There were a few questions in r/vmware in the last while about perpetual licenses and subscriptions. 

I thought I'd make it clear what the licensing limitations on them are, what is allowed/ compliant and thought this might be useful for this community too.

Any customer that had perpetual licenses that had SnS after October 2022 possibly still has a perpetual license for VMware 8 products, unless they converted through the Subscription Upgrade Program without amending the terms to retain perpetual licenses. If anyone wants more detail/ backing info for this DM me. I'm not a lawyer, so not legal advice.

Any customer using a perpetual license must:

• use a perpetual license key from the contract/ transaction/ site that held the perpetual licenses.
• must be compliant with the terms of the original license (geography, entity, deployed quantity etc)
• Can use any version released and downloaded prior to perpetual SnS end date or released as a critical build (ESXi 8.0 U2d, U3d, U2e, U3f and vCenter U2d, U3d). This is based on a Broadcom policy at https://knowledge.broadcom.com/external/article/314603/zero-day-ie-critical-security-patches-fo.html/I recommend reviewing the policy for changes before applying a build to check it has not changed.
• If you are on a later build, its not very easy to downgrade. The most effective way is to rebuild each host/ vCenter one by one. If on VxRail, you need to "de-VxRail" and rebuild as if they were just the Poweredge servers that are underneath. If on build later than SnS entitled, but earlier than a critical build, upgrade to a critical build.
• In the EEA/UK/Switzerland it is also possible to buy 2nd hand perpetual licenses. Make sure you do that carefully with a reputable company!
• In a hybrid situation, where some licenses have active support and some don't, all licenses in a functional environment must have the same support level; so all VMware components must be seperated, and automated vMotion etc between those environments switched off.
• Using a trial is not compliant. Continuing use of the crippled software after subscription expiry is not compliant.
• Use of the various 3rd party support organisations on perpetual licenses can be compliant if they pay attention to licensing and respect IP laws. Disclaimer: I work for one of them. Not spamming here, so DM if more info needed.
• Use of perpetuals is most likely governed by either the original contract or old VMware EULA rather than Broadcom EULA, but you need to read your contracts and transaction documents to confirm.
• Broadcom still has rights to carry out a license audit on the Licensee. I have never seen a VMware contract without an audit clause.

Is anyone using and can recommend some sort of online Outlook training class? We have tons of users who can't manage basic email management, reminders, folders, rules, etc. The basics to keep email in check, more intermediate things.

I know Linkedin Learning used to have a bunch of good stuff, we had that for a while, but it got too pricey so they dropped that. I've done some google searching, but it's all random places I've never heard of before and it's really hard to get any sort of feel for what's out there that users will actually get some value out of.

Is there anything else out there that you've have first hand experience with that can actually improve a user's experience and usage of Outlook?

We're using Microsoft 365 Business Premium with the included M365 Copilot (Basic), not the paid version.

Our AI policy allows general Copilot Chat use, but not access to company emails, SharePoint or OneDrive files.

Most of our data is on an on-prem file server, but users save work-in-progress documents to Desktop/Documents, which sync to OneDrive.

The issue is a user asked Copilot in classic Outlook general questions about our industry, got the usual ansers and a few web searches but then it unexpectedly found and referenced an internal document.

I've reproduced this myself. Copilot in Outlook on the web found files in my OneDrive, and the standalone M365 Copilot (Basic) app also found and described documents.

Honestly, this caught me off guard. I'd assumed (wrongly!) access to company files would be opt-in. Apparently not. My mistake, lesson learned. Whatever happened to the principle of least privilege?

Data is not being trained on or anything, but still......

Anyway. what I've tried:

• AD GPO: Disabled connected experiences that analyse content. Appears to block Copilot in classic Outlook, but not Outlook on the web or standalone Copilot.
• M365 Cloud Policy: Can't find a suitable restriction.
• Integrated Apps: Seems to be all-or-nothing.
• SharePoint controls: Restricted Content Discovery doesn't appear to cover OneDrive unless im missing something.

My goal is to keep basic Copilot Chat for general questions, but stop it accessing company emails and files.

Am I missing something obvious? Is there really no central setting for this?

Worst case, I'll disable Copilot entirely, but that seems ridiculous for what should be a simple restriction.

My role is pretty much putting out fires and support. I dont feel my title matches my job description. In fact I think I barely make the sysadmin qualifications.

Looking to go back to school (50 yo) and go for cybersecurity degree.

Would this be a step forward or behind in my career at this stage?

The sysadmin role is burning me out fast.

Hi all,

I'm reviewing the User Rights Assignment settings in our DC hardening GPO and I'm not sure what the best practice is for "Bypass traverse checking" (SeChangeNotifyPrivilege).

Current GPO value:

- Administrators

- Authenticated Users

- Everyone

- Pre-Windows 2000 Compatible Access

Compared to the Microsoft DC default, LOCAL SERVICE and NETWORK SERVICE are missing. As far as I understand, they still get the privilege through Everyone, so nothing should break today.

What I found so far:

- Microsoft recommends keeping the default and warns about compatibility issues (KB 823659).

- Neither the CIS Benchmark nor the DISA STIG for Server 2019 seems to have a rule for this setting.

- Removing it can break IIS, HttpListener (access denied 5), share access and change notifications.

My questions:

1. Do you keep this setting "Not Defined" on DCs, or explicitly define it with the Microsoft default (including LOCAL SERVICE / NETWORK SERVICE)?

2. Has anyone actually removed Everyone or Pre-Windows 2000 Compatible Access from this right in production? Was it worth it, and what broke?

3. Any auditor or pentest finding you have seen related to this setting?

Thanks!

So, how’s everyone’s security department handing this so far? Mine has been completely worthless like always. Give me some good stories to cheer me up.

Hi all,

I'm reviewing the User Rights Assignment settings in our DC hardening GPO and I'm not sure what the best practice is for "Bypass traverse checking" (SeChangeNotifyPrivilege).

Current GPO value:

- Administrators

- Authenticated Users

- Everyone

- Pre-Windows 2000 Compatible Access

Compared to the Microsoft DC default, LOCAL SERVICE and NETWORK SERVICE are missing. As far as I understand, they still get the privilege through Everyone, so nothing should break today.

What I found so far:

- Microsoft recommends keeping the default and warns about compatibility issues (KB 823659).

- Neither the CIS Benchmark nor the DISA STIG for Server 2019 seems to have a rule for this setting.

- Removing it can break IIS, HttpListener (access denied 5), share access and change notifications.

My questions:

1. Do you keep this setting "Not Defined" on DCs, or explicitly define it with the Microsoft default (including LOCAL SERVICE / NETWORK SERVICE)?

2. Has anyone actually removed Everyone or Pre-Windows 2000 Compatible Access from this right in production? Was it worth it, and what broke?

3. Any auditor or pentest finding you have seen related to this setting?

Thanks!

Hi Folks,

At work we use WhatsUp Gold for monitoring network devices (about 80 Groups with each between 8-50 devices. The think about WhatsUp Gold is that you can create visual maps/layouts of your groups. Although WUG is kinda slow sometimes, I like that managing your devices is very easy, and that the icons are simple. Just create a group, add your devices, position them on the layout, add lines between them, add monitors and done.

I want to use WhatsUp for my personal projects but it’s limited to 10 devices on the free license, without paying a very hefty bill every month.

Are you aware of any monitoring tool that has a very easy interface to create visual layouts of your monitored items? I am aware that Zabbix has some kind of layout feature but for me zabbix has too much features, has too much steps to add a device and the layout feature is too bloated. I like how compact you can make your layouts on WhatsUp. Ideally I would want to have something as easy as Uptime Kuma but with a mapping feature.

Preferably the alternative would be free or cheap. Open source is nice but not a must. Thanks!

I'll start:

IT Infrastructure Manager/155k/ Hybrid(3 day in, 2 remote)/ Chicagoland area.

Hi guys,

I was hired as a pc builder about 2 years ago in a company here in Belgium.
Nowadays my package that i do is way more than building.
I build computers (custom) and i install windows on it.
But now my manager wanted me to grow, and asked me if it would be possible for me to create a custom image of windows to deploy on the built computers.

What i learned in an hour or so is how to just deploy a "standard" windows pro or home image on a VM, screenshot it and then deploy that on a machine. But that's not enough. As we want our "company wallpaper" to be deployed on the systems aswell, and also they want dark theme to be enabled there.

But as soon as we are done with setting up the system in audit mode (drivers, rgb software etc) and we do OOBE, so we go to language select (this is the last step before we ship it to the customer) the wallpaper and dark theme dissapear.

I could also edit the image offline through powershell, but that does not make it possible to add the wallpaper and dark theme and let it get through OOBE and language select.

Is there someone who could give me a link to a tutorial, or maybe even help me? To set it up? Or at least guide me to the right way to do this? I want this job to succeed.

What are larger orgs using for DLP (standard and AI related) solutions? We've demo'd products from Forcepoint (their Remote Browser Isolation) and Orion Security, neither of which was a good product.

We do have Crowdstrike already for EDR but our IS team is trying to find another solution to use for some reason.

I enabled forwarding + to keep a copy of emails. Also modified the defender setting to allow forwarding. Later I unchecked forwarding and returned the defender settings to where they were, to block forwarding and saved the settings.

A few hours later someone mentioned no emails had been received. I looked at the forwarding setting and it was still set to forward but with no destination email address and was set to NOT keep a copy of the email. I eventually had to reset it with PowerShell.

No emails in purview or sent or deleted items. Is there anything I can do to recover?

anyone else getting errors on the dashboard?

I wish i could just nuke it all but I can’t.

What other options do I have? I have 1 week to clear out 50000 emails.

Someone on our team changed numbers recently and it exposed something I’d never really thought about. A few weeks later we found out their old number had already been reassigned. That number had been used for years with vendors, former coworkers, contractors, delivery people, old MFA setups, random group chats and probably a hundred things nobody remembers anymore. Imagine being the person who gets it next. You don’t need to hack anything, people just start texting you assuming you’re the previous owner.

Obviously the answer is cleaning up accounts and not using SMS as an identity system in the first place but realistically nobody remembers every place their number has ended up. We’ve started thinking much more carefully about which relationships are tied to phone numbers at all. Signal for some people, Kibu for a few contacts where identity matters more, company managed accounts for work etc. Am I overthinking this or is phone number recycling a massively underrated social engineering risk? These two hit very different things like the first is invisible wealth, while the second is identity persistence after a phone number changes.

Anyone here tried the ZKTeco T1? I cant find any review of this one. Because I need a Biometric that can be extracted through online. and also is the ZKbio ZLink free if i buy this device?

I have my bachelors in IT as well as a completed internship at my local ISP that has a MSP department. Unfortunately my internship could not lead to full time, even though my manager needed the help, the budget was not there.

I really enjoyed the experience and learned a ton in the 14 weeks. They mainly had me doing layers 1-3 stuff and shadowing everything else, since I was an intern, but still.

Anyways, an MSP a couple towns over posted a computer technician role asking for an associates, about 1 year of experience, or combination of education and experience. The pay is really good at 45k a year, has great benefits including education funding, and it seems to be right on par with all the stuff the techs were doing in my previous role.

Although it is not an official title of IT Technician 1, Help Desk Analyst 1, or JR Sysadmin, all the job duties seem to entail more stuff than just a tier 1 role. It includes everything from running and terminating cables, Active Directory / Entra ID Management, Imagining devices, scripting, hardware deployments, and everything else. It is all a combination of office, on client site, and remote work with on calls strictly reserved for software based issues.

Seems like a no brainer. However, I am not sure if doing this or trying to get a tier 1 role that has a more structured team consisting of Network Engineers, SRE / Devops team, official sysadmins, etc that you can learn from and promote to.

So would it be wise to go for this role, chill in it for a two or three years (if I get it), while learning everything I can and upskilling, then then move on? I know you aren't 'supposed' to stay in help desk for a long time, but if the work ends up advancing even closer to being a sysadmin, it seems very beneficial.

That's the subject line of an email from my personal website hosting this morning, advertising upgraded AI-assisted websites.

I'm taking it as a sign that my decision to retire early at the end of the year is a good one. But it's also really depressing, especially given the posts I've seen here lately of layoffs and other separations attributed to management confidence in AI as a substitute for skilled sysadmins. EDIT: I made my decision months ago, I had many reasons for retiring, it was NOT because of this marketing email.

Ultimately, I think the bubble will burst, and the value of experience will make itself obvious again, but it's going to be a rough ride for our profession until then.

Can we get a list going?

So far I found:
Synology
Unifi OS EDIT: I may be wrong about this one.
pfsense
fortinet

Current setup:

• Main site in Houston with on-prem AD and Windows file servers. Users map drives network Drives
• Azure Hybrid environment with about 100 users.
• Brazil users connect back to Houston over FortiGate VPN, and file access is slow
• About 10 TB of data total.
• ½ of Brazil staff don't work from one office. They're spread out or remote. We have about 10 users now and may be expanding soon.
• Veeam for backup

Hope you guys can give me some reocmmendations on how can users from Brazil can access the data on on-prem faster. I looked into Azure Files and Azure FIle Syncs with and without local Brazil server. What do you guys recommend? Thanks.

Hey fellow sysadmins, a significant chunk of our tech stack is hit today, affecting our main CRM (PM Tool) alongside our dev tools; wondering could this be caused by the PHP day0 discovered or you believe there's something else lingering in the background?

Wondering if anyone got any insights as to what's going on in here, any other global, widespread used apps that are affected?

thanks for coming to my ted talk.

How seriously was it taken? Was there genuine panic, or was it mostly business as usual? Did you spend months preparing for it, and what was the atmosphere like as midnight approached?

Would love to hear some firsthand stories, especially from those who were on duty that night.

SharePoint Hero Links have finally started rolling out in our organization. I’ve started exploring how they work and thought it would be worth discussing here.

What are your thoughts on this feature so far? Any interesting use cases, limitations, or things admins should be aware of?

Has anyone recently encountered Error 87 when installing shared network printers through Windows 11's automatic printer discovery?

We're running an on-prem Active Directory environment with a Windows print server using older Universal Print Drivers.

The issue:

When users navigate to Settings → Bluetooth & devices → Printers & scanners → Add device, Windows automatically discovers our shared printers from the print server.

They appear correctly as:

HP Printer 123 on PRINTSERVER

However, selecting one to install results in Error 87 (The parameter is incorrect).

What's strange is that both manual installation methods work perfectly.

• ✅ File Explorer → \\PRINTSERVER → Double-click shared printer.
• ✅ Windows Settings → Add manually → Select shared printer by name → Enter UNC path.
• ❌ Windows Settings → Add device → Select automatically discovered shared printer → Error 87.

The printers are being discovered correctly, and the drivers install successfully through either manual method.

This automatic installation method has worked for years, and the issue appears to have started recently.

I'm wondering whether a recent Windows 11 update changed something in how Windows handles installing automatically discovered shared printers.

Any insight would be appreciated.