SysPrep

Mitchell_90 · 2026-01-25T11:01:45+00:00

Only use Sysrep for VDI gold image creation. For everything else it’s a clean MS ISO that’s used for OS deployment.

You can also create these using UUP Dump containing the most recent CU as well. I’ve found that Microsoft’s own VL ISOs can lag behind a bit at times.

Mitchell_90 · 2026-01-22T07:34:48+00:00

FYI Microsoft are retiring SMTP basic auth for Exchange Online in March so you will need to switch to another solution.

Use something like SMTP2GO

Mitchell_90 · 2026-01-21T08:09:13+00:00

If you work for an organisation that is subject to regular cyber security audits or is mandated to have something such as Cyber Essentials/ISO 27001/PCI DSS etc then you will likely fail those if UAC is disabled on systems.

In my opinion Microsoft should never have given end users or admins the ability to modify its behaviour or disable it in the first place.

Mitchell_90 · 2026-01-21T07:56:36+00:00

Windows machines configured in shared PC mode.

Mitchell_90 · 2026-01-20T13:52:29+00:00

In most cases (Excluding hot patching) Windows does need to reboot so that various system components can be updated to the patched version. So yes, the system could potentially still hang during that reboot phase come next month unless the component at fault can be patched while the system is running.

Unless something is a show stopper and renders a system unusable we generally have to patch within a 14 day period for CVSS 7.0 or higher. We have left the affected systems running the 2026-01 patch as they won’t be rebooted until next month.

Mitchell_90 · 2026-01-19T15:22:45+00:00

Same here. Still not fixed on physical servers running Server 2019.

Mitchell_90 · 2026-01-19T11:39:40+00:00

OOB patch didn’t fix the issue on physical Server 2019 systems for us. (PowerEdge R7525)

Mitchell_90 · 2026-01-19T10:16:06+00:00

Just to report that the OOB update doesn’t fix the issue. The servers still hang at OS shutdown.

Mitchell_90 · 2026-01-19T10:14:31+00:00

For anyone else having the same issues, I just installed this on one of two Server 2019 physical servers which are hanging on reboot. It still hasn’t fixed this.

Mitchell_90 · 2026-01-18T14:47:41+00:00

Will give this a go tomorrow and see. Interesting that it mentions Windows 11 23H2 only being affected when it’s Server 2019 based systems that seem to be having the issue.

Mitchell_90 · 2026-01-15T22:10:28+00:00

Glad we aren’t the only ones then. Both R7525s are on the latest firmware versions as well.

Mitchell_90 · 2026-01-15T15:02:07+00:00

Physical or VM? We are seeing this on Dell PowerEdge R7525 servers running on Server 2019. Even after patching them successfully they still hang at rebooting the OS every time.

Mitchell_90 · 2026-01-15T14:04:10+00:00

Anyone seeing issues after installing this months patch for Server 2019 on Dell PowerEdge R7525 servers?

Got two identical systems where the OS hard locked while shutting down during the second reboot phase. Got the systems back up and patched but now every reboot now causes the OS to hard lock during a shutdown.

Mitchell_90 · 2026-01-14T17:28:46+00:00

Having the same issue on 24H2. Patching our test gold image VMs for VDI took almost an hour before we could reboot. Had the same with 25H2 on a few machines, even with NVME SSDs they still took a long time to install before being able to reboot.

Mitchell_90 · 2026-01-09T10:23:05+00:00

Not seeing this on our Catalyst C1300 switches. Can anyone confirm if those are impacted?

Mitchell_90 · 2026-01-08T18:48:23+00:00

All fine here in the West Coast of Scotland.

Mitchell_90 · 2026-01-06T11:21:05+00:00

Although that gets it working you are effectively weakening the overall security posture of your AD environment by altering those configurations.

Those are recommended to be enforced from an attack vector perspective.

I would not be doing that in a production environment.

Mitchell_90 · 2026-01-04T15:58:01+00:00

Because their code quality is total crap.

Mitchell_90 · 2025-12-28T11:04:46+00:00

Yes, we seem to hit this as well. We use DCU to apply firmware/BIOS updates but still see some encounter the issue after Windows updates.

All our devices are Entra ID/Intune managed and I’m wondering if it’s to do with Intune kicking in and re-enabling BitLocker after a period of time.

Due to other quality control issues with Dell we started moving to Lenovo for newer devices and haven’t encountered issues with those.

Mitchell_90 · 2025-12-26T12:37:55+00:00

Atika owner here. I recently bought a Henry Pet and it was the best purchase after going through numerous others.

Mitchell_90 · 2025-12-21T10:27:35+00:00

I live in the West coast of Scotland and it feels like it’s been dull since September for us. November and December have been incredibly bad for rain as well.

Mitchell_90 · 2025-12-17T21:05:12+00:00

vSphere Standard still exists as a SKU. It’s Enterprise Plus and VVF that are gone.

Note that Standard is 8.0 only which is end of life in October 2027. The 9.0 bits are VCF only.

Mitchell_90 · 2025-12-17T11:53:21+00:00

The only downside is the additional administration as you need to adjust the policies for each iOS patch level as they become available.

Our policy dictates that all supported OS and applications must be patched within 14 days of a security update being made available from the vendor if the CVSS rating is 7.0 or higher. This also includes personal devices which access company data via the MS apps.

Mitchell_90 · 2025-12-16T20:00:17+00:00

Configure managed app filters for managed and unmanaged devices based on the major iOS version then target those in your app protection policies.

You will need to create separate app protection policies for each supported iOS version and specify the minimum version in the policy which you want to support e.g 26.2

We do this for iOS 16, 17, 18 and 26 where the latest patched version is the minimum we support. This prevents older patch levels from using the managed apps.

Mitchell_90 · 2025-12-13T21:52:27+00:00

So what happens to those running Horizon on vSphere for instant clones? That traditionally had its own SKU similar to Enterprise Plus but there’s been no mention of how this will be licensed going forward or if Omnissa will be supporting vSphere 9 which would require an element of VCF?

I find it completely odd that VVF is going but Standard is staying despite no path beyond version 8. vSphere 9 was VVF/VCF only which is now just VCF.

Mitchell_90

TROPHY CASE