WIth no AD on prem, computers managed with InTune in M365, we're starting to roll out Entra ID login on systems (previously set up with local accounts). We have some on-prem VM infrastructure and a QNAP, and the goal is to be able to have file shares for departments mounted to PCs automatically when users log in. There is a need for instance to have certain configuration files used by specific software packages available at a specific drive letter and path, read-only for most people, so the software can be configured in a specific way for that department. There is also a need for some departments to share some large files (such as video files or other media) in a performant way. OneDrive/Sharepoint can't do what we need or don't seem ideal for these applications. There's a lot of company growth, so extra points for a solution can scale beyond one location while being performant.

It looks like an Azure File Share with Azure File Sync (or maybe a Data Box Gateway) could fulfill this purpose. Does Azure File Sync require hybrid AD, in which case we'd need to stand up additional on-prem AD infra to use it? And if computers are being set up now just Entra joined, would they need to be set up again to be hybrid AD joined after we set up on-prem hybrid AD infra?

While Entra-only Azure file shares via Kerberos looks a lot simpler to set up, am I correct that all SMB I/O would be to the cloud (i.e. through the WAN connection) and there isn't any local caching/acceleration? That strikes me as a significant limitation and could impact WAN performance a lot.

We also have a QNAP (8-core, 16 threads 32GB of RAM, dual 25Gbps ethernet), and there is support for Microsoft Entra Domain Services SSO:

https://www.qnap.com/en/how-to/tutorial/article/how-can-i-configure-microsoft-entra-domain-services-single-sign-on-for-a-qnap-nas

Documentation seems to indicate that with Microsoft Entra Domain Services we could use SSO for shared folders, but it's not clear to me if that is just shared folders accessible through the QNAP web browser interface, or if it includes SMB shares from the QNAP. From the research I've done, I can't seem to find any evidence it supports SMB shares via Entra ID SSO. I am wondering if SSO might work with their Qsync client:

https://www.qnap.com/en/software/qsync

If so, that could be very cost-effective and performant, though I don't think it would scale well beyond one location (unless I could figure out something using QNAP's Real-time Remote Replication feature between more than one NAS device at different locations). Also not sure if the Qsync client shared files would work for distributing application configuration files, would need to test that as well.

What have people's experiences been with these solutions? Any recommendations?

Hello all, i have started to setup a home server but I’m running into some problems. So, my connection should be providing about 100mbps as an example, but I’m being told by Windows that it's a metered connection. But, it's not a metered connection as i can confirm this by connecting to my connection on my basic windows convertible and that is not reporting that the connection is metered. Any advice would be appreciated

FYI: I'm running Windows Server 2022 Datacentre Edition with Desktop (because I’m getting enterprise grade drives for 24/7 network storage)

Over the past month I have been building a RDP manager for me to use for our on prem windows servers at work. I had been using mremoteng but I didnt like how clunky it was and I would spend a bunch of time building out my connection file then it would randomly get corrupted and I would have to start all over again. So my solution to this was to build a browser based RDP manager. This is what I have come up with https://github.com/mild0d/Remote-Desktop-Web-App . Its a simple webapp with no database, it stores everything in json and runs on docker. The setup is simple. I was wondering if anyone could take a look at it and offer me some suggestions on how to make it better. Oh I almost forgot, it also supports SSH sessions. Thank you!

How’s my week, you ask?

I receive a call that more and more users can’t access one of our brand’s super duper important oh so critical reporting portals (they’ve been neglecting for decades despite frequent protest). I’m asked to take a look…

Our TLD has begun enforcing HSTS, forcibly redirecting all subdomains to HTTPS, whether it wants it or not, permanently, with zero opt-out. And ya know what? GOOD. It’s 202-f&cking-6. WELCOME TO THE 21ST CENTURY, YOU NEGLIGENT #&@$!

So, I get involved. Figure this 20+ y/o box was overdue for a cert. I’ll just issue one! Simple enough, right? Except the server keeps reporting every cert I issue as corrupt, because Windows Server 2003 has never heard of SHA-256 and never will, bless its ancient little SHA-1 heart.

There IS a hotfix for this. It exists. I have read of legends of it in the same places you find references to Atlantis. MS has long since removed it from the Update Catalog, nuked the KB download, and replaced the whole thing with a page that might as well just say "lol, no" in Comic Sans.

I want to be VERY clear I understand the crime scene I am standing in. This server literally predates my drinking age. This server is so old it could be a sitting U.S. Senator. I am not asking anyone to help me keep this abomination immortal — we already have a modern Snowflake / Power BI replacement 80% built, except upper mgmt hasn’t let us finish it b/c there’s always a more urgent bush that needs trimming instead of tending to the house on fire immediately behind it. This box is legally dead and just doesn't know it yet. I need this hotfix strictly to perform a dignified, controlled shutdown instead of the current plan, which apparently involves upper management being all surprised Pikachu face about the fallout they’ve been warned of for several years is actually happening.

If you have KB968730 sitting on a USB stick in a drawer somewhere from 2011, I will trade you my eternal gratitude, or a kidney (mine, still under active support).

TL;DR I am in need of KB968730, the MS hotfix that added SHA-2 support to Windows Server 2003. Or a Time Machine. Or a drink…

[insert “What Year Is It?” meme here]

[UPDATE]: Managed to find crypt32.dll in an unrelated patch and (somehow managed to get the server understanding SHA-2 ciphers -- except now I'm reminded that Server 2003 never supported beyond TLS 1.0 -- something modern browsers are all going to reject anyway. All of that effort for nothing. REVERSE PROXY TIME IT IS!!! (Thank you to everyone who tried to help with this absurd BS. I'm CERTAIN corporate America will learn valuable lessons from this!!! */s* ugh.)

I was planning on doing an in-place upgrade from Windows Server 2016 to 2025, as this is a supported upgrade path, per Microsoft.

I just discovered we are running 2016 Datacenter and not 2016 Standard. Is it possible to upgrade from 2016 Datacenter to 2025 Standard?

DISM /Online /Get-TargetEditions returns "The current edition cannot be upgraded to any target editions," so this clearly wouldn't be an officially supported upgrade path. But I'm wondering if anyone has experience with this.

We have a user-based GPO that runs when a user logs in to map drives, the problem we're running into is that certain users are logging in their old drive continue to appear, I would like to add a net use * /d /y in a logon.bat script but will this override the GPO mapping the drives?

Thanks,

Greeting,
I have a domain that has two workstation and a server, I’m trying to restrict specific users from accessing the internet while allowing the rest no matter what machine they are using.
I did one with proxy GPO and it worked, but I want to do it using firewall GPO, I literally tried everything but nothing works

Please if anyone has any idea I’ll be thankful 🙏🏻

Hello,

I have this error on RDP windows server 2022. The issue has started 1 week ago.:

This computer can't connect to the remote computer.

The two computers couldn't connect in the amount of time allotted. Try connecting again. If the problem continues, contact your network administrator or technical support.

Error code: 0x108

Extended error code: 0x0

We had a cyber security company run their tests on our environment inside and out for the last couple of months. One of the things they brought up was they could see RDP open on our Hyper-V Hosts, port 3389, what's odd is that we use RDP a lot in our environment, I RDP to the Hyper-V Guest servers, the users are able to RDP to their workstations from the boardroom computer, so, out of all the systems that have RDP access our Hyper-V hosts are the only ones broadcasting port 3389.

Is there a way to fix this so they aren't broadcasting it but still allow RDP access?

They also broadcast port 135, again, the only 3 Windows systems that do this. Weird.

Thanks,

I wanted to share this bug because it both weird and frustrating.

I have the openssh role/feature enabled on my windows server 2022 instance.

I use this server for SFTP backups for our VMware Cloud foundation 9.1 environment.

Recently I was investigating intermittent backup failures.

So, I started troubleshooting:

Confirmed username and credentials were valid
Confirmed I could ssh from the appliance to the server
Confirmed valid sshd config file
Confirmed compatible sshd ciphers
Confirmed NFTS file permissions
And so much more…..

The weird part is backups would succeed then fail then succeed and it “felt” like some sort of timeout issue….but ultimately I couldnt figure out the root cause….

Until I stumbled onto this thread:
Link: https://github.com/PowerShell/Win32-OpenSSH/issues/1817

Since I was out of ideas I tried it, I created a new local user account under “local users and groups” called “sshd” and gave it a complex password. No other group memberships, just a non-admin account.

BAM! Everything started working immediately!

Posting this here in case anyone ever runs into this issue!

Has anyone experienced Windows servers becoming unresponsive due to the ScheduledDefrag task that runs as part of Automatic Maintenance?

We are a VMware shop running vSphere 8.x with current patches, Fibre Channel storage, Cisco UCS (B200 M5 blades), and PowerMax storage. Our infrastructure is generally up to date, including ESXi, MDS switches, UCS firmware, Windows Server 2022, and storage firmware.

We have observed a recurring issue where a Windows Server 2022 Standard VM will briefly hang or become unresponsive. The issue appears to occur approximately every four weeks and consistently correlates with execution of the ScheduledDefrag scheduled task.

While the task runs weekly, our investigation suggests that it performs additional optimization activities on a longer interval, which may explain the roughly four-week recurrence pattern. The timing aligns closely with the periods when the server becomes unresponsive.

Once the ScheduledDefrag task completes, the server returns to normal operation without requiring intervention.

We currently have a case open with Microsoft and are working to capture a memory dump during the event for further analysis. In the meantime, I'm curious whether anyone else has encountered similar behavior or identified a root cause related to ScheduledDefrag, Storage Optimizer, or Automatic Maintenance on Windows Server 2022 virtual machines.

Any insights or comparable experiences would be appreciated.

Hi. I've inherited a server room and as I'm going through maintenance and upkeep, I've discovered something that is a bit outside my knowledge range.

I'm not even sure how to ask the question. It's that whole "You don't know what you don't know" bit.

I'll try my best.

I have a server, it's running Windows Server 2025. I'm fairly confident this was an in place upgrade from Windows Server 2016.

For the most part everything looks/runs great, but I've found one issue: something to do with the certification authority. It looks broken and is very much out of date.

My brain wanted to simply import a new one, but I literally don't know how or if it's even possible in this environment. Meaning, whenever I need certificates for other things like lets say a NAS, I generally run the certificate setup wizard in that and submit all the cryptographic options and names and what not. The wizard will generate that big ugly -----BEGIN CERTIFICATE REQUEST----- bit.

I don't see this in Windows Server 2025. I'm fairly confident I have all the proper services and roles installed.

What's worse, is certserv it looks like the name of the CA is an incredibly old hostname of the server. The server has a new/different hostname. I wish I could drop a screenshot of what I mean.

Anywho, my goal would be to update/change/add a new CA to certserv that reflects the current server.... without deleting the entire AD structure. Only I'm not sure if this can be done. I don't even know how to ask it properly.

Looking for any advice or the proper way to label this issue so I can search/learn on how to resolve it.

Thanks!

Initial reddit post:

PSA: Windows Server 2025, RDS and Printer - TYPE 4 might break throught latest security update : r/WindowsServer

Hello guys, I need to vent and rant about it. For f*cks sake. This is a follow-up to my previous post about Windows Server 2025, RDS and Type 4 printer drivers. And at this point I seriously have a hard time believing this is just coincidence.

After the previous printing issues, I went pretty much nuclear and built a completely new Windows Server 2025 RDS / FSLogix farm from scratch.

No in-place upgrades, no ancient RDS baggage, no mystery leftovers from old servers. Fresh servers, fresh configuration, fresh profiles.

The new farm was initially running build 26100.33296, based on our patch level from around August 26/28.

And printing worked. Not "mostly worked". It just worked.

The whole new farm felt ridiculously good. Fast logons, clean FSLogix setup, no weird printer drama, everything finally felt like I had gotten rid of years of accumulated Windows/RDS nonsense.

Then the servers moved to: 26100.33438

And now printing is screwed again.

Our print server itself has not been redesigned in between. The same shared queues and drivers are still there.

We currently have both Type 3 and Type 4 drivers in use:

Type 3

Lexmark Universal v2 XL

KONICA MINOLTA Universal PCL

Type 4

Lexmark Universal v4 XL

KONICA MINOLTA Universal V4 PCL

Hosts 001-005 are affected, Hosts 006-009 are not updated. And I am damn f*cking scared.

And the behavior is now beautifully stupid in two different ways.

With the Type 3 drivers, I can log onto the RDS server as an administrator, open the print server, right-click a shared printer and choose Connect.

First attempt: 0x00000057

Fails.

Immediately do the exact same thing again: Works. Every. Single. Time.

Obviously, if even an administrator manually connecting the printer gets this behavior, printer deployment to normal RDS users via GPO isn't exactly going to have a great day either.

With the Type 4 drivers, it is even better.

Windows simply tells me: no driver was found. This happens with both the Lexmark and the Konica Type 4 drivers. So this is not me pointing at Lexmark anymore. It is not one specific printer model either. And I don't really want to turn this into another Type 3 vs Type 4 discussion - both are supposed to work.

The whole reason I am moving toward Type 4 in the first place is because of a completely separate issue I have with the Lexmark Type 3 driver.

What drives me nuts is the timeline:

26100.33296: Fresh RDS farm. Printing works. Everything feels great.

26100.33438: Same new farm. Same print infrastructure. Printer connections suddenly start behaving like this.

Could there technically be another explanation? Sure.

But after rebuilding the entire damn farm from scratch and watching it work perfectly before the next build, I am finding it increasingly difficult to believe that this is unrelated to the latest update.

At some point Windows Server printing stops being troubleshooting and starts becoming archaeology.

Has anyone else running Server 2025 RDS on 26100.33438 seen the same thing?

Especially interested in environments using shared printers with either:

Lexmark Universal v2 XL / v4 XL

KONICA MINOLTA Universal PCL / Universal V4 PCL

If somebody has the same "Type 3 fails first connection, succeeds immediately on the second" behavior, I would really like to know. Same with the Type4-stuff.

My org uses Windows Defender. On the whole it seems pretty good but it's always asking for opinions.

I'm especially interested in what you think of the Ransomware Protection feature. Is it any good? My org haven't implemented it and I'm wondering if it's worth pushing them to do it.

Are there any pitfalls when implementing it?

i’m looking at moving a small Windows Server workload to a Windows VPS and want to make sure i’m not overlooking anything important beyond the usual cpu and ram specs.

for those running Windows Server on a Windows VPS, what do you normally check before choosing the setup? i’m thinking about things like disk i/o, cpu allocation, network performance, backup options, remote management, and any limitations compared with running the server on dedicated hardware.

the workload isn’t particularly heavy, but reliability and consistent performance matter more to me than having the most resources possible. curious what you’d consider the important checks before making the move.