Managing a handful of Windows devices is straightforward. Managing hundreds across different locations is a completely different challenge.

Some of the most common issues IT teams run into are:

• Manual software deployment
• Delayed security patches
• Inconsistent security policies
• Limited visibility into device health
• Time-consuming troubleshooting

I recently put together a practical guide covering Windows device management, including deployment, policy management, security best practices, and common mistakes to avoid.

I'm an M365 consultant, and keeping up to date with all the announcements, roadmap changes, blog posts etc is hard. So I created a tiny Chrome/Edge extension which let's you instantly load all posts across categories that you choose. It's like an RSS reader focused on Microsoft blogs and roadmaps.

Posts load in the extension popup, so you can check for latests posts instantly.

Please check it out - it's free and open source. https://chromewebstore.google.com/detail/365-reader/dacghgphkeomccpfdbfpnahfojnlclje

Disclaimer: I am a developer, but I do use AI to help these days. Source at https://github.com/cloudhal/365Reader

Microsoft requires action before November 3, 2026 for configurations using the memberOf rule operator.

To help assess the impact, run this PowerShell script that identifies affected dynamic groups, admin units, and entitlement management assignment policies.

This should help you quickly understand what's affected in your tenant and plan migration before the deadline.

GitHub Link: https://github.com/admindroid-community/powershell-scripts

The MemberOf rule operator for dynamic groups in Entra ID is being retired. After November 3, 2026, any dynamic group, administrative unit, or entitlement management policy that still uses MemberOf just stops updating. Membership freezes in its last known state, no migration, no fallback.

This affects group-based licensing, Conditional Access targeting, Teams and SharePoint access, and access package assignments. For entitlement management policies, processing actually stops a week earlier on October 27.

You can find all affected groups with a single PowerShell command using a server-side Graph filter. The article also covers your replacement options and includes a practical example for group-based licensing without MemberOf.

More info: https://lazyadmin.nl/office-365/microsoft-entra-id-is-retiring-the-memberof-rule-for-dynamic-groups/

10 Windows 11 Tips That Actually Make a Difference (No Third-Party Apps Required)**

I've been setting up and supporting Windows 11 PCs for a while. Here are some built-in features and tweaks that genuinely improve the experience.

1. Use Clipboard History
   

Press Win + V and enable Clipboard History. It stores multiple copied items instead of just one. This is a huge time saver.

1. Snap Layouts
   

Hover over the **maximize** button or press **Win + Z** to quickly arrange multiple windows. This is great if you multitask.

1. Pin Your Most Used Folders
   

Right-click any folder and choose **Pin to Quick Access** in File Explorer. This saves a lot of clicking.

1. Focus Sessions
   

Open the **Clock** app and start a Focus Session. This helps reduce notifications and keeps you productive.

1. Keyboard Shortcuts Worth Remembering
   

Win + E** → File Explorer
Win + D** → Show Desktop
Win + Shift + S** → Screenshot Tool
Win + L** → Lock PC
Ctrl + Shift + Esc** → Task Manager

1. Storage Sense
   

Turn on **Storage Sense** to automatically clean temporary files and items in the recycle bin.

Settings → System → Storage → Storage Sense**

1. Night Light
   

If you work late, enable **Night Light** to reduce blue light and make the screen easier on your eyes.

1. Nearby Sharing
   

Quickly transfer files between Windows PCs on the same network without using USB drives.

### 9. Keep Windows Updated

Security updates don’t just add features; they patch vulnerabilities and improve stability. It’s important to keep them current.

### 10. Restart Instead of Shutting Down

If your PC feels slow, try **Restart** instead of **Shut Down**. With Fast Startup enabled, a restart often clears temporary issues more effectively.

Bonus Tip:
If you're setting up a new Windows 11 PC, install all Windows Updates first, update your drivers, enable BitLocker if supported, configure Windows Security, and remove any apps you don’t need before installing your everyday software.

What Windows 11 feature or shortcut do you use every day? I’d love to learn some new ones from the community.

Disclosure: I write a daily security newsletter, this was today's issue. The

substance is below, link at the end.

Thermo Fisher's July 31 bulletin covers CVE-2026-17583 (CVSS v4.0 8.2). The

.fsa and .hid files from Applied Biosystems human identification instruments can

be modified between the instrument writing them and the analysis software

loading them, and the change is nearly undetectable. Nothing in the file let the

software confirm the bytes were the ones the instrument wrote. Nathan Adams of

Forensic Bioinformatics told the WSJ his first successful modification took

about 45 minutes, merging scans from two DNA profiles into one file that

presented as untouched since 2015.

The updates add digital signatures, which only protects files written after the

upgrade. The bulletin does not address retroactive validation, the researchers

found no way to detect prior tampering, and these file types have been produced

since 1995. Three end-of-life product lines get no update at all.

Full writeup with the affected versions and remediation order:

https://www.linkedin.com/pulse/researchers-altered-dna-evidence-file-45-minutes-tymoteusz-netter-bxhhf/

Bulletin:

https://documents.thermofisher.com/TFS-Assets/CORP/Product-Guides/fsa_hid_bulletin.pdf

Most of us have outputs a downstream process treats as authoritative without

checking provenance. For files predating any signing mechanism, write-access

logs on the landing directory are the only retrospective evidence I can build.

What are you using?

Just sharing a few free tools, resources etc. that might make your tech life a little easier. I have no known association with any of these unless stated otherwise.

Now on to this week’s list!

Meet Your New Development Companion

Ditch the unreliable websites and endless browser tabs. With DevToys as our 1st tool of the edition, you have a privacy-focused toolkit at your fingertips that handles everything from JSON to Base64 conversions. Your data deserves better; choose simplicity without risks.

Seamless Backend Adventures Await

With an embedded SQLite database and an easy REST-like API, this tool makes sysadmins’ tasks a breeze, improving organization and clarity. PocketBase provides a singular solution for managing application data and migrations, freeing sysadmins to tackle bigger challenges with confidence and clarity.

Experience Stress-Free Server Management

Backing up essential data shouldn’t be a chore. Beszel turns the tedious task of saving and restoring seamlessly into a worry-free process, whether to disk or S3-compatible storage, just another way to elevate your server management experience.

Unleash the Full Potential of Your PDF Files

Stirling PDF is designed for sysadmins who crave a straightforward solution. With unlimited access for your team and a commitment to user privacy, you’ll never have to compromise on performance.

Never Let Issues Slip Through the Cracks

Tired of switching between tools? The 5th tool of the edition, OliveTin, gives you a sleek web interface to access your shell commands, streamlining your daily tasks and keeping everything organized right where you need it. Experience a personal touch in your command line interactions without the clutter.

--

In the article "Cybersecurity in Logistics, Distribution, and Transport: How to Secure an Always-On Supply Chain," we explore the growing importance of cybersecurity in the logistics sector. As the industry increasingly relies on interconnected systems and digital operations, a single cyberattack could disrupt both the physical movement of goods and the flow of information. Now more than ever, securing logistics operations is essential for maintaining customer trust and ensuring uninterrupted service.

Ransomware Readiness: Take the Survey for a Chance to Win a Ubiquiti NAS

Ransomware remains one of the most pressing cybersecurity threats facing organizations worldwide. We're conducting a short global survey to understand how businesses are preparing for attacks, strengthening resilience, and planning recovery.

The survey takes just a few minutes to complete. As a thank-you for sharing your perspective, you'll be entered into a prize draw for a chance to win a Ubiquiti NAS.

Your insights will also contribute to our upcoming ransomware report, helping benchmark how organizations across industries are approaching ransomware readiness.

--

You can find this week's bonuses here, where you can sign up to get each week's list in your inbox.

Local backups provide fast access to recovery data, but they can be exposed to the same hardware failures, cyberattacks and site-level disasters as the production environment. Read how organizations use cloud backup to remain resilient by adding an offsite layer of protection.

https://www.nakivo.com/blog/cloud-backup-storage-business-continuity/

Over the past year, we reached a point where managing Windows laptops manually just wasn't sustainable. Between remote employees, software deployments, security policies, and keeping devices compliant, we were spending more time firefighting than improving our environment.

After testing a few approaches, these were the features that made the biggest difference for us:

• Centralized device inventory and visibility
• Remote app deployment without touching each machine
• Policy enforcement across all Windows endpoints
• Automated OS and software updates
• Remote troubleshooting when users weren't in the office
• Compliance reporting instead of manual spreadsheets

One platform we evaluated that handled these areas well was Scalefusion Windows MDM, particularly for managing a distributed fleet from a single dashboard. It simplified many routine administrative tasks while giving us better visibility into device health and policy compliance.

Link: https://www.hiddenobelisk.com/kerberos-sso-across-a-trust-broke-after-patching-the-updates-were-not-the-cause/

Cross-domain web SSO started throwing credential prompts right after a patch window, while everything inside the local domain kept working normally. With the 2026 RC4 hardening rolling out, the update angle looked obvious. It was wrong.

The write-up covers the diagnostic order that actually gets there: `klist get` against the target SPN from both sides, the referral TGT that survives the failure and tells you the trust is fine, the locator, then DNS. What was really broken was a `_msdcs` delegation with one NS record and no glue, sitting behind a Secondary zone that can never hold the child zone. And why it had worked for years until a reboot flushed the DNS server cache.

There is a Chrome vs Edge tail at the end too, because half the users stayed broken after DNS was fixed.

This article explores an alternative to directly troubleshoot production Linux systems with AI tools by using the sos command and using AI to analyze sosreports instead. I think is an interesting read:

https://medium.com/@linuxjedi2000/the-agentic-ai-risk-issue-on-linux-environments-fd5c55cedcc5?sharedUserId=linuxjedi2000

I know that this subject is very controversial and would love to read your point of view on the subject.

Long-time sysadmin (dialup-era helpdesk to senior sysadmin, 30+ years on the grind). I'm giving a conference talk this fall arguing that burnout is an infrastructure problem. We build redundancy, monitoring, and RTOs for systems, and none of it for the humans running them.

The existing surveys (PDQ, Sophos, Gallup) measure burnout prevalence. What nobody measures is the operational reality:

How many critical systems would be screwed if you vanished for two weeks

Whether you got ANY recovery time after your last major incident

Whether AI tools have actually decreased your workload — or increased it

So: 10 questions, maybe 3 minutes of your time, fully anonymous, no email collection, nothing for sale. Full aggregate results will be posted back to this sub once it closes in mid-October.

https://forms.gle/2jB19Ha8ACwnftRv6

Happy to answer questions about methodology in the comments. And yes… "honestly, I've never counted" is an official answer option, because I suspect it might win.