IT Weekly Review: Verify Domain Sign-in, Exchange Patches and SQL Import Permissions

The week of September 28 to October 4 puts three specific checks on the operations calendar: domain sign-in after a Windows feature update, the revised security update level of on-premises Exchange, and the privileges used by SQL Server import jobs on Linux. The useful distinction is between installing a package and accepting the resulting behavior. A successful installer does not exercise a domain trust, prove that the latest security revision is present, or establish that a service account has only the permissions its workload needs.

Microsoft made Windows 11, version 26H2 available on September 29. Its release-health guidance, checked on October 4, describes a domain-trust issue involving previously configured Machine Identity Isolation. Affected clients can lose their secure channel to on-premises Active Directory while cached offline sign-in still works. Microsoft explicitly separates this from domain-controller replication and AD service health. The operational risk is therefore easy to miss if acceptance consists only of rebooting a pilot laptop and signing in with cached credentials.

Before expanding a deployment ring, check whether Machine Identity Isolation was configured and whether the domain meets its documented prerequisites. Use a representative online domain sign-in and test access to the services that rely on that trust. If the documented issue applies, follow Microsoft's current mitigation through the management mechanism that owns the setting; do not scatter registry changes across the estate. Record the effective policy and the test result with the device's build. Release-health guidance evolves, so review it again at the actual change window.

On October 2, the Exchange team published version 2 of the September 2026 security updates. The release covers Exchange Server Subscription Edition and, for enrolled customers, Exchange Server 2016 and 2019 under the Period 2 ESU program. It adds coverage for CVE-2026-96940 compared with the original September release. A September patch record alone therefore cannot establish that the revised update is installed. Exchange Online is already protected against the vulnerabilities covered by these server updates; locally retained Exchange servers and management-tools workstations still need attention.

Treat this as a targeted inventory and maintenance task. Match each local Exchange installation to its supported branch, entitlement and applicable update, then use the vendor's installation guidance. Afterward, verify the installed revision and exercise mail flow, administration and the hybrid functions actually in use. Keep the pre-change configuration and a recovery plan appropriate to that server. The important acceptance record is the resulting build plus working service paths, rather than a generic statement that the monthly patch cycle ran.

Microsoft's October 1 announcement brings bulkadmin support on SQL Server for Linux to general availability with SQL Server 2025 CU9 and SQL Server 2022 CU27. The bulkadmin role and ADMINISTER BULK OPERATIONS permission provide a narrower basis for bulk imports than assigning sysadmin to the importing identity. Earlier documentation already described preview support in older cumulative updates; this week's announcement is the general-availability milestone, not the first appearance of the capability. SQL permissions and Linux access to the import file remain separate checks.

Review scheduled import jobs that still run with broad server privileges. In a representative environment, identify their complete workload before changing grants: reading the source file, loading the intended table, handling malformed input and any follow-up procedures. Test with the intended reduced identity, including an expected refusal outside its approved scope. Filesystem access must be granted to the actual SQL Server process as required, not opened indiscriminately. Removing sysadmin is a useful outcome only when the ordinary job still succeeds and unrelated operations remain unavailable.

For the next change window, choose three concrete acceptance records: a live domain sign-in for the Windows pilot, the applicable Exchange V2 build with working mail paths, and a SQL import under reviewed privileges. These are separate changes with different urgency. Keeping each test tied to the relevant system and identity makes the weekly review actionable without turning every vendor announcement into an estate-wide rollout.