We acquired a company that uses QNAP NAS'es but we have no experience with these whatsoever. Defender is telling me to update our TS-431XeU because of the recent PHP2Shell vulnerabilities, but looking at the details, it's still running QTS 4.3.4.0675 , so we're about eight fucking years behind.

However, checking for updates through QTS says the system is up-to-date while the QNAP support page lists newer firmware for this model. I assume we'll have to update it manually, but I'm not sure whether we can jump straight to QTS 5.x or if we need to install intermediate versions first.

My question: is it safe to update across such a large version gap and what does the process look like? Any indications of update duration, possibilities of failure, compatibility issues with existing RAID configurations or volumes, etc.? Also, what are the recovery options if the firmware update fails or the NAS doesn't boot afterwards? Fuck me but also fuck that guy for leaving no documentation.

We will of course back up the data but I'd rather not risk anything since this is a production NAS and we don't know much about its history.

Anyone who's done a similar upgrade on this model or another older QNAP?

Edit: fuck it, I created a ticket at QNAP but since they're not reachable from outside, I'll just put a wall around it as someone said here. Thanks for the info, my dudes

Walmart opened its store to AI shopping agents last week while Amazon is blocking Meta's, and it landed right as we're finishing our Black Friday WAF rules.

Every year our checkout rules get stricter going into peak, anything that looks automated gets challenged or blocked, and that's done a good job against card testing and credential stuffing.

An agent buying for a customer looks a lot like those bots from our side, headless browser or straight API calls, fast and with no mouse movement, and from next month some of that traffic will be real orders.

Our shop is headless (Scayle), so search, cart and checkout are already APIs an agent can call, which means the whole decision lands on the WAF.

The business side hasn't decided whether we copy Walmart, copy Amazon or let a few known agents through, and the rules freeze on Nov 1.

So before I pick a default myself, how are you treating agent traffic going into Black Friday ?

As if Microsoft and their software/cloud isn't bad enough in it's current state, it's likely going to get worse with a reduction of about 1/4 of their workforce.

Microsoft makes new 'voluntary exit' offer to about a quarter of its workforce, including some execs – GeekWire

I'm eager to see how many more shit updates get through MS "QA" into production environments and cause unnecessary havoc and stress globally.

Anyone else experiencing this issue? We've got multiple reports of errors when clicking "Open with Word" or Excel or similar in New Outlook.

Edit: Usually it just spins, but sometimes you get this error message https://imgur.com/a/EIOrTdq

We're trying to get M365 setup. However whenever I try to login to the application with a test licensed user account, I get a 404 Network error. I know the creds are good, I can log into web portal no problem.

I've isolated the issue to a specific GPO that when applied causes this, but this is a like a legacy GPO that may be 20 years old and no matter what I've done I can't seem to isolate what specific policy item is causing this.

I've recreated the policy by hand, trying to match it item for item, no problems, the new test policy doesn't prevent M365 from working.

I do a backup and restore policy item, new restored policy does cause the problem.

I modified the files in Sysvol and renamed the ADM folder in the relevant GPO to adm.old, this prevented new computers from experiencing this behavior. But since I need to get M365 working, I need to find the actual policy so that I can either delete the registry key or set the inverse as simply removing the policy leaves the behavior in tact for anything that got the policy previously

I've used Regshot for a before and after, unforunately this creates a 5,000ish line txt file and there is simply too much noise to figure out what's actually happening here.

If anyone has any ideas or thought about where to look or ideas on how to isolate this further, that'd would be greatly appreciated.

This is M365 installed on Windows 11 24H2 Ent.

Is anyone else's team still recovering from the recent PHP2Shell fire drill (CVE-2026-109618 / 109619)?

How we got here is what scares me the most. The developers knew about a memory issue back in 2024. They ignored it to keep older systems working, thinking no one could actually use it to hack into systems.

But then, someone used a new AI model on the old C codebase. The AI quickly found a complex bug that humans had missed for years. To make things worse, a software company accidentally released the fix 12 hours too early. Because of this mistake, hackers could see exactly what was changed. They started attacking the internet before the official warning even came out.

For 20 years, old open-source code stayed safe mainly because finding memory bugs by hand is incredibly hard, boring work. Now, AI models can easily find hidden flaws in 15-year-old code. Volunteer developers simply can't keep up with this speed.

How are you all handling this at work? If we now have to fix servers in four hours or unplug them completely, I might just move to the woods and raise goats.

Has anyone else experienced Quickbooks Online being very slow loading reports when in a Zoom meeting doing a screenshare? We have an accounting client that is fully remote and just about all of them report this issue. QBO is fast and responsive until the Zoom meeting starts, then it takes 10+ seconds to go from page to page. We're trying everything we can for them, but wondering if anyone else has come across this and found a solution? TIA!

Our rep at CDW doesn't seem to be able to renew our Windows 10 ESU licenses. He screwed up our Druva renewals repeatedly. Does anyone have any suggestions for an alternative to CDW? We don't use them often (we manage the Microsoft licensing in house). a VAR willing to handle an occasional small volume customer?

Increased cloudflare down reports. Have two circuits at work here, users on one were fine to connect to anything. Other users on lumen circuit were having connection issues to some websites. Switched everyone off lumen fire is quenched for now.

Anyone else have a similar issue right now?

I'm trying to transition into IT and would appreciate some advice from people who have made a similar move.

I have an upcoming interview for a Customer/Hardware Specialist position at a dental imaging company. It's a six-month contract-to-hire role paying $17/hr, onsite, Monday through Friday.

The job involves Level I support calls and emails, troubleshooting hardware and software issues, working with medical imaging equipment, installing equipment, training customers, documenting issues, and escalating problems when needed. My background is in education technology, where I've supported devices, printers, software, and end users, but I haven't worked in a dedicated IT support role.

I'm planning to work toward CompTIA certification and stack others.

My situation is that I have about 2.5 months of unemployment benefits remaining at $584 a week, and I'm currently living with family without paying rent. At $17/hr for 40 hours, the job would pay $680/week before taxes, so the financial difference isn't huge.

I'm trying to decide whether to take an opportunity like this to get actual IT experience while studying for certifications, or use the remaining time to study and look for a remote job paying around the same amount or more.

I think the hands-on experience could help me qualify for better IT jobs down the road. Another concern is that a six-month contract could limit my flexibility if a better opportunity comes along, and working onsite might make it harder to study.

Thanks in advance for any insights you guys have!

EDIT: Hi everyone! Thank you for sharing all your insights. It’s been really helpful!

I just wanted to add a little more context about my situation. I’m 37 and have been working in education for a while, but I’m now looking to transition into IT and build a new career path. My interview is Thursday afternoon, and the commute is pretty short since I’m in the NJ/NYC area.

I asked the recruiter if there was any wiggle room on the pay, but he pretty much said no. He also described it as primarily a customer service role with some technical work mixed in. I’m still going to take the interview and ask what the day-to-day responsibilities might look like over the next few months, especially when it comes to getting hands-on technical experience.

On paper, the job description sounds more technical, so I’m hoping there’s more to it than the recruiter’s description suggests. For now, I’m going into it with an open mind and doing as much preparation as I can. I’m excited about the possibility of getting my foot in the door and building experience, but I also want to make sure the role will help me develop practical IT skills that I can build on in future positions.

Thanks again for all the advice!

Hey!

We’re seeing a strange issue with VSS / Shadow Copies on a Windows Server 2025 VM running on Nutanix AHV.

Whenever a shadow copy starts, whether scheduled or triggered manually, everything works normally for about 1 minute.
After that, the affected disk becomes almost completely unresponsive for roughly 3 minutes.
There is still some disk I/O during the freeze, but nothing that looks unusually heavy.
Once the VSS service stops due to inactivity, the disk immediately becomes responsive again.
At that exact point, we see a large burst of writes to the separate volume being used for shadow copy storage. The behavior is very repeatable.
So the pattern looks like:

Shadow copy starts → ~1 min normal → disk freezes ~3 min → VSS stops → disk instantly recovers → heavy writes to shadow-storage drive

EVEN WEIRDER
These disks were orginally attached to a 2016 file server and we had no issues. It was only once we attached them to 2025 that we see a problem.

Thoughts? Thanks!

Many of my users travel full-time or part-time for work. I need a laptop multi-monitor solution that will be durable and supportable. Amazon has clip-on dual/triple monitor options but they look cheaply made to me and not durable. Cost is not the primary issue. I need reliability, longevity, supportability. I am currently looking at the MobilePixels Trio 3. Do you have any experience with this device? I need something with a chance at a 5-year lifespan.

In your experience, are there ANY multi-monitor solutions, for traveling workers with laptops, that meet the criteria given?

I am worried the Amazon solutions will just be crap that breaks constantly and floods our ticket queue with broken monitor complaints.

Anyone else seeing this? I've been trying to get to the authentication methods > policies and the password reset pages, and I'm just getting 404 not found responses. Other parts of Entra are OK. The service health doesn't seem to report this as a detected issue? Our tenant is in the UK.

MgGraph is working fine.

I just wanted to get this off my chest. I don't have anyone to talk to who would understand what I'm going through.

I'm in hell. The metrics are unattainable, and there are too many tickets. I'm getting anxious every day, and I've even started dreaming about tickets. My managers call me out almost every week because I miss a ticket.

I want to leave this job, but I can't for now.

... and rats are gnawing the floorboards.

(To be kinda meta, this post isn't seeking anything except commiseration and conversation. I'm just reflecting on the dizzying array of changes within the last ~3 years, and hoping a graybeard out there can relate to feeling ... I don't know, displaced? surreal? anyways, my apologies if this doesn't belong in r/sysadmin*)...*

While the underlying tech has evolved, the core of the Internet and computing remains the same as it was in the 1980s: content is stored on hosts and delivered to clients through multiple layers of protocols.

It makes sense, then, that AI will discover uncontrollable amounts of vulnerabilities. The visionaries who initially drafted the RFCs for DNS, HTTP, and TCP/IP couldn't have possibly imagined our data getting commodified, names and birthdays sold for pennies or held for ransom, financial ruin inevitable. Of course they baked their naiveties into the tech. Of course history is getting sandwiched between OpenAI and Anthropic, with attendant freakouts from suits and normies alike.

It seems like the wooden planks are decaying, but the replacements don't fit anywhere yet. Maybe it's time we transition away from the existing infra and replace it in its entirety with the Semantic web and MCP/agents. Give up the whole ghost.

Can anyone relate? Does this resonate at all?

Hi everyone,

I did a migration back in June on a pair of Server 2016 DCs to Server 2025. For some reason, the primary DC had two IPs (one virtual NIC with two IP addresses) - both on the same subnet. It was a new environment that I wasn't terribly familiar with so I recreated the same setup on the new DC. I gave the old DCs IP addresses to the new DCs when I cut them over. Everything went fairly smoothly and I didn't think anything of it at the time.

Then yesterday the DHCP scope for the primary staff subnet filled up. Turns out DHCP on the two DCs (they were in load-balancing mode) lost connection with each other because the primary DC only binds to one IP and it times out when DNS resolves to the other IP (DNS is listening on both IPs). So the two servers weren't syncing and one of them filled up and the other one didn't.

And that's how I found out what "multi-homing" is.

So I want to get rid of the 2nd IP to get it set up properly but I want to try and find out first if it's even safe to do that? I don't want to do something hastily and break things further.

Would removing the 2nd IP and clearing out the associated DNS records have any implications for the GC or the general health of the domain? Do the DHCP databases need to be rebuilt or will they replicate when I restore connectivity?

Any advise is appreciated.

​

Hi everyone,

I'm seeing intermittent high CPU usage from Microsoft Defender Antivirus ("MsMpEng.exe"). CPU usage reaches around 90–200%, and the alerts usually resolve themselves after a few hours.

No active scan was running during troubleshooting, and Defender appears healthy. I suspect real-time scanning triggered by application file activity may be involved.

Has anyone experienced something similar? What would you recommend checking first to identify the root cause?

Thanks!

Hi,

I need to migrate our File Server 2012 R2 servers to Windows Server 2025 (on vSphere).

I want to avoid a never-ending Robocopy job, so I was thinking of doing a disk swap:

1. Export HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Shares (including the “security” subkey) from the 2012 server.
2. Shut down the 2012 server and detach the VMDK.
3. Attach it to the 2025 server and assign it the same drive letter.
4. Import the .reg file, restart the LanmanServer service, or reboot.

NTFS permissions are carried over with the VMDK, and shares are carried over with the .reg file.

Are there any edge cases or unexpected issues to watch out for with such a large version gap? Also, I’ve heard about SMS (via WAC), but since the swap literally takes 5 minutes, I don’t really see the point. What do you think?

Translated with DeepL.com (free version)

Hello everyone,

In my ESXi 6.0 environment, when I run /usr/lib/vmware/vmsyslog/bin/vmsyslogd, I get the following error message:

Cannot open kernel log device!

After checking, I discovered that the symlink /dev/klog pointing to /dev/char/mem/klog does not exist. I tried recreating the symlink manually, but was unsuccessful.

Currently, the vmsyslogd service is unable to run.

Any help or suggestions on how to resolve this would be greatly appreciated!

Thank you!

Does anyone have experience with Forensit User Profile Wizard in migrating a user profile from the old domain to a new domain?

I’m migrating 6 users to the new domain, and want the transition to be as seamless as possible.

Edit: it worked great for user #1. She had a ton of desktop documents, etc. i manually exported and imported the Chrome passwords and bookmarks. In our setup, I had to connect to VPN before running the tool and afterward as local administrator before signing the user in for the first time. I’m pleased.

Hey fam. My company is going for CMMC and we have an outside MSSP who specializes in CMMC hardening guiding us through it. We’re already on o365, but need to migrate to the GCC High tenant. They’re strongly recommending we rebuild every workstation as part of this process, as they say it leaves too many settings behind to just update outlook / OneDriveSync. This seems.. unnecessary to me.. I’ve migrated companies we’ve acquired into our tenant many times, but haven’t worked with GCC before. Wondering if this has any validity or if it’s a big cash grab for this third party.

Advice and insights welcome and appreciated.

In todays age of AI the standards have changed. I am a bit confused on what shows I actually possess knowledge. So I will list what I have done this year solo:

1. Rebuilt network - (scope 38 users)

• We run alot of things on prem. I moved most of our servers and switches to a new server room we built in the basement.
• Replaced legacy firewall,setup vlan, migrated legacy dhcp and dns server to a newer one. Created reversproxy and a dmz zone.
• Replaced switches and changed our topology. Moved systems into different vlans and configured a firewall.

1. SSO and Active directory

As we had to move away from Microsoft products and setup local on prem solutions. I also created a SSO + AD solution for linux stack.

• Setup and tested playbooks for creating keycloak sso server + smallstep ssh server + freeipa server.
• Made it work so we can SSO to selfhosted apps like gitlab. Use SSO for ssh:ing to servers and have an active directory where I can choose what users should have sudo access where.

I have done smaller projects too but also supporting people in house with all kind of matters. I am maintaining our cloud on prem. I try to use ansible for everything I do and terraform to provision vms for me . I have 2-3 years experience as sysadmin.

Hello all,

We moves tenants and update everyone's iPhone or Android. But one iPhone lost it's names in Messages. I tried just about everything I could find on the net. No help. Any thoughts?

**A simple troubleshooting sequence for AD/DNS symptoms**
When domain authentication, Group Policy or domain-controller discovery starts behaving inconsistently, I prefer to establish the basic evidence before making configuration changes.

My initial checks are:
ipconfig /all — confirm the configured DNS servers and network settings.
Resolve-DnsName _ldap._tcp.dc._msdcs.yourdomain.local -Type SRV — check whether the relevant domain-controller locator records resolve. Replace the example domain with your own.
nltest /dsgetdc:yourdomain.local — test domain-controller discovery.
dcdiag /test:dns — investigate DNS-related domain-controller health.
repadmin /replsummary — review replication failures and delays.
I treat these as a starting point rather than a definitive diagnosis. A successful DNS lookup does not rule out every DNS issue, and replication problems can have causes beyond DNS.
The important part is to preserve the output and correlate it with event logs, timestamps and recent changes before attempting a fix.
A repeatable evidence-first process makes troubleshooting easier to explain, reproduce and hand over. You opinion?

Hello. I am trying to hire two positions and while I think these are good jobs on a good team, I am getting very few applications and I am hoping for some advice on how to retool the positions to get more hits.

I know I'll catch hell for this, but I cannot provide a salary range, but management said they are willing to pay high for quality talent. These positions are in Huntsville, AL and require a Secret clearance. Huntsville has a lot of cleared talent, so I was hoping for more applications.

One is a 50% network position and 50% storage position:
https://careers.trinzic.com/us/en/job/R3000564/Senior-Infrastructure-Engineer

The other is a pure Linux sysadmin:
https://careers.trinzic.com/us/en/job/R3000823/Senior-Linux-Systems-Administrator

Not necessarily trying to advertise here, I'm just looking for advice on how to retool the postings, but obviously if any of you want to apply please go ahead.