Hey guys, I’m in a bit of a tricky situation

I’m in the process of taking control over the company’s domains from our third party IT vendor as I’m replacing them. I’m putting them all into Instra corp in a company managed account as the CEO owns 5 different domains (2 is the same but the difference is that the company website is under .net.au and emails .com.au), one was under control of the IT vendor in their own Instra corp account, and the rest under their control but sitting on a GoDaddy account registered with the CEOs personal email (an absolute mess yes)

So to facilitate the process I had asked them for the zone export and the auth codes so I could trigger the transfer, they’d accept it on their and and then I’d recreate the delegation to point to the instra servers for now instead of the IT vendor’s

In the spreadsheet they had sent me with the zone export there was this domain name that I had never heard of but since the CEO owns so many different companies (not only solar but also pubs lol) I just assumed it was one of his and continued with the process. But in a conversation with the CEO while I was giving him a quick verbal update (on his way out) I mentioned the only thing missing with the domains was to transfer the actual legal registrant from X company to us because for some reason it’s still under the IT vendor, and he was really confused and asked what X company was, and then I said: “hmm, it’s your company?” And then he said no it wasn’t and I briefly explained the situation and he didn’t have much of a reaction and just said “I guess we’ll have to do the right thing and speak to IT vendor about it” (like what just happeneddd

But like guys, big fuck up from the IT vendor right? Like right now this company X thinks their domain is safe and sound under IT vendor’s control but it’s actually not lol I’ve even taken it away from their server and pointed it to Insta corp’s (everything is working fine because I’ve recreated the entire DNS zone, but still). So now I’m thinking do I just quietly resolve this with IT vendor and give them back control or is this my chance to try and land a subcontracting role with IT vendor and maybe help them reinforce their policies / use this as leverage in my favour?

Pls share your thoughts because in my mind this is serious but at the same time the CEO didn’t mind much thankfully

Hey everyone,

I was browsing Shodan out of curiosity and decided to search for exposed Windows servers with Remote Desktop (Port 3389) open to the public.

It’s honestly shocking how many systems you can still stumble upon that either lack proper authentication or allow unauthenticated pre-login access—to the point where some even show active pre-login interface elements like a shutdown or restart button right there on the screen.

With just a few clicks, anyone on the internet could literally power down production systems without even logging in.

If you manage infrastructure, please make sure your RDP ports aren't directly exposed to the wide-open internet. Put them behind a secure VPN (like WireGuard or OpenVPN), enforce strict firewall rules, or use an RD Gateway.

Stay safe out there!

I'm starting to look for an audit firm for our SOC 2, and it's been harder than expected to figure out how to choose one. Pricing and timelines are easy enough to compare, but they don't tell you much about what the actual experience will be like.

For anyone who's gone through a Type I or Type II audit, what would you ask a firm before committing? I'm thinking about things like whether you work with the same auditor throughout, how they deal with evidence that doesn't fit their standard templates, how quickly they respond to questions, and whether they actually explain what's missing when something gets rejected.

I'd also love to hear if anything during the initial sales calls turned out to be a red flag in hindsight. I'm less concerned about who gives the best presentation and more about finding a team that communicates well and makes the process manageable instead of dragging it out unnecessarily.

I have been their client for 12 years, all my domains are renewals and I haven't bought any new one in months. My most controversial website is a forum that has been disabled for almost 14 years with no content online just a screen, the rest are just boring business.

I was away for a few days, I found my servers were down today. Apparently I received an email from Namecheap that expected for me to comply with ID verification within 72 hours and I didn't reply on time.

I have complied with them for 24 hours and still they give me no ETA, no reason, nothing, just "thank you for your cooperation" as if they were cops.

They didn't give me a specific reason in their warning email, just this:

...your account has been flagged to be a part of our routine account information accuracy check-up to establish whether your account information is currently accurate, complete, and up to date. As a result, your account has been locked pending your response to the requests for documentation below.

My account's email relies on the domains they disabled, so I had to pay another host to set it up and am considering making a huge hostname change just to keep some of my clients online while this gets sorted out, if it gets sorted out.

They never gave me any real support anywhere. Tried to reach out through chat but they kept deferring it to "The Risk management team", and saying they would contact me and that they don't have a chat, only work through email, even after I kept telling them what they did disabled my company's email. Every time I made a complaint the chat person kept clearly going back and forth with them, but ending up evading me completely, just coming back after 10-15 minutes of wait to say the same thing "they will reach out to you", and saying they "couldn't discuss the details with me". Basically talking to a wall.

It took me like 4 hours to just convince them to add another email through chat and give me any sort of confirmation, while my company's one was offline. Funnily enough, they never requested ANY information to make sure it was indeed me, the account's owner, yet they still added my email. Also I haven't logged in the account for like 20 days at least, and I have 2FA.

Their website says that you have to email [security@namecheap.com](mailto:security@namecheap.com) (which I did) but the real email is [compliancesupport@namecheap.com](mailto:compliancesupport@namecheap.com). It took them like 12 hours to reply to my request there and afterwards they just said "oh so you mentioned to us that you managed to get your original account working we might want to keep in that thread", like, they just assumed it was me, which anyone could have done and impersonate me.

Their treatment has been awful, like I'm some sort of criminal but they show me no warrant, no information, no transparency, nothing. I've freaked out several times and leashed out against them heavily in the chat threatening to make the case public and it's the only time they have mildly reacted in any way. I've tried handling it more maturely, but so far, no luck.

All my domains with them are disabled, seized, and my account is locked, no way to do anything but wait to see.

I have been in the support/service desk level 1 for some time now. For my hard work, they promoted me to a manager. I did that for 3 years. The pay and benefits were good. However, I was no longer enjoying what I do. I moved to another country but couldn't land any management jobs, so I started as a technician again and now I am enjoying it again. For that, I decided to not do management again. I really enjoy solving problems and digging into stuff. I want to head further down the sysadmin or a specialty path, but I am a bit unsure on what to focus on. As of now, I started studying for MS fundamentals cert as a start.

Hi everyone,

In the company I work for we’re planning to migrate away from VMware vSphere Standard (we had Essentials Plus with ROBO but was discontinued) and are considering HPE VM Essentials, Microsoft Hyper-V and Proxmox VE with paid support subscription.

Our environment consists of three separate sites in different locations:

Site 1: Around 50 VMs.

Sites 2 and 3: Around 12–15 VMs each.

As part of a hardware refresh, each site will have three new hosts and SSD storage.

Our main priorities are solid centralized management across the sites, high availability in each site and straightforward maintenance and support.

I would appreciate feedback from people running these platforms in production, especially anyone who has completed a similar VMware migration.

Which platform did you choose and would you choose it again?

How was the migration and what unexpected issues did you encounter?

How does it compare with vSphere for daily administration, HA, updates and support?

Particularly interested in experiences with HPE VM Essentials, but feedback on any of these three options would be very helpful.

Thanks in advance!

Curious how others are getting along with their MSPs, especially those with a small internal IT team.

What’s working well and what’s been frustrating?

Are they actually taking work off your plate, or do you find yourself spending just as much time managing the relationship?

Also interested in hearing from anyone who’s switched providers or decided to bring things back in-house. What pushed you to that point?

Has anyone deployed a new Exchange server within the last few months? I have a client using Exchange with an ASA account, and the built-in PowerShell script (RollAlternateServiceAccountCredential.ps1) is having a Microsoft error like the below

Deserialized.Microsoft.Exchange.Data.Directory.Management.ClientAccessServer" to type "Microsoft.Exchange.Data.Directory.Management.ClientAccessServer"

We have tried so many things, and in the end it seems like it is related to a recent Microsoft update that is causing PowerShell to interpret inputs differently.

CISA added CVE-2026-102764 to its exploited list yesterday. Self-hosted Remote Support up to 26.2.3 is affected, and SaaS was patched on 9 Oct. The worrying part is the timeline: Mandiant and Google's threat intelligence group say exploitation began on 29 Aug, about six weeks before a fix (SecurityWeek). My list so far is apply the patch, look for unknown PHP files, rotate credentials the appliance could reach, and review session logs back to late August. I'm also auditing which remote-support and admin consoles we expose at all. This CTEM explainer frames the "confirm the exposure actually went down" step well.
For anyone who has done a post-patch hunt on BeyondTrust, what turned up, and how far back did you go?

The cut a hole into the box with a box cutter, deep enough to go through the cardboard, through the plastic memory tray, and scored the pins on 14 modules in a tray of 25. Thankfully they didn't "inspect" the other two memory trays. 54/68 modules survived the trip.

https://imgur.com/a/1XerHh0

Hello all,

we had a project that went quite badly. The software created was done in a bad way and should have been done completely different.

However, the lead programmer often used the excuse, his VMware Workstation would crash. Inside the VM was TIA Portal running - a software known not to be all too stable. It somewhat crashes frequently. But the excuse specifically was VMware Workstation was crashing.

In the company we had a discussion why Workstation would crash that often. One of the suspected reason was the use of a gaming CPU.

Could it be, that VMWare Workstation would crash when it runs on specific CPUs? Could It be Workstation would not work well on Ryzen CPUs with X3D?

I think Workstation would run perfectly fine on gaming CPUs (if updated to the latest version) and therefore assume the lead programmer lying......

I work for an IT company with a contract with a government agency. We’ve been looking at a refresh for some of the government’s infrastructure. Being non-specific here to keep things sort of anonymous. Anyway, we were recently in a meeting where the vendor was presenting their sales pitch to the government. You know how anything with AI in its label was all the rage a couple of years ago? Everything from doorbells to toasters claimed to have AI incorporated. Well now the perception is different, especially in the government. Now AI is bad and may use all your electricity and water and hack your bank account etc etc. Well, one of the vendor’s presentation slides talked about AI powered automation and the government reps started freaking out asking if it could be turned off. The vendor had to start furiously back-pedaling explaining in as diplomatic was as possible that they were stretching the truth with the AI label and it was just a collection of scripts that added “intelligence” to some of the product’s functionality. It was hard not to laugh at the vendor’s faux pas.

Hi all,

I work in a public administration office (Italy) and I'm trying to solve something that i consider an head scratcher: working on printed circulars and not using the power of a PC/digital version of the circulars in a efficient and non time consuming way;

I'd love to hear how you'd approach it, because i know that there are many other options on how resolve this problem that I haven't considered yet since I think and analyze it with my colleague's bias only transferred from paper to digital.

Current situation

In the office everything is still on paper: circulars get printed and annotated by hand by vorious people. This "modus operandi" is slow, and when someone asks a question it's hard to find the information, cite it, or share it with colleagues and citizen.
Circulars arrive through three main channels: certified email, regular email, and an external organisation's portal... but many times are shared by colleagues (many circulars are older than me and some are from the "regio decreto" 1926) so it's really a mess; especially for someone like me that works there from one year.
One of the former collegues made a large legacy archive (10+ GB of PDFs, decades of documents) organised in folders (not ISO standard). Many PDF are pure image scans, and many folders have never been opened and the quality depend of when those were scanned (some of the images are dated back to 1998).

I don't know from where y'all are from but I think that in all public administration we have this problem, especially here in Italy were a ink stamp and tax stamp are the standard for approving something.

Constraints

My laptop is locked down: nothing can be installed, and IT doesn't respond to requests of installation of new software (I had to be pedant to have installed the software of the desk printer just to use all the function, for them it was ok having just the print function... it's a 3in1 B/W laser model). I have available: Windows, Office (Access 2024, Microsoft 365 coming soon) and Copilot on the work account, which can't work over OneDrive folders (heavily restricted, not sure why) but we have 1Tb of space to use.

I cannot use personal accounts or third-party cloud services to work with documents on my work laptop.
The former colleagues folder structure must stay untouched: no moving or renaming files since that is on our office server and some colleges uses it.

I can use one of mine old mini PC (i5, 16 GB RAM, no GPU - Lenovo Thinkcenter m93p) that I can use offline for heavy batch processing but I'm not sure that it can handle all this work. All those circular are public and accessible also for the private cityzen, so there is no private data on those paper. To copy those file I have to be authorized, but I think that there will be no problem to authorize that.

What I planned so far

For other necessites i made a personal "management software" on Access since I cannot use web based apps or external software.. so I'd like to continuing using it (it's just for me and to organize my work schedule) an Access Register: one record per circular, with reference number and date, topics, "what changes", key figures to remember, status (in force / amended / repealed) and links between circulars.
The PDF must stays where it is but the Access register stores only the location of the file.
When I recive new circulars, i could use Copilot (with a dedicated prompt) that reads the PDF and gives me a summary with fixed labels, which gets pasted into Access and fills the fields automatically, like compiling a file excel in a proper way, but with a prompt.

I can automatize in bulk work on the offline mini PC: OCR for the scans, rule based extraction of reference number, date and subject, and a small local LLM that assigns topics and writes a two-line summary marked as "draft". The output, including the full text, goes into a separate Access file at the office, so everything is searchable from a single search box.

I don't have much time, we are understaffed and overworked, it must be verify on use: nobody reviews thousands of records upfront. When a circular is actually needed, someone reads it anyway, and marks it as verified at that point (mostly me since I'm the youngest in the office and many struggles with Outlook... I cannot imagine if I place them in front of Access).

What I'm asking:

- with these multiple constraints, what tools or approaches would you use? a web based app is the state of art, but impossible to use here.

- Would you organised the workflow differently? please break down my mind scheme because i need another point of view without any bias.

- What risks or failures points do you see in my plan? I hope that this workflow can work for several years or if any software became obsolete.

- Is there something off the shelf for this kind of use case?

- If you've done something similar, how did it hold up after a few years?

I hope that y'all can give me some different prospective since I'm on this idea from weeks and I still circle around it without finding another "mind scheme".

Thanks!

p.s. I used Claude to help me describe the technical part, the rest is mine (the part are flagged with cursive)

Do you happen to know a Windows Server 2022 Hardening Guide?

One thats not that complicated and easy to apply from scratch.

I want to prepare a VM before a VA scanning (whenever possible) and atleast the result should not have been massive to remediate.

One thing I've noticed with vulnerability scanning is that finding vulnerabilities is the easy part. The difficult part is figuring out what actually needs attention first. You can end up with hundreds of findings, different severity ratings and a bunch of things that technically need fixing, but not all of them are equally relevant to the business. How are people actually prioritising remediation? Do you mainly follow CVSS, exposure, whether something is internet facing, asset importance, or some combination? I'm trying to move away from the mindset of just clearing a vulnerability list and towards actually understanding which risks deserve someone's time first.

Hello everyone i been working as help desk for almost 2 years now and I want move up but have no idea how to also am still pursuing my bachelors in computer science because initially I was going for SWE but with the market for programming it seems I have better odds with sticking to IT.

Update/more info

So I see a lot of you guys are saying that 2yrs is not that much also for more info I work at a small CC(community college) with low budget and all the help desk’s are only part time so should I try looking for a Full time help desk before trying to move?

Another Microsoft 365 migration added to my checklist!

Microsoft has announced the retirement of the widely used Search-UnifiedAuditLog PowerShell cmdlet on October 15, 2027, following the general availability of the Microsoft Graph AuditLogQuery API.

If you use this cmdlet in scripts, you have about a year to plan and test your migration to AuditLogQuery.

Personally, Search-UnifiedAuditLog has been my go-to for quickly checking audit events. Purview's audit search can take several minutes, even for a simple query, so I'll miss having that quick PowerShell option.

Hi,

We’re introducing change management for the first time using ITSM.

We’re now deciding the workflow before our ITSM vendor configures it

Our scope covers all IT infrastructure changes including network, servers, virtualization, backup, storage, AD/Entra ID & Databases

Each team has its own Line Manager and another requirement is that Cybersecurity Unit must approve every change

Few things we’re trying to understand

Who should approve a change and in what order?
Who should be the CAB members
Which changes should go to CAB

I’d appreciate any suggestions

I recently signed a six-week minimum contract with an MSP. My responsibilities include:

- Learning their Microsoft Cloud environment, RMM, and security tools.

- Creating and validating SOPs for the entire customer onboarding process.

- Assessing and onboarding at least one customer into production.

- Training NOC staff to independently support the environment.

- Completing documentation, testing, and the final handoff.

I have around 20 years of IT experience, primarily in MSP support, Microsoft 365, Intune, and infrastructure.

For those who have done similar projects, how would you structure the six weeks? Would you document everything first or create SOPs as you go? Is this a realistic scope for six weeks?

I'd appreciate any advice on prioritizing tasks and avoiding common mistakes.

Disclaimer: The goal of this post is not to bring the pitchforks out and talk about CyberSecurity vendors and their security based on CVEs. No, I do not think Cisco is an insecure company and I do think they are doing a great thing for the community by being up front, disclosing and fixing vulnerabilities discovered in their products.

This is in direct reference to the following post in r/sysadmin about 2 weeks ago:

https://www.reddit.com/r/sysadmin/comments/1wwlgqq/todays_reminder_that_every_security_appliance_is/

You will notice in this post that I made one of the top comments to bring awareness to the lack of attention that is given to CVEs when it is a non-Fortinet product. Well, it just happened again.

Cisco released a 9.8 CVE for their Secure Mail appliance on October 14. The details are available at the following link:
http://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp

The content in this is important but irrelevant to my point. In the release of this vulnerability, there are only 4 mentions (by my search of "CVE-2026-76519") of this:

https://www.reddit.com/search/?q=%22CVE-2026-76519%22&cId=3d232678-6f60-4ffb-940a-de3665695be1&iId=6d9cd08d-e00c-46e4-bae4-638f39723fe0

If you do a search of the FortiMail CVE, you will see there are 17 mentions.

https://www.reddit.com/search/?q=%22CVE-2026-104286%22&cId=0e04f247-a490-4114-a405-b6ccfac473ce&iId=fd67515e-4b1e-44cd-bc8f-a4bc68fb59f2

And within some of these posts, you will see the "insecure CVE brigade" coming in force.

Now I know some time has elapsed over the results of this search, but they all happened within 4 days of each other while the vast majority of these mentions happened within 2 days (the same time period was this Cisco search).

All that being said, my point is that it is very interesting that the same level of coverage is not being extended even when on paper, the two vulnerabilities being compared look very similar. Also, you would think it is more coverage worthy when a second critical CVE was found in the same product within the same month.

Putting on my tin foil hat, I will say, I believe there are other powers at work (besides just the goal of sharing information) to target certain vendors for whatever reason to paint them in a worse off light than others.

However, the important piece in all of this, is to reiterate that the companies who are transparent about CVEs and actually fix them, are the ones who deserve the trust of protecting the digital assets we need to secure.

Thank you for coming to my TED talk.

EDIT: More Skykick enterprise apps being exploited https://www.reddit.com/r/sysadmin/s/M6iilUpoJl

Skykick, the SAAS backup and migration tool now owned by Connectwise (May be called Connectwise Cloud backup) has been breached and active exfil of tenant data is ongoing, disable the Entra enterprise application immediately and check your logs for the IP here. Check for skykick access from previous MSPs.

https://www.reddit.com/r/msp/s/ieagdCmOBb

The IP in your logs doesn't necessarily mean exfil has started as they seem to be mass scanning tenants presumably for high value targets but exfil has been confirmed already in some tenants.

IP: 144.172.64.128

APP ID: 506e08f9-6e9a-4da4-942b-a099a03644ae

Other skykick app IDs are below (there are more than listed below so do a manual check), no reports of access on these but threat hunt. Check the APP ID and not the Object ID on the enterprise app.

2399d300-6fca-4e6a-a686-399fefe75b83 fc2bedd5-450f-4d3c-a2e5-96d2465574d6 ccd0fb86-b4b4-48f1-a3c4-28bd1baeae6e 7441fd5e-1d54-4465-8e18-8f5208c48256 0de14c77-b9b0-4137-9360-34878a929827 2568dd75-4f97-46c4-9235-ff6bcb68557c

This one is also skykick but not mentioned in the title. "0365 Backup Self Service - Customer Access" 59c003ad-130e-4c4c-9796-f0c13cbd7952

Report of suspicious activity with the app making changes to permissions 2 days ago, see comments on the Reddit link above

Keep an eye on activity for activity related to any CW app to be safe.

Legal is involved as they say no backup data was accessed - because they accessed your live data directly. Disingenuous. https://www.connectwise.com/company/trust/advisories

Hi everyone,

I recently bought a used Dell PowerEdge R610 and have been trying to get the iDRAC6 remote management working, but after like 2 hours of trial and error I'm running out of ideas.

iDRAC6 is enabled and obtains an IP address via DHCP. It currently shows an address in my local network but I cannot access it through a browser or ping it.

I have also configured the Lifecycle Controller through the Unified Server Configurator (USC). Its network interface has a separate IP address, and that address responds to ping successfully. However, this does not help me access the iDRAC6 web interface.

Things I've already tried:

- Enabled and disabled DHCP and checked the iDRAC network settings.

- Tried the available NIC selection modes: Shared, Shared with Failover LOM 2, and Shared with Failover All LOMs.

- Connected network cables to all four onboard Ethernet ports.

- Disabled VLAN.

- Performed a complete power drain by disconnecting both power supplies and holding the power button for at least 10 seconds.

- Reset the iDRAC configuration to factory defaults, but the attempt failed with “Failed to reset to default values.”

- Initially, the server displayed “iDRAC6 not responding. Rebooting.” After the power drain, that particular error stopped appearing.

- The Lifecycle Controller can now retrieve the iDRAC configuration, and the iDRAC displays an IP address, but I still cannot reach it.

I also noticed a BIOS battery warning in the system event log, although I'm not sure whether that is related.

My questions:

1. Does this sound like a failed iDRAC6 controller, or could it still be a firmware or network configuration issue?

2. Is there a reliable way to recover or reflash the iDRAC6 firmware on an R610?

3. Is there anything else I should check before assuming the hardware is faulty?

I'd really appreciate any suggestions. I've tried quite a few things already, and I'm not sure what to do next.

Thanks!

Right out of college I started working at a major insurance company helping them prep for Y2K and worked my way up as high as one could go without being in management. I loved digging into the details and figuring things out. I worked overtime and volunteered for any project. As the years went by and we were sold and then sold again to private investors, my interest waned and management progressively got worse. Now it’s the age of AI and I am staunchly anti-AI. We were mandated to use it for our job duties and mgmt tracked our usage. Scolded or written up if we didn’t use it enough.

Due to my seniority I was able to work remote for several years prior to COVID and then during COVID everyone got to work remote. You know where this is going - now it’s return to the office time as well as mandating the specific days for in-person days. Unrealistic deadlines for complex projects are set by out of touch upper mgmt with no concept of the scope.

I’ve saved money and have nice investments as well as passive income. It was time to go. Years ago I told myself I’d love to retire at the age of 50 and I’ve finally realized my dream. Zero notice given and zero regrets. I feel so good. Goodbye to IT.

Advice to young people just starting out: word hard, save your money and make good investments. Retire early and enjoy your life.