Hey everyone,

I was browsing Shodan out of curiosity and decided to search for exposed Windows servers with Remote Desktop (Port 3389) open to the public.

It’s honestly shocking how many systems you can still stumble upon that either lack proper authentication or allow unauthenticated pre-login access—to the point where some even show active pre-login interface elements like a shutdown or restart button right there on the screen.

With just a few clicks, anyone on the internet could literally power down production systems without even logging in.

If you manage infrastructure, please make sure your RDP ports aren't directly exposed to the wide-open internet. Put them behind a secure VPN (like WireGuard or OpenVPN), enforce strict firewall rules, or use an RD Gateway.

Stay safe out there!

I have been their client for 12 years, all my domains are renewals and I haven't bought any new one in months. My most controversial website is a forum that has been disabled for almost 14 years with no content online just a screen, the rest are just boring business.

I was away for a few days, I found my servers were down today. Apparently I received an email from Namecheap that expected for me to comply with ID verification within 72 hours and I didn't reply on time.

I have complied with them for 24 hours and still they give me no ETA, no reason, nothing, just "thank you for your cooperation" as if they were cops.

They didn't give me a specific reason in their warning email, just this:

...your account has been flagged to be a part of our routine account information accuracy check-up to establish whether your account information is currently accurate, complete, and up to date. As a result, your account has been locked pending your response to the requests for documentation below.

My account's email relies on the domains they disabled, so I had to pay another host to set it up and am considering making a huge hostname change just to keep some of my clients online while this gets sorted out, if it gets sorted out.

They never gave me any real support anywhere. Tried to reach out through chat but they kept deferring it to "The Risk management team", and saying they would contact me and that they don't have a chat, only work through email, even after I kept telling them what they did disabled my company's email. Every time I made a complaint the chat person kept clearly going back and forth with them, but ending up evading me completely, just coming back after 10-15 minutes of wait to say the same thing "they will reach out to you", and saying they "couldn't discuss the details with me". Basically talking to a wall.

It took me like 4 hours to just convince them to add another email through chat and give me any sort of confirmation, while my company's one was offline. Funnily enough, they never requested ANY information to make sure it was indeed me, the account's owner, yet they still added my email. Also I haven't logged in the account for like 20 days at least, and I have 2FA.

Their website says that you have to email [security@namecheap.com](mailto:security@namecheap.com) (which I did) but the real email is [compliancesupport@namecheap.com](mailto:compliancesupport@namecheap.com). It took them like 12 hours to reply to my request there and afterwards they just said "oh so you mentioned to us that you managed to get your original account working we might want to keep in that thread", like, they just assumed it was me, which anyone could have done and impersonate me.

Their treatment has been awful, like I'm some sort of criminal but they show me no warrant, no information, no transparency, nothing. I've freaked out several times and leashed out against them heavily in the chat threatening to make the case public and it's the only time they have mildly reacted in any way. I've tried handling it more maturely, but so far, no luck.

All my domains with them are disabled, seized, and my account is locked, no way to do anything but wait to see.

The cut a hole into the box with a box cutter, deep enough to go through the cardboard, through the plastic memory tray, and scored the pins on 14 modules in a tray of 25. Thankfully they didn't "inspect" the other two memory trays. 54/68 modules survived the trip.

https://imgur.com/a/1XerHh0

I work for an IT company with a contract with a government agency. We’ve been looking at a refresh for some of the government’s infrastructure. Being non-specific here to keep things sort of anonymous. Anyway, we were recently in a meeting where the vendor was presenting their sales pitch to the government. You know how anything with AI in its label was all the rage a couple of years ago? Everything from doorbells to toasters claimed to have AI incorporated. Well now the perception is different, especially in the government. Now AI is bad and may use all your electricity and water and hack your bank account etc etc. Well, one of the vendor’s presentation slides talked about AI powered automation and the government reps started freaking out asking if it could be turned off. The vendor had to start furiously back-pedaling explaining in as diplomatic was as possible that they were stretching the truth with the AI label and it was just a collection of scripts that added “intelligence” to some of the product’s functionality. It was hard not to laugh at the vendor’s faux pas.

Another architecture review, another wall of diagrams and failure scenarios, someone saying "exactly-once semantics" like that ends the discussion. Nobody ever asks what happens when the feature flag service itself dies.

Google's SRE book puts it at roughly 70% of outages coming from changes to a live system. Not the exotic failure modes in the diagrams. Someone flipping something in prod.

I'm not saying feature flags are bad. I'm saying I don't trust anything with "flag" in the name at 2 AM.

What's the dumbest outage you've had? I could use the company.

Another Microsoft 365 migration added to my checklist!

Microsoft has announced the retirement of the widely used Search-UnifiedAuditLog PowerShell cmdlet on October 15, 2027, following the general availability of the Microsoft Graph AuditLogQuery API.

If you use this cmdlet in scripts, you have about a year to plan and test your migration to AuditLogQuery.

Personally, Search-UnifiedAuditLog has been my go-to for quickly checking audit events. Purview's audit search can take several minutes, even for a simple query, so I'll miss having that quick PowerShell option.

Do you happen to know a Windows Server 2022 Hardening Guide?

One thats not that complicated and easy to apply from scratch.

I want to prepare a VM before a VA scanning (whenever possible) and atleast the result should not have been massive to remediate.

Hi everyone,

In the company I work for we’re planning to migrate away from VMware vSphere Standard (we had Essentials Plus with ROBO but was discontinued) and are considering HPE VM Essentials, Microsoft Hyper-V and Proxmox VE with paid support subscription.

Our environment consists of three separate sites in different locations:

Site 1: Around 50 VMs.

Sites 2 and 3: Around 12–15 VMs each.

As part of a hardware refresh, each site will have three new hosts and SSD storage.

Our main priorities are solid centralized management across the sites, high availability in each site and straightforward maintenance and support.

I would appreciate feedback from people running these platforms in production, especially anyone who has completed a similar VMware migration.

Which platform did you choose and would you choose it again?

How was the migration and what unexpected issues did you encounter?

How does it compare with vSphere for daily administration, HA, updates and support?

Particularly interested in experiences with HPE VM Essentials, but feedback on any of these three options would be very helpful.

Thanks in advance!

Hi,

We’re introducing change management for the first time using ITSM.

We’re now deciding the workflow before our ITSM vendor configures it

Our scope covers all IT infrastructure changes including network, servers, virtualization, backup, storage, AD/Entra ID & Databases

Each team has its own Line Manager and another requirement is that Cybersecurity Unit must approve every change

Few things we’re trying to understand

Who should approve a change and in what order?
Who should be the CAB members
Which changes should go to CAB

I’d appreciate any suggestions

I dug around the internet for a solution and couldn't find anything worth diving into. Even the one "paid" solution (Files App) that I read might be able to do it, didn't seem like it could when I tested it and it also would be a pain to deploy at any scale but your own computer.

So I did what any developer minded IT person would do and dug through open source solutions, still nothing but one for the completely wrong OS (https://github.com/bewithdhanu/office-online-bridge-macos). This project gave me the idea to try porting the same work around to Windows. I sort of did it. Basically the same idea but used the existing "View Online" function from the context menu and wrote a PowerShell script to execute it. The script was then improved with an exe wrapper to make it more user friendly.

I am pretty surprised this solution hasn't been made before, but here it is now!

https://github.com/Fireant456/M365-Bridge

It is bundled with an installer that can be deployed silently. Only requirement (at the moment) is that your files you are attempting to open must be in a OneDrive synced folder. If they are not an error will tell you they need to be. I might work to add automatic handling of uploading files to a temporary OneDrive directory and writeback to the original location in order to seamlessly handle non-synced file editing, but I don't require that in my use case. Happy to take pull requests if anyone wants to give it a shot.

Would love any feedback. Enjoy!

Disclaimer: The goal of this post is not to bring the pitchforks out and talk about CyberSecurity vendors and their security based on CVEs. No, I do not think Cisco is an insecure company and I do think they are doing a great thing for the community by being up front, disclosing and fixing vulnerabilities discovered in their products.

This is in direct reference to the following post in r/sysadmin about 2 weeks ago:

https://www.reddit.com/r/sysadmin/comments/1wwlgqq/todays_reminder_that_every_security_appliance_is/

You will notice in this post that I made one of the top comments to bring awareness to the lack of attention that is given to CVEs when it is a non-Fortinet product. Well, it just happened again.

Cisco released a 9.8 CVE for their Secure Mail appliance on October 14. The details are available at the following link:
http://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp

The content in this is important but irrelevant to my point. In the release of this vulnerability, there are only 4 mentions (by my search of "CVE-2026-76519") of this:

https://www.reddit.com/search/?q=%22CVE-2026-76519%22&cId=3d232678-6f60-4ffb-940a-de3665695be1&iId=6d9cd08d-e00c-46e4-bae4-638f39723fe0

If you do a search of the FortiMail CVE, you will see there are 17 mentions.

https://www.reddit.com/search/?q=%22CVE-2026-104286%22&cId=0e04f247-a490-4114-a405-b6ccfac473ce&iId=fd67515e-4b1e-44cd-bc8f-a4bc68fb59f2

And within some of these posts, you will see the "insecure CVE brigade" coming in force.

Now I know some time has elapsed over the results of this search, but they all happened within 4 days of each other while the vast majority of these mentions happened within 2 days (the same time period was this Cisco search).

All that being said, my point is that it is very interesting that the same level of coverage is not being extended even when on paper, the two vulnerabilities being compared look very similar. Also, you would think it is more coverage worthy when a second critical CVE was found in the same product within the same month.

Putting on my tin foil hat, I will say, I believe there are other powers at work (besides just the goal of sharing information) to target certain vendors for whatever reason to paint them in a worse off light than others.

However, the important piece in all of this, is to reiterate that the companies who are transparent about CVEs and actually fix them, are the ones who deserve the trust of protecting the digital assets we need to secure.

Thank you for coming to my TED talk.

Hey everyone!

I recently got a Dell PowerEdge R610 and installed Windows Server 2019 on it. Now I’d like to update everything to the latest available firmware, including the BIOS, iDRAC, RAID controller, and anything else that might need updating.

Since the R610 is end-of-life, I’m having trouble finding all the necessary downloads on Dell’s website.

Is there an easy way to update everything, preferably using Windows EXE installers or an official Dell update tool or something?

Are there any archived Dell repositories, bootable update ISOs, or reliable guides specifically for the R610 that you’d recommend?

I’d really appreciate any links or advice. Thanks!

EDIT: More Skykick enterprise apps being exploited https://www.reddit.com/r/sysadmin/s/M6iilUpoJl

Skykick, the SAAS backup and migration tool now owned by Connectwise (May be called Connectwise Cloud backup) has been breached and active exfil of tenant data is ongoing, disable the Entra enterprise application immediately and check your logs for the IP here. Check for skykick access from previous MSPs.

https://www.reddit.com/r/msp/s/ieagdCmOBb

The IP in your logs doesn't necessarily mean exfil has started as they seem to be mass scanning tenants presumably for high value targets but exfil has been confirmed already in some tenants.

IP: 144.172.64.128

APP ID: 506e08f9-6e9a-4da4-942b-a099a03644ae

Other skykick app IDs are below (there are more than listed below so do a manual check), no reports of access on these but threat hunt. Check the APP ID and not the Object ID on the enterprise app.

2399d300-6fca-4e6a-a686-399fefe75b83 fc2bedd5-450f-4d3c-a2e5-96d2465574d6 ccd0fb86-b4b4-48f1-a3c4-28bd1baeae6e 7441fd5e-1d54-4465-8e18-8f5208c48256 0de14c77-b9b0-4137-9360-34878a929827 2568dd75-4f97-46c4-9235-ff6bcb68557c

This one is also skykick but not mentioned in the title. "0365 Backup Self Service - Customer Access" 59c003ad-130e-4c4c-9796-f0c13cbd7952

Report of suspicious activity with the app making changes to permissions 2 days ago, see comments on the Reddit link above

Keep an eye on activity for activity related to any CW app to be safe.

Legal is involved as they say no backup data was accessed - because they accessed your live data directly. Disingenuous. https://www.connectwise.com/company/trust/advisories

Hello everyone i been working as help desk for almost 2 years now and I want move up but have no idea how to also am still pursuing my bachelors in computer science because initially I was going for SWE but with the market for programming it seems I have better odds with sticking to IT.

Update/more info

So I see a lot of you guys are saying that 2yrs is not that much also for more info I work at a small CC(community college) with low budget and all the help desk’s are only part time so should I try looking for a Full time help desk before trying to move?

I recently signed a six-week minimum contract with an MSP. My responsibilities include:

- Learning their Microsoft Cloud environment, RMM, and security tools.

- Creating and validating SOPs for the entire customer onboarding process.

- Assessing and onboarding at least one customer into production.

- Training NOC staff to independently support the environment.

- Completing documentation, testing, and the final handoff.

I have around 20 years of IT experience, primarily in MSP support, Microsoft 365, Intune, and infrastructure.

For those who have done similar projects, how would you structure the six weeks? Would you document everything first or create SOPs as you go? Is this a realistic scope for six weeks?

I'd appreciate any advice on prioritizing tasks and avoiding common mistakes.

Curious about this one... everyone seems to have that story where something quietly expired and took half the stack down with it. A cert, an old API key, a license nobody knew about...

Mine was a server upgrade where the cert path ended up wrong. Service looked fine, but auth was broken for any client without a valid token, and we found out because customers called first.

What's yours, and did anything actually change afterwards ?

Right out of college I started working at a major insurance company helping them prep for Y2K and worked my way up as high as one could go without being in management. I loved digging into the details and figuring things out. I worked overtime and volunteered for any project. As the years went by and we were sold and then sold again to private investors, my interest waned and management progressively got worse. Now it’s the age of AI and I am staunchly anti-AI. We were mandated to use it for our job duties and mgmt tracked our usage. Scolded or written up if we didn’t use it enough.

Due to my seniority I was able to work remote for several years prior to COVID and then during COVID everyone got to work remote. You know where this is going - now it’s return to the office time as well as mandating the specific days for in-person days. Unrealistic deadlines for complex projects are set by out of touch upper mgmt with no concept of the scope.

I’ve saved money and have nice investments as well as passive income. It was time to go. Years ago I told myself I’d love to retire at the age of 50 and I’ve finally realized my dream. Zero notice given and zero regrets. I feel so good. Goodbye to IT.

Advice to young people just starting out: word hard, save your money and make good investments. Retire early and enjoy your life.

Hi everyone,

I recently bought a used Dell PowerEdge R610 and have been trying to get the iDRAC6 remote management working, but after like 2 hours of trial and error I'm running out of ideas.

iDRAC6 is enabled and obtains an IP address via DHCP. It currently shows an address in my local network but I cannot access it through a browser or ping it.

I have also configured the Lifecycle Controller through the Unified Server Configurator (USC). Its network interface has a separate IP address, and that address responds to ping successfully. However, this does not help me access the iDRAC6 web interface.

Things I've already tried:

- Enabled and disabled DHCP and checked the iDRAC network settings.

- Tried the available NIC selection modes: Shared, Shared with Failover LOM 2, and Shared with Failover All LOMs.

- Connected network cables to all four onboard Ethernet ports.

- Disabled VLAN.

- Performed a complete power drain by disconnecting both power supplies and holding the power button for at least 10 seconds.

- Reset the iDRAC configuration to factory defaults, but the attempt failed with “Failed to reset to default values.”

- Initially, the server displayed “iDRAC6 not responding. Rebooting.” After the power drain, that particular error stopped appearing.

- The Lifecycle Controller can now retrieve the iDRAC configuration, and the iDRAC displays an IP address, but I still cannot reach it.

I also noticed a BIOS battery warning in the system event log, although I'm not sure whether that is related.

My questions:

1. Does this sound like a failed iDRAC6 controller, or could it still be a firmware or network configuration issue?

2. Is there a reliable way to recover or reflash the iDRAC6 firmware on an R610?

3. Is there anything else I should check before assuming the hardware is faulty?

I'd really appreciate any suggestions. I've tried quite a few things already, and I'm not sure what to do next.

Thanks!

Not unique to our field, but I genuinely really enjoyed this job. It was fully remote, paid well, my boss was a true sysadmin in that as long as I got my work done he didn’t care how I spent my time. I had near full autonomy. Minimal meetings. It was 14 months of the IT job I’d always dreamed of.

My boss resigned earlier this week; the company was going in a direction he didn’t agree with and they were expecting him to fudge the attestation of some compliance reports. With him gone, upper management decided to include our department in the wave of layoffs rather than find a replacement for my boss.

So today I got the calendar invite for a five minute meeting. Exec read the script in 60 seconds flat and sent me on my way. Currently waiting on a follow up email to see if I get a severance or not (please god). Spent the afternoon updating my resume and filling out applications.

I’m bummed. But life goes on. Hopefully I’ll find a similar job (and soon)!

ETA: heard back that we will not be offered severance. Makes things harder but just means I have to hustle harder to find a job

Anyone else getting reports from users on Windows 11 24H2 Enterprise that after getting this month’s cumulative update, whenever they restart or shutdown, they get presented with the message below?

“Someone else is still using this PC. If you restart now, they could lose unsaved work.”

We’ve confirmed that there are no other users on these laptops and I am able to reproduce it too.

Uninstalling KB5127648, the message goes away. Reinstalling it makes it come back.

We are advising users to ignore it, but the false positive message is definitely making people feel uneasy.

I’m curious if anyone has some insights and are seeing the same thing in their environment. Thanks!

Sharing a critical threat notice for those using BeyondTrust. It's a critical improper origin validation vulnerability in Remote Support that has been confirmed as actively exploited by a suspected China-nexus nation-state threat actor, ARMORY CASTLE since August 2026. Here's their advisory for reference BeyondTrust Advisory: https://www.beyondtrust.com/trust-center/security-advisories/bt26-05

Not sure if this is allowed, but we currently use MaaS360 to manage iOS devices. It is expensive and the support stinks. Otherwise, it works for us.

I have been thinking about moving to InTune for a few different reasons. Cost - for us, InTune would be about 50% cheaper, and to have things on one platform.

Wondering if anyone else out there has made this switch and, if so, do you regret it or have any suggestions?

It is hard to really compare platforms. I am going to try a trial but that is going to take some effort to get up and going.

Thanks,

Can someone let me know why trusted tech is so cheap and if they’re legit? Wondering if this is a too good to be true situation or if its actually good. 

Not trying to talk bad or good about them, just legit wondering. My grandpa always said “If its too good to be true, it’s a lie!” And I aint tryna get lied to lol. Thanks for any help given in advance, I know I can look up reviews but Reddit is my best friend