All post
Do not install a third-party packet capture driver on a production Windows server just to learn which hop is dropping your packets. The driver you add for one afternoon of troubleshooting can outlive the ticket, survive a reboot, and reappear in your next change-control review. Windows has shipped its own packet capture and drop-detection tool for years, and it does real diagnostic work without a third-party binary. The risk you carry into a capture is the capture itself. A full-packet trace on the wrong interface records credentials and customer payloads to disk, and an unbounded file can fill the system drive of the server you are trying to rescue, which is why the filter, file-size, and log-mode choices below decide whether the trace is an asset or an incident.



adamtheautomator.
Read More
Windows 11 now includes System Monitor (Sysmon), a tool that logs process creation, network connections, and file creation time changes to the Windows event log. Previously, it was a separate download from Sysinternals. The built-in version is an optional feature that is disabled by default, so you must enable it with PowerShell and install it with the sysmon command. This article explains the prerequisites, the commands, how to apply your own XML configuration, and how to verify that Sysmon writes events.


Source : 4sysops
Read More
Starting October 10, Microsoft will require Exchange Online apps to appear in `EWSAllowedAppIDs` to keep using EWS, following the earlier warning that the allow list would be required. For qualifying Worldwide tenants, Microsoft plans to add IDs on October 8 and 9 based on the previous 60 days of activity—but apps used less often may need to be added manually.
Source : Exchange Online enforces EWSAllowedAppIDs on October 10 – 4sysops
Read More
WSL is central to our commitment to making Windows the best place to build, run and manage Linux workloads. As AI, cloud-native development, containers, and open-source ecosystems continue to converge on Linux, more developers are choosing to perform these workloads directly on Windows devices. We’re continuing our journey towards this goal with a new feature in WSL: WSL containers, which is generally available today.

Source : Windows Developer Blog
Read More
Don’t let the tool you already know decide PowerShell vs. Power Automate for you. That instinct feels efficient: you got fluent in PowerShell during your first sysadmin job, or you built your first approval chain in Power Automate, and now every automation request gets routed through whichever skill is already in your hands. It’s also how you end up with a PowerShell script handling SharePoint approval routing, or a Power Automate flow looping through a 40,000-row CSV one API call at a time.

Before you route the next ticket (new-hire provisioning, a stale batch of Active Directory accounts, a Teams alert that has to reach an invoicing system with no API), score it against how PowerShell and Power Automate are built.


Read More
Microsoft plans to deprecate the Windows Deployment Services (WDS) server role, including its Preboot Execution Environment (PXE) boot functionality, starting with the next Windows Server release. WDS continues to work on Windows Server 2025 and earlier, but you should begin planning a migration now. This article explains what the deprecation covers and evaluates the alternatives Microsoft names: the Configuration Manager PXE responder without WDS, non-Microsoft PXE solutions, and UEFI HTTP(S) Boot. It also covers Windows Autopilot for new devices and the planning steps Microsoft recommends.


Source : 4sysops
Read More
Microsoft is warning IT administrators not to wait for VBScript removal to disrupt Windows activation automation. Organizations that still rely on `slmgr.vbs` should begin moving critical workflows to PowerShell, using Microsoft’s newer activation module where it is supported.

Source : Microsoft tells IT admins to replace slmgr.vbs with PowerShell now – 4sysops
Read More
It’s been a busy week, and sometimes you just need something like a dad joke while almost hitting project deadlines, etc.  In this short blog post, I will show you how to use the FreeDadJokes module and add it to your profile to get one every time you start a Terminal.
Read More
SQL Server Express users can now move small applications to Azure SQL Database Free Tier with a short workflow that combines SSMS or Visual Studio Code, Azure provisioning, and GitHub Copilot-assisted migration. The option removes Express’s local hardware and maintenance burden, while Microsoft’s preview Azure SQL Developer container provides the same database engine for developers who want to stay local.

4sysops
Read More
Canonical expects Ubuntu running through Windows Subsystem for Linux (WSL) to overtake native Ubuntu desktop installations within the next few months. The prediction reflects faster growth among Ubuntu users on Windows 11, where developers and AI engineers can access Linux tools without replacing Windows or configuring dual boot.
Source : 4sysops
Read More
Windows Server 2016 reaches the end of extended support on January 12, 2027. If you cannot retire or upgrade every server by then, Extended Security Updates (ESUs) provide Critical and Important security updates through January 2030, but not new features or non-security fixes. Microsoft now makes the Azure Arc option generally available: it connects on-premises and other cloud servers to Azure so that you can license and enroll them centrally. This is a temporary security measure while you complete an upgrade or migration plan, not a replacement for it.
Source : 4sysops
Read More
While debugging PowerShell code outside of Visual Studio Code, it’s always difficult to keep drilling down into all the Properties with nested objects inside of them, etc. With DumPS, this is a lot easier. In this blog post, I will show you how it works.
Read More
Microsoft is introducing a new security feature called KMS Hardware-Secured to protect Key Management Service (KMS) activation. This feature uses Trusted Platform Module (TPM) attestation to verify the hardware integrity of your activation servers. Starting with Windows Server 2025, you can assess your infrastructure's readiness for this change. In a future Long-Term Servicing Channel (LTSC) release, this hardware-based verification will become mandatory. This article explains the technical requirements and how you can prepare your environment.
Source : 4sysops
Read More
Windows hides advanced CPU boost settings to balance performance, power consumption, and heat, more effectively. They can be easily enabled.

Source : Neowin
Read More
Windows 11 version 25H2 introduces a new Group Policy setting, Configure maintenance windows for automatic updates, that lets you define precise time windows for downloading, installing, and restarting after updates. The policy ships with version 3.0 of the ADMX administrative templates and is currently available only in Windows 11 Insider Preview builds. It takes priority over several existing update-related policies, but the interaction rules are only partially documented.
Source : 4sysops
Read More
Microsoft 365 Backup now lets you recover individual files and folders from SharePoint and OneDrive backups without rolling back an entire site or account. This granular restore feature became generally available in late April 2026. You need the SharePoint Backup Administrator role to use it, and the service charges $0.15 per GB per month for protected data. This article explains how the feature works, its limitations, and how to perform a restore.

Source : 4sysops
Read More
Today, we’re announcing a public preview of file‑level archiving in Microsoft 365 Archive. This new capability enables you to archive individual files moving them into a lower-cost, cold-storage tier in SharePoint. This means you can archive outdated and redundant files while keeping the rest of the site active, improving both your Copilot relevancy and your search results in the process.

Source :
microsoft_365blog
Read More
The Defender deployment tool for Windows now ships as a single .exe with the onboarding package baked in, with configurable expiry dates, a required portal key to activate it, and onboarding event logs visible in the device timeline — replacing the old script/blob approach. The previous tool gave no clear status feedback, leaving admins unable to tell if onboarding was in progress or had failed.
Source : 4sysops
Read More
Microsoft has started automatically updating Secure Boot certificates on eligible Windows 11 systems with the January 2026 security update. The update replaces certificates that are set to expire in June and October 2026, ensuring devices maintain boot security and continue receiving critical updates. Learn what admins need to know.

Source : 4sysops
Read More
In my home network, I run a Graylog Syslog instance in Docker for logging network and Linux events. But you can also log events from PowerShell scripts to Syslog for easy filtering or correlation. In this blog post, I will show you how that works.

Read More
Next PostNewer Posts Previous PostOlder Posts Home