SysAdmin Weekly #31: The "Supported" Install That Ate My Evening

"Supported" is a claim a vendor makes, not a promise the software keeps

TL;DR

• Rebuilt damned-near the whole lab on Windows Server 2025: WS2025 Hyper-V host, Debian guests, plus DC, CA, and fileserver VMs (all 2025).

• Homelabs are how you meet the newest version of the thing, and its rough edges, before a change window forces the introduction.

• The Take: “supported” is a claim a vendor makes, not a promise the software keeps; test the mainline path in the lab from time to time, not just the weird edge cases.

• Podcast episode 053: how to survive as a solo SysAdmin, with Eric Siron.

• Tool of the Week is Smallstep step-ca, an open-source internal CA that makes lab certificates a lot less painful than they were this month.

From the Console

I spent the last few weeks tearing my lab down to the studs and rebuilding (again) on Windows Server 2025. Hyper-V now runs the virtualization layer, and the part that still makes me grin is what sits on top: a stack of Debian VMs, right alongside a domain controller, a certificate authority, and a file server, all three of those on Server 2025 as well. Windows hosting Linux guests alongside the AD estate. That is the lab for now.

This is the whole reason any of us run homelabs. Not the rack lights. It is the one place you get to meet the newest version of the thing on your own terms, before a customer or a change window makes the introduction for you. Staying current is not a nice-to-have in this job; it is the job.

What do the “what’s new in Server 2025” posts skip? Labbing the new stuff does not just show you the new capabilities. It shows you which of the vendor’s own instructions (and docs) quietly do not hold. I went to stand up Windows Admin Center on that fresh fleet, the documented and supported way, and lost most of an afternoon to it. The supported installer walked right up to the certificate step and silently failed to bind the cert to HTTPS (amongst many other issues), on a clean box, following the official docs to the letter. Four hours, and about ten minutes of that was genuinely my fault. I am writing the full autopsy up as a blog post for AndyOnTech.com, so I will not spoil the ending here. The short version is the thread running through this whole issue: “supported” is a claim a vendor makes, not a promise the software keeps, and the lab is where you find that out on your own time instead of in production.

The latest on the SysAdmin Weekly Podcast

Episode: How to Survive as a Solo SysAdmin: Where to Start When You’re the Only One Topic: When you are the only person between a working business and total collapse, the job stops being about doing everything and starts being about deciding what not to do this week.

Why SysAdmin’s should tune in:

• It is a survival guide for the team of one: triage before projects, documentation as insurance, and buying your time back with automation and the right managed services partner.

• Ignore it and you burn out, or you get hit by a bus and the business finds out the hard way that everything important lived in your head.

• For anyone who got hired into, downsized into, or promoted into owning the whole environment

• Plus a News React on Windows Server hot patching and a Nerd Hour on Debian 13.6 Secure Boot certs.

Watch on YouTube

Listen on Spotify

The Take

Vendors publish a “supported path” for a reason, and we lean on it for a reason. It is meant to be the route that has been tested, documented, and blessed, the one you can trust when you do not have time to reverse-engineer the product. So here is the uncomfortable thing I got reminded of this week. Supported is a claim, not a guarantee. The documented, supported way to do a routine thing with Windows Admin Center quietly failed multiple ways throughout the installation / setup, and nothing in the process warned me or provided meaningful error messages.

When you are the solo or lean-team admin like the theoretical solo SysAdmin we discussed in this week’s featured podcast episode, you plan your maintenance windows around the assumption that the supported path works. You do not budget four hours to install a management tool the vendor says installs in twenty minutes. The exotic edge cases you already distrust, so you test those. It is the boring, supported, “this obviously works” step that sometimes surprisingly wrecks your evening, precisely because you had no reason to give it a second look.

So test the happy path, not just the weird one. The install everyone says just works, the migration the docs call routine, the failover you assume is fine because the vendor says “It’s fine… trust me bro”. Run it once in the lab before you run it live. Not because you are paranoid, but because “supported” and “actually works in your environment” are two different sentences, and the gap between them is your outage. I would rather find that gap in my basement or test/dec environment than in a change window with someone waiting on me.

Community Signal

James van den Berg - “Windows Admin Center 2511 and the Security of Windows Server” - Van den Berg is a long-running Microsoft MVP for Cloud and Datacenter Management, and this is a clean walkthrough of using Windows Admin Center to drive the Server 2025 security surface: OSConfig baselines for CIS and DISA STIG, Secured-core, TPM attestation, and VBS. What earns it the slot this week is that he tells you to test it in a lab before you point it at production. That is the exact reason my own lab exists, and it is a reminder that WAC, on-ramp gripes aside, is a genuinely useful console once it is running.

Florian Burnel / IT-Connect - “Debian 13.6 Is Out: Here Are the Key Changes” - Burnel is a Microsoft MVP for Cloud and Datacenter Management, and his rundown of the Debian 13.6 point release is a near-perfect illustration of this week’s whole point. Microsoft’s old UEFI Secure Boot certificate authority, the one that has quietly signed bootloaders for well over a decade, expired in June 2026, and Debian 13.6 ships the fwupd 2.0.20 update that rotates affected machines onto the Microsoft UEFI CA 2023 certificate before a future bootloader update leaves a Secure Boot box unable to start. Nobody signed up for “my certificate expired, so my server will not boot,” and yet here we are. If you run Debian anywhere in the estate, read this before your next kernel or shim update makes the decision for you; it is the exact terrain Eric and I walk through at Nerd Hour this week.

Tool of the Week

Smallstep step-ca - An open-source, online certificate authority with a built-in private ACME server, so your internal boxes can automate certificate issuance and renewal the same way the public web does with Let’s Encrypt.

If you have ever wanted TLS everywhere in the lab without hand-rolling OpenSSL commands or standing up a full ADCS deployment, this is the lighter path. It speaks ACME, so certbot, Caddy, Traefik, nginx, and cert-manager all just work against it, and it issues short-lived certs with automated renewal so you are not babysitting expirations. Honest scope: it is Apache-licensed and actively maintained, and it is aimed at DevOps and homelab use, not at replacing an AD-integrated enterprise PKI. There is no OCSP or CRL and no Active Directory Certificate Services integration, so if you need GPO autoenrollment and AD-authenticated templates, that is still ADCS territory. One caution: it has patched a run of provisioner authorization CVEs over the past year, so run a current release (0.30.0 or newer) and do not expose the SCEP endpoint if you are not using it. For a lab, or for internal service certs on a private network, it removes a lot of pain.

Quick Win of the Week

Take the last thing that cost you half a day of troubleshooting and write the ten-minute version of it. Not a polished KB article; the terse “here is what was actually wrong and here is the command that fixed it” note that your future self, or the next admin, will be desperate for at 2am. Drop it wherever your hit-by-a-bus documentation lives. The four hours are already spent; the only question is whether anyone, including you, ever gets those hours back.

Fun Retro SysAdmin Fact

Windows Admin Center did not start life with that name. Microsoft unveiled it at Ignite in September 2017 under the codename “Project Honolulu”. I was there and remember it! Microsoft pitched as the browser-based console that would finally pull the scattered MMC snap-ins into one pane of glass, and it ran under that codename all through the preview. It did not pick up the Windows Admin Center name until it went generally available on April 12, 2018. So the tool that ate my afternoon this week is only about eight years into carrying its real name, and apparently still working a few of the install-day kinks out of its system.

Until Next Week

Run the boring supported step in the lab once before you trust it in production. Remember…. supported and working are not the same sentence.

Stay Frosty,

SysAdmin Weekly