Field notes
Shorter write-ups, lessons learned, and the odd war story.
- Field notes
Field note: a fake CEO email, a clean purge, and the leftover hybrid connectors it turned up
A CEO-impersonation email reached five people at a small Microsoft 365 shop. The purge had gotchas, and the message trace exposed connectors to a dead Exchange server.
- Field notes
Field note: the laptop that hung on every boot device, and the dead M.2 behind it
A work laptop hung in Windows, in recovery, on a USB installer, and in Clonezilla. The BIOS still opened, so it looked fixable. The M.2 drive had died and taken the PCIe bus with it.
- Field notes
Field note: replacing a public folder with a shared mailbox, without changing the address
A public folder's contents went out to a PST and into a new shared mailbox, and the old address moved across with it. Here's the order that worked and what to check before you start.
- Field notes
Field note: the Motorola Flex launcher that "crashed" with exit code 0
The Flex (formerly Spillman) client launcher flashed for five seconds and vanished on one PC, and two reinstalls changed nothing. It wasn't crashing at all. The PC was missing a second product that every working PC had.
- Field notes
Field note: auto-disabling inactive AD accounts, and why the first run was report-only
An audit wanted inactive accounts disabled automatically. The first dry run flagged 65 accounts, including a domain trust account and a pile of VPN accounts that were rarely used but very much needed.
- Field notes
Field note: a screen lock GPO with an exemption group, and the Kerberos ticket that has to come first
An audit required a 30-minute screen lock on every domain PC, except the dispatch consoles. Linking the GPO at the domain root with a deny for an exemption group worked, but only after the exempt machines picked up their new group membership.
- Field notes
Field note: the desk phone that could call out but never rang
A SIP phone showed Registered and placed calls fine, but incoming calls never reached it. The firewall was quietly forgetting the phone's NAT session after 40 seconds.
- Field notes
Field note: the whole building's clock was 20 minutes off
Every PC in a building drifted because the domain controller handing out time was trusting its own failing hardware clock.
- Field notes
Field note: two Microsoft 365 accounts for one person, and two different fixes
Directory sync left a user with a duplicate account twice, in two different shapes. Here's how to tell which shape you have and how each one was fixed.
- Field notes
Field note: MFA blocked our mailbox migration tool, and a one-letter typo did the rest
A small business moving its mailboxes into a partner's Microsoft 365 tenant hit two snags. The migration tool couldn't get past MFA, and two mailboxes failed on a misspelled domain.
- Field notes
Field note: OneDrive stuck on the sign-in screen
OneDrive kept hanging on its sign-in window and crashing. The usual cache resets weren't enough; a full uninstall and a sign-in started from the web was.
- Useful scripts
Field note: a nightly export broke after a file share move, and error 1202 was why
A scheduled script that exported accounting data to a mapped drive stopped working after the office's file shares moved. The cause was a stale remembered drive mapping, and the first fix made it worse.
- Field notes
Field note: a dying Switchvox appliance, a Hyper-V rebuild, and the 32-second drops that weren't the hardware
A Switchvox box with a failing network port got moved to a Hyper-V VM in an afternoon. The calls kept dropping at 32 seconds anyway, and a packet capture showed the real cause was one empty setting.
- Field notes
Field note: an antivirus update broke a server, and its copy too
A bad antivirus update left a server unable to boot, and the physical-to-virtual copy made for safety had the same problem. A lesson about what copies do and don't protect.
- Field notes
Field note: clearing more than 60,000 blocked IPs across 13 phone systems
What I learned clearing years of accumulated blocked-IP lists from a fleet of on-prem phone systems, from crashed web interfaces to a browser quirk that quietly slowed everything down.
- Field notes
Field note: the internet problem that was really a cable TV booster
An office's internet kept dropping packets after a speed upgrade. The culprit was an old cable TV signal booster sitting in the line. A good reminder to look at the physical path.
- Field notes
Field note: the domain controller that couldn't take a new partner
The plan was simple, add a new domain controller and retire the old one. An old replication setting nobody had thought about in years stood in the way.
- Field notes
Field note: bringing a virtual server back after its storage died
When a storage array failed, one virtual server wouldn't start. The virtual disk was fine. The problem was a corrupt saved state, and the fix took minutes once we saw it.
- Field notes
Field note: chasing a network loop across a multi-story building
A network loop kept knocking things offline. Loop protection didn't stop it. Tracking a single MAC address switch by switch finally did.
- Field notes
Field note: why one user kept getting locked out
A user's account kept locking, over and over, with nothing wrong on her end. The cause was a password spray, and how the directory checked those failed sign-ins.
- Field notes
Field note: the remote desktop user who kept getting kicked off
It looked like a flaky VPN. One number in the Windows event log, disconnect reason code 5, pointed somewhere completely different.
- Field notes
Field note: the SQL server that "crashed" every night
A database kept going down overnight and needed a manual restart every morning. The logs said it wasn't crashing at all. Here's what was really going on.
- Field notes
Field note: the "dying" SSD that wasn't
A server's health report said its SSDs were nearly worn out, and its RAID array was degraded. Neither turned out to be what it looked like.
- Field notes
Field note: "This username may be incorrect"
A user couldn't sign in to Microsoft 365 with her own email address. Years of account changes had left her sign-in name and email address pointing different directions.
- Field notes
Field note: VPN users could reach one network but not the other
Everything on the VPN side checked out. The missing piece was a single return route on a second firewall, so replies went nowhere.
- Field notes
Why this site exists
Small offices run on one IT person or a contractor who drives in. This site is written for them.