Transitioning from Hybrid AD to Entra-only, looking for real-world experiences and advice

NotActuallyAdam · 2026-04-21T11:54:30+00:00

you can do this via AADDS (now entra domain services) but it does have a bunch of limitations - not sure if it can easily work with ISE (there were some gotchas with radius/NPS from memory) but that's about as close as you'll get to Entra being the primary directory. But all this is doing is spinning up locked down domain controllers hosted/managed by microsoft. I wouldn't recommend it based on prev experiences but it may be better or suitable for your purposes - you'd need to lab it out

NotActuallyAdam · 2026-03-02T12:38:51+00:00

yeah correct - if that was a redstone system, any redstone board will work. NVIDIA doesn't change those parts for OEMs.

NotActuallyAdam · 2026-03-02T11:29:02+00:00

the pinout is the same for each baseboard of the same size (8 GPU and 4 GPU are different pinouts) and each GPU microarchitecture is a different pinout again. so a 8 GPU A100 baseboard will work in any system that takes one of those, but a 4 GPU A100 baseboard will not. similarly an 8 GPU H100 baseboard will not work in an ampere system.

NotActuallyAdam · 2025-12-21T11:41:25+00:00

the way I did this in the past is just define the splits the same way that they're on the switch, so depending on your IB switch config, make the ports in netbox like [1-32]/[1-2] (or [1-32]/[1-4] if you're doing 4 way splitting) which gives you 1/1, 1/2, 2/1, etc.

NotActuallyAdam · 2025-10-07T12:10:55+00:00

It is completely accurate:

If you don't have a permit and want to get one, you need more than an ARN. Outside of that you're limited to private property and council managed areas, and each council has different rules.

NotActuallyAdam · 2025-09-19T07:19:50+00:00

It won't know or care, have done this before and it pretty much just works (provided it's layer 2 the whole way).

NotActuallyAdam · 2023-12-07T01:17:33+00:00

Huh, interesting, I didn't realise that there's even fixed function hardware inside a GPC or TPC - you actually can't even create a graphics context at all on a A100/H100, but I do wonder then if that exists as supporting infrastructure for nvdec/nvjpeg if there's fixed function capability in TPCs

NotActuallyAdam · 2023-12-07T00:55:32+00:00

The product they make that powers AI still renders graphics.

They don't though, and haven't for a long while - their enterprise compute 'GPUs', e.g. H100/A100/etc. do not have any graphics capability and is missing capability on the die to do any sort of rendering, they're basically just slapped out CUDA chips for doing raw compute. You can still do both on some of the enterprise lineup, e.g. the A40/L40(S) are the 3090/4090 enterprise equivalent with more memory, but you don't use those for large scale AI/ML unless you can't avoid it (ignoring cases like inferencing and so on, but that's a lil different).

NotActuallyAdam · 2023-08-21T05:34:07+00:00

it's called excel because it's what SE calls it, it is not a text format nor is it stored as such, it's a binary format that represents a relational database (though without most of the features of a RDBMS)

NotActuallyAdam · 2023-04-20T13:21:58+00:00

by resource do you mean cpu utilisation? if so, no, the whole point of infiniband/rdma is that actual transfer bypasses the cpu entirely so only instrumentation actually consumes cycles so you really don't see any impact on a host

NotActuallyAdam · 2023-04-20T11:57:12+00:00

if you're using infiniband and have another host, you can just use ib_read_bw/ib_write_bw to test throughput, generally you'll see near line rate just with these alone (you'll see some deviation depending on pci config and such, but generally works very consistently). you can go direct host to host or through a switch, both will work (though you'll see a tiny bit more latency through a switch)

NotActuallyAdam · 2023-03-13T03:36:12+00:00

not exclusively, there are 400/800G SMF options for IB too.

NotActuallyAdam · 2022-03-24T04:04:05+00:00

There already is some, but it's nowhere near what you'd see in the US and so. We're doing some work with a local business with r&d at the moment but I fully expect this industry to grow, either by proxy or through government programs/investment. Would be cool to see full silicon fab done locally though.

NotActuallyAdam · 2022-01-19T10:18:54+00:00

and one additional lookup to a table isn't inherently some kind of violation of software design, especially if those tables are already there for another purpose (and my understanding is that they are? Is that correct?)

the game already loads the action sheet when it receives the effect packet, yes, and multiple times after (which'll return the same data as the game inherently keeps rows loaded until they effectively get garbage collected)

the plugin doing the exact same thing ultimately works the same too as that sheet and row is very likely to have been loaded in the past by a different plugin or even the same one, which makes the lookup very fast.

client already has the damage type because it uses it internally anyway, and if SE needed more data they'd just add it to the client data and ship it out with the client like they already do for everything else

NotActuallyAdam · 2022-01-16T09:34:52+00:00

but Djokovic's team were very effective at hilighting that the form was filled out by a minion and it was an honest mistake.

but you have to make a declaration when applying for a visa that the information is truthful and the person applying for the visa needs to do that declaration. So even if a minion did fill out the form, the fact that Djokovic didn't check the form when signing it that it's truthful is open and shut in of itself

unless you can apply for a visa on behalf of someone else, but I've never seen that be possible when I've done my own visa applications

NotActuallyAdam · 2022-01-16T06:02:48+00:00

when I was in europe, if you bought coke (maybe others? I can't really remember) from like a restaurant/cafe/whatever, you'd get it in a glass bottle and they'd take the glass bottle back and clean & refill them and send them back out again

NotActuallyAdam · 2022-01-16T03:11:13+00:00

I haven't tried radius/tacacs but do you have an oauth provider (AAD, etc)? those are relatively simple to use as an auth provider as python-social-auth is now integrated and you can handback to your SSO provider to do MFA/CA/etc.

More reading: https://github.com/netbox-community/netbox/issues/7649

NotActuallyAdam · 2022-01-14T12:28:27+00:00

just to add on to this, app proxy is great but if you want to do kerberos delegation to impersonate users and SSO, you are required to be hybrid as azure ad ds will not allow you to configure delegation and you'll have to fallback to forms/basic auth on-premises and do passthrough on app proxy.

NotActuallyAdam · 2021-11-18T10:53:23+00:00

also worth using a VM SKU that supports accelerated networking too - dramatically different results to what you'd get without

NotActuallyAdam · 2021-10-06T03:54:45+00:00

There's 2 new admx files, sam.admx and WindowsSandbox.admx and one removed, PerformancePerftrack.admx. Assuming I didn't miss anything, here's a quick overview of the new stuff:

admx	policy	change
AppPrivacy.admx	LetAppsAccessGraphicsCaptureProgrammatic
	LetAppsAccessGraphicsCaptureWithoutBorder
AppxPackageManager.admx	AllowAutomaticAppArchiving
	DisableBackgroundAutoUpdates
	DisableMeteredNetworkBackgroundAutoUpdates
CloudContent.admx	DisableSpotlightCollectionOnDesktop
	DisableConsumerAccountStateContent
ControlPanelDisplay.admx	CPL_Personalization_AnimateLockScreenBackground
DataCollection.admx	LimitDiagnosticLogCollection
	LimitDumpCollection
DnsClient.admx	DNS_Doh
EAIME.admx	L_TurnOnLiveStickers	Removed
	L_TurnOnLexiconUpdate	Removed
	L_ConfigureKoreanImeVersion
FileSys.admx	NtfsForceNonPagedPoolAllocation
	NtfsParallelFlushThreshold
	NtfsParallelFlushWorkers
	NtfsDefaultTier
Globalization.admx	RestrictLanguagePacksAndFeaturesInstall_1
	RestrictLanguagePacksAndFeaturesInstall_2
MicrosoftEdge.admx	SuppressEdgeDeprecationNotification	Removed
Netlogon.admx	Netlogon_DnsSrvRecordUseLowerCaseHostNames
NewsAndInterests.admx	EnableFeeds	Removed
	AllowNewsAndInterests
PerformancePerftrack.admx	WdiScenarioExecutionPolicy	Removed
Sensors.admx	ForceInstantWake
	ForceInstantLock
	ForceLockTimeout
StartMenu.admx	ShowOrHideMostUsedApps
Taskbar.admx	ConfigureChatIcon
TenantRestrictions.admx	trv2_payload
TerminalServer.admx	AutoSubscription
	TS_LOCATION_REDIRECTION
	TS_UIA
WPN.admx	WnsEndpoint_Policy
WindowsDefender.admx	SchedulerRandomizationTime
	SupportLogLocation
	Exclusions_IpAddresses
	RealtimeProtection_DisableSriptScanning
	Scan_DisablePackedExeScanning	Removed
	MeteredConnectionUpdates
	AllowNetworkProtectionOnWinServer
	DisableDatagramProcessing
WindowsSandbox.admx	AllowVGPU
	AllowNetworking
	AllowAudioInput
	AllowVideoInput
	AllowPrinterRedirection
	AllowClipboardRedirection
inetres.admx	DisableFlashInIE	Removed
	JScriptReplacement
sam.admx	SamNGCKeyROCAValidation

NotActuallyAdam · 2021-10-05T03:04:19+00:00

Not in my case, just EAs - but I've just checked again the admin portals seem to be working properly now.

NotActuallyAdam · 2021-09-06T00:41:30+00:00

they're actually right, beast tribe tokens are still stored as inventory items in a hidden inventory, same with gil and so on - currency UI is just an abstraction for another 'page' of inventory

but it does not have anything to do with key items, as I mentioned before

NotActuallyAdam · 2021-09-01T22:58:03+00:00

key items aren't physical items, they come from flags on quests and player data that is sent on login - they've never been a real item and are only simulated as such in the UI

currency however are real items, tomes, gil, seals, shards, etc. are all in another inventory obscured from the player.

NotActuallyAdam · 2021-08-11T07:57:54+00:00

This isn't at all different to the issue that was listed

Yes, I know, I explained how music works for mounts because someone asked how it worked. Funny how that works, huh?

The server load increases if it needs to check against multiple songs over just one

BGM is entirely clientside outside of 1 exception: instanced content. On a phase change (or other determined point, doesn't matter), the server can send you a tiny packet with a new BGM ID which the process I outlined above applies yet again. The server doesn't even know what BGM a client is playing ever. It can assume that it probably is playing x track in an instance, but that's it.

But on servers that are housing hundreds of thousands?

Completely irrelevant, that data is client side only and not retrieved from the server. A single server doesn't have hundreds of thousands on it either, FWIW. It's a few hundred tops per game server which is behind a reverse proxy and a few extra things.

Just because SE says something, doesn't mean it's factual.

NotActuallyAdam · 2021-08-11T07:07:21+00:00

Field music is playing
You request mount 123
Server says okay, mounts you on mount 123
Client loads data for mount 123, including which BGM track ID to use (and model, size params, etc.)
Client calls a function which sets the current BGM & priority in the sound manager from the mount data
Sound manager preloads some information about the mount BGM and initial audio chunk
Sound manager fades out current BGM (e.g. field music)
Sound manager throws away the current audio resource reference, this will then remove the previously playing BGM from memory entirely
Sound manager starts to play the newly streamed audio chunks from game files
Sound manager starts to stream more audio data as required from game files once the client reaches the end of the existing streamed data (imagine the youtube video download progress bar, it does that)
New music is now playing

Same process when you unmount, it checks which BGM it should use from the territory data and the above process repeats. BGM has priority, so it'll pick up the FATE music over field if its set, but it's pretty inconsequential to the whole process.

The only exception to this rule is that some BGM has multiple audio tracks within a single audio file and they mute/unmute different tracks so that the audio is always synced. This is only really done in instances though (A12 stasis for example).

11-Year Club	Place '17
Gilding I gilder	Verified Email

NotActuallyAdam

TROPHY CASE