Hi everyone!

I'm so exhausted being an M365 admin these days. Technology and AI are moving at crazy speeds and I just can't keep up!

Hearing about all the big tech layoffs makes the stress twice as bad. I honestly feel like I could easily be replaced by an AI agent.

Am I overthinking this or are you feeling this pressure too? Maybe burnout?

Had an employee leave on Friday and found out Monday morning their badge was still active. HR had processed everything on their side but nobody had told the person managing door access

Nothing happened but it made us realize how easy it is for something like that to get missed when different departments are handling different parts of offboarding. For anyone managing access control, does HR automatically trigger badge removal or does someone have to manually request it? Trying to figure out what people do to make sure these don't slip through

Over the weekend, we got charged over $48k across 2 bank payments by Autodesk (aa 3rd of another 40k got blocked), the issue is that we have never had an Autodesk account nor used their systems before, we already contacted the bank and their support directly and Autodesk says they don't see such payment, with the specific transaction number/code being received. Any suggestions?

https://imgur.com/a/9CBEok2

Started getting a few complaints about this one and it was news to me. I never saw anything in the M365 Admin Center about it, even went back through all the Admin Center messages and my emails.. still absolutely nothing.

Disabling the tag involves a mail flow rule. Folder behavior is controlled by bulk move options in your anti-spam policies.

https://learn.microsoft.com/en-us/defender-office-365/anti-spam-bulk-complaint-level-bcl-about#deliver-bulk-mail-below-the-bcl-threshold-to-the-promotions-folder

Can we relax a little? lol asking for a friend.

There is a shipping and receiving warehouse that prints a lot of labels from software like UPS Worldship as well as pdf output from a few web portals. This has been working well for years aside from the occasional reset the zebra printer stock size settings once in a blue moon.

The company is looking to change things up with a Warehouse Management System that should help us be more efficient and reduce errors.

One of the options requires all label printing to have an IPsec VPN tunnel to the vendors VPS systems which will send ZPL print jobs directly to the Zebra printers.

I am curious if you happen to work with shipping and receiving warehouses and have run into this type of network requirement for label printing?

This is a really strange setup from my experience but I am not claiming to be a warehousing IT expert, happy to learn and our segmented POC does the job just fine but it seems like a lot of extra pieces for something that traditionally has been a super simple setup

I'm seeing this trend more and more. WFH users opening tickets for very simple things that they claim is preventing them from working. I remote in and the issue magically vanishes. How many people do you think are just faking technology problems from home so that they don't have to connect or work? Seems pretty simple to just throw your tech under the bus. Thoughts?

What is everyone doing with this? Moving all PC's to the new Time Zones or staying with known time zones? Anyone brave enough to use the Microsoft Invoke-Calendar move commands that come out tomorrow?

Current Microsoft communications.

Update to MC1510951: Canada 2026 time zone changes — Microsoft 365 impact and required admin actions

 Summary

 On November 1, 2026, certain Canadian regions will not change clocks, affecting Microsoft 365 scheduling. Admins must update Windows, Outlook time zones, review meetings, update Teams Rooms, and keep apps current. Testing and support case submission with #Canada Time-Zone are advised.

 This post updates MC1510951 ((Updated) Windows updates are available for 2026 time zone changes in Canada, posted October 16, 2026).

 On November 1, 2026, affected locations in British Columbia, Alberta, and Manitoba will not move clocks back and will remain on UTC-07:00, UTC-06:00, and UTC-05:00 respectively. Affected locations in the Northwest Territories (including Yellowknife and Inuvik) align with the Alberta change, and Northwestern Ontario aligns with the Manitoba change.

 Windows and Microsoft 365 services depend on updated time zone definitions for correct scheduling and display behavior.

 How this affects your organization

 Confirmed impact

1. Outlook and Exchange Online (calendar): Users must move to the new time zone. Existing events do not migrate automatically. Recurring meetings require additional review.
2. Microsoft Teams Rooms on Windows: Some devices may display time one hour behind Windows until Edge/WebView2 is updated.

Potential impact (under validation)

1. Microsoft Teams (desktop, web, mobile) and other Teams devices
2. Outlook for iOS, Android, and Mac
3. Microsoft Bookings
4. Shifts
5. SharePoint Online
6. OneDrive

What you need to do

1. Ensure Windows devices in affected regions have the latest Windows updates (including October 2026 updates).
2. Ask users in affected regions to select the new time zone in Outlook and review meetings scheduled after November 1, especially recurring series.
3. Plan to run the Exchange Online PowerShell remediation cmdlet for non-recurring meetings once released (target: October 28, 2026).
4. Update Microsoft Edge and WebView2 on Teams Rooms on Windows and confirm room time display matches Windows.
5. Keep Teams, Outlook (including iOS/Android/Mac), and other Microsoft 365 apps current.
6. Test key scenarios before November 1: recurring meetings, free/busy, Bookings appointments, Shifts schedules, and SharePoint regional settings.
7. If issues occur, open a support case in the Microsoft 365 admin center and include #Canada Time-Zone in the title.

Additional information

• Outlook Time Zone Changes for British Columbia, Alberta, and Manitoba (Microsoft Support)
• Interim guidance for British Columbia time zone changes 2026 (DST Blog)
• Interim guidance for Alberta time zone changes 2026 (DST Blog)
• Manitoba 2026 time zone update available now (Daylight Saving Time and Time Zone Blog)

We will continue updating this post as product teams confirm impact, publish mitigations, and release additional guidance.

DreamHost's status page logged the first problem at 2:20 PM PDT on October 23, with connectivity issues on the panel File Manager. By 5:20 PM it was resetting some email passwords as a precaution. At 10:13 PM the resets covered FTP and SFTP users too.

Four days on, DreamHost still hasn't named a cause. BleepingComputer asked how many accounts were hit and whether files or messages were exposed, and got no answer by publication. CyberInsider reports the count of affected customers hasn't been disclosed either.

The File Manager is the panel tool that edits and deletes website files and can fetch a file from any URL. BleepingComputer's story said it was still down. DreamHost's status page says a fix went out at 3:35 PM PDT on October 26 and it's monitoring.

The owner notice tells owners to review the forwarding settings on every mailbox and remove any forward they don't recognize. For SFTP users it says to set a new password. It also says SFTP user data stays on the server.

DreamHost lists 750k+ WordPress installations on its company page. A new SFTP password doesn't remove a PHP file written to wp-content while the old one still worked.

It has happened before. In January 2012 DreamHost reset FTP and shell passwords for all customers after someone got into one of its database servers.

When a host expires SFTP passwords "to ensure the continued integrity" of accounts, does it owe customers a word on whether anything was written to their sites, or is checking the files the owner's job?

Just noticed. Still looking.

Out of band, not a preview.

Secure boot certificates mentioned in this one. Edit: <-- Nope, NOT secure boot. Just certificate.

https://support.microsoft.com/en-us/servicing/os/windows-11/2026/10/kb5134133-windows-11-24h2-25h2-26h2-update

Hey guys, the company I’m working for has no form of back up active right now and id like to set that up. I’ve looked into the Microsoft back up but it doesn’t feel reliable because why would I keep the back up for the environment within the environment

I’ve looked at Rubrik but it’s expensivee, and I’ve looked at Veeam web which also looks expensive

So how is everyone backing up the data for your organisations? It’s mainly for our Microsoft environment in the event of a ransom attack etc. I’m looking for cheap options as management does not want to spend a lot of money

Plss help : (

Can anyone offer me some advice? I quoted for the hours I thought this would take and it has been at least 4x times that already.

I'm using the Office 365 Admin Centre migration tools.

Issue 1: Migrating Files/Shares - CONSTANTLY FAILING - I get a report on what is failed, exclude those folders, and try and run it again. Gets a bit more data then fails again! In the end - I have a "complete" user migration but 20 excluded folders and I have no way of knowing what the issue is and what hasn't moved across. Right now I'm trying to download a full user's data locally so I can just copy it across but I don't know if it will work and also might not work for their "big" 150GB share folder.

I only have ONE user and ONE large share that's an issue, everything was small enough to sync through. But once it is hitting these sync issues it's almost impossible to actually move all their data.

Issue 2: Email migration - they have at least 100k emails, at least 50k being sent auto-replies. I know the issue about file limits rather than sizes and have asked them to look at and clear this data, otherwise it will take weeks of restarting the sync over and over for one mailbox.

Ahhhh

Any other options I can try outside of this damned MS migration tool, that won't break things that have already half migrated?

Microsoft shipped .NET updates out of band on Saturday (Oct 25) for CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with .NET. The .NET advisory scores it 8.1 and MSRC rates it Critical for .NET, and Microsoft says exploitation is more likely, with no exploitation reported as of the 25th.

The patched runtimes are 8.0.33, 9.0.22 and 10.0.14. Anything below those is still exposed, and .NET Framework is not affected, so older Framework servers can sit this one out. The same release also fixes CVE-2026-114148, a file-ownership problem in .NET tarballs on Linux, and it re-does two October 13 fixes that had not fully landed (CVE-2026-70197 and CVE-2026-102870).

A few things that decide how urgent this is on a given box:

Exposure needs an app that decompresses Brotli data it does not control, through ASP.NET Core request decompression, HttpClient automatic decompression, or the System.IO.Compression Brotli APIs. Neither decompression path is on by default, so a patched-later queue is defensible for internal apps that never enable them, while internet-facing ASP.NET Core goes first.

Updating the shared runtime does nothing for self-contained apps because they carry their own copy of the runtime, and those need a rebuild and redeploy. Framework-dependent apps pick the fix up from the runtime update, though the processes still need a restart, and on IIS that means updating the ASP.NET Core Hosting Bundle rather than only the runtime.

PowerShell is in scope as well, with fixes in 7.4.22, 7.5.13 and 7.6.9, which matters on admin workstations that never run a .NET app. Anyone on Azure App Service with built-in .NET images on Linux gets the platform update from Microsoft; the rollout had finished for the Latest channel and was still going out to Standard as of Oct 26.

`dotnet --list-runtimes` gives a quick inventory per machine. Microsoft's announcement is here: https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/

We were sadly compromised. Twice. It's finally answered the question of investments, but the police want evidence.

The audit logs is clear on that, but I realise this will become police evidence. They have a secure upload. I filtered the audit logs as I downloaded them to show everything from the attackers to create the csv file. I then created a text file showing the filter, how it was created and the SHA hash of the file.

Is this enough? I think the attacker(s) made a mistake and may be traceable, so absolutely would be willing to see them prosecuted.

The question is, should I have included anything else in there or done anything else to show the file is not tampered with between myself creating and them opening?

Just like the title says, I needed to record a simple step-by-step for a client today and found that the old tool I used to use (PSR.exe) has been deprecated. Another casualty of modern Microsoft. Does anyone know of a free and simple alternative that works decently enough?

Today, I got the news that a co-worker of mine passed away. She was one of the first people I on-boarded at this client when I previously worked for them as a tech with an MSP and not as their manager. She was always smiling and made me feel so accepted at a place that I was unfamiliar with. She was a mother, under 50 yrs old and had a young daughter she was co parenting. I would get to see her daughter often at the org and you could tell how much her mom loved her.

Now, she is gone and I have to retrieve her laptop. Maintenance has to clean up the office and we have to move on.

It is the second person this year that I have closely worked with that I will have to terminate and it is devastating.

I know this is a somewhat common post here, but I think it's a conversation that is very important for those of us that have had to deal with grief in the workplace.

She had a direct impact on my experience at work and me feeling like I was at the right place in my career.

I want her memory to live on so I will tell others of our interactions and how sweet she was.

If you have had to go through similar, please feel free to share your own experiences with this.
Sending love to anyone dealing with death.

Hey Folks,

Scenario:

• User running MuseAI (not M365 integrated)
• User works on a sharepoint document OR shares a link to a sharepoint document with the bot
• ITDR screams on token theft
• Logs show user logging into sharepoint on chrome/linux, accessing the same file with the same session token they have on their workstation
• none of the other typical evidence of BEC is present (no phishing messages, nothing weird in browser history, etc)

To me, this looks like Muse is taking extreme liberties with end users active cookies and login tokens, replaying them on other machines in other geo-locations. Terrifying if true.

Wondering if anyone else has seen similar.

And yes, I know, block non-approved apps, filter DNS, etc. Not looking for solutions, just confirmation that others are seeing similar behaviour.

Hi everyone,

Earlier today we were the target of an automated Layer 7 DDoS attack against our production Cloud Run service. The attack was carried out using a Python script (Python/3.13 aiohttp/3.14.5) which was making around 50 requests per second to POST /api/login, attempting to consume container concurrency.

The traffic came through Google's own proxy infrastructure, potentially Apps Script or Colab, rotating across 200+ IPs resolving to google-proxy-*.google.com (e.g., 66.102.8.132, 66.102.8.161, 74.125.210.103).

The problem is that Google's official abuse reporting form (https://support.google.com/code/contact/cloud_platform_report) immediately closes the report with:

We're unable to do anything with this report as the IP address referenced in it isn't hosted on Google Cloud.

It appears the automated system only recognizes customer Compute Engine IP ranges, not Google's own proxy egress IPs (AS15169). As a result, the report gets rejected before anyone can review the Cloud Logging evidence, including timestamps and Cloud Trace IDs.

We've already hardened the backend with distributed Firestore rate limits, concurrency controls and request timeouts so the attack traffic is now being dropped. We've also responded to the closed ticket with the trace IDs, asking for escalation to the relevant Trust & Safety team.

I have three questions:

1. Is there a specific abuse reporting email or intake point for traffic coming in via Google's own proxy infrastructure which would effectively bypass the automated IP validation?
2. Has anyone with Basic Support actually escalated a similar proxy based DDoS to a human at Google?
3. Would Google Bug Hunters be the right place to report this as a potential proxy abuse/SSRF vector or is there a more appropriate channel to get to the relevant security engineers?

Any suggestions on how to get this routed to the appropriate team would be great. Thanks!

Please don't settle for a salary that barely lets you get by.

I know you're just starting out. Maybe you're resetting passwords, fixing user issues, installing software, or doing basic troubleshooting all day. You might feel like your responsibilities aren't that big yet, so you don't deserve to ask for more money.

But here's the thing about this career. The job you're doing today is only a small part of what you need to learn if you actually want to get somewhere in IT.

You have to learn networking, operating systems, servers, virtualization, cloud, scripting, security, and a whole bunch of other stuff. And a lot of it? You're gonna have to learn on your own time, because your company isn't gonna teach you everything you need to know.

You'll be spending your evenings learning, building labs, troubleshooting things that don't work, and trying to figure out what you should learn next. Sometimes you'll spend months learning something that has absolutely nothing to do with your current job, just because you know you'll need it to move forward.

Now imagine doing all that while worrying about money every single month.

That's what bothers me.

You're already investing your time and energy into building your career. Your salary shouldn't make that harder than it needs to be.

My advice? Ask for better pay. Don't just calculate how much money you need to survive until the end of the month. Think about how much you need to support your family, save money, pay for learning resources, handle emergencies, and still have something left over.

If possible, aim for a salary that lets you save at least twice your essential monthly expenses. It might take time to get there, but at least have that goal.

And don't keep accepting the same salary year after year while you're learning more, gaining experience, and becoming better at what you do.

If your company doesn't value your growth or pay you fairly, start looking at other companies. Prepare for interviews, improve your skills, and move when you find a better opportunity. Just make sure you have a sensible plan before leaving your current job.

One more thing: don't convince yourself that you deserve less just because you're a junior or because your current work seems easy.

You might not be managing production servers today. You might not be designing networks or working with cloud infrastructure yet. That's fine. Everybody starts somewhere.

But you need time and money to get beyond that stage.

IT changes fast. If you can't afford to keep learning, or you're so stressed about your finances that you never have the energy to study, you're making your own career progression harder.

And a few years down the road, you don't want to find yourself doing the same work, earning almost the same money, and wondering why you haven't moved forward.

I'm not saying you should demand an unrealistic salary or quit every job that pays less than you want. Sometimes you have to start small.

Just don't make the mistake of thinking a low salary is perfectly fine simply because you're doing entry-level work.

Think about where you want to be three or five years from now, and make sure your current job is helping you get there financially as well as technically.

Work hard, keep learning, and ask for the money that gives you a real chance to grow. Don't spend your entire career just trying to survive while preparing yourself for a better one.

Hi there! Not sure which subreddit to ask this in, so here I am! I work at a non profit arts organization that houses lots of artists short-term throughout the year. We have about 50 rooms scattered around our campus, and managing every rooms schedule in Excel is torture.

Does anyone have a room booking system (preferably free or low cost for non-profits) that they have used to create and manage booking like you might use at a hotel or something similar? We wouldn’t need the ability to have people make reservations themselves, as my team assigns everyone a space. Just looking for a way to create reservations myself, see who is in which room when and have our housekeeping team update rooms when they’re clean. Any advice is appreciated!

We acquired a company that uses QNAP NAS'es but we have no experience with these whatsoever. Defender is telling me to update our TS-431XeU because of the recent PHP2Shell vulnerabilities, but looking at the details, it's still running QTS 4.3.4.0675 , so we're about eight fucking years behind.

However, checking for updates through QTS says the system is up-to-date while the QNAP support page lists newer firmware for this model. I assume we'll have to update it manually, but I'm not sure whether we can jump straight to QTS 5.x or if we need to install intermediate versions first.

My question: is it safe to update across such a large version gap and what does the process look like? Any indications of update duration, possibilities of failure, compatibility issues with existing RAID configurations or volumes, etc.? Also, what are the recovery options if the firmware update fails or the NAS doesn't boot afterwards? Fuck me but also fuck that guy for leaving no documentation.

We will of course back up the data but I'd rather not risk anything since this is a production NAS and we don't know much about its history.

Anyone who's done a similar upgrade on this model or another older QNAP?

Edit: fuck it, I created a ticket at QNAP but since they're not reachable from outside, I'll just put a wall around it as someone said here. Thanks for the info, my dudes

Hello, everyone!

Sysadmin with 9 months experience here(basically nothing). My question is kinda more theoretical/philosophical rather than technical one. So I do tasks and tickets, but at the same time I read books about Linux and recently I was learning on a deep level about TTY, PTY, history of terminals, what is line discipline and etc. And when I asked my senior colleague clarifying question about it, he said that he does not know, indeed he thinks that its pointless to learn this things because its highly unlikely that I am ever going to implement this knowledge at all. He stated that it is better to learn new stuff as you get new tasks instead of building up this knowledge because you will forget it anyway. He added these things like low level components and C and all this stuff that Unix systems are running on is already a legacy and we have to shift to a next abstraction layers like developers do not need to know how assembly runs code. So my question is do I really need to know all these things and even more so on a this profound level to become highly skilled sysadmin and infrastructure specialist or I need to form a more pragmatic thinking? For example, I know what is bios, uefi, lvm, disk partition, daemons and etc, but it's more on superficial/practical level even though I can answer interview questions about it.

I think that this philosophy (understanding Linux/Unix and its components on a profound deep level even though I probably will not use this knowledge on a day to day basis ) is going to make me a strong professional by building a whole picture but at the same time since I am new to this industry and do not know it is going to work in a long run.

Thank You everyone in advance!

Walmart opened its store to AI shopping agents last week while Amazon is blocking Meta's, and it landed right as we're finishing our Black Friday WAF rules.

Every year our checkout rules get stricter going into peak, anything that looks automated gets challenged or blocked, and that's done a good job against card testing and credential stuffing.

An agent buying for a customer looks a lot like those bots from our side, headless browser or straight API calls, fast and with no mouse movement, and from next month some of that traffic will be real orders.

Our shop is headless (Scayle), so search, cart and checkout are already APIs an agent can call, which means the whole decision lands on the WAF.

The business side hasn't decided whether we copy Walmart, copy Amazon or let a few known agents through, and the rules freeze on Nov 1.

So before I pick a default myself, how are you treating agent traffic going into Black Friday ?