Hi everyone!

I'm so exhausted being an M365 admin these days. Technology and AI are moving at crazy speeds and I just can't keep up!

Hearing about all the big tech layoffs makes the stress twice as bad. I honestly feel like I could easily be replaced by an AI agent.

Am I overthinking this or are you feeling this pressure too? Maybe burnout?

Had an employee leave on Friday and found out Monday morning their badge was still active. HR had processed everything on their side but nobody had told the person managing door access

Nothing happened but it made us realize how easy it is for something like that to get missed when different departments are handling different parts of offboarding. For anyone managing access control, does HR automatically trigger badge removal or does someone have to manually request it? Trying to figure out what people do to make sure these don't slip through

DreamHost's status page logged the first problem at 2:20 PM PDT on October 23, with connectivity issues on the panel File Manager. By 5:20 PM it was resetting some email passwords as a precaution. At 10:13 PM the resets covered FTP and SFTP users too.

Four days on, DreamHost still hasn't named a cause. BleepingComputer asked how many accounts were hit and whether files or messages were exposed, and got no answer by publication. CyberInsider reports the count of affected customers hasn't been disclosed either.

The File Manager is the panel tool that edits and deletes website files and can fetch a file from any URL. BleepingComputer's story said it was still down. DreamHost's status page says a fix went out at 3:35 PM PDT on October 26 and it's monitoring.

The owner notice tells owners to review the forwarding settings on every mailbox and remove any forward they don't recognize. For SFTP users it says to set a new password. It also says SFTP user data stays on the server.

DreamHost lists 750k+ WordPress installations on its company page. A new SFTP password doesn't remove a PHP file written to wp-content while the old one still worked.

It has happened before. In January 2012 DreamHost reset FTP and shell passwords for all customers after someone got into one of its database servers.

When a host expires SFTP passwords "to ensure the continued integrity" of accounts, does it owe customers a word on whether anything was written to their sites, or is checking the files the owner's job?

https://imgur.com/a/9CBEok2

Started getting a few complaints about this one and it was news to me. I never saw anything in the M365 Admin Center about it, even went back through all the Admin Center messages and my emails.. still absolutely nothing.

Disabling the tag involves a mail flow rule. Folder behavior is controlled by bulk move options in your anti-spam policies.

https://learn.microsoft.com/en-us/defender-office-365/anti-spam-bulk-complaint-level-bcl-about#deliver-bulk-mail-below-the-bcl-threshold-to-the-promotions-folder

We were sadly compromised. Twice. It's finally answered the question of investments, but the police want evidence.

The audit logs is clear on that, but I realise this will become police evidence. They have a secure upload. I filtered the audit logs as I downloaded them to show everything from the attackers to create the csv file. I then created a text file showing the filter, how it was created and the SHA hash of the file.

Is this enough? I think the attacker(s) made a mistake and may be traceable, so absolutely would be willing to see them prosecuted.

The question is, should I have included anything else in there or done anything else to show the file is not tampered with between myself creating and them opening?

Over the weekend, we got charged over $48k across 2 bank payments by Autodesk (aa 3rd of another 40k got blocked), the issue is that we have never had an Autodesk account nor used their systems before, we already contacted the bank and their support directly and Autodesk says they don't see such payment, with the specific transaction number/code being received. Any suggestions?

Can we relax a little? lol asking for a friend.

I'm seeing this trend more and more. WFH users opening tickets for very simple things that they claim is preventing them from working. I remote in and the issue magically vanishes. How many people do you think are just faking technology problems from home so that they don't have to connect or work? Seems pretty simple to just throw your tech under the bus. Thoughts?

What is everyone doing with this? Moving all PC's to the new Time Zones or staying with known time zones? Anyone brave enough to use the Microsoft Invoke-Calendar move commands that come out tomorrow?

Current Microsoft communications.

Update to MC1510951: Canada 2026 time zone changes — Microsoft 365 impact and required admin actions

 Summary

 On November 1, 2026, certain Canadian regions will not change clocks, affecting Microsoft 365 scheduling. Admins must update Windows, Outlook time zones, review meetings, update Teams Rooms, and keep apps current. Testing and support case submission with #Canada Time-Zone are advised.

 This post updates MC1510951 ((Updated) Windows updates are available for 2026 time zone changes in Canada, posted October 16, 2026).

 On November 1, 2026, affected locations in British Columbia, Alberta, and Manitoba will not move clocks back and will remain on UTC-07:00, UTC-06:00, and UTC-05:00 respectively. Affected locations in the Northwest Territories (including Yellowknife and Inuvik) align with the Alberta change, and Northwestern Ontario aligns with the Manitoba change.

 Windows and Microsoft 365 services depend on updated time zone definitions for correct scheduling and display behavior.

 How this affects your organization

 Confirmed impact

1. Outlook and Exchange Online (calendar): Users must move to the new time zone. Existing events do not migrate automatically. Recurring meetings require additional review.
2. Microsoft Teams Rooms on Windows: Some devices may display time one hour behind Windows until Edge/WebView2 is updated.

Potential impact (under validation)

1. Microsoft Teams (desktop, web, mobile) and other Teams devices
2. Outlook for iOS, Android, and Mac
3. Microsoft Bookings
4. Shifts
5. SharePoint Online
6. OneDrive

What you need to do

1. Ensure Windows devices in affected regions have the latest Windows updates (including October 2026 updates).
2. Ask users in affected regions to select the new time zone in Outlook and review meetings scheduled after November 1, especially recurring series.
3. Plan to run the Exchange Online PowerShell remediation cmdlet for non-recurring meetings once released (target: October 28, 2026).
4. Update Microsoft Edge and WebView2 on Teams Rooms on Windows and confirm room time display matches Windows.
5. Keep Teams, Outlook (including iOS/Android/Mac), and other Microsoft 365 apps current.
6. Test key scenarios before November 1: recurring meetings, free/busy, Bookings appointments, Shifts schedules, and SharePoint regional settings.
7. If issues occur, open a support case in the Microsoft 365 admin center and include #Canada Time-Zone in the title.

Additional information

• Outlook Time Zone Changes for British Columbia, Alberta, and Manitoba (Microsoft Support)
• Interim guidance for British Columbia time zone changes 2026 (DST Blog)
• Interim guidance for Alberta time zone changes 2026 (DST Blog)
• Manitoba 2026 time zone update available now (Daylight Saving Time and Time Zone Blog)

We will continue updating this post as product teams confirm impact, publish mitigations, and release additional guidance.

Just noticed. Still looking.

Out of band, not a preview.

Secure boot certificates mentioned in this one. Edit: <-- Nope, NOT secure boot. Just certificate.

https://support.microsoft.com/en-us/servicing/os/windows-11/2026/10/kb5134133-windows-11-24h2-25h2-26h2-update

We acquired a company that uses QNAP NAS'es but we have no experience with these whatsoever. Defender is telling me to update our TS-431XeU because of the recent PHP2Shell vulnerabilities, but looking at the details, it's still running QTS 4.3.4.0675 , so we're about eight fucking years behind.

However, checking for updates through QTS says the system is up-to-date while the QNAP support page lists newer firmware for this model. I assume we'll have to update it manually, but I'm not sure whether we can jump straight to QTS 5.x or if we need to install intermediate versions first.

My question: is it safe to update across such a large version gap and what does the process look like? Any indications of update duration, possibilities of failure, compatibility issues with existing RAID configurations or volumes, etc.? Also, what are the recovery options if the firmware update fails or the NAS doesn't boot afterwards? Fuck me but also fuck that guy for leaving no documentation.

We will of course back up the data but I'd rather not risk anything since this is a production NAS and we don't know much about its history.

Anyone who's done a similar upgrade on this model or another older QNAP?

Edit: fuck it, I created a ticket at QNAP but since they're not reachable from outside, I'll just put a wall around it as someone said here. Thanks for the info, my dudes

Hey guys, the company I’m working for has no form of back up active right now and id like to set that up. I’ve looked into the Microsoft back up but it doesn’t feel reliable because why would I keep the back up for the environment within the environment

I’ve looked at Rubrik but it’s expensivee, and I’ve looked at Veeam web which also looks expensive

So how is everyone backing up the data for your organisations? It’s mainly for our Microsoft environment in the event of a ransom attack etc. I’m looking for cheap options as management does not want to spend a lot of money

Plss help : (

Please don't settle for a salary that barely lets you get by.

I know you're just starting out. Maybe you're resetting passwords, fixing user issues, installing software, or doing basic troubleshooting all day. You might feel like your responsibilities aren't that big yet, so you don't deserve to ask for more money.

But here's the thing about this career. The job you're doing today is only a small part of what you need to learn if you actually want to get somewhere in IT.

You have to learn networking, operating systems, servers, virtualization, cloud, scripting, security, and a whole bunch of other stuff. And a lot of it? You're gonna have to learn on your own time, because your company isn't gonna teach you everything you need to know.

You'll be spending your evenings learning, building labs, troubleshooting things that don't work, and trying to figure out what you should learn next. Sometimes you'll spend months learning something that has absolutely nothing to do with your current job, just because you know you'll need it to move forward.

Now imagine doing all that while worrying about money every single month.

That's what bothers me.

You're already investing your time and energy into building your career. Your salary shouldn't make that harder than it needs to be.

My advice? Ask for better pay. Don't just calculate how much money you need to survive until the end of the month. Think about how much you need to support your family, save money, pay for learning resources, handle emergencies, and still have something left over.

If possible, aim for a salary that lets you save at least twice your essential monthly expenses. It might take time to get there, but at least have that goal.

And don't keep accepting the same salary year after year while you're learning more, gaining experience, and becoming better at what you do.

If your company doesn't value your growth or pay you fairly, start looking at other companies. Prepare for interviews, improve your skills, and move when you find a better opportunity. Just make sure you have a sensible plan before leaving your current job.

One more thing: don't convince yourself that you deserve less just because you're a junior or because your current work seems easy.

You might not be managing production servers today. You might not be designing networks or working with cloud infrastructure yet. That's fine. Everybody starts somewhere.

But you need time and money to get beyond that stage.

IT changes fast. If you can't afford to keep learning, or you're so stressed about your finances that you never have the energy to study, you're making your own career progression harder.

And a few years down the road, you don't want to find yourself doing the same work, earning almost the same money, and wondering why you haven't moved forward.

I'm not saying you should demand an unrealistic salary or quit every job that pays less than you want. Sometimes you have to start small.

Just don't make the mistake of thinking a low salary is perfectly fine simply because you're doing entry-level work.

Think about where you want to be three or five years from now, and make sure your current job is helping you get there financially as well as technically.

Work hard, keep learning, and ask for the money that gives you a real chance to grow. Don't spend your entire career just trying to survive while preparing yourself for a better one.

Hey Folks,

Scenario:

• User running MuseAI (not M365 integrated)
• User works on a sharepoint document OR shares a link to a sharepoint document with the bot
• ITDR screams on token theft
• Logs show user logging into sharepoint on chrome/linux, accessing the same file with the same session token they have on their workstation
• none of the other typical evidence of BEC is present (no phishing messages, nothing weird in browser history, etc)

To me, this looks like Muse is taking extreme liberties with end users active cookies and login tokens, replaying them on other machines in other geo-locations. Terrifying if true.

Wondering if anyone else has seen similar.

And yes, I know, block non-approved apps, filter DNS, etc. Not looking for solutions, just confirmation that others are seeing similar behaviour.

There is a shipping and receiving warehouse that prints a lot of labels from software like UPS Worldship as well as pdf output from a few web portals. This has been working well for years aside from the occasional reset the zebra printer stock size settings once in a blue moon.

The company is looking to change things up with a Warehouse Management System that should help us be more efficient and reduce errors.

One of the options requires all label printing to have an IPsec VPN tunnel to the vendors VPS systems which will send ZPL print jobs directly to the Zebra printers.

I am curious if you happen to work with shipping and receiving warehouses and have run into this type of network requirement for label printing?

This is a really strange setup from my experience but I am not claiming to be a warehousing IT expert, happy to learn and our segmented POC does the job just fine but it seems like a lot of extra pieces for something that traditionally has been a super simple setup

Just like the title says, I needed to record a simple step-by-step for a client today and found that the old tool I used to use (PSR.exe) has been deprecated. Another casualty of modern Microsoft. Does anyone know of a free and simple alternative that works decently enough?

Hi everyone,

Earlier today we were the target of an automated Layer 7 DDoS attack against our production Cloud Run service. The attack was carried out using a Python script (Python/3.13 aiohttp/3.14.5) which was making around 50 requests per second to POST /api/login, attempting to consume container concurrency.

The traffic came through Google's own proxy infrastructure, potentially Apps Script or Colab, rotating across 200+ IPs resolving to google-proxy-*.google.com (e.g., 66.102.8.132, 66.102.8.161, 74.125.210.103).

The problem is that Google's official abuse reporting form (https://support.google.com/code/contact/cloud_platform_report) immediately closes the report with:

We're unable to do anything with this report as the IP address referenced in it isn't hosted on Google Cloud.

It appears the automated system only recognizes customer Compute Engine IP ranges, not Google's own proxy egress IPs (AS15169). As a result, the report gets rejected before anyone can review the Cloud Logging evidence, including timestamps and Cloud Trace IDs.

We've already hardened the backend with distributed Firestore rate limits, concurrency controls and request timeouts so the attack traffic is now being dropped. We've also responded to the closed ticket with the trace IDs, asking for escalation to the relevant Trust & Safety team.

I have three questions:

1. Is there a specific abuse reporting email or intake point for traffic coming in via Google's own proxy infrastructure which would effectively bypass the automated IP validation?
2. Has anyone with Basic Support actually escalated a similar proxy based DDoS to a human at Google?
3. Would Google Bug Hunters be the right place to report this as a potential proxy abuse/SSRF vector or is there a more appropriate channel to get to the relevant security engineers?

Any suggestions on how to get this routed to the appropriate team would be great. Thanks!

Anyone else experiencing this issue? We've got multiple reports of errors when clicking "Open with Word" or Excel or similar in New Outlook.

Edit: Usually it just spins, but sometimes you get this error message https://imgur.com/a/EIOrTdq

Can anyone offer me some advice? I quoted for the hours I thought this would take and it has been at least 4x times that already.

I'm using the Office 365 Admin Centre migration tools.

Issue 1: Migrating Files/Shares - CONSTANTLY FAILING - I get a report on what is failed, exclude those folders, and try and run it again. Gets a bit more data then fails again! In the end - I have a "complete" user migration but 20 excluded folders and I have no way of knowing what the issue is and what hasn't moved across. Right now I'm trying to download a full user's data locally so I can just copy it across but I don't know if it will work and also might not work for their "big" 150GB share folder.

I only have ONE user and ONE large share that's an issue, everything was small enough to sync through. But once it is hitting these sync issues it's almost impossible to actually move all their data.

Issue 2: Email migration - they have at least 100k emails, at least 50k being sent auto-replies. I know the issue about file limits rather than sizes and have asked them to look at and clear this data, otherwise it will take weeks of restarting the sync over and over for one mailbox.

Ahhhh

Any other options I can try outside of this damned MS migration tool, that won't break things that have already half migrated?

Reading about the EDK2 PXE bug (CVE-2026-97631). If something can send a crafted ICMP error to a machine while it's network booting, it can run code before Secure Boot does anything.

What I keep coming back to is the inventory side. Not which servers use PXE, which have it enabled. I'd guess a lot of that is just factory default. And provisioning networks aren't alwys as isolated as the diagram says. Is there a sane way to audit this, or is it just checking BIOS settings machine by machine?

Hi there! Not sure which subreddit to ask this in, so here I am! I work at a non profit arts organization that houses lots of artists short-term throughout the year. We have about 50 rooms scattered around our campus, and managing every rooms schedule in Excel is torture.

Does anyone have a room booking system (preferably free or low cost for non-profits) that they have used to create and manage booking like you might use at a hotel or something similar? We wouldn’t need the ability to have people make reservations themselves, as my team assigns everyone a space. Just looking for a way to create reservations myself, see who is in which room when and have our housekeeping team update rooms when they’re clean. Any advice is appreciated!

connected with a buddy of mine from the trenches after a looong time the other day, got hit hard with a wave of nostalgia from the early 2000s. i was working tech in higher ed back then. we had this crazy overhyped $8 million setup. vbrick encoders, crestron touch panels running shitty windows ce overlays, all packed into these heavy wooden rolling carts. the whole system blew up practically every other day. whenever a faculty started panicking mid lecture our actual high tech fix was sending a 19 year old workstudy kid to crawl behind the cart and yank the main power strip out of the wall. lol! remember begging the dean to let us build a simple linux stack in house but they fell for the slick vendor presentation instead. honestly though the broken hardware wasnt even the point. it was the culture. At 5:00 pm on the dot, front door to the office got locked so faculty couldn't barge in askign for help with personal laptops. my guys would fire up doom on the office pcs while we waited for nt 4.0 service packs to to finish patching. terry the workstudy kid held down the helpdesk phone till 11 pm. we'd order pizza, test out new projectors on the office wall, unwrap new blades and just mess around and tinker. the human connection was real back then. senior admin assistants would drop off fresh homemade muffins or cookies just because you spent twenty minutes fixing an access shortcut or some broken ODBC driver for them so they didnt have to suffer through banner. you weren't a tier-1 support asset tag. you were their guy! I've been in executive roles for years now and looking at modern IT kinds breaks me a bit. everything today is servicenow tickets, outsourced helpdesks, AWS pipelines, zero trust, and liability policies. no personal favors, no late night lan games in the back room, no tinkering. sure the corporate dashboards look great and uptime is 99.9% but we sucked out and traded all the soul, warmth, and actual human connection for green SLAs. maybe it still exists somewhere, i don't know.

Our rep at CDW doesn't seem to be able to renew our Windows 10 ESU licenses. He screwed up our Druva renewals repeatedly. Does anyone have any suggestions for an alternative to CDW? We don't use them often (we manage the Microsoft licensing in house). a VAR willing to handle an occasional small volume customer?

We're trying to get M365 setup. However whenever I try to login to the application with a test licensed user account, I get a 404 Network error. I know the creds are good, I can log into web portal no problem.

I've isolated the issue to a specific GPO that when applied causes this, but this is a like a legacy GPO that may be 20 years old and no matter what I've done I can't seem to isolate what specific policy item is causing this.

I've recreated the policy by hand, trying to match it item for item, no problems, the new test policy doesn't prevent M365 from working.

I do a backup and restore policy item, new restored policy does cause the problem.

I modified the files in Sysvol and renamed the ADM folder in the relevant GPO to adm.old, this prevented new computers from experiencing this behavior. But since I need to get M365 working, I need to find the actual policy so that I can either delete the registry key or set the inverse as simply removing the policy leaves the behavior in tact for anything that got the policy previously

I've used Regshot for a before and after, unforunately this creates a 5,000ish line txt file and there is simply too much noise to figure out what's actually happening here.

If anyone has any ideas or thought about where to look or ideas on how to isolate this further, that'd would be greatly appreciated.

This is M365 installed on Windows 11 24H2 Ent.

Increased cloudflare down reports. Have two circuits at work here, users on one were fine to connect to anything. Other users on lumen circuit were having connection issues to some websites. Switched everyone off lumen fire is quenched for now.

Anyone else have a similar issue right now?