u/picklednull

What is this check for? There is no issue with such tasks inherently.

The only two (or more?) cases it's an issue is with:

• unquoted paths for the executable
• an unwanted party has write access to the path that is being executed

It's been a year since I've looked at this, but:

Just add a deny rule for the specific unwanted binaries before the RPM trust rule?

Yeah, fapolicyd is it.

Great reply. Yeah, it’s true tech is becoming more reliable and simpler to deploy - of course, that’s evolution.

I switched careers about 10 years ago seeing the writing on the wall for tech careers.

Can I ask what you mean by this? It's very interesting. I wouldn't have considered anything (AI) foreseeable 10 years ago. And even then, you could still get paid well (at least until now) doing IT. IMO IT will still be good for some years, but decades is uncertain.

Then again it might indeed make sense to get started in another career path earlier to get yourself established sooner.

Yeah, Finland has actually surpassed the entire EU and can claim top unemployment in the entire OECD now.

Finland is also the only EU country where apartment prices have decreased with prices going down for 4 years in a row now. Prices have gone down >20% since 2021. It's "impossible" to even sell apartments.

If you bought your apartment at the peak in 2021 with a 90% loan and its value has now fallen 25%, the value of your apartment is less than the loan you have left. There's no personal bankruptcy in Finland, so the bank would come after you for the remainder if you default. So you can't even leave the country (for work)...

The IT market here is just like any other I guess, very hard to find anything. Luckily I still have a job though.

For comparison: they got 2000 applications to play an elf at Santa's Village in the north this year where they're paying 12 euros an hour. Last year they had 10000 applications for a dish washer position on a cruise ship.

Finland currently has the highest unemployment rate of all OECD countries.

Hyper-V clustering / live migration.

CAU is a feature of Failover Clustering, not WSUS (or anything else). It's just a cluster plugin that orchestrates patching, the patch source is irrelevant.

I know why not dogfooding could be a bad look, but on the other hand, it does make sense.

Suppose your clients are running anything from NT4 to Server 2025 with AIX and Solaris mixed in. You can offer them a great multi-tenant shared product very cost efficiently, however, due to its OS support flexibility it’s not the most effective product for Server 2025.

Internally you run a pure Server 2025 environment with no legacy whatsoever and you don’t need multi-tenancy. The most effective product on the market fits that mould.

Should you dogfood the - in your situation - inferior product you sell to your clients or use the best one on the market?

Suppose a client comes to you and wants the best of the best product in a dedicated deployment. Do you offer them your standard product or deliver them what they want?

It all depends on the circumstances.

or even just whole hog ditching certs for another system

Merkle Tree certificates are already coming.

Never tested, but YOLO: recreate it the same way Active Directory initially creates it, with LDIF.

The Windows Server install media will contain \support\adprep\sch40.ldf (or \Windows\System32\adprep\sch40.ldf on a Domain Controller), which contains the Server 2008 schema upgrades including the Password Settings Container.

Pull out only the records for the Password Settings Container into a fresh LDIF file, you don't want to overwrite other things in the schema. Small tweaks might be required, such as ntdsSchemaAdd probably can't be used, it would be a standard add.

Then just import the fresh LDIF with ldifde.

bring up forest and domain level

Do that and you can never go back. The new level doesn’t really offer anything useful.

However the majority of my work experience is on-prem. … And that's a weak point.

You sound exactly like me. I tried to fix this by making some moves now and ended up with so much pain - it wasn’t even my fault (at least that’s what I tell myself) or technical really, but organizational.

It can get really hard to break into a new area and it’s easy to stagnate - even unintentionally - and it’s not (always) even about the technical aspect.

Ultimately you might just (have to) start considering going backwards in ”prestige” or pay to move forwards or just going backwards and that comes with its own risks.

You understood everything correctly.

Why does Purple Knight flag this / why should it be removed? I understand the ADIDNS spoofing → MitM/credential-theft angle, but is Low severity accurate given how easy it is to abuse?

This is the key question. I don't think it's very relevant and I haven't seen any actually concerning attack scenarios utilizing this.

If you want to remediate it, you would have to statically add server records and omit registering client records entirely or use Microsoft DHCP and make it register the records on behalf of clients. The client records are pretty useless regardless.

This is the recommendation in the "Modern AD" book as well.

submits it via a quiet certreq.exe wrapper

Why don’t you just use the COM interfaces to do the enrollment?

It's not a question of "numbers" - the EULA explicitly forbids it:

Limited rights versions. If the software version you acquired is marked or otherwise intended for a specific or limited use, then you may only use it as specified. Except for Windows Server Essentials, you may not use such versions of the software for commercial, non-profit, or revenue-generating activities.

II. Evaluation. For evaluation (or test or demonstration) use, you may not sell the software, use it in a production environment, or use it after the evaluation period. Notwithstanding anything to the contrary in this agreement, evaluation software is provided "AS IS" and no warranty, implied or express (including the Limited Warranty), applies to these versions.

You of course don't have to license it to run it temporarily.

Evaluation Edition is strictly only licensed for non-production usage. Your suggestion is a literal licensing violation (but in practice no one will care).

Glad to know there's a new version released.

I just tried running it on a Server 2025 and it crashes at startup with a "DLL not found" exception.

Launches on W10 LTSC though. Connects fine too.

Microsoft Loop. The only bad thing is it’s not exportable - other than print to PDF - and the format is proprietary.

You might have painted yourself into a corner by going into management. It's hard to go back "downwards" from there. Or I don't know in practice, that's just what they say and I can see why.

The other thing is, IT salaries are mostly above everything else unless you're looking to become a (medical) doctor. So are you really willing to take a cut in pay?

I'm not exactly in the position you are, but I'm having the same thoughts to an extent - not burnout, but the work is becoming boring or/and the entire field is moving in a bad direction (AI).

Did you consider going for another role within IT? That's what I've always thought you could do if things get boring. Programming might be "dead" due to AI (or it depends on how you like to work), but sysadmin or networking still exists (paradoxically networking might be in more demand than ever due to cloud usage, even if on-prem datacenters are going away).

For me, ever since the beginning, I wondered whether I should have gone into programming instead. I always liked it. Now with AI I think that's dead.

Get some monitors with integrated KVM, that's the modern option. You can feed the laptops power too through USB-C.

They added support pathetically late (Exchange 2019).

Yeah, I read up on it myself and it sets up a custom credential provider (of course) that uses the OTP functionality (support) of the Yubikey.

Technically that should/could work remotely if it doesn't directly interface with the Yubikey, but just uses the emulated keyboard output, but I don't know if it does. Now I want to test this, I've never used the built-in OTP for anything.

NLA would have to be disabled to have access to the "local" login screen and the custom credential provider.

You have 4 options:

1. you can pre-stage a computer object into Active Directory and delegate the permissions to join it to the domain to a certain principal (it's right there in the dialog in dsa.msc)
2. you can grant an arbitrary principal the ability to join arbitrary (number of) devices to the domain
3. if your Domain Controllers are <2025, you can domain join devices with no user principal at all, you just need to pre-stage the computer object
4. offline domain join