SysAdmins Drowning in Permissions & Complexity

“Generally - simplicity where at all possible (no sub-site permissions, manage access to sites by group membership). Identify the business owners responsible for any given site - they are also responsible for regular access reviews (potentially delegated to whoever they want). And as much as possible, document out RBAC per job role as well as your role change process. In a perfect world, permissions are dictated simply by job role, and access reviews are a "just in case" item.”

“Hi everyone, I’m working in a Windows Active Directory environment and recently came across the use of administrative shares such as: \\PC-001\C$ \\PC-001\ADMIN$ I understand these are built-in Windows administrative shares and can be accessed by users with the appropriate admin privileges. I’m curious how others handle these in production environments: Do you leave C$ and ADMIN$ enabled by default? Do you restrict access using Windows Firewall, GPO, or other controls? Do you monitor access to t”

“You don’t have anything to worry about. You could run AD with a functional level of 2016 if you wanted to. We have a mixed environment too and have turned off LDAP encryption on a specific Domain Controller specifically so a legacy system can still authenticate to it. The m running all domain controllers server core 2025 with 2016 functional level zero problems my shit is way older than your stuff”

“Hello all. This is more of an exploratory post. I'd like to ask you all if you could take a minute to share some specific aspects/answer some questions about your experiences in a topic I don't see mentioned often around here. Without further delay: - are you using OpenLDAP as directory service and main source of truth? - are you using the default schema, a fully custom schema or a mix? - are you also using active directory in any way, and how? (Samba 4, Windows server...) - are you sync”

“I am not that tech. I am running a check on NTFS / AD security groups and file permissions on server share. We don't assign users to folder permissions, we only assign groups. Over time (years) staff get promoted and become part of a group where shouldn't be able to see priv'd information before a certain point in time. This happens rarely, but I wonder what people do to keep the permissions and groups clean: - Bob works in dept x. - Dept X has docs folder \xTeam\ \xTeam\Appraisals -”

“Hi All, My place of employment relies heavily on Microsoft Active Directory. (AD) We have systems that synch with Active Directory for various purposes, including picking up changes to our RBAC (Role-Based Access Control). The teams that support those apps that 'talk' to AD are now finding it challenging to make changes and support their system through updates because we lack an effective 'mirror' of our Active Directory domain as a 'Test' equivalent. We've created po”

“Been stuck on this at work all day so figured I'd throw it out there and see if anyone has any ideas. I work IT at my company and I was stuck troubleshooting my own printing issues for several hours today (with no resolution). I had to set up a new computer for myself, mapped the printer, (my printer I have to map using IP) pulled the drivers, and attempted to print and nothing happened. Checked the mapping, checked the driver, bounced the spooler, tried again and got nothing. Fully removed”

“Can anyone suggest a product that allows me to easily contrast and compare the Sharepoint permissions over several sites between users? I have an environment that has a combination of groups and individual permissions, and I'm looking to try and tidy this up. In the meantime I am fielding requests like, "Give UserA the same Sharepoint permissions as UserB." While the groups are easy enough, the individual permissions seem a lot harder to track down. submitted by /u/Agit”

“Hi, I got a report for the issue where participants got kicked out of the Teams meeting with the message “Someone has removed you from the meeting”. I checked audit logs in Purview but I couldn't find any clues. I opened a ticket with MS and I was told not only the meeting organizer but also the participants can remote other participants and they don't have the logs about who does it. They also don't have the Teams policy that can control who can remove the participants. That is dang”

“Hi Everyone We are about to embark on a Network Drive migration to SharePoint Online but i need to find a location (will stay on the Network Drives temporarily) for about 3.5TB worth of Photos. If SharePoint wasn't expensive, i'd use that - but i was hoping there was something out there that is 1) Cloud based 2) Decently priced and 3) Supports Entra SSO so users don't need to have a separate set of credentials to access it. Any ideas would be appreciated submitted by /u/d”

“Anyone else deploy a server and use a 25gb AOC for the iDRAC connection because you dont want any copper runs in the rack? Before you ask im using an ocp nic port not the dedicated. submitted by /u/dude380 [link] [comments]”

“I'm looking for a way to allow standard users on Intune-managed Windows devices to request administrator privileges when they attempt to install software, without having to submit a help desk ticket. Ideally, the workflow would be something like: User launches an installer that requires admin rights. Instead of entering admin credentials, they're presented with a "Request Access" option. They provide a justification. IT can approve the request The installer is elevated without”

“Background: Running a file server as a staging ground to drop data ingests by a set of servers, process-massage the data into something cute and adorable, and then export off into the database of wonders and miracles called /dev/null The service account has full SMB access to the share to Read/Write/Delete the data and it's supposed to automagically remove post-process, and it does mostly until we get in these weird folders with a strange set of permissions and attributes that are completely”

“Hi Everyone, I tried to copy a folder with a large VHDX files from one server to another, same Windows Server 2025, and I accidentally copied the folder to the same location it was in. I hit cancel on the copy and started the copy to the correct location. It finished instantly which made me check if the disk was there. It was not, it was not anywhere actually. The original folder, the copied folder, the recycle bin, no where. Has anyone experienced this? submitted by /u/biggus_brain_”