or messages were exposed, and got no answer by publication. CyberInsider reports the count of affected customers hasn't been disclosed either.

The File Manager is the panel tool that edits and deletes website files and can fetch a file from any URL. BleepingComputer's story said it was still down. DreamHost's status page says a fix went out at 3:35 PM PDT on October 26 and it's monitoring.

The owner notice tells owners to review the forwarding settings on every mailbox and remove any forward they don't recognize. For SFTP users it says to set a new password. It also says SFTP user data stays on the server.

DreamHost lists 750k+ WordPress installations on its company page. A new SFTP password doesn't remove a PHP file written to wp-content while the old one still worked.

It has happened before. In January 2012 DreamHost reset FTP and shell passwords for all customers after someone got into one of its database servers.

When a host expires SFTP passwords "to ensure the continued integrity" of accounts, does it owe customers a word on whether anything was written to their sites, or is checking the files the owner's job?

Hi,

I need to migrate our File Server 2012 R2 servers to Windows Server 2025 (on vSphere).

I want to avoid a never-ending Robocopy job, so I was thinking of doing a disk swap:

1. Export HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Shares (including the “security” subkey) from the 2012 server.
2. Shut down the 2012 server and detach the VMDK.
3. Attach it to the 2025 server and assign it the same drive letter.
4. Import the .reg file, restart the LanmanServer service, or reboot.

NTFS permissions are carried over with the VMDK, and shares are carried over with the .reg file.

Are there any edge cases or unexpected issues to watch out for with such a large version gap? Also, I’ve heard about SMS (via WAC), but since the swap literally takes 5 minutes, I don’t really see the point. What do you think?

Translated with DeepL.com (free version)

We acquired a company that uses QNAP NAS'es but we have no experience with these whatsoever. Defender is telling me to update our TS-431XeU because of the recent PHP2Shell vulnerabilities, but looking at the details, it's still running QTS 4.3.4.0675 , so we're about eight fucking years behind.

However, checking for updates through QTS says the system is up-to-date while the QNAP support page lists newer firmware for this model. I assume we'll have to update it manually, but I'm not sure whether we can jump straight to QTS 5.x or if we need to install intermediate versions first.

My question: is it safe to update across such a large version gap and what does the process look like? Any indications of update duration, possibilities of failure, compatibility issues with existing RAID configurations or volumes, etc.? Also, what are the recovery options if the firmware update fails or the NAS doesn't boot afterwards? Fuck me but also fuck that guy for leaving no documentation.

We will of course back up the data but I'd rather not risk anything since this is a production NAS and we don't know much about its history.

Anyone who's done a similar upgrade on this model or another older QNAP?

Edit: fuck it, I created a ticket at QNAP but since they're not reachable from outside, I'll just put a wall around it as someone said here. Thanks for the info, my dudes

I have to setup a new domain and I am strongly considering windows 2025 for smb without VPN and to save myself from reinstalling the DC two years from now. Given the frequent complains here I wanted to circle back with you people if anybody having a recent update roll up installed is facing problems? Especially with the RDP broker and trust issues between servers (also domain joined Linux VMs).

The domain would be a pure 2025 AD with roughly 50 clients providing file access and DNS, dhcp handled by pfsense. Authentication would be provided to web apps through privacyIdea and keycloak.

Fire away!

We were sadly compromised. Twice. It's finally answered the question of investments, but the police want evidence.

The audit logs is clear on that, but I realise this will become police evidence. They have a secure upload. I filtered the audit logs as I downloaded them to show everything from the attackers to create the csv file. I then created a text file showing the filter, how it was created and the SHA hash of the file.

Is this enough? I think the attacker(s) made a mistake and may be traceable, so absolutely would be willing to see them prosecuted.

The question is, should I have included anything else in there or done anything else to show the file is not tampered with between myself creating and them opening?

For those who set HKLM\SOFTWARE\Microsoft\Rpc\EpmapSavedContextCap = 65536 on Exchange instead of uninstalling the October KB (https://techcommunity.microsoft.com/blog/exchange/exchange-servers-may-become-unstable-after-installation-of-october-2026-windows-/4565382): are your servers stable since then, or are you still seeing MdbOffline / mail flow lockups? Any side effects, and are you doing scheduled reboots until a real fix ships?

Also, how are you monitoring Exchange for this issue?

Imagine a sysadmin working with VMware, cloud infrastructure, networking, and automated deployments. They can follow documentation, run commands, and click buttons to deploy or restart systems, but they don't fully understand the underlying concepts.

For example, a production server suddenly becomes unreachable. They know how to restart it, but they don't understand how DNS, routing, virtualization, and firewall rules interact to cause the problem.

My question to experienced sysadmins: How challenging is it to work in a fast-paced IT environment like this? What happens when something breaks and the usual fixes don't work? Have you experienced a situation where understanding the underlying concepts made all the difference?

Microsoft shipped .NET updates out of band on Saturday (Oct 25) for CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with .NET. The .NET advisory scores it 8.1 and MSRC rates it Critical for .NET, and Microsoft says exploitation is more likely, with no exploitation reported as of the 25th.

The patched runtimes are 8.0.33, 9.0.22 and 10.0.14. Anything below those is still exposed, and .NET Framework is not affected, so older Framework servers can sit this one out. The same release also fixes CVE-2026-114148, a file-ownership problem in .NET tarballs on Linux, and it re-does two October 13 fixes that had not fully landed (CVE-2026-70197 and CVE-2026-102870).

A few things that decide how urgent this is on a given box:

Exposure needs an app that decompresses Brotli data it does not control, through ASP.NET Core request decompression, HttpClient automatic decompression, or the System.IO.Compression Brotli APIs. Neither decompression path is on by default, so a patched-later queue is defensible for internal apps that never enable them, while internet-facing ASP.NET Core goes first.

Updating the shared runtime does nothing for self-contained apps because they carry their own copy of the runtime, and those need a rebuild and redeploy. Framework-dependent apps pick the fix up from the runtime update, though the processes still need a restart, and on IIS that means updating the ASP.NET Core Hosting Bundle rather than only the runtime.

PowerShell is in scope as well, with fixes in 7.4.22, 7.5.13 and 7.6.9, which matters on admin workstations that never run a .NET app. Anyone on Azure App Service with built-in .NET images on Linux gets the platform update from Microsoft; the rollout had finished for the Latest channel and was still going out to Standard as of Oct 26.

`dotnet --list-runtimes` gives a quick inventory per machine. Microsoft's announcement is here: https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/

Walmart opened its store to AI shopping agents last week while Amazon is blocking Meta's, and it landed right as we're finishing our Black Friday WAF rules.

Every year our checkout rules get stricter going into peak, anything that looks automated gets challenged or blocked, and that's done a good job against card testing and credential stuffing.

An agent buying for a customer looks a lot like those bots from our side, headless browser or straight API calls, fast and with no mouse movement, and from next month some of that traffic will be real orders.

Our shop is headless (Scayle), so search, cart and checkout are already APIs an agent can call, which means the whole decision lands on the WAF.

The business side hasn't decided whether we copy Walmart, copy Amazon or let a few known agents through, and the rules freeze on Nov 1.

So before I pick a default myself, how are you treating agent traffic going into Black Friday ?

Can i get an entry level job like help desk if I get a CCNA cert with no degree?

So I got tasked with looking into a solution for keeping track of deliveries that come in. I used chatgpt & did some research and I found a couple paid options but chatgpt suggested using SharePoint + Power Automate + Microsoft lists. I started looking into that as a solution and made a SharePoint site with a test list for myself. However the CTO would like the system to send an email to whomever is having a package delivered. So the front desk would log the delivery in SharePoint. I'm a little lost on how to trigger the sending of an email to the package receiptent. Is that where power automate comes into play?

Does this plan sound feasible at all? I'm pretty new to SharePoint.

​

Hi everyone,

I'm seeing intermittent high CPU usage from Microsoft Defender Antivirus ("MsMpEng.exe"). CPU usage reaches around 90–200%, and the alerts usually resolve themselves after a few hours.

No active scan was running during troubleshooting, and Defender appears healthy. I suspect real-time scanning triggered by application file activity may be involved.

Has anyone experienced something similar? What would you recommend checking first to identify the root cause?

Thanks!

I'm trying to transition into IT and would appreciate some advice from people who have made a similar move.

I have an upcoming interview for a Customer/Hardware Specialist position at a dental imaging company. It's a six-month contract-to-hire role paying $17/hr, onsite, Monday through Friday.

The job involves Level I support calls and emails, troubleshooting hardware and software issues, working with medical imaging equipment, installing equipment, training customers, documenting issues, and escalating problems when needed. My background is in education technology, where I've supported devices, printers, software, and end users, but I haven't worked in a dedicated IT support role.

I'm planning to work toward CompTIA certification and stack others.

My situation is that I have about 2.5 months of unemployment benefits remaining at $584 a week, and I'm currently living with family without paying rent. At $17/hr for 40 hours, the job would pay $680/week before taxes, so the financial difference isn't huge.

I'm trying to decide whether to take an opportunity like this to get actual IT experience while studying for certifications, or use the remaining time to study and look for a remote job paying around the same amount or more.

I think the hands-on experience could help me qualify for better IT jobs down the road. Another concern is that a six-month contract could limit my flexibility if a better opportunity comes along, and working onsite might make it harder to study.

Thanks in advance for any insights you guys have!

I've been messing around with my AD lab today and finally got one issue sorted out. I have two Windows Server domain controllers, but DC01 is currently powered off, so I'm working with DC02 for now. While running dcdiag, I found that the _msdcs delegation was still pointing to DC01. I checked the records and changed it to point to DC02 instead. Ran dcdiag again, and the DNS tests are now passing. I also jumped onto my Windows 11 client to see if it could reach DC02. DNS resolution works, ping is fine, and TCP tests to ports 53, 88, and 389 all succeeded.

The part I'm still trying to understand is that repadmin/showrpl reports replication failures involving DC01, and DC02 is still logging Event ID 2092 about FSMO role validation. All five FSMO roles are assigned to DC02, but apparently that doesn't mean everything is healthy. I'm not planning to force anything or clean up DC01 until I decide whether I'm bringing it back or retiring it properly. For those who've dealt with this before, would you focus on the Event 2092 warning first, or sort out the DC01 situation before going further?

I'm still learning the deeper side of AD, so I'd appreciate hearing how you'd approach it.

I've been an IT generalist at a large tech company for a few years and I will be "next in line" for a SysAdmin role soon, however, I don't think the stress and responsibility is worth the reward and opportunity.

I clearly am complacent on some level, but I am still challenged enough in my day to day that I stay engaged and interested while working. I make ~$115k/year gross including bonus, with ~5% raise yearly. I am in HCOL area but feel I am compensated well. I like my team and I like my company, which I think is rare.

In my late 30's, have bachelors in IT, almost 10 years in the field, a couple of basic IT and networking certs. I am married and don't plan to have kids. I have hobbies I am passionate about, but I have zero interest in a home lab or spending free time learning new IT skills. The extra income would be nice, of course, but the trade-off's are real, and unfortunately I don't think I can go back to my current role here if I make the jump. Pressure from management to move up is real.

I'm sure folks can relate - what do you think?

There's a lot going on right now with all the high priority CVEs and as per usual, the net is under a constant attack.

There's a lot on the news such as the French freezer attack, and the UK government is pushing for everyone to make sure they have 3 days worth of food. The dark web and many main stream sites have rumblings of bad things to come.

That leads me to: how good is your DR plan?

If some entity managed to take out M365 in its entirety, or Google Business services, for an extended amount of time, how would you cope? Do you have a real recovery option?

I'm asking because I think I could spin up on prem Exchange and restore our mailboxes, or even go old school and restore to Linux mail server to get us working again. That's easy enough, we're an SMB of 400-500 at any given time. The RTO from a "this isn't coming back" is probably a day to a day and a half. The cyber insurance I have helps, but if half the net went out then that insurance is pretty moot as they'd be overwhelmed.

Some of you are massive and cloud only, so how cooked are you?

Hello everyone,

We are planning to expand our current tape infrastructure by adding an expansion module to our existing LTO-8 tape library.

Our current setup consists of 2 tape drives and 40 slots. After the expansion, we will have a total of 4 tape drives and 80 slots. The tape drives use Fibre Channel (FC) to transfer data from the primary server.

Reason

Our RTO and RPO have increased significantly, as we are now transferring around 200 TB of data per week. We need to improve them.

I also have the feeling that our current logical infrastructure design may not be the most efficient. We are currently using Veeam Backup & Replication to perform our backup-to-tape operations.

Current

We currently have a single Standard Media Pool containing all our tapes. None of them are WORM tapes.

We use a single tape job with no incremental backups, which copies only the weekly full backups to tape. Parallel processing is enabled in the job, allowing it to use both LTO-8 drives simultaneously. The tapes are labelled both logically and physically according to their retention category: weekly, monthly, and yearly. We also label each tape with a DIMO. We do not use quarterly tapes.

Our current process is entirely manual. We select and insert different tapes depending on the occasion, rather than having an automated process. To be honest, I really dislike our current labelling system. All tapes have the same retention settings in Veeam. We manage retention manually by moving the tapes and storing them physically for the required period.

Proposed

Since we will have 80 slots available, I was thinking about using the additional capacity to keep the weekly tapes and, potentially, future daily tapes loaded in the library, as these will be the tapes we use most frequently. Our weekly tape rotation requires a total of 64 tapes, so this would allow us to keep them in the library instead of having to move around 16 weekly tapes to our off-site vault.

However, this raises my first question: Is it recommended to leave tapes loaded in the library when they are not actively being used?

I understand that these are not WORM tapes and that, in the event of a cyberattack, they could potentially be exposed to overwriting. One idea I had was to use the physical write-protect switch on the tapes to prevent them from being overwritten while they are idle.

On the other hand, I have also considered the risk of a physical incident in the data centre, although we consider the likelihood of a fire or flood to be relatively low.

Is this a reasonable approach, or is it strongly recommended to remove written tapes from the library and store them in an off-site vault?

For those managing larger tape libraries with many slots, how do you typically handle this? Do you leave tapes stored in the library and use the available slots as intended, or do you still remove written tapes manually, as we currently do?
From a Veeam configuration perspective, I am considering the following changes:

• Media Pool: Use a single GFS Media Pool containing all retention types, excluding quarterly tapes.
• Tape labelling: Eliminate our current logical and physical labelling system and rely entirely on barcodes to identify the tapes.
• Tape job configuration: Keep parallel processing enabled and configure the job to use all four tape drives.
• Media Vault: Set up a Media Vault in Veeam to better organise and track the tapes stored outside the library, as I understand this functionality is available in Veeam.

These changes would be implemented progressively as our tape operations evolve, rather than all at once.

Do you have any recommendations regarding this approach? Are there any potential pitfalls or configuration changes that you would advise against?

Thanks!!

ssh sends no keepalives of its own by default (ServerAliveInterval 0), and Linux waits two idle hours before the first TCP probe, so a script on a frozen host can hang for hours. Set the interval to 15 and a 45-second network blip kills the session. Do you tune keepalives, run commands detached and poll, or wrap them in timeout?

The other post about the sadness that comes along with terminating a deceased employee's account made me think of another possible outcome:

What things have you found on deceased employee's equipment or accounts that were...unsettling, illegal, or otherwise just shocking?

I'm very experienced in Intune, don't know much Jamf yet, so this is a new platform for me. Just wondering if it's beneficial to use it in an environment that only has a handful of Macbooks?

We're an online shop with a pickup counter. Some customers come with an order already placed, while others place their orders with us. To enable customers to place orders, our employees need the appropriate IT equipment. However, we can't provide a separate device for each employee at the pickup counter; that would be completely impractical. So, we need multi-user devices. These devices need to run our web-based ERP system, our shop CMS, and 1Password. We also need printing capabilities. The problem is, until now, we've been using Windows devices with a single user account. This means everyone has to remember the same password. It's impossible, so they've resorted to hiding Post-it notes. I want to eliminate this. I want to create a single device where multiple users can authenticate themselves securely and quickly (ideally using biometrics). The operating system isn't a major concern; I just need to be able to manage it with Intune. Does anyone have any ideas on how I could achieve this?

... and rats are gnawing the floorboards.

(To be kinda meta, this post isn't seeking anything except commiseration and conversation. I'm just reflecting on the dizzying array of changes within the last ~3 years, and hoping a graybeard out there can relate to feeling ... I don't know, displaced? surreal? anyways, my apologies if this doesn't belong in r/sysadmin*)...*

While the underlying tech has evolved, the core of the Internet and computing remains the same as it was in the 1980s: content is stored on hosts and delivered to clients through multiple layers of protocols.

It makes sense, then, that AI will discover uncontrollable amounts of vulnerabilities. The visionaries who initially drafted the RFCs for DNS, HTTP, and TCP/IP couldn't have possibly imagined our data getting commodified, names and birthdays sold for pennies or held for ransom, financial ruin inevitable. Of course they baked their naiveties into the tech. Of course history is getting sandwiched between OpenAI and Anthropic, with attendant freakouts from suits and normies alike.

It seems like the wooden planks are decaying, but the replacements don't fit anywhere yet. Maybe it's time we transition away from the existing infra and replace it in its entirety with the Semantic web and MCP/agents. Give up the whole ghost.

Can anyone relate? Does this resonate at all?

Anyone figure out a way to deal with this garbage... We use it to collab with valid vendors but we keep getting these fake calls... This has nothing to do with teams phones just a normal teams call.

Greetings all, I am currently level 1 helpdesk at my company and I am looking to move up to level 2, and help the future level 1s along the way. One of the projects I plan on making soon is a gui based tool to either interact with the registry editor, or get logs (for example, if you want logs, the gui app menu would say “are you looking for info” or “looking to make a change, etc):

I wanted to ask if any of you have created custom system utilities for your team.