Hi all,

we deployed the PaperCut Print Deploy Client via Intune (Win32 app, MSI) to ~5,500 Windows 11 devices. Devices are Entra ID joined only (Autopilot), so no GPOs and no logon scripts.

The issue: a user has a local printer (e.g. a Brother) set as default. When a queue is installed through Print Deploy (e.g. a Konica Minolta), it becomes the default printer. If the user switches the default back to the Brother, after a reboot the Konica is the default again.

What I've already checked:

- "Let Windows manage my default printer" is turned OFF

- No GPO applied (device is Entra joined only)

- No logon scripts, and no Intune policies or scripts touching printers

- I found nothing in PaperCut's public docs about a "set as default printer" option in Print Deploy

Our team doesn't manage the PaperCut admin console, so I can't check the pool/profile settings myself.

Questions:

1. Does the Print Deploy Client re-apply a default printer at every login/startup? Is that expected behavior?

2. Is there a server-side option (printer pool, profile, or rule) that sets the default printer on clients?

3. Has anyone found a way to stop it, either via console config or on the client side?

Thanks in advance!

Anyone else seeing issues with Microsoft Teams this morning? Messages not being sent or received?

Edit: Thanks for confirming everyone. GCC here as well. Tested from external cell phone as well to make sure it wasn't our internal network but wasn't seeing anything on the M365 service health page.

Hi everyone,

We're currently migrating approximately 3,000 Windows endpoints from traditional Active Directory to Microsoft Entra Join, with Intune and Microsoft Global Secure Access (GSA / Entra Private Access).

One challenge we're facing is how to preserve effective remote troubleshooting capabilities for our L2/L3 support technicians and IT analysts.

Our current environment

With AD-joined devices, we use WinRM / PowerShell Remoting extensively for interactive troubleshooting, diagnostics, inventory queries, and remediation.

For example, a technician can:

• Connect to a remote workstation using PowerShell.
• Query services, processes, registry settings, WMI/CIM, event logs, and Windows configuration.
• Investigate an issue interactively.
• Execute a corrective action.
• Immediately verify the results.
• Continue troubleshooting based on what was discovered.

This is particularly valuable because troubleshooting is rarely a predefined sequence of actions.

The challenge with Entra Join and GSA

We understand that WinRM can work with Entra-joined devices under certain conditions.

However, using WinRM through GSA, especially for remote endpoints without direct network connectivity, appears to be considerably more complicated.

Our architects are understandably cautious about maintaining traditional remote administration capabilities in a modern Zero Trust environment.

But here's my concern: What about the technicians and analysts who actually troubleshoot workstations every day?

Why Intune Remediations may not be enough

Intune Remediations are useful for proactive management, automated corrections, and recurring issues.

However, they don't necessarily replace interactive troubleshooting.

Consider a technician investigating a Windows service issue.

With WinRM, they can query the service, inspect dependencies, examine logs, test a hypothesis, apply a correction, and immediately verify the outcome.

With Intune, the process may involve creating or selecting a remediation script, deploying it, waiting for execution, retrieving results, and repeating the process if additional investigation is required.

Furthermore, our L2/L3 technicians and analysts won't necessarily have access to Intune administrative functions, nor should they require broad Intune permissions simply to diagnose a workstation.

We don't want every troubleshooting operation to depend on an Intune administrator or someone developing a new remediation script.

My questions to the community

1. How are you handling interactive remote troubleshooting for L2/L3 technicians in an Entra-joined environment?
2. Have you successfully retained WinRM / PowerShell Remoting, including for remote endpoints using GSA?
3. If you've moved away from WinRM, what solution replaced its interactive diagnostic capabilities?
4. How do your technicians retrieve diagnostic information and execute corrective actions without having to create and deploy new scripts for every investigation?
5. Has your organization implemented a solution that provides immediate, interactive PowerShell diagnostics while respecting Zero Trust and least-privilege principles?

I'm not opposed to modernization or replacing WinRM.

If a modern solution provides equivalent or better functionality with appropriate security controls, I'm all for it.

But I believe we need to distinguish endpoint management from interactive technical support.

Replacing a technology should not mean losing operational capabilities that support teams rely on daily.

I'd be particularly interested in hearing from organizations managing thousands of Windows endpoints that have already completed this transition.

What does your L2/L3 troubleshooting workflow actually look like today?

For those who set HKLM\SOFTWARE\Microsoft\Rpc\EpmapSavedContextCap = 65536 on Exchange instead of uninstalling the October KB (https://techcommunity.microsoft.com/blog/exchange/exchange-servers-may-become-unstable-after-installation-of-october-2026-windows-/4565382): are your servers stable since then, or are you still seeing MdbOffline / mail flow lockups? Any side effects, and are you doing scheduled reboots until a real fix ships?

Also, how are you monitoring Exchange for this issue?

Ran into this while chasing a bug report and it surprised me, so sharing.

Spamhaus doesn't answer queries that come through big public resolvers. Google returns an empty answer, which your software reads as "not listed". So a Postfix reject_rbl_client zen.spamhaus.org on a box that resolves through 8.8.8.8 lets everything through, and nothing ever logs an error.

10-second test, run on your mail server:

dig +short 2.0.0.127.zen.spamhaus.org

That's Spamhaus's permanent test entry; it should always return 127.0.0.2. Empty or 127.255.255.x means your lookups aren't working.

Fix: run a local recursive resolver (Unbound takes five minutes) and point the mail server at it. If you're non-commercial, a free Spamhaus DQS key also works.

How I found it: I maintain a small self-hosted blacklist monitor, and a user reported an IP that was on Spamhaus but showed clean. Same cause. It now tests every list against its test address first and shows "no answer" instead of a fake "clean".

Curious how common this is: what does the dig return for you?

Im a L1/L2 support guy. Our end users use the new outlook from Microsoft. Since yesterday, ive had a handful of users call in saying they can't open documents, specifically PDF documents

When I go to their mail and open the PDF I can't. Its only a preview of it. I have to save it to the desktop or one drive and then I can open it in edge. I can't just double click and open it in edge anymore.

Same goes with word documents. I click them, select to use it in the desktop app, and it will say its opening or loading then it stops and never opens.

Ive downloaded Adobe acrobat reader and tested it as thr default app to use, nothing works.

Its driving me crazy and making me feel extremely stupid that I can't resolve this.

Any help, ideas, even a solution at best would be helpful, thank you.

Hi all,

I'm migrating a Windows Server 2019 DHCP server (~200 scopes) to a new Windows Server 2025 server.

I exported with Export-DhcpServer -Leases on the 2019 server, but Import-DhcpServer on 2025 fails with:

"Failed to set server configuration on DHCP server ... Network Access Protection is not supported by the server. (20138)"

NAP was never used on the old server, but the export XML still contains NapEnabled / NpsUnreachableAction (server level) and NapEnable / NapProfile (scope level). Removing these elements from the XML breaks the schema validation ("The element 'IPv4' has invalid child element 'ActivatePolicies'. Expected: 'NapEnabled'").

Options I'm considering:

1. Import scope by scope with -ScopeId in a loop and move the server-level settings (option definitions, classes, server options, policies, filters) separately.

2. Skip the XML entirely: create a DHCP failover relationship from the 2019 server to the 2025 server with all scopes, let it replicate, then remove the relationship.

Questions:

- Has anyone hit this? Which approach did you use and did anything get lost (server options, vendor classes, policies, DNS credentials)?

- Is there a supported way to make Import-DhcpServer ignore the NAP settings?

- Any gotchas with the failover method for ~200 scopes (time, lease state, reservations)?

Thanks!

I am a bit late in this boom. Right now I am only using LLM chatbots to create infrastructure as code and other things . But I have the controll and I am able to read the output and doublecheck. But then I am hearing about people actually spending time with agents and mcp servers. How much more advantage does it get me?

ssh sends no keepalives of its own by default (ServerAliveInterval 0), and Linux waits two idle hours before the first TCP probe, so a script on a frozen host can hang for hours. Set the interval to 15 and a 45-second network blip kills the session. Do you tune keepalives, run commands detached and poll, or wrap them in timeout?

Here’s what I mean. If someone asks me how computer hardware works, I can take them all the way from the basics of physics and electricity to semiconductors, transistors, logic gates, integrated circuits, CPU architecture, and beyond. I want them to understand how everything connects, not just memorize a bunch of terms.

Now I want to understand software and operating systems the same way.

I don’t just want to learn Linux commands, memorize troubleshooting steps, or learn how to use different IT tools. I want to know what’s actually happening under the hood. How does an OS work? What’s really going on when a process runs, memory gets allocated, a system call happens, or a device communicates with the kernel? And how do all these pieces fit together to make modern IT infrastructure work?

Basically, I want to start from absolute zero and build my understanding step by step, just like I would with hardware and electronics.

Is there anyone here who really understands operating systems at a deep level and can explain them from first principles? I’d love to learn from someone who can connect the dots instead of just telling me what commands to run.

We are seeing a increase reports of an error "Something went wrong" after logging onto any Microsoft app. Windows 11 26H2 running the latest Windows Updates.

Found this post where it was suggested KB5127648 was the cause.

Anyone else?

Hello everyone,

We are planning to expand our current tape infrastructure by adding an expansion module to our existing LTO-8 tape library.

Our current setup consists of 2 tape drives and 40 slots. After the expansion, we will have a total of 4 tape drives and 80 slots. The tape drives use Fibre Channel (FC) to transfer data from the primary server.

Reason

Our RTO and RPO have increased significantly, as we are now transferring around 200 TB of data per week. We need to improve them.

I also have the feeling that our current logical infrastructure design may not be the most efficient. We are currently using Veeam Backup & Replication to perform our backup-to-tape operations.

Current

We currently have a single Standard Media Pool containing all our tapes. None of them are WORM tapes.

We use a single tape job with no incremental backups, which copies only the weekly full backups to tape. Parallel processing is enabled in the job, allowing it to use both LTO-8 drives simultaneously. The tapes are labelled both logically and physically according to their retention category: weekly, monthly, and yearly. We also label each tape with a DIMO. We do not use quarterly tapes.

Our current process is entirely manual. We select and insert different tapes depending on the occasion, rather than having an automated process. To be honest, I really dislike our current labelling system. All tapes have the same retention settings in Veeam. We manage retention manually by moving the tapes and storing them physically for the required period.

Proposed

Since we will have 80 slots available, I was thinking about using the additional capacity to keep the weekly tapes and, potentially, future daily tapes loaded in the library, as these will be the tapes we use most frequently. Our weekly tape rotation requires a total of 64 tapes, so this would allow us to keep them in the library instead of having to move around 16 weekly tapes to our off-site vault.

However, this raises my first question: Is it recommended to leave tapes loaded in the library when they are not actively being used?

I understand that these are not WORM tapes and that, in the event of a cyberattack, they could potentially be exposed to overwriting. One idea I had was to use the physical write-protect switch on the tapes to prevent them from being overwritten while they are idle.

On the other hand, I have also considered the risk of a physical incident in the data centre, although we consider the likelihood of a fire or flood to be relatively low.

Is this a reasonable approach, or is it strongly recommended to remove written tapes from the library and store them in an off-site vault?

For those managing larger tape libraries with many slots, how do you typically handle this? Do you leave tapes stored in the library and use the available slots as intended, or do you still remove written tapes manually, as we currently do?
From a Veeam configuration perspective, I am considering the following changes:

• Media Pool: Use a single GFS Media Pool containing all retention types, excluding quarterly tapes.
• Tape labelling: Eliminate our current logical and physical labelling system and rely entirely on barcodes to identify the tapes.
• Tape job configuration: Keep parallel processing enabled and configure the job to use all four tape drives.
• Media Vault: Set up a Media Vault in Veeam to better organise and track the tapes stored outside the library, as I understand this functionality is available in Veeam.

These changes would be implemented progressively as our tape operations evolve, rather than all at once.

Do you have any recommendations regarding this approach? Are there any potential pitfalls or configuration changes that you would advise against?

Thanks!!

I have to setup a new domain and I am strongly considering windows 2025 for smb without VPN and to save myself from reinstalling the DC two years from now. Given the frequent complains here I wanted to circle back with you people if anybody having a recent update roll up installed is facing problems? Especially with the RDP broker and trust issues between servers (also domain joined Linux VMs).

The domain would be a pure 2025 AD with roughly 50 clients providing file access and DNS, dhcp handled by pfsense. Authentication would be provided to web apps through privacyIdea and keycloak.

Fire away!

The SSL certificate has been updated to the latest version on the IIS server and is working correctly in Microsoft Edge. However, Google Chrome still displays a “Not Secure” warning even though the latest certificate is visible.

Anybody else's Microsoft Bookings page not correlating with their outlook calendar? This is causing HUGE issues right now with bookings appointments when people aren't even available or took vacation. I have already made a ticket with Microsoft and they are 🤷🤷🤷🤷🤷. Yes the check box for "bookable when staff are free" is checked.

I've been messing around with my AD lab today and finally got one issue sorted out. I have two Windows Server domain controllers, but DC01 is currently powered off, so I'm working with DC02 for now. While running dcdiag, I found that the _msdcs delegation was still pointing to DC01. I checked the records and changed it to point to DC02 instead. Ran dcdiag again, and the DNS tests are now passing. I also jumped onto my Windows 11 client to see if it could reach DC02. DNS resolution works, ping is fine, and TCP tests to ports 53, 88, and 389 all succeeded.

The part I'm still trying to understand is that repadmin/showrpl reports replication failures involving DC01, and DC02 is still logging Event ID 2092 about FSMO role validation. All five FSMO roles are assigned to DC02, but apparently that doesn't mean everything is healthy. I'm not planning to force anything or clean up DC01 until I decide whether I'm bringing it back or retiring it properly. For those who've dealt with this before, would you focus on the Event 2092 warning first, or sort out the DC01 situation before going further?

I'm still learning the deeper side of AD, so I'd appreciate hearing how you'd approach it.

Hi All,

Before i spend a day on hold to GoDaddy.

Has anyone had any feedback from GoDaddy/CertificatesForExchange on potential compensation ?

After renewing a bucket load of certificates for clients, after what only could be called negligence on their behalf.

From what i can see they mass revocation of 404,607 SSL/TLS certificates after finding that issued certificates did not match its published certificate policies, however The company missed its required revocation deadline, creating a second compliance issue. An updated customer notice says the incorrectly issued certificates were revoked on October 21, 2026.

Personally we received 3 hours notice at 2am in the morning on some certificates, and no notice on others.

Interested in hear what others have herd before we engage representation.

Edit : we didnt use GoDaddy Directly, it was through a subsiduary called Certificates for Exchange.

Been reading up on the EWS retirement because we’re still sorting out GAL sync for our locations and I don’t want to end up with something that depends on it.

My understanding from MC1227454:

From Oct 1 Microsoft started turning EWS off in tenants that didn’t set up the app allow list. It’s phased so not everyone got hit on day one
You can turn it back on until April 1, 2027
After that it’s gone for good, no re-enabling

For those of you who already ran into it:

What broke? Was it mostly the stuff you expected (backup, sync, calendar tools) or random things nobody knew about?

How did you find what was still using EWS? Or did you only find out when something stopped working
Did you set up the allow list to buy time or just replace things?

And if a contact or calendar sync tool broke on you, did the vendor already have a Graph version ready or were you stuck waiting?

Side note for hybrid people, from what I’ve read Entra Connect also has an April 7, 2027 deadline to switch to application based auth.

We've recently been seeing MS push out the new unified Copilot app, replacing the M365 Copilot app on some of our systems. Seems like this actually comes via Edge Update service of all things.

We've put the PauseCopilotUnification registry key in now, so hopefully we don't get this occuring on any more systems for now...

However, once the Unified Copilot app has been installed, users are no longer able to run it. Watching task manager, CopilotApp.exe starts & then closes immediately.

With help from ChatGPT & ProcMon, we found that it was trying to load copilot_overlay_strings_en-AU.pak and failing to find it (its not there in the install directory).
Copying the en-GB file & naming it for en-AU seems to allow it to launch successfully...

Has anybody else seen this or something just unique to our environment?

Edit: Also just found another different case where the system has ended up with both installed. On these, 'Copilot' launches however just shows a 'something went wrong' error. The en-AU.pak workaround does nothing to fix these. The exe for these versions is also 'mscopilot.exe' rather than 'CopilotApp.exe'

The certificate policy has changed, and SSL certificates will expire in 47 days. Currently, we log in to GoDaddy to renew the certificates, run a script to copy the renewed certificates to the local machine, and bind them to IIS sites across the web servers.

Can we automate certificate renewal through GoDaddy? Alternatively, are there any better options to automate the renewal and deployment process?

Hi everyone, I'm handling a Google Workspace to Microsoft 365 Business Standard migration for 18 users and would appreciate some advice.

A few questions:

1. Large mailboxes: Five users have 100–150 GB mailboxes. We want to migrate emails from 2023 onward, but EAC doesn't seem to support date filtering. What's the best approach? Do we need a third-party tool or Microsoft's Large Mailbox Onboarding method?
2. Shared mailboxes: We have two Gmail-only accounts (info@ and billings@) that we want to migrate into M365 shared mailboxes. Is it best to license them during migration, convert them afterward, then remove the licenses if they're under 50 GB?
3. Domain and Google accounts: Our domain is managed through the old Google Domains/Squarespace setup. Should we leave the registrar unchanged during migration? What happens to existing Google accounts and domain access when we eventually cancel Google Workspace?
4. Cutover: We're planning 2–3 migration batches, starting with the shared mailboxes, followed by a weekend cutover. Any tips for minimizing downtime and preparing a rollback plan?

I'm handling the technical implementation myself, so I'd appreciate any practical advice or lessons learned. Thanks!

[ Removed by Reddit on account of violating the content policy. ]

My environment uses 3 tenants to manage users. The tenants talk to each other most users are created cloud-side & we have 3 different domains. I removed a user from one of our tenant months ago. Today, i discovered their Exchange contact was still there. Okay, fine, I can remove the contact. But WHY is it still there? Where did it come from? What else is still hanging around that I don't know about?

Microsoft gives you multiple administrative views of connected objects, but no reliable, end-to-end view of an identity's origin, relationships, & lifecycle. Im expected to understand how all these systems interact, often by discovering the connections through troubleshooting.

The address book. You open a contact & theres no obvious indication of where the object came from, which tenant it belongs to, or what its associated with. Guest vs Member, cloud vs on-prem, cross-tenant identities... removing one object doesnt necessarily clean up the others.

I want to be able to look at my environment & understand where an identity came from, what its connected to & what will happen if I delete it. Apparently thats too much to ask without becoming a part-time Microsoft archaeologist.

Thanks for coming to my TED Talk. Fuck.

For sysadmins who have NinjaOne in their organization, have you had the opportunity to use Katana AI?

Our team recently acquired it, but we’re struggling to identify a practical use case for it. None of us are convinced that it’s truly “agentic” yet.

If you have any suggestions on how to effectively utilize Katana AI, please let me know!

So far, 13 hours since it went live, no-one has successfully collected the bitcoin prize. The prize total is currently up to $2000

Show HN: Steal My Bitcoin