· A frontier AI model can be switched off worldwide in 72 hours, and not by you. Anthropic’s Fable 5 and Mythos 5 proved it this month.

· Clearly it’s not a Claude problem. It is a dependency problem, and it is the strongest case yet for owning the hardware your inference runs on.

· SysAdmin Weekly Podcast Episode 048 is out: the AI doom narrative held up against the actual data with Eric Siron.

· The WEF Future of Jobs numbers say net +78 million jobs by 2030, and the fastest-growing skill categories behind AI and big data are networks and cybersecurity. The work that keeps infrastructure running is on the growth side.

· Tool of the Week: Ollama, the second time around. Same recommendation as Issue 24, sharper reason to act on it now.

From the Console

I stripped my lab down a few weeks ago. Pulled the always-on gear I was not really using, consolidated a couple of roles onto hardware I trust to keep running, and rebuilt the rest with longevity in mind instead of raw horsepower. I expected to give something up for that.

Turns out…..I have not, in fact, given up something for those changes…. Everything I actually depend on is running as well as it ever did, and my power bill came back noticeably lighter. Turns out a lot of what I was running was running because it was already on, not because I needed it on.

Given the recent news about Anthropic… it makes me thing about something. Every box in that pared-down lab is one I control. It does not get a worse model pushed to it overnight. It does not get switched off because of a directive passed down from three companies upstream of me (or the US Government for that matter…). Those cases sounded like a philosophical point a month ago. This week it stopped being philosophical.

And now, back to our regularly scheduled programming.

The latest on the SysAdmin Weekly Podcast

Episode: 048 - The AI Doom Narrative vs the Data: Layoffs, Energy, and Jobs in 2026 Topic: Andy and Eric Siron take the AI fear stories one at a time, the layoffs, the data center energy and water panic, the “office workers are gone in eighteen months” predictions, and put each one next to what the actual data says.

Why this one matters:

· The WEF Future of Jobs numbers, the post-COVID overhiring correction, and the hyperscaler nuclear and cooling commitments, read against the headlines instead of in place of them

· What AI actually looks like at a SysAdmin’s keyboard versus what the press would have you believe it looks like

· Plus the nerd hour: Linus Torvalds on AI-generated bug reports drowning the kernel security list, Edge caught storing passwords in clear text, and a Forgejo and Restic lab cleanup

Listen on Spotify

Watch on YouTube

The Take

A model you build your work around can be turned off in three days, worldwide, and you will not be the one who decides it.

That is not a hypothetical. Anthropic released Claude Fable 5 to the public on June 9, with the wider Mythos 5 class going to a narrow set of partners the same week. By the evening of June 12, both were dark. Not deprecated, not rate-limited; switched off for every customer on the planet. The trigger was a US export-control directive barring access by any foreign national, and because nationality cannot be filtered on a live API in real time, the only way to comply was to pull the models for everyone. Anthropic’s own foreign-born staff included.

The part relevant for us mere-mortal SysAdmins? None of that had anything to do with how we were using the model. You could have had a clean, paid, well-behaved workflow built on it, and it would still have gone dark on Friday night because of a conversation between an executive and a cabinet secretary that you were not in.

And that conversation is its own story. The reporting says Amazon CEO Andy Jassy is the one who flagged the concern to Treasury Secretary Scott Bessent, citing Amazon researchers who got Fable 5 to cough up cyberattack-useful output. Amazon is Anthropic’s investor. Amazon is Anthropic’s cloud host. And Amazon, this week, is the party that walked a competitor’s three-day-old model release into a regulator. I am not going to tell you what to read into that. I am going to tell you those three roles sitting in one company is exactly the kind of thing you want to know about when it comes to the supply chain under your tooling.

To be fair to Anthropic, they pushed back on the severity, noting the same capabilities are already reachable through other public models, and Opus 4.8 and Sonnet kept running the whole time. So this is not me telling you Claude is the problem. Claude is not the problem. The dependency is the problem.

We have been building this case in different shapes for a while. Issue 21 was about compute consolidating into a handful of hands. Issue 25 was about the hardware squeeze landing on your doorstep. Both of those were about cost and supply. This adds a third axis, and it is the sharpest one: availability you do not govern. A model running on hardware you own cannot be revoked by a directive you never saw. That is the whole pitch for local inference, and it just got handed the cleanest example it has ever had. The full timeline is here if you want to read it cold.

None of this means rip the hosted models out of your stack. They are still better than what most of us can run at home, and that gap is real. It means know which of your workflows would simply stop if a model went dark on a Friday, and have an answer that does not require anyone’s permission to switch on.

Question I Got Asked (and the Real Answer)

The question: “Be honest, is AI going to delete my job?”

The common answer: Some executive’s eighteen-month countdown, repeated back with the serial numbers filed off. Half the room nodding, the other half quietly updating their resume.

The real answer: The most-cited primary source on this is the WEF Future of Jobs Report, and the people repeating the doom number rarely seem to have read it. The report projects 170 million jobs created and 92 million displaced by 2030, for a net gain of roughly 78 million. That is real churn, about 22% of the jobs studied, and it is going to HURT in specific places; clerical and administrative roles, cashiers, and data entry are on the wrong side of it.

The more useful number in that same report is the skills outlook: the fastest-growing skill categories through 2030 are AI and big data, networks and cybersecurity, and technological literacy. Those are not the skills of a job being deleted. Those are the skills of the work that keeps the rest of it running.

The displacement is real and worth taking seriously. The version where it deletes the people who keep systems running is not what the data says. Again, Eric Siron and I spend a full episode of the podcast (above) on this distinction, and it is worth the listen, because the gap between the headline and the report is wide enough to drive a career decision through.

Community Signal

James Kilby - “Self-Hosting an AI Stack Using vSphere, Docker and NVIDIA GPU” - The practical version of everything above. Kilby walks through standing up a containerized inference stack on a single NVIDIA Tesla P4 inside vSphere, with the install commands and, the part I appreciated, the real power numbers: roughly 7 watts idle, 50 to 60 under active inference. If you read From the Console and wondered what “own your inference” actually costs to run, this is a concrete answer from someone who measured it. Updated June 2026.

Tool of the Week

Ollama - Open-source local LLM runtime. Pull a model, run it on hardware you own, expose an OpenAI-compatible endpoint any existing tool can talk to.

If you read Issue 24 you have already heard this pitch. The reason it earns the slot a second time is that the argument for it just got sharper. For issues 24, the case was privacy, cost, and not being told you cannot use AI at all. The Fable 5 takedown adds the axis I did not have a clean example for in May: availability you govern. Again…. a model running on hardware you own cannot be pulled by a directive you never saw.

Honest scope has not changed since Issue 24. Local model quality at consumer hardware tiers still trails the frontier hosted models, and for greenfield engineering work you will still reach for the hosted option more often than not. For the workflows that actually need to keep running no matter what happens upstream, this is the fallback The Take is asking you to have. The Quick Win below is “stand it up and prove it works.” An hour of your time, a permission slip from nobody.

Quick Win of the Week

Make a one-page list of every tool and workflow in your shop that calls a hosted AI model, and mark which ones would simply stop if that model went dark on a Friday night. For the one that matters most, pull an open-weight model in Ollama, point the tool at the local OpenAI-compatible endpoint, and confirm it actually runs. You are not switching off the cloud. You are proving you have a fallback that needs nobody’s permission to turn on, before the week you actually need it.

Fun Retro SysAdmin Fact

This is not the first time Washington export-controlled software. Through the 1990s, strong encryption was classified as a munition under the same export rules as weapons, and PGP author Phil Zimmermann spent roughly three years under federal criminal investigation for “exporting munitions without a license” after his code spread overseas; the case was dropped in 1996, and the idea that publishing software could be an arms-export crime has felt absurd ever since. Felt.

Until Next Week

Know which of your systems would keep running if the company upstream of you had a bad Friday.

Stay Frosty,

Andy

SysAdmin Weekly

• The compute consolidation I flagged back in Issue 21 isn’t a forecast anymore; it’s sitting in your parts bin.

• DRAM contract prices jumped roughly 90% in a single quarter, consumer SSDs climbed 147%, and a 16GB Raspberry Pi 5 that launched at $120 now runs $305.

• The hyperscalers didn’t just rent you the cloud; they bought up the fab capacity that makes the parts you’d use to avoid it.

• We pulled an older episode of the podcast to highlight this week > Episode 023 with Eric Siron from the vault: building a real lab without selling a kidney, more relevant now than the day we recorded it.

• This week’s moves: pool mismatched disks with SnapRAID, and actually measure how much write life your NVMe has left.

From the Console

I went looking for a couple of high-endurance NVMe drives last week. Not the bargain-bin kind; the write-tolerant drives you put under a workload that actually does sustained writes. I didn’t find them at a good price. I didn’t find them at a bad price either. They simply weren’t there.

Same story when I priced out more RAM for an existing box. Same story again when I looked at what a Raspberry Pi costs now versus a year ago. Somewhere in the last few months the math quietly flipped: buying new capacity stopped being a line item and turned into a project with a budget meeting attached.

So I’ve stopped trying to buy my way forward. I’m re-architecting what I already own, with longevity as the goal instead of raw horsepower. Make the gear I have last, instead of betting on a parts market that clearly isn’t betting on me.

This is a rant you’re going to be hearing about on SysAdmin Weekly for….. a while… I apologize in advance. =D

And now, back to our regularly scheduled programming…..

From the SysAdmin Weekly Vault

Instead of reaching for the latest episode of the SysAdmin Weekly podcast, we’re reaching for an older episode that fits with this week’s theme around PC hardware and homelabs.

Episode: SysAdmin Weekly 023 - Budget Home Lab Setup for IT Pros (with Eric Siron) Topic: Building a genuinely useful home lab without torching your budget, across five segments: hardware, software, virtualization, networking, and cloud.

Why this one still holds up, and matters more now:

• The hardware advice was always practical: don’t underestimate an old desktop or laptop with enough RAM, and lean on mini PCs as the modern budget chassis. For example, Eric stood up his entire lab on four 32GB nodes for around $4,000 (When we recorded that episode) The underlying logic used? > “cutting edge, not bleeding edge” (skip DDR5, stick with DDR4), reads less like budget tinkering and more like a 2026 survival guide today.

• Eric’s rule of thumb, brick a $100 box, not a $20,000 one, was about learning safely on cheap hardware. In a market where you can no longer reliably buy the $100 box either, it lands as an argument for defending what you already own and being patient with the gear that still works.

• The virtualization tour is still the cheapest path off the VMware tax: Hyper-V on Windows Server’s 180-day evaluation (re-arm it three times for roughly two years of runway), Proxmox if you miss the vSphere feel, libvirt and KVM for the Linux native route. Containers via Docker, Podman, or a small Kubernetes cluster cover the workloads where full VMs are overkill.

• Bonus reality check we did not plan for: Eric flagged in the recording that VMware trial licenses are now gated behind enterprise customer designation. If you ever wondered why I started talking about “the VMware tax” as a thing, that gate is where it started.

The Take

Back in Issue 21, I ran a thought experiment and landed on an uncomfortable answer: the consolidation of compute into a handful of hyperscalers would, eventually, take choice and independent operation away from the rest of us. I framed it as a question and said I thought the answer was yes. I did not expect the proof to arrive this fast, and I did not expect it to come through the supply chain instead of through policy.

So the ugly truth….. The three companies that make the world’s memory have pivoted their fab capacity toward high-bandwidth memory and enterprise parts for AI buildouts, because that’s where the margin is…. it’s simple capitalism. AI is on track to consume roughly a fifth of all DRAM production this year, per TrendForce. The downstream effect isn’t subtle: DRAM contract prices jumped around 90% in a single quarter, consumer SSDs climbed 147%, a 30TB enterprise SSD went from about $3,000 to $17,500, and that 16GB Raspberry Pi 5 went from $120 at launch to $305.

That’s the consolidation thesis, except it isn’t an abstraction about cloud strategy anymore. It’s the reason you can’t buy a stick of RAM or a decent NVMe drive at a price that makes sense. The same demand that’s building hyperscale AI capacity is the demand that’s pricing you out of building anything for yourself.

And that’s the quiet move now……. When the entities building the cloud also control who gets the silicon to build off the cloud, “just rent compute from us” stops being a sales pitch and becomes the path of least resistance, because every other path got more expensive on purpose. I’m not telling you to panic. I’m telling you to notice, and to make the gear you already own last, because owning your own compute is starting to look less like a preference and more like a position you have to defend.

Community Signal

One item this week, and fits right in with these week’s discussion.

Jeff Geerling - “DRAM pricing is killing the hobbyist SBC market” - Geerling lays out how LPDDR memory now makes up the majority of a single-board computer’s cost, which is why anything past 4GB of RAM has drifted out of hobbyist reach. His read lines up with mine: the theme of 2026 is repurposing what you already have, not buying new. If you want the hardware-level receipts behind everything I argued above, this is the post to read.

Tool of the Week

SnapRAID - parity-based protection for an array of ordinary, mismatched disks, which is exactly what you end up with when you can’t buy a matched set of new drives.

Full disclosure before I describe it: I haven’t run this one in production myself yet. It’s on the shortlist for the re-architecting work I’m doing now, and I’m flagging it here because it’s the community-tested answer (Perfect Media Server, r/DataHoarder, the Self-Hosted podcast crowd) for exactly the mismatched-disk world we’re heading into. I want it on your radar before you need it, not after.

SnapRAID computes parity across drives of different sizes and ages, so you can add whatever disk you scrounged this month and still survive a failure or two (it scales up to six parity disks if you want the headroom). Pair it with mergerfs and those odd-sized disks present as a single pool. Honest scope: this is snapshot-style parity synced on a schedule, not real-time RAID, so it’s built for data that doesn’t change by the second; media, backups, and archives are the sweet spot. Don’t drop a busy database or a hot VM datastore on it and expect RAID behavior. For bulk storage you want to keep alive for years on hardware you already own, it’s hard to beat. It also pairs cleanly with the eBay-and-government-surplus path Eric recommended on the Vault episode, since the whole point of that path is ending up with a stack of drives nothing else can pool.

Quick Win of the Week

Find out how much life your SSDs and NVMe drives actually have left, before the market forces the decision for you. On Linux, install smartmontools and run sudo smartctl -a /dev/nvme0 (swap in your device); read Percentage Used and Data Units Written for NVMe, or the Wear_Leveling_Count and Media_Wearout_Indicator attributes on SATA SSDs. On Windows, CrystalDiskInfo shows the same health and total-bytes-written data in a couple of clicks. Five minutes per box tells you which drives have years left and which ones you should quietly start planning around while you still can.

Fun Retro SysAdmin Fact

The RAM in 1960s mainframes was literally woven by hand: tiny magnetic ferrite rings threaded onto crisscrossing wires, often assembled by women hired for the fine motor skills the work demanded, and it’s why we still say a crashed program wrote a “core dump” and why some old-timers still call memory “core.”

Until Next Week

The cheapest compute you’ll own for the foreseeable future is whatever is already humming in your rack; treat it accordingly.

Stay Frosty,

Andy

SysAdmin Weekly

• The AI doom narrative has hit saturation. Some of the doom is warranted. A lot of it is marketing.

• “AI” is doing PR work for layoffs that were really overhiring corrections. The investor signal is the point.

• Episode 046 of the podcast is out: the honest case for Claude Code in SysAdmin workflows, plus three fresh Linux LPE CVEs.

• Tool of the Week: Ollama. Run open-weight models locally, no data leaves your network.

• A full data breakdown of the doom narrative is coming on SysAdmin Weekly Podcast Episode 047 with Eric Siron in a day or two.

From the Console

The AI doom narrative has hit saturation. You feel it on LinkedIn. You see it in every other headline. Microsoft’s AI chief telling lawyers, accountants, and marketers they have eighteen months. Big tech CEOs floating that AI will replace half of white-collar work by 2030. Investors clapping. The rest of us reading the room.

Some of the doom is real. The transition is going to be painful for real people. Data center water usage today is a problem. Real jobs have been cut and real households are absorbing that. I am not minimizing any of it.

The rest of the doom is marketing dressed up as inevitability. And it is loud enough that even people who already do this work for a living are starting to second-guess themselves. That is the part that bothers me.

So I went looking at the actual data. Layoff numbers. The WEF Future of Jobs Report. Energy and water projections. What the hyperscalers are actually doing about it versus what the headlines say they are doing. There is a full breakdown coming on the podcast with co-host Eric Siron in the next day or two. Until then, the short version: the data does not say what the headlines say it says.

The rest of this issue is about the part of the doom narrative that does not get enough scrutiny in our circles: how it is being used.

And now, back to our regularly scheduled programming.

The Latest on the SysAdmin Weekly Podcast

Episode: 046 - Can Claude Code Help SysAdmins? Scripting, Log Analysis, and the CLAUDE.md Workflow

Topic: Andy makes the honest case for Claude Code in SysAdmin workflows, with the caveats and the parts that still fall short. Plus three recent Linux kernel local-privilege escalation vulnerabilities and what they mean for your patch cycle.

Reasons to tune in:

• Most AI demos are built for developers. This is a long-time SysAdmin walking through what actually helps and what does not

• The CLAUDE.md workflow is the single biggest thing most folks are missing when they try AI in their day job

• Three Linux LPE vulnerabilities (Fragnesia, DirtyFrag, CopyFail) dropped in quick succession. Local-only, but still on the patch list

If you prefer to read about my experiences with Claude Code instead of the podcast episode, I did a write-up over on my blog at andyontech.com

All Links For the Show: https://www.sysadminweekly.com or watch / listen below!

The Take

The piece of the AI layoff story that does not get enough airtime is the part where AI is the excuse and not the reason. Again, not downplaying those jobs that were legit replaced by AI, but the enterprise space seems to love making AI the scapegoat, warranted or not.

The early wave of 2023 tech layoffs had a different reason on the slide deck. IBM and a few others actually said it: we over-hired during COVID by something close to thirty percent, the demand correction hit, and we cut. That is not a comfortable thing for an executive to say in public. It also is not an investor-friendly thing to say at an earnings call. So the language quietly changed.

By 2024 and into 2025, the same kinds of layoffs were getting a different label. “Restructuring around AI.” “Reallocating capital toward AI initiatives.” “Aligning our workforce with the AI-first future.” Conveniently, that wording does two things at once: it makes layoffs feel like strategy instead of correction, and it signals to investors that the company is an AI play, which moves the stock.

We are not just speculating here. Cisco cut roughly 4,000 people on the back of strong earnings. Oracle is reportedly cutting up to 30,000 jobs (about 18% of its headcount) while standing up a massive data center buildout. Meta announced 8,000 more cuts in May while telegraphing $115B to $135B in 2026 capital expenditure, almost all of it AI infrastructure. Read those press releases against each other and the pattern is consistent: trim the headcount line, route the savings into AI capex, take the investor bump for being “AI-first.”

Again, that doesn’t mean AI is NOT displacing some jobs. It is, in specific roles, at specific companies, on a real timeline. It does mean, though, that “we cut X people because of AI” is doing a lot more PR work in 2026 than it is doing operational work. And if you are a SysAdmin, an MSP operator, or an IT manager trying to read the temperature in your own organization, that distinction matters. The internal memo and the external press release are not telling the same story for the same reason.

The piece I keep coming back to is something Eric Siron mentioned in a recent recording of the podcast….. when an executive who has never been an accountant tells accountants they have eighteen months, ask that executive what THIER numbers actually need to look like by then. Eighteen months is often less about when the technology will be ready and more about when the latest AI bet has to start showing returns.

We will get into the data side, the WEF Future of Jobs numbers, the historical tech wave precedents, the water and power question, in detail when Episode 047 drops with Eric Siron. For now: if your CIO walks in citing the eighteen-month deadline, ask them to source it. Real conversations get easier from there.

Community Signal

High-signal community work worth your attention this week.

Brandon Lee (VMware vExpert) - “I Built a Local AI Coding Agent Home Lab Setup With OpenCode and Ollama” - The practical antidote to the doom narrative… practical use of AI systems! In this post Brandon Lee walks through standing up OpenCode against a local Ollama instance, with the model running on his own hardware and no data leaving the lab. The part worth the read is the honest scoping: where the local setup actually competes with the cloud offerings, where it does not yet, and what hardware you need to make it usable. Practitioner work, no vendor influence.

Tool of the Week

Ollama - Run open-weight LLMs locally. Single binary, simple model pull syntax, OpenAI-compatible API surface for any tooling that already speaks that protocol.

The pitch in 2026: if you are tired of either feeding sensitive data to a hosted model or being told you are not allowed to use AI at all, Ollama is the third option. Pull a model (Llama, Qwen, Mistral, DeepSeek, Codestral, others), point your client at the local endpoint, and run inference on your own hardware. Pairs cleanly with OpenCode, Continue, and any IDE plugin or CLI tool that supports a custom OpenAI-compatible base URL.

To be straight: the local model quality at consumer hardware tiers is not the frontier-model quality you get from Anthropic or OpenAI. For privacy-sensitive workflows, internal-only use cases, log triage, and scripting against data you cannot ship outside the network, the gap closes considerably. For greenfield engineering work, you will still reach for the hosted option more often than not based on my experience. Either way, nice to have the options.

Quick Win of the Week

Pick one “AI is replacing X” headline you have seen this month. Trace it back to the primary source. Is it a CEO quote, a press release, a paper, or a survey? Whose survey? How were the numbers gathered? You will be surprised how often the headline number does not survive the trip back to where it came from. Sourcing your own claims is one of the most useful skills a SysAdmin can keep sharp in 2026.

Fun Retro SysAdmin Fact

The first “AI is coming for your job” panic in IT was not in 2023. It was in the late 1980s, during the expert systems boom, when symbolic-reasoning platforms running on Lisp machines were supposed to replace whole categories of decision-making work. By the early 1990s the entire commercial expert systems market had collapsed into what historians of computing now call the second AI Winter. The Lisp machines went to museums, the panic dissipated, and the next wave of IT growth (the consumer internet) created more jobs than the AI Winter ever displaced.

From My Other Corner of the Internet

AndyOnTech

Can Claude Code Help SysAdmins? Real Use Cases for IT Pros - The companion write-up to Episode 046. Covers the CLAUDE.md workflow, scope-based settings, and where to stay skeptical with sensitive data and production-adjacent prompts. If the episode landed, the post is the version you can hand to a teammate who prefers reading to listening.

Thing I’m Re-Thinking

The assumption: When a major tech CEO makes a specific timeline claim about AI displacement, I should weigh it as informed analysis from someone close to the technology.

Why it no longer holds up: After a few iterations, it REALLY seems like a lot of those claims are not predictions, they are deadlines. Eighteen months is a number that lines up with when AI infrastructure spend has to start producing returns. The person saying it has a financial reason for that number, and that reason is not “this is the date the technology will be ready.”

What I am testing instead: Treating those statements as investor communications, not as forecasts. If the same claim comes from someone who has actually done the job being replaced, who is working at the keyboard with the tools, and who has no AI-adjacent stock price to defend, that is the version I weigh.

Until Next Week

If the doom is loud enough that you are starting to repeat it without checking, that is the moment to go check.

Stay Frosty,

Andy

SysAdmin Weekly

• Was at a conference recently. Half the room was on their phones. That’s not a people problem.

• The culture of IT quietly starves curiosity. And we as SysAdmins let it happen.

• I stood up Forgejo in my lab out of curiosity. It ended up replacing every GitHub component of my workflow. Zero regrets.

• Lab work isn’t a hobby. It’s how you stay dangerous.

• This week: do something that doesn’t have a ticket number.

From the Console

I attended a recent tech event in Texas which turned out to be a good event, had decent content, and a strong sense of community. At one point, I’m sitting there looking around the room….observing people as I’m want to do at times to gauge interest in a particular topic. I noticed lots of phones out, laptops open, heads down and my initial reaction was frustration, because I’ve been the guy up on stage talking, many times. Then I caught myself.

These aren’t checked-out people. These are DEPLETED people. The queue never stops. The alerts never stop. And somewhere in all that noise the thing that made most of us good at this job (the curiosity), the “I wonder what happens if I press this button” instinct, just quietly gets starved out.

That’s the thing worth talking about this week.

Folks that are regulars of the SysAdmin Weekly Podcast have likely heard me talk about the importance of curiosity for SysAdmins. I’ve been in the industry long enough now to know that SysAdmins used to have more time to be curious. We used to have more time for training. In fact, we’ve done our jobs so well over the last decade or two that tech and “digital transformation” have become core to many businesses. So much so, that the many businesses simply cease to function when tech systems are offline or impacted in some way.

Pair that with the fact that many organizations still view IT as a cost center. I still run into accounting heads that see IT as a black hole for money, and I still see leadership teams not giving IT teams the resources or the time needed to get the job done while leaving room for self-improvement or self-care. SysAdmins are overworked, and understaffed / underfunded, and it shows.

That all said, I would urge all of you to maintain that curiosity. Tinker in the lab. Check out that new community tool. Spin up that new game server. Most of us got into this industry because we have a deep love for the technology. Sometimes experimenting with new tech for no reason other than curiosity is all that’s needed to keep the bad parts of the job from overwhelming you and in the process it helps you keep your skills current and growing.

And now, back to our regularly scheduled programming.

The latest on the SysAdmin Weekly Podcast

Episode: 045 - Why Is It Always DNS? How DNS Actually Works, Breaks, and Gets Exploited Topic: Andy and Eric pull apart the full DNS resolution chain, Active Directory DNS integration, DNS security threats, and two war stories that will make you go check your fourth domain controller.

Why this one matters: - Most SysAdmins work with DNS every day without actually understanding how it works. This is the episode that fixes that - If you’ve ever said “have you tried flushing the DNS cache?” and quietly hoped it worked, this one is for you - DNS is also how attackers move data and talk to compromised machines. Understanding the protocol means understanding the threat

Episode Links

All Links:

https://www.sysadminweekly.com

YouTube:

Spotify:

The Take

I stood up Forgejo in my homelab recently. Self-hosted git forge, two-class repo model, nginx reverse proxy, internal HTTPS with mkcert. Did I plan for this to become my full git workflow? No. It started as curiosity. It ended up replacing every GitHub component of my day-to-day. GitHub no longer has a seat at the table, unless a repo has to be public and in that case I use repo mirroring so I still only have to interact with Forgejo at the end of the day.

On top of those benefits the curiosity that drove me to test out Forgejo to begin with enabled me to learn things I wouldn’t have learned any other way.

That’s the whole point. The lab isn’t always about the output. It’s about keeping the instinct alive. The instinct to dig in, break something on purpose, and figure out why it works. That muscle atrophies when you stop using it… and the environment most of us work in is perfectly designed to let it atrophy. Tickets, queues, SLAs, “what did you close today.”

It’s become a sad reality that the people who think lab work is a waste of time are usually measuring the wrong thing. They want deliverables. The lab doesn’t produce deliverables. It produces practitioners who don’t panic when something breaks outside the documentation.

This isn’t a generational thing either. I’ve seen 20-year veterans lose the curiosity instinct just as fast as someone two years in. It’s a culture problem. The fix is the same regardless of time in the chair: build something this week that nobody asked you to build. I’ll be money that two things will happen:

1. You’ll learn something new

2. You’ll enjoy the time spent doing so

So that said, what personal tech project are you interested in that you’ve been putting off? Maybe today is the day to start?

Community Signal

High-signal community work worth your attention.

mrlokans.work - “State of Homelab 2026” - A personal, opinionated stack writeup from someone who documents their gaps honestly: no backups, single NVMe, running costs under $10/month. The part worth reading is the SOPS with age encryption section as an upgrade over Ansible Vault for version-controlled secret management. Good real-talk energy, no vendor influence, highly recommend!

Brandon Lee - “How I Built a Self-Healing Home Lab That Fixes Itself” - Brandon Lee documents building an n8n automation pipeline that monitors CI/CD via Discord, uses an AI agent to identify failures, and automatically re-triggers failed pipelines without human intervention. Proxmox, Prometheus, Grafana, Docker restart policies. The interesting angle here isn’t the specific stack; it’s the idea that the lab itself can model the same automation discipline you’d want in production. Also a good read for this week!

Tool of the Week

Beszel - Lightweight infrastructure monitoring with a hub-and-agent model that actually fits the way homelabs and small shops are built.

Lightweight single binary, hub-and-agent model. Monitors CPU, memory, disk, network, and Docker/Podman container stats. The web dashboard is clean, alerting is configured with sliders and toggles instead of a rule language, and it doesn’t require standing up a full Prometheus stack to get meaningful visibility.

To be straight with you: this is a homelab and small fleet tool. No SNMP, no custom metrics, no HA, SQLite-backed. It is not a Zabbix or Prometheus replacement for enterprise environments with SLA requirements. For everything else, it’s the current community default for a reason.

Quick Win of the Week

Pick one service you interact with every day and actually read how it works this week. Not a tutorial. Not a YouTube walkthrough. The documentation or the RFC. Twenty-five minutes. The goal isn’t to become an expert; it’s to make contact with the actual thing instead of just operating the surface of it.

Fun Retro SysAdmin Fact

Before DNS existed, every host on the ARPANET was tracked in a single HOSTS.TXT file maintained by one person at the Stanford Research Institute and distributed via FTP. By 1983, the growth of the network had made manual updates impossible, which is what prompted Paul Mockapetris to design DNS. The specs he wrote in RFC 1034 and RFC 1035 are still the foundation of every DNS lookup happening right now.

Worth Your Time

Forgejo - User Documentation - If The Take in this week’s edition landed and you want to actually spin up your own git forge, the docs are legitimately good. The user docs index includes a getting started section.

Uptime Kuma - If you spin up Beszel, pair it with this. Beszel watches internal resource metrics; Uptime Kuma watches external service availability (HTTP, TCP, DNS, SSL). They cover different failure modes and the community runs them together for that reason. Worth mentioning that it also has a large number of GitHub stars….. meaning this one has been around long enough to trust.

Thing I’m Re-Thinking

The assumption: Staying current means following the news cycle.

Why it no longer holds up: Reading about technology and understanding technology are not the same thing. You can follow every CVE, every product announcement, every LinkedIn hot take… and still be completely lost the first time you have to operate something unfamiliar under pressure.

What I’m testing instead: One new thing in the lab per month. Doesn’t have to be big. Doesn’t have to be relevant to the day job. Just has to be something I haven’t run before.

Until Next Week

The queue will be there Monday. Your curiosity might not be if you keep telling it to wait.

Stay Frosty,

Andy

SysAdmin Weekly

· Big Tech is consolidating compute, cloud, and client hardware at an unprecedented pace and open source is increasingly the only viable counterweight.

· The Steam Deck is the clearest mainstream proof that open source can compete on quality, flexibility, and user freedom, even in a consumer market dominated by locked ecosystems.

· Open source isn’t just idealism. It’s a practical, career-relevant strategy for SysAdmins managing costs, avoiding lock-in, and maintaining operational control.

· This week’s Community Signal highlights open source tools worth building into your stack right now.

· Tool of the Week: A self-hosted alternative that punches well above its weight class.

From the Console

The Locked Room Problem

I want you to think back to a time… maybe recent, maybe not, where a vendor changed something fundamental about a tool you depended on. Maybe it was a licensing model. Maybe it was a feature that got paywalled. Maybe it was an acquisition that turned your go-to platform into a product roadmap you no longer recognized.

The most recent example for me, was Firefox. And if you’ve been listening to the podcast or have read my lengthy blog post on the subject, you already know how I feel about that particular saga.

That thing I keep coming back to: that feeling of helplessness….of being locked in a room where someone else controls the door, isn’t unique to Mozilla. It’s, sadly becoming the default state of modern enterprise IT, for a number of reasons.

In issue #21, we talked about the Great Compute Divide. Big Tech is hoarding GPUs, cloud vendors are pitching you on renting your own PC BACK from them, and RAM prices have quadrupled because the market for on-prem compute is being systematically starved (whether that’s the intention or not remains to be seen). That said, the consolidation is real, it’s accelerating, and it has consequences.

So what’s the counterweight? Despite my example above being Mozilla / Firefox (which has started catering to market demands) I’d argue that the long-term counterweight is in fact open source. It’s also worth noting that I don’t mean that in the idealistic, “free software should be free” sense (though that argument has merit). I mean open source as a practical, professional survival strategy for SysAdmins.

And if you want the clearest mainstream proof that this strategy works, look no further than Valve’s Steam Deck.

Here’s a consumer device running a custom Arch Linux distribution called SteamOS that ships with full terminal access, supports arbitrary software installation, and lets you configure, break, and rebuild it however you see fit. Valve didn’t lock it down. They handed you the keys. And the result? A device with one of the most enthusiastic and capable user communities in consumer tech, running games and workloads that “shouldn’t” work because the platform respects user freedom.

That’s the open source promise made tangible…. And it’s exactly the philosophy SysAdmins need to be applying to their own stacks right now.

This is the part where you all come at me with torches and pitchforks… “But, Andy! What about support”? I would make the argument that the support question can be worked around while vendor lock-in, hardware scarcity, planned obsolesence, and adversarial behaviour towards customers are much more difficult to contend with. At least with the support question you can:

· Train up internally

· Partner with a third party

· Some Linux distros have their own support mechanisms

The other issues I laid out above have more difficult solutions for the most part.

Whatever your stance on this issue is, I would urge you, at the very least, to conduct an audit of all functions within your environment where you depend solely on a single vendor. Which of those vendors have you locked in, in some way? Those are the areas you need to at least have a fallback plan in mind in the event that things go south.

A SysAdmin Clinging to an Open Source life preserver

And now, back to our regularly scheduled programming.

🎙 Recently on the SysAdmin Weekly Podcast

SysAdmin Weekly - 039 - BitLocker, Key Escrow, and the Microsoft Trust Question

All the relevant links for this episode can be found below:

· SysAdmin Weekly Website

· SysAdmin Weekly Github Discussions Board

The Case for Open Source in 2026 - Beyond the Ideology

I’ve been on a practicality kick lately with my content. So, let’s get practical for a second. Building on the “From the Console” section in this week’s issue of the newsletter, here’s why open source deserves a strategic seat at the table for every SysAdmin today:

1. You Own the Exit

Proprietary software comes with a quiet hostage clause, which is sometimes spelled out (and sometimes not). When the vendor raises prices, discontinues a feature, gets acquired, or simply decides your use case no longer aligns with their roadmap, you are stuck….full stop. Open source breaks that clause. You can fork it, self-host it, freeze it at a version that works, or migrate on your terms.

This isn’t hypothetical. Looking at a few examples:

· BookStack - Open Source Wiki / Documentation App

· Gitea - Self Hosted Open Source Code Repo Software (Note: owned by a for-profit org)

· Forgejo - Self Hosted Open Source Code Repo Software

· Nextcloud - Self hosted cloud filestorage

· Restic - Awesome CLI-based backup application

These are all tools that we’ve mentioned in this newsletter before and they exist because the proprietary alternatives became untenable for a meaningful number of organizations. The community voted with their forks.

2. Auditability Is a Security Feature

Putting my security brain in place for a second, I would also make the claim that, in general, you cannot fully trust what you cannot inspect. There are some exceptions to that rule for certain software suites, sure, but I feel it’s true when speaking generalities. The fact is, that with proprietary tooling, you’re accepting a black box at the foundation of your infrastructure. With open source, the code is accessible and viewable. Security researchers can (and do) find and fix vulnerabilities more quickly because the surface is visible. Now, it’s worth noting that this isn’t always comfortable. Visibility cuts both ways, but at least it’s honest, open, and everyone can see things for what they are, warts and all.

3. Cost Control in a World of Subscription Creep

SaaS subscriptions compound quietly. Open source tools, even with self-hosting overhead, frequently deliver better TCO at scale, especially for non-glamorous infrastructure services: documentation platforms, backup tools, monitoring stacks, identity providers.

4. The Talent Pipeline Recognizes It

The next wave of SysAdmins grew up on GitHub, Linux, and Docker. Open source fluency is increasingly a hiring signal, and building an open-source-forward environment makes your org more attractive to the people you want to retain.

Core Fundamentals: Reading an Open Source Project Before You Commit

Not all open source is created equal. Before you adopt a tool and build workflow around it, here’s a quick due diligence checklist:

· Commit frequency: Is the project actively maintained? When was the last commit?

· Issue response time: Are maintainers engaged with bug reports? Or are issues piling up unanswered?

· License: MIT, Apache 2.0, and GPL all have different implications for commercial use and modification. Know which one you’re working with.

· Community size: A project with thousands of GitHub stars and an active Discord/forum is less likely to be abandoned than a solo maintainer’s side project.

· Commercial backing: Projects with a company behind them (HashiCorp, Grafana Labs, Canonical, Gitea) have longevity. That said, watch for the “open core” model that some of them offer. Open core is where the good stuff is still generally paywalled.

· Documentation quality: Poor docs are a maintenance burden. Great docs are a force multiplier.

Community Signal

High-signal community content worth your attention this week > open source edition.

awesome-selfhosted – The Community’s Master List If you only bookmark one link from this edition, make it this one! Awesome-selfhosted is a community-maintained GitHub repository cataloging hundreds of free, open source network services and web applications you can host on your own infrastructure. Organized by category, it includes stuff like: analytics and backup tools to document management, monitoring, and identity providers…etc..etc. It’s the definitive reference for SysAdmins evaluating self-hosted alternatives to SaaS platforms. Think of it as the antidote to vendor lock-in, one category at a time.

Gitea Official Migration Documentation Full disclosure: There have been some community concerns around Gitea now existing under a for-profit company (See further down re: Forgejo). That said, Gitea remains a solid git repo hosting option that still retains the open source label. This documentation is a great resource for getting started if you’ve never used Gitea before. The official documentation covers installation, systemd service configuration, access, etc. That migration angle is the key differentiator here. It’s not just “here’s how to install a thing.” It’s “here’s how to actually move the thing.” If you’ve been meaning to get your repos off a platform you don’t control, this is your starting point.

TechReviewer – Linux Hits 90% Windows Game Compatibility Milestone The Steam Deck and Proton keep coming up in this edition for good reason. They’re the clearest mainstream proof that open source can compete at scale without compromising on user experience. This piece puts hard numbers to that argument: over 5.6 million Steam Decks sold by mid-2025, 21,694 Deck Verified games, and nearly 90% of Windows titles now running on Linux via Proton. The story here really shows what happens when a platform holder commits to openness and invests in the community infrastructure to back it up. Sound familiar?

Tool of the Week

Forgejo - A community-driven fork of Gitea, born after concerns about Gitea’s governance direction under a new for-profit organization. Forgejo is a fully self-hosted Git service. Like Gitea, you can think of it like GitHub, but it’s yours and it lives in your environment. Lightweight, fast, and increasingly the preferred choice for SysAdmins who want source control without handing data to Microsoft.

Quick Win of the Week

Audit one proprietary tool in your current stack this week. Ask these three questions:

1. What does it cost annually (licensing + admin overhead)?

2. Is there a credible open source alternative?

3. What would migration realistically take?

You don’t have to move anything. Just know your options. Because the time to evaluate alternatives is before your vendor sends you a renewal notice with a 40% price increase.

Fun Retro SysAdmin Fact

The GNU Project, which is the foundation of modern open source as we know it, was announced by Richard Stallman in September 1983. That means the open source movement is older than most of the Windows Server versions you’ve probably had to decommission. And unlike those servers, it’s not going anywhere.

Until Next Week

The tools to stay independent already exist. They’re battle-tested, community-supported, and increasingly production-ready. The question isn’t whether open source is viable, the Steam Deck is one project proved that argument is over, in my opinion. The question is whether you’re building your stack in a way that keeps the exit door unlocked.

Thanks for reading and stay frosty out there!

Andy @

• Big Tech is consolidating massive amounts of compute while AI workloads continue driving unprecedented demand for GPUs and memory.

• Major cloud vendors are openly advocating for a future where you rent your PC and infrastructure instead of owning it.

• RAM prices have exploded, with some configurations quadrupling in cost, effectively pricing out homelabs and even certain enterprise deployments.

• The more workloads move to centralized cloud platforms, the less independent control organizations retain over their own compute.

• This week’s From the Console asks a hard question: does compute consolidation ultimately reduce flexibility, choice, and long-term autonomy?

• Community signal worth your time: a practical guide to estimating and managing Azure costs before they spiral out of control.

From the Console

I think it finally happened….. I’ve finally circled back to the portion of the industry that prefers to run (most) workloads locally as opposed to “cloud-first”.

Trust me… this comes as much as a surprise to myself as it does you (or maybe not?). It was a very specific line of thinking and industry events that led me back down this path… events which we plan to cover in a future podcast episode. That said, I thought articulating them here would make for an interesting “From the Console” opener for this week’s Newsletter.

So what led me down this path? A number of different news stories over the past couple of months eventually led to a thought experiment… which, in turn, led to my new stance, I suppose.

So, what were those news stories, you ask?

Big Tech Helping Trump & GOP in the 2026 Midterm Elections

https://www.washingtonpost.com/technology/2025/12/19/tech-super-pacs-midterms-ai/

Now, first off, this newsletter is NOT a political newsletter. That said, we have mentioned politics on the podcast from time to time as it relates to the technical topics of the day. Regardless of your stance on the current state of US politics, the important and relevant bit for this discussion, is this personal take I put together re: the article:

There are a group of individuals with direct or indirect ties to “Big Tech” that are using their resources to influence a specific result(s) in the US 2026 Midterm election. When the same entities that control massive compute resources also shape political outcomes, it raises questions about long-term digital independence.

Political activism by big tech isn’t a new thing. It’s been going on for years now, but it’s an important item to point out as currently happening in our industry and it’s important to take into account for this editions “From the Console” discussion.

Quote from Jeff Bezos on Local Compute

https://www.windowscentral.com/artificial-intelligence/jeff-bezos-says-the-quiet-part-out-loud-bezos-envisions-that-youll-give-up-your-pc-for-an-ai-cloud-version

I came across this article from Windows Central in my usual RSS meanderings and Bezos’s stance on local compute is what caught my eye. This section of the article specifically.

So, what prediction did Bezos make back then, that seems particularly poignant right now? Bezos thinks that local PC hardware is antiquated, and that the future will revolve around cloud computing scenarios, where you rent your compute from companies like Amazon Web Services or Microsoft Azure.

There has been talk for some time now from the major cloud vendors talking about the “benefits” to “renting” a PC in the cloud. In fact Microsoft has even produced a line of endpoints (which are basically thin-clients) called Windows 365 Link who’s sole purpose is to connect to a cloud-hosted PC in Azure.

We’ve seen the massive consolidation of server-related workloads being pushed into large cloud environments for the last 10 to 15 years. Now, it seems, there is a renewed push to get a percentage of client market share hosted in large cloud providers as well.

Well Known and Ongoing Industry Memory Scarcity

https://tech.yahoo.com/computing/articles/ram-prices-exploding-heres-why-111115489.html

It’s become well known throughout our industry (and amongst the gaming community as well) that if you need to buy memory, do it NOW. Prices have been rising for some time and I can speak from personal experience on this one. About a year ago, I had built a decent box for some homelab workloads that has 96GB of memory in it. Out of curiosity, I checked what that same 96GB of memory would cost me today and I discovered that the cost for that given configuration has QUADRUPLED in price. I’ve even heard stories from fellow enterprise admins that their organizations have been effectively priced out of certain configurations due to the massive cost increase of memory.

We’ve seen the industry’s push to leverage cloud compute more and more. That said, there has always been a cohort of SysAdmins that have either been unable, or simply do NOT want the loss of control that using someone else’s hardware entails.

What Concerns Does This Raise?

Having consumed all three of these news stories in close succession, my brain started something of a thought experiment with some key points:

· The current industry (and arguably geopolitical) line of thought is: AI = Inferencing = Power

· We know that AI workloads require a gargantuan amount of compute resources

· There has been increasing market inertia to move workloads to the cloud

· Increased cloud dependence REMOVES the need for on-prem / owned compute hardware

This pattern ultimately takes us to one place, and that is a world where the hardware needed for massive compute workloads (like large-scale AI) is largely in the hands of a few major players.

The question I leave you with today is this:

Does the consolidation of compute, and by extension, the ability to run compute-heavy workloads (like AI), eventually take away choice, flexibility, and independent operation absent influence from big-tech & politics? And, does this sequence of events take away power from individuals by extension?

Also worth asking:

What happens when access to high-performance compute becomes a subscription privilege instead of an owned capability?

We’ll be sure to cover this in a future episode of the podcast with more discussion. However, for now, I’d LOVE to hear what your thoughts are on this! Feel free to comment below!

Big Tech Hording All the Compute

And now, back to our regularly scheduled programming

🎙 Last Time on the SysAdmin Weekly Podcast

Episode: SysAdmin Weekly - 038 - Making Security Decisions Based on Data, Not Fear

SysAdmin Weekly - 038 - Thumbnail Image

Topic: Given the state of tech marketing and the Cybersecurity news-cycle currently in the industry, this topic is increasingly important for today’s SysAdmins. It’s easy to fall into the trap of FUD (Fear, Uncertainty, Doubt) when it comes to Cybersecurity. The reasoning is rather simple. While we SysAdmins know that security is a necessary component of any modern network, the psychology behind the NEED for security comes from a place of danger and uncertainty. We must protect our networks against threats both real and suspect, so when a vendor comes knocking, saying “What if?”, it’s easy to to fall down that rabbit-hole.

In this episode Paul and Andy discuss steps you can take to make sure that you’re making these choices from a place of data and setting the fear and emotion to the side. Links to the applicable platforms can be found below:

· SysAdmin Weekly Website

· SysAdmin Weekly - 038 - on YouTube

· SysAdmin Weekly - 038 - on Spotify

· SysAdmin Weekly - 038 - on Apple Podcasts

Also, if you’ve got thoughts to share on this episode be sure to join the SysAdmin Weekly GitHub Discussion Boards!

Community Signal

I’ve got one Community Signal item for readers this week, and it’s high quality.

Thomas Maurer - Azure Cost Estimation

Beings compute consolidation and big public cloud platforms were a big discussion earlier in today’s edition, this resources felt applicable. I know MANY SysAdmins that are dealing with cost management on public cloud platforms and it can be really difficult to get an accurate estimation of your cloud-spend, especially when rolling out new services.

Thomas Maurer always provides fantastic resources and this post is no exception. I highly suggest you check it out!

A Backup Tool Worth Your Time

Restic is an open-source, cross-platform backup tool designed for simplicity, security, and efficiency. It performs fast, incremental backups using content-defined chunking and deduplication, meaning only new or changed data is stored after the first run. All backups are encrypted by default using strong cryptography before leaving your system, so even the storage provider cannot read your data.

Restic supports a wide range of backends including local disks, SFTP, SMB, and cloud object storage such as S3-compatible services, Azure Blob, and Backblaze B2. It is lightweight, script-friendly, and reliable, meaning it’s AWESOME for SysAdmins and homelab enthusiasts.

Official documentation is available HERE

From AndyOnTech

Why You Should Consider Debian Linux in 2025

I’ve spoke about this particular post in the newsletter in the past, but I’ve seen a number of “Why Debian” related posts on Reddit as of late, and even ran into the question on social media in the last week or so as well.

I wrote this article last year, so it’s a bit dated, but all the reasons why you might want to consider Debian Linux all stand in 2026. If you want the gritty details (and a YouTube video!), you can check out the link. Otherwise the short list is here:

· Stability

· Customizability

· Free and Open Source

· Highly Secure

· Fantastic Community

· Excellent Server Performance

· Wide Hardware compatibility

· Long-Term Servicing Options

If you find yourself currently hopping around and testing distros, I highly suggest you consider Debian. New features to do lag from time to time, but Debian can’t be beat in terms of rock-solid stability!

Until Next Week

I want to make sure I say it again. We here at SysAdmin Weekly REALLY appreciate all of you that partake in our content and community. As this weekend brings us the Superbowl in the US, I wish you a quiet weekend and may all your systems stay running, at least until the big game is over.

Until next week, stay frosty!

— Andy @

• Incident response plans and backup / DR strategies are boring, neglected, and absolutely career-saving when things go sideways. Review them before you need them.

• New podcast episode out: When Incident Response Plans Meet Reality, covering what actually belongs in an IR plan, who should be involved, and how tabletop exercises should work in practice.

• Curiosity isn’t optional for SysAdmins. Using short, intentional learning sessions can help you keep skills sharp even when motivation is low.

• Community signal worth your time: strong arguments for using Markdown and the CLI to improve focus, consistency, and long-term maintainability of technical documentation.

From the Console

With it still being somewhat near the start of the year, we’ve been reminding our listeners that it’s a good time to take a look at those…. foundational SysAdmin things that we tend to neglect. This would be things like Backup & DR planning, incident response plans…. recovery testing…etc.

Now to preface this opening section of this week’s newsletter I’m not judging anyone here. I get it. End-users are pounding on your door, mail services went offline AGAIN, and you’ve got a project list as long as the help output for ffmpeg. The last thing you want to think about are incident response plans that should still be good.

Also relevant along these lines and interesting, is our watch / listen metrics for last week’s episode aligns with this mindset as well. In our episode last week Eric and I discussed Incident Response Plans in the Real World and the consumption of that episode was noticeably less than normal. Again, I’m not knocking anyone, it’s just an interesting data point that supports my theory that the average SysAdmin either doesn’t have time for incident response / backup & DR planning or its boring and / or overdone in terms of content, or everyone assumes existing plans are…. fine.

I have to say, that in terms of interest and “general IT priorities”, incident response planning isn’t the sexiest topic, but it is a critical and foundational one. As SysAdmins, it’s our job to insure systems uptime and data safety whether that (thankless) work is visible to the organization or not. An (at minimum) annual review of your incident response and backup & DR plans does a couple things:

· Highlights technical gaps or limitations within critical business infrastructure

· Informs key stakeholders within the business that may have moved / changed / forgot about these initiatives

· Helps prevent overly long outages

· Safeguards company data

· Makes you look like the superhero and INSTANTLY validates your salary the second something happens and you’ve got the magic plan that saves everything

What’s the saying?

“An ounce of prevention is worth a pound of cure.”

Block some time off in the calendar, and soon. Again, I know these items aren’t interesting. They aren’t some shiny new tech that needs to be installed. They aren’t business transforming things, but you’ll be much better served to have them ready (and updated) and not need them, than the other way around. Chaos without a plan is just chaos. Chaos with a plan is still chaos, but at least it’s managed chaos where you come out the hero, and your organization stays out of news.

If you’d like some real world guidance on the review of your incident response plan and backup / DR plan, be sure to check out last week’s episode of the SysAdmin Weekly Podcast listed below!

Also, if you’d like to chime in with your incident response / backup & DR success (or horror) stories, check out this thread on the SysAdmin Weekly GitHub Discussions Board!

A SysAdmin ignoring the incident response plan in favor of cool infrastructure projects

And now…. back to our regularly scheduled programming.

🎙 The latest on the SysAdmin Weekly Podcast

SysAdmin Weekly - 037 - When Incident Response Plans Meet Reality

SysAdmin Weekly - 037 - When Incident Response Plans Meet Reality

Topic: In this week’s episode Andy and Eric discuss one of the most groan-inducing and seemingly boring SysAdmin Topics on the planet: Incident response plans. While many SysAdmins dislike the documentational nature of building (and maintaining) incident response plans, they are one of the most critical components to ongoing operations. To put it shortly, when you need it, you NEED it.

This episode gives you the details on:

· What to include in your incident response plan

· What stakeholders within your organization to involve

· Frequency and details covered during table-top exercises

· Lots more!

The episode also includes the usual nerd-hour talk, VMware / Broadcom gripes…etc.

Episode Links Here!

· All platform links

· SysAdmin Weekly - 037 - On YouTube

· SysAdmin Weekly - 037 - On Spotify

· SysAdmin Weekly - 037 - On Apple Podcasts

The Take - Curiosity Should be a Weekly Mandate for SysAdmins

I wanted to make a short take this week to continue some commentary on the importance of curiosity as a core trait(s) needed by SysAdmins.

It’s easy in this industry to rest on your existing knowledge, but you’ll find that you fall behind pretty quickly. It can be difficult to focus on learning new skills on the regular, especially when it’s (maybe) a technical skill that you’re really not interested in, but is required due to things you have to support during your day job. I find that curiosity helps with the resistance in this situation.

There are certain technical skills that I’ve committed to training myself on over the course of 2026, but they aren’t always the most interesting (I’ll plan a future blog post on this). What I find works well for me is to spend a little time digging into something that I AM highly interested in prior to tackling the “un-interesting” skill. For example, I’ve long been curious about Unity. While I’m not officially a programmer, I dabble. On top of that, I’ve been playing video games now for nearly 40 years, which is basically how long I’ve been able to properly use a controller. As such, I’ve always had an interest in tinkering with game engines and maybe someday building my own game.

With that said, the sequence I’ve found that works well for learning those “un-interesting” skills is the following:

· Define a training time period

· Start with a short session tinkering / training on something that actively interests you. (Unity in my case)

· Actively work on the training / tech that you’re obligated to work on

· Repeat sequence as needed

Is this context switching? Yes… to a degree, and yes, I do hate context switching. But, session lengths should be long enough to where it doesn’t really have an impact. For example, I follow the pomodoro method for just about everything. In this context, I’ll tinker with unity for 25 minutes (one pomodoro) and then commit 2 pomodoros to the other training need.

This method helps make sure that I learn the skills that I need to learn for external reasons, while also keeping my brain engaged and in “learning mode”.

Hopefully this will be as helpful to you as it is to me!

Community Signal

High-signal community work worth your attention.

Ryan Elston – Why I Use Markdown and Why You Should Too

As I’ll shortly be singing the praises of Markdown later in this newsletter, this article by Ryan Elston seemed to be highly relevant. In this post Ryan covers why Markdown is a highly valuable documentational language and even provides a great argument for why you SHOULD be using markdown along with some markdown authoring tools to get started!

Mike Robbins - Write clear step-by-step Instructions Using Markdown

Mike Robbins is also a fantastic source of information about markdown as well as how to properly use it in a how-to format. It’s worth noting that Mike is also a great source of PowerShell scripting knowledge as well! His blog is highly recommended!

Question I Got Asked (and the Real Answer): “Why are you obsessed with the CLI and markdown?”

Boy, it’s been a very commentary heavy week for me throughout this edition, but I feel like this will all provide some value (at least I hope it does).

Those that watch / listen to The SysAdmin Weekly Podcast know that I am an absolute CLI and Markdown nerd. My co-hosts have even made fun of me during certain episodes, which is warranted if I’m honest about it.

It so happens that I have had this question levied at me several times over the past couple of weeks:

*“Why are you obsessed with the CLI and markdown?”

First, valid question. Second, I’ll plan on a long form blog post or YouTube video (maybe both?) that explains my method and the “Why?” behind it.

In short I author ALL of my content using the following tools:

· Kitty (A terminal emulator)

· vim (A CLI-based text editor)

· Git, GitHub, & Gitea (to act as change tracking methods & content repositories)

· Markdown (my documentational language of choice)

· Pandoc (for converting markdown content to finalized formats)

To keep it short and straight to the point here, the core reasons “Why?” are as follows:

· I’m an easily distracted person, and CLI UIs are clean, focused, and purpose-built.

· Markdown is a defined and rule-driven documentational language that should output in concise formatting regardless of the author, assuming markdown principals are followed.

· As part of my job and my tech community efforts I spend A LOT of time authoring content of various types.

· A CLI environment paired with markdown prevents context switching, enables focus, and insures unified and consistent output.

· By using Git and Git-compatible repos I get the full benefit of code-review, pull requests, and commit history through the lifespan of the content

I’ll plan on covering this in a future blog post in more depth or via a podcast episode, but if you have questions you can reach out to me on LinkedIn or feel free to start a thread on the SysAdmin Weekly GitHub Discussion Board!

Until Next Week

Thanks for hanging out with us for another week! May you remain curious in your SysAdmin journey, and may your packets continue to flow as planned throughout the weekend!

Stay frosty!

Andy @

⏩ TL;DR – This Week in SysAdmin Land

• Abstraction is great… until the dashboard lies to you. A real-world Kubernetes + Longhorn storage lesson on why “schedulable” doesn’t always mean usable.

• Running stateful workloads on Kubernetes still requires understanding the underlying storage mechanics, replicas, disk sizing, and node-level constraints matter.

• SysAdmin Weekly now has an official GitHub Discussions home for announcements, technical discussions, polls, and general sysadmin banter.

• New podcast episode out: The Hidden Dangers of Abstraction in Modern IT that covers why deep technical understanding still matters in 2026.

• Community signal worth your time: a grounded take on why you probably don’t need 10 Gbps home fiber, and a smart rethink of how GitHub Copilot should actually be used.

From the Console

I was reminded to embrace curiosity in IT again this past weekend

In perfect timing with our episode regarding abstraction in modern IT (more on that below), I was reminded to embrace curiosity and not blindly trust / follow abstraction layers in modern software.

As many who watch the podcast know, I’ve been slowly converting many of the workloads in my homelab into containers running on a (now) 4-node K3S (Kubernetes Lite) cluster. This project was brought on by a number of things:

· I’ve always leveraged platforms like Azure Kubernetes Service and wanted to get up to speed on running local Kubernetes

· I’ve got aging hardware in my homelab and getting everything to follow Hyper-V best practices is…. difficult

· Distributed Architecture has always been highly interesting to me

· Many of the workloads I run benefit from being stateless

· I’ve rediscovered my love of all things open-source recently, and have taken steps to start using more stuff from the FOSS ecosystem

While, yes, many of the workloads I run can benefit from being stateless, I have several workloads that MUST be persistent, and as such, require persistent storage for data, state, etc…etc. To facilitate this in a clustered and highly-available fashion, I’ve deployed Longhorn to the cluster to provide distributed block storage across the cluster.

It’s an amazing system really. Unlike hypervisor clusters that require high degrees of compatibility checks, fabric deployment & management, etc, Longhorn makes storage configuration STUPID easy. Once setup and configured on the cluster, anytime a new node is added to the existing cluster, Longhorn will automagically ingest the available storage. Storage is spread in a redundant fashion across all the available nodes and fault domains are automatically defined and configured. Abstraction at it’s finest. This is where some of my assumptions caught me by surprise. Here is my high-level storage status for the cluster:

Longhorn Storage Dashboard on K3S

At first glance you could make the (reasonable) assumption that:

· 459Gi Schedulable = Storage I Can Use

· 226Gi Reserved = Reserved Storage for Data Parity and Safety

· 68.3Gi Used = Storage that the cluster is actively using

Imagine my surprise then when I carved off 100Gi for a persistent Debian Apt-Cacher container that the volume would fail to mount or do anything meaningful. See, on the surface, everything seems to work. It seems like I would have PLENTY of room for this workload. However, this is where abstraction was lying to me.

To make a long story short, my limitation is NOT the 459Gi number. The REAL limitation is the smallest available schedulable disk on any node that must hold a replica after accounting for:

· Replica count

· Reserved space

· Disk pressure thresholds

This is information that which had not been presented to me on the dashboard. A 100Gi volume with three replicas needs ~300Gi total and each replica MUST fit entirely on a single disk. If one node can’t fit said 100Gi replica…. game over. No volume attachment for you.

Once I put my assumptions aside, got curious, and acknowledged that this was a case where an abstraction layer was hiding the truth from me, I got the manual out and really dug into how Longhorn handles it’s underlying storage. Once I had that deep technical understanding of the underlying storage system, I was able to make informed decisions without solely relying on the abstraction layer, and ultimately get my workload up and off the ground after making different architectural decisions.

It was sobering to run into the very dangers of abstraction that we had JUST gotten done talking about on SysAdmin Weekly so quickly after posting that episode (last week - see below). Also, to be fair to Longhorn, that information is surfaced within the dashboard, just not in THAT particular view. This is, again, how abstraction (and assumptions) can get you into trouble.

So remember, when you run into a situation where things seem one way, but you have that gut feeling that not all appears as it should, ask yourself if you have all the information. Do you truly understand everything under the hood? You’ll be a better SysAdmin for it.

And now…. on to our regularly scheduled programming!

SysAdmin Weekly Announcements

As I’ve mentioned in several episodes of the podcast, we’ve been working on a defined community “hangout” spot that we can use for announcements, community conversations, knowledge sharing, questions, polls…etc…etc. Well I’m happy to announce that said initiative is complete and we now have an official GitHub Discussions repository setup specifically for this purpose.

You can find the SysAdmin Weekly GitHub Discussions Repository Here!

Why GitHub Discussions?

My one hard requirement for any community gathering place was low barrier of entry. Applications like Discord / Slack, while good, require users to download an app and / or setup an account. MOST SysAdmins will already have a GitHub account and GitHub is widely supported in both desktop web browsers as well as on mobile.

The notifications system is simple as well. For example:

· If you just want a quick shortcut to the SysAdmin Weekly discussions repo, just star it.

· If you want granular notifications based on activity, “watch” the repo instead.

What Type of Content Can We Expect There?

You can expect to find:

· Show / Newsletter Announcements

· Discussion Posts for the latest episode / edition of both the podcast AND the newsletter

· Polls about content you’d like to see more of on the show

· Technical Discussions

· Q & A

· Helpful scripts / tools like I posted here

· Friendly Banter

· Etc…

What Do I Need to Do to Get Started?

Outside of setting up a GitHub account in the off chance you don’t have one? Nothing! Feel free to check it out and Introduce yourself, if you’d like! (optional)

🎙 The Latest on the SysAdmin Weekly Podcast

SysAdmin Weekly - 036: The Hidden Dangers of Abstraction in Modern IT

SysAdmin Weekly Podcast Episode 036

Topic: In our first episode of 2026, Andy and Eric dive into the topic of rampant abstraction in modern IT. While yes, abstraction layers have solved many scaling issues over the last decade, there IS a hidden cost. Do SysAdmins still have that deep technical understanding of the entire stack? This episode explores that question in depth!

Why this one matters:

· This episode highlights the dangers of relying heavily on abstracted features & deployments without deep understanding

· Should something break under abstraction layers, SysAdmins are often at the mercy of a vendor to solve the issue.

· This epsiode contains some tips and tricks to help you ensure that your skills are at a point where you can benefit from abstraction layers, but NOT be dependent on them.

Community Signal

Here are some super-cool community links I’ve stumbled upon recently. Highly recommended!

Didier Van Hoye – Do I really need 10 Gbps fiber to the home?

Didier cuts through the marketing noise around ultra-fast residential fiber and lands on a conclusion most practicing SysAdmins already know: raw bandwidth is rarely the real bottleneck. Using his own home setup as an example, he shows how a relatively modest fiber connection is more than sufficient for remote work, lab access, and day-to-day operations, especially when most heavy lifting stays local. The real value here is the reminder that stability, latency, and realistic workload analysis matter far more than chasing headline speeds, and that blindly upgrading capacity without a matching use case is just another form of abstraction-driven decision making.

Luise Freese – Stop using GitHub Copilot as a chatbot!

Luise takes a hard look at the common pattern of treating GitHub Copilot like a chat-based coding partner and explains why that workflow almost always feels fragile and slow. This is not because the model is dumb, but because the interaction model is unstable. Rather than prompt, re-prompt, and steer in chat until something sticks, the article argues that you get far better results by encoding stable constraints and task definitions in files before ever calling Copilot, so the model can actually execute against known invariants instead of chasing shifting context. This post reframes Copilot from a reactive autocomplete toy into a tool that thrives within explicit structure, which is a valuable shift in mindset for anyone trying to use AI in software development.

From AndyOnTech and Project Runspace

AndyOnTech

Regular listeners of the podcast will know I went on something of a…. “rant” during the last podcast episode of the year. In said rant, I explained how there are no longer any good web browsers available in the marketing today. I recently posted a lengthy blog post along the same lines if you’re interested. I’ve linked that below, along with the Podcast episode from late last year on the same topic:

· There Are No Good Web Browsers Left (and It Is a BIG Problem)

· SysAdmin Weekly - 035 - AI Browsers, Chromium Monoculture, and the Future of Browser Security

Handy Tool - Pomocli

Full disclosure: This week I am selfishly promoting my own tool. That said, I can hardly call it a “tool” and more of a “anti-context switcher”. Folks that know me know I’m a BIG markdown guy and love to create my content within the terminal. Context switching is highly impactful on my output, so I go to great lengths to prevent it if possible.

Awhile back I had released a very simple cli tool called Pomocli that acted as a terminal-based pomodoro timer. It would ask what you planned on working on, log that to a text file, then start a timer. I always liked it’s lightness…. but hated how it looked. I recently started tinkering with building basic UIs using Ncurses and Python. As a result, I decided to rebuild Pomocli with a curses-based UI that still fills the same role with the added feature of allowing you to browse previous work sprints.

Pomocli image

You can find Pomocli HERE

I hope you all find it as useful as I do!

Until Next Week

Thanks for reading this week’s edition! I really hope everyone is enjoying the new, more conversational format! If you have any feedback or would like to see a specific topic discussed, be sure to let us know on the SysAdmin Weekly GitHub Discussions Board!

May your systems stay running, and may you avoid maintenance at 5pm on a Friday!

Stay Frosty!

--Andy @ SysAdmin Weekly

· The newsletter is evolving! This means fewer link dumps, more opinion, commentary, and real-world SysAdmin pain from the trenches.

· Theme of the week: Craft vs. Shovelware and why modern software feels more brittle, less thoughtful, and far more hostile to operators.

· A real-world rant with receipts: Microsoft Authenticator quietly falling over once you manage a lot of accounts… and the only fix being “nuke from orbit and start over.”

· The latest SysAdmin Weekly Podcast digs deeper into “good enough” software and why SysAdmins are the ones paying the price for it.

· Community Signal highlights thoughtful takes on whether software is actually getting worse. Plus practical Azure Local update guidance you’ll actually need.

· Other links worth your time this week include one rock-solid security podcast and one non-technical sanity-preserver (because balance matters).

· Looking ahead: plans to spin up GitHub Discussions as a low-friction, SysAdmin-friendly place to keep conversations going beyond the podcast and newsletter.

An Update on the Newsletter

First off, I’m sensitive to the fact that we’ve been away on this newsletter for quite sometime (4 weeks?) and I’m also very aware that I’ve provided MANY “Updates on the Newsletter” like this over the last month or two. The fact of the matter comes down to two things:

1. With the day job, the podcast, and a VERY time intensive side-project I’ve been working on, getting to this newsletter has been inconsistent and difficult.

2. I haven’t been 100% feeling the “vibe” of the newsletter format we’ve been using up until this point. Statistically “Link-dump” newsletter are one of the most common and while, yes, they can provide some value depending on the quality of the links, dumping a collection of links each an every week just to provide a collection of links doesn’t produce CONSISTENT value that I personally find worthy of your time.

Moving forward this newsletter will serve as much more of a commentary and opinion-based newsletter remaining laser-focused on SysAdmins and the challenges they face in the trenches every day. Will there still be some links? Sure, but the format will change to content that is much more conversational in style which provides a better backdrop for me to produce that CONSISTENT value that I want to provide this community.

If you have comments or concerns about the new direction, do let me know in the discussion section below!

From the Console

Our theme for this week’s edition of the newsletter focuses on “Craft vs. Shovelware”. I’ve been in the industry long enough now to recognize that software seems to be more brittle and problematic now than it used to. The amount of times that I’ve had to employ some sort of workaround to a seemingly simple-to-solve bug in order to keep production live has certainly increased over the years. And yes, our environments are wildly more complex than they used to be what with cloud and hybrid deployments and yes, that introduces EXTRA chances for breakage. This does not however account for cases where applications operate in a way that is woefully unhelpful to the user.

I’ll provide my own example on this one. I have been a LONG time user of the Microsoft Authenticator app for MFA and Identity services across a number of tenants in Entra ID and various 3rd party accounts. As of this writing I have around 43 different accounts managed within the Microsoft authenticator app. One day, I tried to add account number 44 to the app and I get hit with a big nasty “device token error”. Long story short, it seems I’ve hit a community-experienced, but non-Microsoft documented issue with the authenticator app where either there is a some soft-limit on number of accounts or there is underlying token corruption. Either way, I am unable to add any more accounts until I rip and restore ALL 43 accounts currently in my authenticator app….. needless to say… I was NOT impressed.

As mentioned, Microsoft has never documented a maximum number of accounts supported by the Microsoft Authenticator app (that I’ve been able to find). However, there is substantial real-world community evidence that the app does not scale reliably for users managing dozens of tenants / accounts. Admins frequently report that once they reach a high number of accounts, Authenticator begins failing to add new accounts or register push notifications, often producing vague registration failures or “device token errors”. One commonly cited message states: “Error changing device token. You must delete and reactivate your accounts to correct the issue,” effectively forcing a full MFA re-registration across all accounts.

Microsoft’s public documentation focuses instead on per-user Entra ID limits (such as the five registered authenticator devices limit), while offering little guidance on app-level scalability or token exhaustion. Community discussions on Microsoft Q&A and Reddit consistently describe these token-related failures and the same recommended remediation of “delete and re-register” suggesting an undocumented Authenticator scalability or push token management issue rather than isolated user misconfiguration.

Which brings me to my point of this whole rant about software quality in the modern day and user-expected app behavior. I’m completely fine with imposed limitations on software (such as max number of supported accounts) as that is something that I, as a SysAdmin, can plan and architect for. What I would have expected in this situation, if my suspicions about scalability and token issues are correct, is a warning at ~30 accounts “Max number of accounts reached”. Instead we get silent breakage, and to quote Ultron from Avengers: Age of Ultron,…“Boom… the end… start again”.

All this is to say, software development needs to once again be given the time and consideration to be a “Craft” again. What we currently seem to have is a hastily built software “content-pipeline” that is designed to push features extra-fast and squeeze maximum revenue from every byte. Something’s got to give.

And now, back to our regularly scheduled programming.

🎙 The Latest on the SysAdmin Weekly Podcast

This week I had regular co-host Eric Siron back on the show to discuss the very issue of “Good Enough” software mentioned above. You’ll find that it’s deeply attuned to this week’s theme.

SysAdmin Weekly Episode 034 Thumbnail Image

Episode: “Good Enough” Software is Ruining IT (and SysAdmins are Paying the Price)

Topic: Software enshitification has been a real issue in the industry lately and there are real consequences (both spoken and not) of that fact. One of those consequences is the fact that SysAdmins are usually the ones that are facing the full brunt of poorly written software that was deemed “good enough” at some point. In this episode Eric and I (Andy) discuss the state of software in our industry while lamenting a time when software was a craft, and NOT just a content pipeline.

Episode links below:

· SysAdmin Weekly on YouTube

· SysAdmin Weekly on Spotify

· SysAdmin Weekly on Apple Podcasts

· SysAdmin Weekly Website

Community Signal

While researching the aforementioned issues regarding this week’s theme. I did happen upon some useful community posts along the same vein or similar:

• This older post on the Stackoverflow Blog by Issac Lyman that asks the question “Is software getting worse?” Issac has a very fair and reasoned look at the question, and even though I’m not a developer, I greatly enjoyed reading it. I highly suggest you check it out.

• I also wanted to include some practical SysAdmin help from the community this week, starting with How to Keep your Azure Local Instances Up to Date by Thomas Maurer! More SysAdmin’s are finding themselves in a situation where they’re starting to rollout Azure Local, so this knowledge is a MUST have.

Other Links Worth Your Time

As I’m a regular podcaster, I often get asked which podcasts do I regularly listen too. I’ll provide one of my favorite technical podcasts, and one more…. hobby related.

• My technical podcast recommendation is very security related, and I’ve mentioned it on SysAdmin Weekly several times. That is the Security Now Podcast featuring Steve Gibson. Steve does an AMAZING job of explaining cybersecurity topics and when you listen to an episode of this show, you’ll learn more about the given topic then you ever thought possible! Highly recommended!

• My NON-technical choice has to do with my long-standing gaming addiction. I’ve been playing video games since I was old enough to hold a controller and I love listening to Remember the Game. Adam (the host) does an amazing job of keeping things interesting and funny. If you’re a long time gamer like me, you won’t regret putting this one on your list.

Building the SysAdmin Weekly Community

A final closing note on my efforts to continue developing our growing community. It’s come to our attention that we need a place that is quicker when it comes to communications. Something that can be used for announcements as well ongoing discussion. While we could certainly comment on each episode posting as well as the newsletter comment sections here, the goal is to have a centralized location where most of the community conversation happens.

As it stands, I’m currently looking at using Github Discussions for this purpose. Most SysAdmins will already have a Github account, and it doesn’t require a new app to be installed, so the barrier to entry is low. Be on the lookout for this new hangout in the coming weeks.

Retro SysAdmin Fact of the Week

Don’t forget. For years, many enterprise systems treated a two-digit year as “good enough” and it could have taken down the world.

The Y2K problem wasn’t a mysterious bug or media hysteria; it was the logical outcome of early storage constraints and yes, short-term thinking. To be fair, saving two bytes per record mattered when memory and disk were measured in kilobytes. Meaning developers stored years as YY instead of YYYY. This “temporary workaround” quietly became the norm. When that calendar rolled to 2000, systems didn’t fail because they were old, they failed because, let’s face it, no one expected them to still be mission-critical 10, 20 or 30 years later. Y2K remains one of the most successful IT and SysAdmin remediation efforts in history.

See? The concept of “we’ll fix it later” has been around for a VERY long time.

Until Next Week

Thanks for reading this week’s edition! If you haven’t yet, be sure to hit that subscribe button. It’s free and you’ll get useful, maximum-uptime quality content in your mailbox every week to help you in the SysAdmin trenches. Also feel free to share with another SysAdmin. For real…. we want to help as many people out of unintended systems outages as possible.

Additionally you can always find all the links associated with this newsletter and the podcast at www.sysadminweekly.com.

Until next week! Stay Frosty!

-Andy
SysAdmin Weekly

· We’ve got a truly spooky Halloween-themed podcast this week (because who doesn’t like horror stories with servers?).

· Major critical patch alert: CVE‑2025‑59287 in Windows Server Update Services (WSUS) is actively exploited - if you run WSUS, patch now.

· We’re revisiting network fundamentals with the OSI model - yes, dust off your layer cake, we’re serving up layer 1 to 7 for your next troubleshooting session.

· Strong community content this week: Linux stress-testing, Azure Local overview, a data-driven look at Apple Silicon CPU core frequencies.

· Tool of the Week: a slick terminal app that could become your new favourite toy.

· Quick Win & Retro Fact - because even infrastructure nerds deserve a little snack.

· Wrap-up with a plug for next week’s podcast (you know you’ll listen).

An Update on the Publication

I greatly appreciate all the readers of this newsletter and you may have noticed an absence of the publication for the edition that was to come out two weeks ago. As folks that watch the podcast know, there has been A LOT of projects (both personal and professional) on my plate over the last month or two. This time of year is typically my busiest time of year and sadly something had to give. That said, I’m through my backlog, and looking forward to continue providing regular editions of this newsletter once again!

This Week’s Insight(s) from Andy

Theme for this edition: “Patch & Pivot: From Fundamental Layers to Active Threats”
In this issue, we’re straddling both ends of the SysAdmin spectrum: going back to the bedrock with the OSI model (don’t roll your eyes yet) and facing forward into the very real, very active world of exploited vulnerabilities (yes, the WSUS one). The juxtaposition is intentional: whether you’re explaining Layer 3 routing to a junior or scrambling to fix a critical RCE in your update infrastructure, the mindset of “understand deep; act fast” is what differentiates the average from the excellent.

When it comes to cybersecurity, and more importantly achieving real security outcomes, the mantra “understand deep; act fast” can feel intimidating for those pivoting into the security space. But here’s the truth: cybersecurity pros are often the ones in the room who understand their tech stack *most* deeply.

Why? Because to truly secure something, you have to understand it from the kernel up. Every layer, every dependency, every quirk. Yet, in a world obsessed with abstraction, we’ve drifted away from the underlying mechanics that keep our systems alive. That blind spot? It’s exactly where threat actors love to play.

So how does that tie into this week’s theme Patch and Pivot? Patching is easy. Anyone can apply an update and move on. But pivoting? That’s where the real challenge lies. SysAdmins are now standing at the crossroads of IT and security, and the ones who thrive will be those who dig deeper the ones who move beyond “apply patch” and into “understand why it matters.” Because real defense starts where surface-level understanding stops.

So if you’re a SysAdmin today, don’t wait to be handed a security title, start learning the internals your tools hide. You can’t protect what you don’t understand.

And now, back to our regularly scheduled programming…..

Latest on the SysAdmin Weekly Podcast

This week’s episode: Halloween “SysAdmin Horror Stories” - join Andy as he and guests spin real-world tales where things went terrifyingly wrong in infrastructure, cloud, and on-prem. Yes, there’s ghosting, haunted servers, and maybe even a spectre of unmanaged firmware creeping through the data centre.

What You Missed on Last Week’s Episode of SysAdmin Weekly

Last week’s episode: University IT training vs real-world readiness - Andy and guest Clay Tamam dove into whether formal IT degrees truly prepare sysadmins for the trenches, or if bootcamps, on-the-job hacks, and real mistakes carry more weight.

Sneak Peek of an Upcoming Episode

Next week: Andy and Eric talk about the “enshitification” of tech vendors and how vendor behavior has shifted from partner to parasite, what happens when the vendor plays you more than you play the tech, and what SysAdmins can do about it.

From AndyOnTech

How to stress-test Linux - A clean, practical walkthrough on putting your Linux boxes through controlled chaos. Covers CPU, memory, GPU, and I/O stress testing with just enough explanation to understand what’s actually happening under the hood. It’s the kind of test you’ll wish you ran *before* production went sideways. Perfect weekend lab project for anyone running a home server or validating hardware stability.

Core Fundamentals

The OSI model explained - It’s old-school, yes, but still gold. Understanding each of the seven layers gives you the lens to pinpoint where things go sideways: from physical cabling (Layer 1) to application behavior (Layer 7).

Helpful Community Content

• How to restore deleted Entra ID conditional access policies and named locations - From Jan Bakker: a lifesaver when someone nukes your conditional access by accident.

• Azure Local overview video - From Thomas Maurer: what Azure Local is, why you might need it, and how it fits with edge/distributed stuff.

• Updated CPU core frequencies for Apple Silicon Macs - Data-driven deep dive for the Apple side of the house. Cool geek reading.

Other SysAdmin Content from Vendors and Official Publications

· Fedora Linux 43 has been released - New features, new kernel, new life for test labs maybe.

· Windows 11 Insider Preview Build 26120.6982 (Beta Channel) announced - If you’re running lab machines or poking at future client OS behavior: heads up.

Security Headlines for SysAdmins

· Critical WSUS vulnerability: CVE-2025-59287 – patch immediately - This one is massive. A remote, unauthenticated RCE in WSUS, CVSS 9.8, active exploits. If you have a WSUS server role enabled: stop reading, go patch.

· Cybersecurity and Infrastructure Security Agency (CISA) updates their Known Exploited Vulnerabilities catalog - They’ve flagged the WSUS vuln among others; this isn’t hypothetical anymore.

Tool of the Week

Ghostty - A slick terminal-application you’ll want to try: for those nights when typing at 3 AM and wondering whether your shell can be cooler. Go ahead, indulge your inner penguin.

Quick Win of the Week

Check your inventory/CMDB and ask the question: “Which servers have the WSUS Server role enabled and are listening on ports 8530 or 8531?” If you find any, prioritize patching or isolating them immediately. You might just win this week before the next alert hits.

Fun Retro SysAdmin Fact

Back in the day, the architecture for the mainframe and minicomputer era relied on multi-user terminals connected via RS-232 lines (often at 9600 bps). That meant many sysadmins were night-shift heroes with endless string lights of terminal screens. Integrity of those lights vs. modern dust-filled racks? It’s evolution, baby.

☕ Wrap-Up

Thanks for riding shotgun with me through this week’s edition of SysAdmin Weekly remember: “Fundamentals + Vigilance = Survival.” If you only take one thing from this newsletter, make it patch early, understand deeply.

Don’t forget to tune into the podcast over at www.sysadminweekly.com and drop us a rating or share your own horror story (especially around midnight). Until next week: stay sharp, stay curious, and yes… stay spooky.

· Running on-prem LLMs gets real with Ollama

· Home lab talk and blueprints from Project Runspace

· PowerShell Select-Object deep dives

· Azure Hybrid Benefit for Linux explained

· A Study from OpenAI on LLM hallucinations

· The Jaguar ransomware story continues + sudo exploit headlines

· BookStack as a documentation MVP

This Week’s Insight(s) from Andy

This edition leans into a theme I’m calling “Reality Checks”. In this context that refers to the messy truth between our ideal architecture diagrams and what actually breaks in production. From AI hallucinations to credential leaks, active exploits, and big companies being breached, tech doesn’t always respect our boundaries. My note this week will tie those stories together and challenge you (and me) to stay humble, vigilant, and ready to adapt.

It’s funny that this edition also features podcast episodes that discuss lab build-outs and local LLM architecture discussions. It’s funny because I can think of several cases throughout my career where the architecture was initially made with assumptions but ultimately wasn’t the correct architecture in the end. One example that comes to mind is from when Microsoft RDS (Remote Desktop Services) was the new cool-kid on the block. The provider I was with at the time had been servicing a large customer who wanted to start leveraging the thin-client model and use co-located RDS services for end-users.

On-paper the architecture followed all Microsoft best practices and each RDS host was specced in a way that followed industry standards as well as those recommended by the customer’s business applications and developers. Well, it turned out that due to the way one of said applications consumed memory, it didn’t become clear what the full needed RDS host memory requirement was until switch to production. Even the software vendor claimed that all should be well on shared infrastructure like RDS. Spoiler alert…. it wasn’t. Even the small test sample prior to going live didn’t surface memory contention.

The result? Poor performance on launch day due to an unforeseen memory consumption issue. We had RDS servers crumbling under the weight of 3 to 4 times more memory usage per session than what the architecture called for. Needless to say, these systems were paging memory like crazy and performance was…. less than stellar.

The moral of the story? We can’t make assumptions and take vendor guidance at face value. Question everything and test everything. Challenge your own assumptions. Because at the end of the day, if you don’t, Murphey’s Law will challenge them for you…. and not usually in a way that you prefer.

And now… back to our regularly scheduled programming….

Latest on the SysAdmin Weekly Podcast

Running LLMs On-Prem with Ollama
Andy and Mike Nelson dig into what it looks like to host large language models in your own datacenter (or basement). They wrestle with resource demands, deployment strategies, use-cases, and integration headaches. If you’ve ever thought “AI → Cloud only,” this episode might shake your assumptions.

What You Missed on Last Week’s Episode of SysAdmin Weekly

Building a Home Lab on the Cheap
Andy and Eric walk through how to bootstrap a functional home lab without draining your bank account. From repurposed hardware to clever virtualization, it’s the kind of episode you revisit when your budget says “no upgrades this year.” Great lessons for both newcomers and seasoned admins alike.

Sneak Peek of an Upcoming Episode

SysAdmin Horror Stories (Coming Late October)
We’re stitching together a “hall of horrors” version of SysAdmin life, complete with outages, screw-ups, and lessons learned. Want your story immortalized? Send it to contact@sysadminweekly.com (shame optional). Be sure to anonymize as needed……just don’t leave the punchline out.

From Project Runspace

How to Build a Home Lab for Learning Server Administration
Eric’s post here is a companion to last week’s podcast: it breaks down physical vs. virtual choices, pitfalls to avoid, and how to structure a lab you’ll actually use. Think of it as your lab’s blueprint……don’t build blind.

Core Fundamentals

The Windows Boot Process
Here’s what actually happens when a Windows box powers on: first the Windows Boot Manager, then the OS loader, then resume loader (for hibernation/fast boot paths). All boot settings are tucked in the BCD, editable with bcdedit (or MSConfig for the less adventurous). Add in Secure Boot, Trusted Boot, and ELAM, and you’ve got multiple layers defending your system before the user even signs in.

Helpful Community Content

PowerShell Select-Object Deep Dive
Andrew Pla and Fred Weinmann dig into how Select-Object can be wielded for cleaner, more efficient pipelines. If your PowerShell scripts feel messy, this is the kind of polish you need.

Upgrade to Windows 11 25H2 via Intune
Joey Verlinden walks through using feature update policies in Intune to push 25H2. Its helpful if you manage many endpoints and want a smooth upgrade path.

Azure Hybrid Benefit for Linux Explained
Thomas Maurer and Shreya Baheti detail how you can bring existing Red Hat/SUSE subscriptions into Azure, cutting redundant licensing costs and potentially saving a boatload vs pay-as-you-go.

Other SysAdmin Content from Vendors and Official Publications

Why Language Models Hallucinate
OpenAI turns the microscope inward and explains how hallucinations arise from how models are trained and evaluated. The takeaway? Some hallucinations are baked into the design, not just sloppy inputs. Understanding this helps you build more resilient systems around AI outputs.

Security Headlines for SysAdmins

Jaguar / Land Rover Ransomware & Data Theft
Even massive firms get hit. Factories went offline, data was stolen, and initial denials gave way to a public breach. Lesson: size ≠ immunity.

Sudo Vulnerability Under Active Exploitation
The --chroot (-R) handling in sudo has a flaw being exploited in the wild. Local privilege escalation, bypassing sudoer rules — patch now, test quickly, and verify mitigation.

Tool of the Week

BookStack
A lean, self-hosted documentation platform built on Laravel. Supports WYSIWYG and Markdown editors, roles/permissions, and structured books/chapters. If you need a central place for runbooks or team docs, BookStack is a strong option without the overhead of massive wiki stacks.

Quick Win of the Week

Fire up a BookStack instance (Docker, VM, whatever), import one critical doc (onboarding, firewall rules, etc.), and force yourself to use it exclusively for one week. That tiny shift centralizes knowledge, surfaces gaps, and starts cracking down on siloed knowledge.

Fun Retro SysAdmin Fact

Back in the day, Microsoft’s BootVis was a tool for profiling and optimizing Windows boot performance. Now, we take near-instant VM boot and container snapshots for granted, but sysadmins still can’t resist chasing those milliseconds.

☕ Wrap-Up

That’s all for now. We’ve walked through AI realities, lab ambitions, boot internals, and real-world security failures. The disconnect between expectation and execution is where we earn our stripes. Stay grounded, stay skeptical, and never trust assumptions.

Don’t forget:
- Send your horror stories for October to contact@sysadminweekly.com - Share this newsletter with a SysAdmin peer
- Hit reply with your feedback, war stories, or what you’d like us to cover next

Stay curious,

Andy

· SysAdmin Weekly is moving to bi-weekly for deeper insights and less noise.

· New podcast episode digs into why documentation matters and how it saves your future self.

· Last week’s podcast broke down Conditional Access, including pitfalls, best practices, and lessons learned.

· Eric Siron shares tips on writing trouble tickets that actually get resolved.

· This week’s fundamentals spotlight is Linux basics, because cloud = Linux.

· Community voices highlight AI storage internals, running local AI agents, and Apple’s new disk image format.

· Apple preps macOS Tahoe with new fixes and updates for admins to tackle.

· Security headlines: worm-driven NPM supply chain attack and the Windows 10 support countdown.

· Tool of the week: Greenshot, the lightweight screenshot sidekick every sysadmin needs.

· Quick win: document one “failure mode” in your environment to save yourself later.

Schedule Change Announcement

SysAdmin Weekly - the Newsletter is going bi-weekly. Why? More value, less filler. This newsletter was always intended to be a supplement to the weekly podcast episodes and by doubling the time between issues, I can deliver insights and context instead of dumping a pile of links in your inbox. Quality over quantity…because your time is worth more than another unread newsletter.

NOTE: The podcast is our core content, and will remain (as always) on a weekly cadence!

This Week’s Insight(s) from Andy

This week ties together docs, tickets, lifecycle planning, and tooling. They’re not just chores they’re narratives. Documentation is the history book, tickets are the plot twists, OS lifecycles mark the chapters, and tools like Greenshot are the illustrations. Together, they tell the story of how systems live, break, and (hopefully) recover.

We’ve touched on learning in tech before, and I’ve found that storytelling, putting context around tech and solutions, is one of the most powerful ways to learn. Sure, the “cautionary tale” is classic IT lore, but there are also quieter stories worth telling: the “why do we do this” moments.

I think about the “why” a lot. Like when helping a nonprofit expand digital capabilities meant they could assist more people. Or when a medical customer’s patient database was down hard, and restoring it kept labs, imaging, and follow-up appointments running. Or in manufacturing, where IT-driven cost savings during a downturn literally kept entire teams employed.

Stories in IT aren’t just learning tools. They’re reminders of the very real human impact behind the job. So, the next time you’re buried in day-to-day sysadmin chaos, remember your “why.” Those stories you’ve lived? They matter.

And now… back to our regularly scheduled programming.

Latest on the SysAdmin Weekly Podcast

SysAdmin Weekly - 022 - Why IT Documentation Matters (Even if you Hate Writing it): Fresh episode just dropped today: Why Documentation Matters in IT. Eric and I talk about how documentation is your future self’s life raft, and that’s whether it’s recovery steps, config notes, or “who owns this service.” We share horror stories of missing docs causing chaos and give tips for making documentation suck less: structure, ownership, and findability.

What you Missed on Last Week’s Episode of SysAdmin Weekly

SysAdmin Weekly - 021 - Microsoft Entra ID Conditional Access Explained: Last week, Paul Schnackenburg joined me to dive into Conditional Access. What it is, why it matters, and where admins trip over implementation. We talked pitfalls (breaking workflows with too-tight policies), benefits (keeping accounts secure), and shared some real-world war stories. If you’re rolling out Conditional Access, this one’s your crash course.

Sneak Peek of the Next Episode

Coming up next week on SysAdmin Weekly: Building a Home Lab on the Cheap. We’ll be covering how to get started without draining your wallet. This includes hardware hacks, cloud freebies, and creative virtualization tricks.

I’d love to hear your homelab setups and stories. Share them with me, and I might feature a few in the show!

From Project Runspace

How to Submit an Effective Trouble Ticket - Eric shares some clear, actionable guidance on writing tickets that don’t get bounced around. Provide context, logs, what you tried, and what you expected. Better tickets = faster fixes and fewer headaches.

Core Fundamentals

Introduction to Linux (Linux Foundation Free Course)

Linux runs the world. This includes things like cloud workloads, containers, IoT, even your kid’s smart fridge. If you’re in IT and not comfortable on Linux, now’s the time. This free course gets you hands-on with the basics and helps you level up where it counts most.

Helpful Community Content

How Azure Storage Powers AI Workloads - Pierre Roman and Vamshi Kommineni explain how Blob Storage handles AI at scale. Storage isn’t just dumb disks anymore; it’s AI fuel.

Docker MCP Toolkit: Local Agentic AI Made Easy - Thomas Thornton breaks down running local AI agents with Docker’s MCP toolkit. Simplifies experimentation and orchestration for sysadmins tinkering with AI.

Apple’s New ASIF Disk Images - Howard Oakley benchmarks and explains who should care about Apple’s new format. If you deploy Mac images or deal with storage optimization, worth a read.

Other SysAdmin Content from Vendors and Official Publications

MacOS Tahoe Release Notes - New tweaks, fixes, and security updates. Admins managing Mac fleets should scan this closely for compatibility issues. Expect some patching fun and maybe a surprise or two in the UI changes.

Windows 10 End of Support - The end is near. If you’re still running Win10, plan upgrades now. Test legacy apps, drivers, and licenses before your helpdesk tickets explode.

Security Headlines for SysAdmins

Self-Propagating Supply Chain Attack Hits 187 NPM Packages - A worm-style exploit in npm packages. Mitigation tips: lock dependencies, use checksums, scan your supply chain, and restrict build agent permissions. Don’t let your CI/CD pipeline turn into a trojan horse.

Tool of the Week

Greenshot is Lightweight, open-source, and a sysadmin’s secret weapon for docs and tickets.

· Grab screen regions, windows, or even scrolling pages.

· Annotate, highlight, blur, and obfuscate sensitive bits.

· Export directly to clipboard, files, or email.

Greenshot is faster than Windows’ built-in tools and makes documenting issues painless.

Quick Win of the Week

This week’s theme is Infrastructure as Storytelling. Quick win: Pick one critical service and document its “failure story.” Who gets notified? What breaks? How do you fix it? Run the drill once and you’ll thank yourself when the lights go out.

Fun Retro SysAdmin Fact

SysAdmins in the ’80s swapped patches and tools on dial-up BBSs. Picture sitting by a phone line, listening to screeches, and praying no one picked up the phone mid-download. Kids today will never know the pain of a 2-hour patch download interrupted by mom making a call.

☕ Wrap-Up

That’s it for this round. Thanks for reading and keeping the lights on in IT.

New podcast goes live weekly: SysAdmin Weekly on YouTube — subscribe, share, and drop a comment.

Catch all past issues, resources, and extras from the newsletter at newsletter.sysadminweekly.com.

Stay caffeinated, stay patched, and stay sane.

- Andy

· 📅 Newsletter schedule shifting to mid-day Wednesdays (because mornings = ticket hell).

· 🎙️ New podcast: Top Microsoft Skills every SysAdmin should have.

· 🛡️ Security watch: Cloudflare caught up in Salesloft Drift mess + Microsoft deep dive on Storm-0501.

· 📩 Microsoft limiting email from .onmicrosoft.com domains.

· 💳 SSA database leak reminder: consider credit freezes (especially for kids).

· 🔧 Tool of the week: Pi-Hole (because ads are malware with better PR).

· 📰 Great community content: decision-making for SysAdmins, OpenStack POCs, career pauses, and retention policy scripting.

📢 Schedule Change Announcement

Heads-up! We’re moving the newsletter drop to mid-day on Wednesdays. Why? Because most of you are knee-deep in tickets, outages, and weird printer issues on Tuesday mornings. Consider this your mid-week coffee break instead of a Tuesday-morning distraction.

💡 This Week’s Insight(s) from Andy

If you think about it, most of a sysadmin’s job is building and maintaining guardrails.

Sometimes they’re technical, like Pi-Hole blocking junk traffic, retention policies keeping lawyers happy, Conditional Access stopping “Bob in Finance” from logging in from Timbuktu. Other times, they’re life-related, like freezing credit after a breach so the bad guys can’t open a mortgage in your kid’s name.

This week’s news is a reminder that attackers are constantly hunting for the gaps. Our job isn’t to stop every car on the road, it’s to make sure they don’t plow through our lane. Guardrails may not be glamorous, but without them, the crash is inevitable.

As many readers of this publication and subscribers of the podcast know, I’ve spent a good chunk of my career either as the customer of MSPs, working for an MSP, or selling to MSPs as a vendor. MSPs thrive on process and iteration, and the same can be said of most internal IT departments.

I’ve seen what happens when guardrails are missing. Take one customer I supported many years ago: they didn’t have any M365 rules in place to alert on the creation of inbox forwarding rules. A malicious insider with high-level IP access set one up that quietly forwarded sensitive data to a competitor. Without guardrails, security was an afterthought and abuse was inevitable.

Guardrails aren’t just about security though. RAID, for example, is a guardrail for your data. Without it, you’re a single drive failure away from disaster. Whether it’s data resilience or security posture, the guardrails we build and maintain are critical to the safety of both our businesses and the digital world we support.

Take that responsibility seriously. Build guardrails. Maintain them. And keep the chaos at bay.

And now…. back to our regularly scheduled programming.

🎧 Latest on the SysAdmin Weekly Podcast

Episode 020: The Top Microsoft Skills Every SysAdmin Needs
Eric and I break down the must-have Microsoft skills for today’s SysAdmins. Topics range from Entra ID know-how to keeping your PowerShell chops sharp. We talk about why old “checkbox” skills aren’t enough anymore, and which modern Microsoft tools really separate the heroes from the merely competent.

⏪ What You Missed on Last Week’s Episode

Episode 019: What Counts as a Security Breach (and What Doesn’t)
Last week we dug into the messy gray area of “breach” vs. “incident.” Not every phishing click means a headline, but downplaying real breaches is dangerous too. If you’ve ever had management panic over nothing (or shrug at everything), this episode is worth a listen.

🔮 Sneak Peek of the Next Episode

Next week, Paul Schnackenburg is back! We’re tackling Conditional Access in Entra ID. Expect practical advice, war stories, and why ignoring “break glass” accounts is like skydiving without a backup chute.

📝 From AndyOnTech and Project Runspace

Decision Making for SysAdmins and System Architects — by Eric Siron
Eric argues that the best SysAdmins aren’t the fastest typers or the fanciest scripters. They’re the ones who make the smartest calls before touching a config. This article covers mental models and structured thinking that help you avoid firefights before they start.

📚 Core Fundamentals

Microsoft AI-900: Azure AI Fundamentals
The AI buzz isn’t going away anytime soon. This entry-level cert introduces you to Azure’s AI services, responsible AI practices, and core concepts. Even if you never become an AI engineer, it gives you enough grounding to call BS in the next vendor pitch.

👥 Helpful Community Content

Azure Essentials Show: Building a Generative AI Center of Excellence
Thomas Maurer & Ben Brauer talk about scaling generative AI responsibly inside an org: governance, best practices, and how not to let “AI everywhere” turn into “AI mess everywhere.”

Tony Redmond: PowerShell for M365 Retention Policies
A deep dive into using PowerShell to wrangle retention policies across tenants. It’s practical scripting advice for anyone tired of clicking around the compliance center UI.

Tytus Kurek: How to Set Up an OpenStack POC
Thinking about private cloud or just want to kick the tires on OpenStack? This guide shows how to spin up a POC without dedicating a month of your life to it.

Reddit: Pausing Your Tech Career for Family
SysAdmins candidly discuss stepping away for family reasons and then re-entering tech. It’s raw, thoughtful, and a reminder that the career ladder doesn’t always go straight up.

🏢 Other SysAdmin Content from Vendors & Official Pubs

Microsoft: Limiting .onmicrosoft.com Email Sending
Starting soon, .onmicrosoft.com domains won’t be usable for outbound email. The intent is to cut off a common abuse vector used in phishing and spoofing. Check if you’ve got any workflows still tied to this before they silently break.

Experian: How to Request a Credit Freeze for a Minor
With reports of the entire SSA database floating around, identity theft risk just went way up. Freezing your own credit is easy; freezing your kids’ credit takes more paperwork but may be just as critical.

🔒 Security Headlines for SysAdmins

Cloudflare Impacted by Salesloft Drift Supply Chain Attack
Even big security vendors aren’t immune to supply chain risk. Cloudflare confirmed exposure via the Salesloft Drift compromise. If you integrate with SaaS platforms, treat vendor risk management as a core control, not an afterthought.

Microsoft on Storm-0501 Ransomware TTPs
Microsoft breaks down how Storm-0501 is abusing cloud services to launch ransomware campaigns. It’s a reminder that attackers are moving where the workloads are, and “the cloud” doesn’t magically protect you.

🛠 Tool of the Week

Pi-Hole
A local DNS sinkhole that blocks ads, trackers, and shady domains network-wide. It’s great for home labs and SMBs alike, and the dashboard gives you eye-opening insight into just how much garbage your devices try to connect to daily.

⚡ Quick Win of the Week

Audit your tenant for auto-forwarding inbox rules. They’re still one of the cheapest and dirtiest tricks attackers (or malicious insiders) use to exfiltrate data. In most M365 environments, you can surface these with a quick PowerShell one-liner and put a guardrail in place before it becomes a security incident.

🕹️ Fun Retro SysAdmin Fact

In the 1980s, 5-10 MB hard drives would be sold for up too $3,000. That’s roughly $300 per megabyte. Today, you can buy a 1 TB SSD for less than lunch money. Not a bad return on progress.

☕ Wrap-Up

That’s a wrap for this week! As always, you can find all the podcasts, newsletters, and resources over at SysAdminWeekly.com.

Go forth, patch responsibly, and don’t forget to hydrate. See you mid-week next Wednesday!

· Broadcom + VMware = SysAdmin headaches (and maybe a few choice swear words).

· Revisiting Hyper-V management drama. Which tool should you use, when, and why it matters.

· Next episode of the podcast: redefining “Compromise” in security (spoiler: it’s not just “the attacker owns everything on your network”).

· Stress testing Linux makes a comeback, because benchmarks matter.

· Core Fundamentals: Getting started with Entra ID (because it underpins literally everything in Microsoft’s cloud).

· Community gold: break glass accounts with TAP/FIDO2, AI thought leader lists, open source LLMs in enterprises, and benchmarking GPUs on Linux.

· Vendor news: Ubuntu Pro patches now surface in Azure Update Manager.

· Security news regarding RDP and Malicious Android Apps

· Tool of the Week: yabai, the MacOS tiling window manager you didn’t know you needed.

· Quick win + retro fact to close us out with a grin.

This Week’s Insight(s) from Andy

If there’s a theme this week, it’s “control slipping away”.

Broadcom’s VMware changes are forcing IT teams to rethink strategies they thought were stable. Microsoft is shifting how we handle identity and access in Entra ID (hello, break glass MFA requirements). Even Linux SysAdmins are talking benchmarking and stress testing, because performance drivers can make or break certain deployments.

The pattern? SysAdmins are being asked to manage less certainty with more responsibility. Vendors keep moving the goalposts, and we’ve got to adapt… with the right tools, smarter fundamentals, and a good dose of community wisdom to keep us sane.

I think a core theme throughout my (now) 23 year career in tech is the fact that long-standing “best practices” have a habit of changing, whether we want them to or not. An example….

I remember the days of centralized end-user computing. There was a time that Citrix was the “top dog” in this area. I remember deploying Metaframe XP and presentation server 4 and having a high degree of success across multiple environments. From there, Citrix starting becoming cost prohibitive (not unlike VMware now!), and many organizations moved to RDS (Remote Desktop Services) in Windows Server. After many of those deployments and ongoing support, admins learned very quickly that multiple users leveraging the same OS instance created some…. Challenges.

As a result the industry then shifted to VMware View…. Which then rebranded to “Horizon View”….. and….. and…. and…. you see what the theme is here. SysAdmins have LONG had to roll with changes in the industry and within specific technology areas (centralized end-user computing in this example). Adaptation, questioning the status-quo, patience (to resist changing too quickly), and staying up to date on best practices are all skills that will prepare SysAdmins for this sad-reality of the tech space. Remember, best practices are less ‘rules carved in stone’ and more like ‘guidelines’ scribbled on a whiteboard that vendors keep erasing when you turn your back.

And now…. Back to our regularly scheduled programming

Latest on the SysAdmin Weekly Podcast

🎙️ WHAT THE HELL DID BROADCOM DO TO VMWARE?! (Yes… all-caps are warranted)

Broadcom’s VMware acquisition fallout is in full swing. Licensing changes, customer pushback, and SysAdmins left holding the bag. Andy and Eric break down what’s changing, why it matters, and how to plan your next move if VMware is in your stack.

In Case You Missed It on SysAdmin Weekly

🎙️ Hyper-V Management Drama

Missed this one thanks to last week’s special Thursday edition (life prevented Andy from our usual FULL newsletter publication)? In this episode, Andy and Eric dive into the messy world of Hyper-V management. Mainly, what tools exist, when you should use them, and how to keep from losing your mind when Microsoft gives you four overlapping options.

Sneak Peek of the Next Episode

Next up later this week: “What is the definition of the word Compromise?”

We’ll be unpacking what compromise really means in a cybersecurity context. Spoiler: it’s way more nuanced than “someone got popped.” Expect a mix of philosophy, practical detection strategies, and a reality check for anyone tossing the term around without thinking.

From AndyOnTech and Project Runspace

📖 How to Stress Test Linux

We covered this one before, but worth a revisit with the benchmarking discussions going around the community this week. If you’re deploying workloads and want to test your Linux box under pressure, here’s a step-by-step breakdown on how to do it.

Core Fundamentals

📖 Getting Started with Microsoft Entra ID

Entra ID isn’t just “Azure AD with a new name”, it’s the backbone of Microsoft’s entire cloud identity stack. This Microsoft Learn documentation gives you the fundamentals you need to start strong.

Helpful Community Content

🛡️ Break Glass Accounts and Azure AD Security Defaults — Jan Bakker explains how to align Microsoft’s required MFA for critical management portals stance with the real-world need for bypassed break glass accounts. Solution: Temporary Access Passes + FIDO2 keys. Essential read if you’re setting these up (like Andy was recently).

🧠 Expert Circle – AI Thought Leaders — Sai Turlapati has done the community a solid with this list of AI experts, bloggers, and Microsoft tech leaders to follow. Great for curating your feed without doomscrolling LinkedIn randomness.

💡 What Open Source Models Mean for Enterprises — Barry Briggs breaks down the business implications of open source LLMs and how they’ll change enterprise strategy.

🖥️ Benchmarking 3D Graphics Cards and Drivers on Linux — Emmanuel Kasprzyk gets nerdy on how to properly benchmark GPU performance under Linux. Pair this with AndyOnTech’s stress test guide (above) for full effect.

Other SysAdmin Content from Vendors and Official Publications

🐧 Ubuntu on Azure: Pro Patches Now Surface in Update Manager — If you’re running Ubuntu on Azure, Update Manager will now surface missing Ubuntu Pro patches. One less place to miss something important.

Security Headlines for SysAdmins

Surge in Coordinated Scans Target Microsoft RDP Auth Servers

Nearly 2,000 IPs were caught hammering Microsoft RDP Web Access portals in a coordinated campaign. This is way above the usual background noise. Attackers are probing for timing flaws that leak valid usernames, with most traffic flagged as malicious and coming from Brazil.

👉 Lock down RDP: enforce MFA, restrict exposure, and hide it behind VPNs or conditional access. (please?)

Read more

Malicious Android Apps with 19M Installs Removed

Google yanked 77 malicious Android apps (19M+ installs) from Play, loaded with adware and banking trojans like Joker and Anatsa. Anatsa now targets 800+ financial apps, using sneaky payload delivery and Accessibility abuse.

👉 SysAdmins: remind users to enable Play Protect, avoid shady publishers, and scrutinize app permissions.

Read more

Tool of the Week

🪟 yabai – Tiling Window Manager for macOS

This one’s just… chef’s kiss. A tiling window manager for macOS that finally gives you power-user control over your desktop. If you’ve ever envied i3 on Linux, but were stuck on a Mac, this tool’s for you.

Quick Win of the Week

Set up a break glass account checklist in your documentation.

It takes 5 minutes to write down:
- Account names
- Stored credentials location
- Authentication method (TAP/FIDO2)
- When they were last tested

Future you (and your boss) will thank you when chaos strikes.

Fun Retro SysAdmin Fact

The first ever “patch Tuesday”… wasn’t on a Tuesday.

Microsoft’s original move toward scheduled patching in 2003 dropped on a Wednesday (gasp!) The “Patch Tuesday” brand didn’t get locked in until later, once sysadmins around the world begged for a predictable cadence.

☕ Wrap-Up

Another week, another reminder that sysadmins live in constant flux. Whether it’s Broadcom throwing curveballs, Microsoft rebranding identity yet again, or Linux folks benchmarking their way to glory.

Drink your coffee, give your dog (or cat?) a good pat on the head for stress-relief, and remember: control may slip, but your SysAdmin skills are the anchor.

Rather than leave your inbox empty, I wanted to pull together something useful: a curated roundup of every Hyper-V episode we’ve done on the SysAdmin Weekly Podcast. If you’re considering a move to Hyper-V (or just trialing it because Broadcom keeps lighting VMware on fire), this is your crash course.

Regularly scheduled programming returns next Tuesday, bright and early.

🎙 SysAdmin Weekly Hyper-V Episode Extravaganza

🔧 Ep. 017 – Hyper-V Management Drama and What Tool to Use When
Watch on YouTube
Hyper-V Manager? Windows Admin Center? Failover Cluster Manager? SCVMM? PowerShell? Azure Arc? Eric and I untangle the mess of management tools and explain when to use what (and when to just pour a drink instead).

🏰 Ep. 013 – Hyper-V in the Domain? Yea or Nea?
Watch on YouTube
Should Hyper-V hosts be domain joined, or live in a workgroup? This debate has been raging for years. Spoiler: Eric and I don’t exactly sit on the fence.

💸 Ep. 003 – Hyper-V vs. VMware: Licensing
Watch on YouTube
Licensing fun! (Yes, that was sarcasm.) But seriously, we break down the differences in software licensing between VMware and Hyper-V. If you’re running the math right now, this one’s for you.

✨ Ep. 002 – What’s New with Hyper-V in Windows Server 2025?
Watch on YouTube
From shiny new features to under-the-hood changes, Eric and I cover what’s actually useful in the Windows Server 2025 release.

☠️ Ep. 000 – No! Hyper-V is NOT Dead!
Watch on YouTube
Our very first episode of SysAdmin Weekly (hence the 000 episode number!), where we kicked things off by dispelling the “Hyper-V is abandonware” myth. Spoiler: it’s still a critical part of Microsoft’s strategy.

🌐 Ep. 001 – What is Azure Local?
Watch on YouTube
Not strictly Hyper-V, but deeply related. We peel back the layers on Azure Local, and and why Hyper-V is at the heart of it.

🗳️ Poll: What Topics Do You Want More Of?

SysAdmin Weekly works best when it’s a two-way conversation. Both the podcast and this newsletter are here for the community, so we want your input.

You can also reach us directly at contact@sysadminweekly.com. If you have direct questions, or funny stories, or show feedback, feel free to reach out! Also, all show links live at sysadminweekly.com.

Wrap-Up

That’s it for this special drop. Thanks for rolling with the schedule hiccup folks! We’ll be back with our regularly scheduled programming on the normal Tuesday morning cadence next week. Until then, may your patches apply cleanly and your VMs never bluescreen.

--Andy

• Andy and Mike Nelson unpack how AI agents can assist IT admins in real-world environments.

• Missed our episode on GitHub Copilot? Eric and Andy had thoughts and tangible use-cases!

• Eric dives into switching Windows Server activation methods via Project Runspace.

• Azure sizing made easier with a visual sizer tool for Azure Local solutions.

• GPT‑5 is now in Azure AI Foundry, say hello to smarter agents……. hopefully

• Learn to cloud the right way with some great fundamentals from Microsoft Learn and a sweet video from Curtis Milne.

• Reminder: shared ChatGPT links had a privacy slip, but only for people who used "Share Chat".

• Prompt injection attacks are evolving, don’t let your tools turn against you.

• Rust vibe coding in VSCode with GitHub Copilot.

• Leadership tip: You're not the hero. Your team is, by Michael Cassar

  👋 New here? Subscribe to SysAdmin Weekly for great IT content, and SysAdmin therapy.

🧠 This Week’s Insight(s) from Andy

This week’s edition rides the edge of a bigger shift: when the abstractions we use (AI copilots, cloud management layers, prompt-based automations) stop being just tools and start becoming the primary way we interact with infrastructure. It's no longer command-line first or docs-first, it’s assistants-first, UI-driven, suggested-code-by-default…. I guess that’s what i’m calling it =P

And that’s not always a good thing.

So this week’s theme isn’t just about new tools, it’s about how our mental models of IT work are being reshaped by the tools themselves. When you start trusting the AI to write your code, manage your permissions, or summarize your risks, you better have a backup plan and a mentality of “trust, but verify.”

We’re not just managing infrastructure anymore. We’re managing the interface to the infrastructure. And sometimes, it lies to us.

What stands out to me about this shift is how much it reminds me of the early days of virtualization. Back then, we were moving away from the world of physical servers where every workload had its own metal. Virtualization was the first major abstraction layer in my career and it took some getting used to. Suddenly, we weren’t configuring workloads directly on hardware anymore, and that broke a lot of long-held assumptions.

But with that shift came huge upsides: high availability became easier, VM mobility unlocked faster recoveries, and templating changed how we deploy systems. The industry hasn’t looked back, and we've kept adding abstraction layers on top of that ever since.

Take Microsoft Azure, for example. Hyper-V still powers the VMs, but you never interact with it directly. The infrastructure has gotten smarter, and now it’s not just abstracting the hardware…….it’s interpreting admin intent. And with AI in the mix, that intent-parsing is only going to get more nuanced.

But here’s the thing: while this will absolutely make some parts of our lives easier, more abstraction means more layers that can break. The more you delegate, the more you need to trust and verify. Otherwise, you’re just flying blind at 30,000 feet in an autopilot you didn’t program.

And now…. back to our regularly scheduled programming.

🎹 Latest on the SysAdmin Weekly Podcast

🎙 AI Agents for IT Admins – with Mike Nelson
Mike Nelson and I had an unfiltered chat about AI Agents. This included, what they are, how they differ from traditional scripts or tools, and where they might actually replace vs. augment SysAdmin workflows. Think: context-aware ticket triage, real-time remediation, and possibly fewer 2 AM wake-up calls. No marketing fluff, just real-world "what ifs" and “what the hecks?”

🎧 In Case You Missed It on SysAdmin Weekly

🧑‍💻 GitHub Copilot: Friend or Foe for SysAdmins?
Eric and I revisited the age-old debate: should SysAdmins learn to code? And if AI writes the code for us… do we still need to? We look at GitHub Copilot not as magic, but as a tool that, when wielded well, makes scripting faster and learning more accessible. And not to mention, when wielded poorly, it generates dangerously plausible nonsense.

🎧 Sneak Peek of the Next Episode

Coming up in our next episode later in the week: Eric and I are entering the haunted maze of Hyper-V management. Between SCVMM, Failover Cluster Manager, Admin Center, PowerShell, and Azure Arc — it’s starting to feel like Microsoft’s version of a choose-your-own-disaster adventure. We’ll try to bring some clarity to what should be your go-to management path for Hyper-V.

🔍 From AndyOnTech and Project Runspace

How to Change the Windows Server Activation Mechanism
Whether you’re in a lab environment or you just inherited a server with the wrong activation type (OEM, KMS, MAK…….yay acronyms!), Eric’s write-up walks through changing the activation mechanism on Windows Server. No fluff, just the PowerShell code and commands you’ll actually use. Useful if you're prepping golden images or cleaning up after a sloppy deployment.

🧱 Core Fundamentals

Get Started with Microsoft Azure (Microsoft Learn)
New to Azure or just need a structured place to send your junior admin who keeps asking how the cloud “actually works”? Microsoft Learn’s Azure Fundamentals path covers cloud concepts, service models, pricing, and core services. It’s vendor-produced, but surprisingly readable and full of free interactive sandboxes that are GREAT for those SysAdmins that are still learning!

🩵 Helpful Community Content

Vibe Coding a Rust MCP Proxy in VSCode with Copilot
Marc-André Moreau documents his experimental journey building a Model Context Protocol (MCP) proxy in Rust using Copilot. If you’ve been listening to our recent episodes on AI-assisted coding and wondering what that actually looks like in practice, this is a fascinating, nerdy, and completely worthwhile read.

How to Get Into Cloud Engineering
This is a solid walkthrough of roles, skills, and steps to launch your career in cloud engineering by Curtis Milne. It’s a bit dated in terms of specific tooling, but the mindset guidance and roadmap still hold up. Great resource for the up-and-comers on your team.

Don’t Let AI Write Your Code Blindly
With great Copilot comes great responsibility. Adam Bertram breaks down how AI-generated code can go sideways fast, especially when you assume it will be awesome at refactoring code!

You’re Not the Hero. Your Team Is. (Michael Cassar)
A refreshing take on leadership in IT by Michael Cassar. This isn’t another “be the change” fluff piece. It’s about understanding when to take the lead and when to get out of the way. A must-read for tech leads, senior sysadmins, and aspiring IT managers.

🎟 Other SysAdmin Content from Vendors and Official Publications

GPT‑5 in Azure AI Foundry: The Future of AI Apps and Agents
Microsoft’s Azure AI Foundry is now packing GPT‑5, complete with multimodal capabilities, deeper reasoning, and improved context handling. If you’ve been considering building an internal agent to assist with IT support, documentation lookup, or internal ticket triage… this may be the moment. The future’s not just here, it’s packaged in a consumption-based billing model.

🔊 Security Headlines for SysAdmins

ChatGPT Shared Links Leaked Private Data
Heads up: a recent privacy slip with ChatGPT impacted users who shared chats using the “Share Chat” feature. If you never hit that share button, you’re in the clear. But if you did, know that links could have exposed more than just the visible content. OpenAI says the bug is fixed, but it’s a strong reminder that even share links can be a soft target.

“Man-in-the-Prompt” Attacks Target GenAI Tools via Browser Extensions
A new attack vector dubbed “Man-in-the-Prompt” exposes ChatGPT, Gemini, and other GenAI platforms to serious prompt injection risks, all via seemingly harmless browser extensions. These attacks exploit the DOM (Document Object Model) in your browser to silently insert, read, or manipulate prompts in real time, no special permissions needed.

The kicker? Most enterprise environments are already exposed. 99% of orgs run at least one browser extension, and half have more than 10. Security tools like CASBs and DLPs don’t even see this behavior, making detection a nightmare. One proof-of-concept showed a rogue extension pulling ChatGPT prompt history and deleting it afterward like a digital ninja.

🛠 Tool of the Week

Azure Local Solutions Sizer Tool
Planning an Azure Stack HCI, Azure Stack Hub, or local deployment? This visual sizing tool helps you spec out the right hardware, licensing, and footprint for your deployment. Think of it as a pre-migration reality check. It's not perfect, but it’s a great way to ground your architecture in what’s actually supportable.

🧠 Quick Win of the Week

A Useful Command to Grab Local Admin Group Membership
One-liner of the week:

Get-LocalGroupMember -Group "Administrators" | Export-Csv "$env:USERPROFILE\Desktop\Admins.csv" -NoTypeInformation

Set it, forget it (and maybe diff it weekly). You could even throw it into a script to alert when the CSV differs from the previous run! Too many surprise local admins? Now you’ll know.

🧠 Fun Retro SysAdmin Fact

Windows NT 3.1 came boxed with a printed Hardware Compatibility List (HCL).
Back in 1993, getting NT to talk to your NIC, SCSI drive, or graphics card wasn’t a quick web search away, you cracked open the box for a printed HCL binder (or at least a physical document) that spelled out exactly which hardware was supported. If your gear wasn’t on the list, you were likely in for a world of frustration.

☕ Wrap-Up

Whether you’re tuning in for insights, tools, or just here for the snark, thanks for reading another issue of SysAdmin Weekly. We’ll be back next week with more AI misadventures, practical fixes, and the occasional “how did Microsoft expect us to manage this?” rant.

Got a resource or rant of your own? Drop it here > or find me on LinkedIn. You bring the ideas, I’ll bring the coffee.

• Podcast with Paul Schnackenburg on the art (and occasional witchcraft) of troubleshooting.

• AI sidekicks for sysadmins? Mike Nelson joins next week to talk Generative AI and MCP protocol.

• Eric reviews Windows Server 2025 Administration Fundamentals on Project Runspace.

• Core Fundamentals: Securing the Windows boot process against early-stage attacks.

• Community highlights: Azure cost savings, SQL Optimized Locking, mental health resources, and Linux kernel updates.

• Security headlines: New Linux “Plague” PAM backdoor and active SonicWall zero-day exploitation.

• Tool of the Week: DaisyDisk – visualizing disk usage like a cyberpunk pie chart.

🧠 This Week’s Insight(s) from Andy

This week’s lineup feels like a journey through sysadmin history and future tech! We’ve got troubleshooting wisdom from veterans, digging into the old-school Windows boot process, tossing in a retro Zip drive nod, and then jumping straight into AI agents and modern kernel updates. SysAdmins don’t just manage systems; we time-travel daily between decades of tech evolution.

The most recent podcast episode dove into the Art of Troubleshooting, a skill every SysAdmin needs to cultivate. And let’s be honest: it’s often practiced in the strangest, most stressful situations imaginable.

Case in point: back in the Windows Server 2000/2003 era, I once had to troubleshoot domain controllers during a server room flood. Picture this: everything offline, water covering the floor, and myself and a few other SysAdmins attempting to seize FSMO roles like our careers depended on it (because, well… it kinda did).

On the opposite end of the urgency spectrum, I once had to track down and reinstall custom mouse themes on Windows XP in a pre-school. Why? Because a group of very determined adults insisted the kids needed the dinosaur cursor restored on a new machine. Low stakes, but hey, they were paying customers, and apparently, no triceratops cursor = bad day.

Different stakes, same core skill: troubleshooting and clear communication. Whether it’s floodwater or cartoon reptiles, sysadmins troubleshoot daily, often unseen, always essential. Keep sharpening that saw and it will serve you well for your entire career.

And now, back to our regularly scheduled programming….

🎹 Latest on the SysAdmin Weekly Podcast

📺 The Art of Troubleshooting with Paul Schnackenburg
Paul and I break down troubleshooting into something less like black magic and more like a repeatable process, though, let’s be honest, sometimes it does feel like summoning spirits.

🎧 In Case You Missed It

📺 Cloud Repatriation Movement with Eric
Cloud in, cloud out! we dig into why some orgs are pulling workloads back on-prem and what it means for sysadmins.

🎧 Sneak Peek of the Next Episode

Coming later this week, I’m joined by fellow Microsoft MVP Mike Nelson to talk Generative AI for SysAdmins. We’ll explore how AI Agents could soon be helping with our daily grind, and where the MCP protocol might fit in to orchestrate these tools. Think less “Skynet” and more “SysAdmin Sidekick.”

🔍 From AndyOnTech and Project Runspace

📖 Windows Server 2025 Administration Fundamentals Review
Eric reviews the latest edition of this SysAdmin staple. It’s like a Swiss Army knife for admins—now with sharper blades and an updated corkscrew.

🧱 Core Fundamentals – Securing the Windows Boot Process

Booting isn’t just about turning on the lights, it’s the front door to your entire system. If attackers slip in early enough, they own the whole house. This Microsoft guide walks through how Windows defends itself during startup with protections like Secure Boot, Trusted Boot, and ELAM (Early Launch Anti-Malware).

Understanding these layers not only helps with troubleshooting startup issues but also makes sure you’re not the admin who discovers a rootkit after it’s been running for months.

🩵 Helpful Community Content

• Azure Cloud Cost Optimization – Christian Forjahn shares practical ways to stop burning cash in Azure. Because let’s face it…. we’ve all left a workload running in Azure that wasn’t being used…. at least ONCE.

• Optimized Locking in Azure SQL Database – We finally had to provide something for the SQL admins out there! In this article Sergio Govoni breaks down Optimized Locking in Azure SQL DB like a pro.

• 404 Stress Not Found – A new community from Paul Croker! This community focuses on mental health and inclusivity in tech.

• What’s New in Linux Kernel 2025 – Ben Hutchings’ talk from DebConf25 on what’s new in the Linux Kernel along with Debian’s gaps.

🎟 Other SysAdmin Content

• Microsoft AI Tour Notifications – For those planning on implementing Microsoft AI solutions within their environment! Sign up to know when the AI circus comes to your city.

🔊 Security Headlines for SysAdmins

• Plague: A Newly Discovered PAM-Based Backdoor for Linux – A stealthy backdoor that hooks into PAM to grant attackers persistent access.

• SonicWall Zero-Day Exploitation – Active exploitation is underway. If you’re running SonicWall, now’s the time to patch or disconnect it from the internet.

🛠 Tool of the Week – DaisyDisk

Need to cleanup disk space on MacOS? DaisyDisk turns the nightmare of cleaning up disk space into a visually satisfying experience. With its interactive sunburst map, you can spot and delete storage hogs faster than you can say “temp files.” Perfect for that server you swear had a terabyte free last week.

🧠 Quick Win of the Week

When troubleshooting slow boots, disable unnecessary startup apps and services. Combine this with the Windows Event Viewer’s Boot Time Diagnostics to zero in on culprits. Small tweak, big speed gain.

🧠 Fun Retro SysAdmin Fact

Before USB sticks, sysadmins carried Zip drives! These were massive, clunky cartridges that held a whopping 100 MB. Losing one felt like losing a SAN.

☕ Wrap-Up

That’s it for this week! Whether you’re diving into AI, trimming Azure bills, or just trying to keep Linux backdoors out of your estate, remember: SysAdmins are the unsung heroes keeping the lights on.

See you next week! Same patch time, same patch channel….. or something….

--Andy

SysAdmins, this week’s mix has everything: proving your value (before HR proves you’re “redundant”), DNS gremlins, Paul Graham’s take on why meetings ruin your flow, and a new toy that makes VSCode even cooler. Plus, PoisonSeed phishing is trying to break FIDO2, and Microsoft quietly dropped Mac LAPS support. It’s like Patch Tuesday, but for your brain!

🧠 This Week’s Insight(s) from Andy

This week feels like “SysAdmin Survival Kits: Adapting to the Modern Wild.”

• You’ve got PoisonSeed phishing trying to break MFA.

• MacOS finally joins the LAPS party (better late than never).

• DNS configs morph into a perfect storm of pain.

• And to stay relevant, sysadmins need coding chops, automation tricks, and sometimes… a Pomodoro timer in the terminal.

It’s less about making unseen work visible this time and more about evolving the SysAdmin toolkit, from mindset (maker’s schedule) to hardening (MFA, LAPS) to smarter workflows (VSCode MCP, pomocli).

If last week was “be seen,” this week is “be ready.”

When I think about that term “be ready” in a SysAdmin context, my brain immediately time-travels back to my Boy Scout days. One of the mottos was “Be Prepared.”

As a kid, I remember thinking it was overkill. We’d spend hours prepping for scenarios that might happen… or might not. Fast-forward 20+ years in IT, and, well…let’s just say I’ve seen enough “learning experiences” over the years to fully appreciate the power of being prepared.

My grandmother had a saying when my dad and grandfather were working on projects around the house:

“You better be careful, or Murphy might show up!”

She was, of course, talking about Murphy’s Law: if something can go wrong, it will. Spend enough time in the SysAdmin trenches and you learn real quick that ol’ Murphy has a reserved parking spot in your server room, and he takes advantage of said parking spot…. frequently.

Preparation is what lets you stare down the inevitable storms: DNS meltdowns, Sev 1 tickets, rogue outages. It’s not paranoia, it’s the quiet confidence that when chaos hits, you’re ready to fix it, patch it, and keep the lights on.

And now…. back to our regularly scheduled programming.

🎹 Latest on the SysAdmin Weekly Podcast

🎧 How SysAdmins Can Showcase Their Value (Before the Next Layoff)
Andy and Eric tackle the reality of proving your worth in IT before your job becomes a budget line item. Expect candid advice on reporting, storytelling, and avoiding invisibility.

🎧 In Case You Missed It

🎧 The Demise of WSUS
We eulogize WSUS and talk about what replaces it. Spoiler: it's not the beloved old patch server.

🎧 Sneak Peek of the Next Episode

In our next episode, Paul Schnackenburg joins to discuss The Art of Troubleshooting, from gut-instinct fixes to methodical debugging. We’ll cover why real troubleshooting is more Sherlock Holmes than Stack Overflow copy-paste.

🔍 From AndyOnTech and Project Runspace

📄 Introducing pomocli
Andy’s shiny new CLI-based Pomodoro timer for SysAdmins who don’t want bloated apps. Tiny, fast, and perfect for terminal nerds.

📄 Should Server Admins Learn to Code?
Eric argues yes, at least enough to script away your pain. From PowerShell one-liners to Python tools, coding makes SysAdmins dangerous (in a good way).

🧱 Core Fundamentals

📘 OSI Model Explained
Cloudflare gives a clean, no-BS walkthrough of the OSI model. Still the bedrock for troubleshooting network mysteries.

🩵 Helpful Community Content

📄 Serverless vs. Just-in-Time Compute
Richard Hooper clears up the buzzword fog around Serverless and Just-in-Time compute. Spoiler Alert: they’re not the same thing.

📄 Designing AI Workloads with Azure Well-Architected Framework
Thomas Maurer lays out how to keep your AI deployments scalable and sane in Azure.

📄 Azure DNS Resolver: The Perfect Storm
Didier Van Hoye documents a cautionary tale of custom resolvers, ambiguous configs, and cloud DNS pain.

📄 Maker’s vs. Manager’s Schedule
Paul Graham’s classic on why meetings wreck deep work. This is a MUST-read for anyone who codes or fixes servers or does any work that takes longer than 20-minutes really…..

🎟 Other SysAdmin Content from Vendors and Official Publications

• macOS LAPS Support – Finally, Mac gets proper LAPS (Local Admin Password Solution) management via Intune.

• Workgroup Clusters – Official Microsoft doc for those non-domain Hyper-V clusters we’ve been talking about on occasion, for those interested.

• Vibe Coding Explained – A look at “Vibe Coding” from Barry Briggs al a Directions on Microsoft and what it means for SysAdmins wrangling modern dev environments.

🔊 Security Headlines for SysAdmins

🛡 PoisonSeed Phishing Downgrades FIDO2 MFA
Threat actors have figured out how to trick users into bypassing FIDO2 hardware security keys by downgrading authentication to weaker methods. If you’re running phishing-resistant MFA, monitor for downgrade attempts in your identity logs.

🛠 Tool of the Week

🔧 VSCode MCP Install Button Generator
Merill Fernando’s utility lets you drop “install” buttons for VSCode Model Context Protocol packages. Makes onboarding AI agents/extensions dead simple.

🧠 Quick Win of the Week

Using Mac LAPS? Rotate those admin creds immediately after enrollment and use short expiry. It’s finally possible! Don’t leave the Macs in your fleet as the forgotten local admin backdoor.

🧠 Fun Retro SysAdmin Fact

Before PXE boot and fancy hypervisors, SysAdmins carried around boot floppies for every OS flavor. Need to boot NT4? Grab Disk 1 (and 2, 3, and 4…). Pray none had bad sectors….. seriously…. pray

☕ Wrap-Up

Another week of unsung heroes and shadow fixes that nobody sees, until something breaks. Forward this to your fellow SysAdmin who deserves credit for keeping the lights on and the DNS resolvers…… uh… resolving.

Stay caffeinated and keep relentlessly showing your value,
--Andy

· 🎙️ Should Hyper-V live in the domain? Eric and I unpack the debate — and the unexpected third option.

· 🛡️ Still using self-signed certs? Project Runspace says stop it. Seriously.

· 🧰 Tool of the week: PingPlotter! For proving your ISP is gaslighting you.

· 🧠 New Quick Concept: Why SaaS misconfigs are the new “oops, I left RDP open.”

· 👨‍💻 Helpful gems from Ola Strom, Mike Robbins, Charbel Nemnom, and others

· 🧬 Plus: Debian Trixie issues, firewall basics, and a long look at standing desks (because your back hates you)

It’s another week of patching, learning, breaking, and somehow still fixing it all. Let’s go.

🧠 This Week’s Insight(s) from Andy

When I stand back and look at the culmination of this week’s links, I think it’s apt to set our theme this week as: “The Hidden Work That Keeps It All Running”

From quiet SaaS misconfigs to the gnarly internals of your backup setup, this week highlights the often invisible (yet mission-critical) work that sysadmins do. It’s not always glamorous, and it rarely ends up in a highly visible and flashy sprint demo, but it’s the reason the lights stay on and the data stays safe.

Whether you’re chasing down a token with no expiration date, trying to make backup restores actually reliable, or fighting with a CLI that hates you personally, you’re doing the kind of work that most folks never see. But, let’s be honest, everyone depends on said work and they don’t even know it.

I remember an incident from my days in the managed service provider trenches. It had been a BRUTAL on-call rotation that week, with multiple 2am calls throughout the week. Then I got the call we all hate to get. Major connectivity issue in a datacenter no where near me. A schedule configuration change had broken an etherchannel in a VMware ESXI cluster 240 miles away, and VMs were unable to boot. It was 4am, work started for this customer at 7am, and the clock was ticking. After multiple phone calls, and a very helpful junior tech that lived much closer than I, the two of us were able to get the etherchannel restored, and back online JUST before the 7am start.

And the best part…. no one had ANY idea that their virtual machines had been dead to the world for several hours. SysAdmin heroics were invisible and highly valuable that day.

It could be the fact that we have an episode of the podcast coming soon about show casing SysAdmin value to the business, and I keep thinking about how all that invisible work often recieves no credit. With that in mind, this issue is for the unsung fixes, the silent patches, and the config reviews no one asked for but would absolutely notice if you skipped.

And now, back to our regularly scheduled programming…

🎹 Latest on the SysAdmin Weekly Podcast

🎧 Should You Domain-Join Hyper-V Hosts or Not?
Andy and Eric dive into a decades-old debate: domain-join your Hyper-V hosts, or keep them workgroup-isolated?

Spoiler alert: there’s a very strong stance taken, with a secret Option C for the adventurous.

🎧 In Case You Missed It on SysAdmin Weekly

🎧 The State of Microsoft Certification (2025 Edition)
Paul and Andy explore what’s changed, and what hasn’t in the world of Microsoft certs. Are they still worth it? How do they fit into modern IT careers?

🎧 Sneak Peek of the Next Episode

In our next episode, Eric and Andy dig into a topic that hits close to home for every SysAdmin: making your work visible and proving your value to the business.

With layoffs and re-orgs sweeping through IT teams across the industry, this one hits hard. The guys talk about:

· Why invisibility is the enemy of job security

· How to tie your daily wins to business outcomes

· What kinds of documentation and reporting actually matter

· And why “nothing broke this week” might be the most underappreciated KPI in tech

To quote one of the guys from the episode:

“If your work as a SysAdmin is invisible, it’s only a matter of time before someone questions its value.”

Don’t miss it! This episode drops later this week on the SysAdmin Weekly Podcast!

🔍 From AndyOnTech and Project Runspace

📄 Stop Using Self-Signed Certs
Eric gives us a blunt but important reminder about why self-signed certs are a terrible idea in 2025. Yes, even in test/dev. There are better (and free) options now, use them.

🧱 Core Fundamentals

📘 How Do Firewalls Actually Work?
Simple. Clear. Timeless. Cloudflare again brings the goods with a no-fluff explanation of what firewalls are and how they protect systems. This is still foundational knowledge, even in our container-and-cloud world.

🩵 Helpful Community Content

💥 I Messed Up Microsoft Teams (So You Don’t Have To)
Ola Strom breaks down a Microsoft Teams crash-on-ARM scenario that absolutely no one wants to debug twice.

✅ Saved you at least an hour, buy this man a coffee!

🔧 Shorten Azure CLI Commands in PowerShell (Without Backticks)
Azure CLI meets readability. Mike Robbins shares a neat trick to clean up those monsterously long azcli commands that eat entire terminals.

📦 Azure Files Storage and Access Tiers Explained
Charbel Nemnom provides a deep dive on how storage tiers in Azure Files work, and when to use each. If you’re spending too much on blob storage, start here.

🪑 14 Years at a Standing Desk
A rare gem: ergonomic wisdom from long-time IT veteran Adam Engst. Spoiler: standing is good, but stretching is better.

🎟️ Other SysAdmin Content from Vendors and Official Publications

🧠 AI Workload Prep: Upcoming Microsoft Event
Rick Claus and team walk through what orgs need to do to prepare infrastructure for modern AI workloads. Worth attending.

🐧 Debian Trixie Release Notes (Issues to Watch)
Debian fans: the Trixie release is close. Here’s what you’ll want to know about issues that could impact upgrade planning.

🔊 Security Headlines for SysAdmins

🛡️ Critical SharePoint Exploits: What You Need to Know
Microsoft drops a detailed write-up on multiple actively exploited SharePoint vulnerabilities, including how attackers are gaining remote access through insecure app management pages. The blog outlines detection methods and Microsoft Defender for Endpoint telemetry you can use to validate whether you’re affected.

👉 If you’re running SharePoint on-prem or hybrid, this one’s a must-read.

🛠️ Tool of the Week

📡 PingPlotter
A dead-simple, highly visual network diagnostic tool that’s helped countless IT pros catch flaky connections and bad ISPs red-handed. Run it, screenshot it, and send it to your vendor > argument over.

🧠 Quick Win of the Week

Need ammo for an ISP battle?
Set up a PingPlotter session and let it run for a few hours. Export the graphs. Boom! Proof of upstream packet loss, in living color.

📤 Out-of-Band Insight(s)

SaaS platforms promise agility and scale, and they DO deliver (most of the time). But they also bring a new flavor of pain: misconfigurations so subtle you won’t notice until data leaks or alerts start screaming.

The core issue? Most SaaS apps were designed for ease of use, not enterprise hardening. Combine that with:

· Federated identity spaghetti (hello SSO entropy)

· Token sprawl with inconsistent scopes and lifetimes

· Admin settings buried in obscure panels

· And users clicking “Accept” like it’s a cookie banner…

…and you’ve got a misconfiguration just waiting for the wrong moment.

TL;DR: SaaS lacks centralized logging, configuration baselines, and consistent policy enforcement, making misconfig drift and blind spots inevitable. If you’re not reviewing settings after every onboarding, vendor update, or advisory you’re probably missing something critical.

It’s not your fault. But it is your problem. Such is SysAdmin Life….

🛠️ Pro Tip: Add recurring reviews of OAuth app consents, sharing settings, and admin roles to your quarterly tasks. Bonus points for per-app and per-group granularity. Future You will absolutely send snacks.

🧠 Fun Retro SysAdmin Fact

Remember RS-232 serial cables? So did your BIOS.
Back in the 80s and 90s, sysadmins kept a literal box of these bad boys for everything from modem hookups to console access on routers. Every time someone asks “Why do we still support serial?” Well, it’s because someone, somewhere, is still racking a switch that only speaks 9600 baud.

☕ Wrap-Up

Another week, another set of scripts, patches, old habits, and new ideas.
If you got something useful out of this issue, forward it to a fellow SysAdmin who might still be typing net use into a login script somewhere.

Stay caffeinated, stay patched, and for the love of uptime, stop using self-signed certs!

Until next week,
— Andy

· 🔐 130 new Microsoft vulns. Patch fatigue is real, but so are the exploits.

· 🎧 This week’s podcast: SaaS Cyber Kill Chains, and identity attacks…Yikes.

· 🛠️ Terraform meets GitHub Copilot in a smart AI-assisted lab build.

· 📘 DNS fundamentals, because everyone thinks they understand DNS… until they don’t.

· 🗂️ Bonus template: Markdown postmortem template to help you document outages like a boss.

🧠 This Week’s Insight(s) from Andy

After reading our curated links and resources this week, it seemed apt to make this week’s theme: “Security by Default? Still Optional… Apparently.”

Why? This week’s news is a chef’s kiss sampler of everything that still feels slightly broken in 2025: 130 patched vulns in one Patch Tuesday, more SaaS identity fire drills, and vendors slow-walking disclosures while CISA is out here yelling “exploit active, fix your stuff.”

On the other side of the spectrum, we’ve got smart sysadmins talking, and learning fundamentals (DNS!), experimenting with AI-assisted Terraform, and finding ways to run LLMs locally on OpenSUSE Tumbleweed via Ollama! Chaos and brilliance, side by side, which if I’m honest, is just another week in tech.

When I set out to create this newsletter, I wanted to make sure I included some security stuff, but by no means have it consume the newsletter. I feel like every week, a little more security content sneaks in, but with good reason! There is important and actionable info in the security space for SysAdmins EVERY week it seems!

One could make the argument that on large, highly-siloed enterprise teams, the role of security is often separate from the “SysAdmin”. I challenge that notion not only because not EVERY SysAdmin is on an enterprise IT team, but because the role of security is INCREASINGLY becoming an everyone responsibility. And, while security may not be the main focus in the SysAdmin role within a given organization, I emphatically believe that SysAdmins have a responsibility to both deploy and operate in a secure manner.

So, the next time you feel like grumbling, remember you’re not alone. We’ve all faced:

· 📢 Security team ping-ponging you on policy
· 🧨 Yet another zero-day needing urgent patching
· 🙃 Users doing “creative” things with their credentials
· 🚨 Vendors quietly leaking customer data again
· 🧠 The 4,995 other sysadmin pain points…

Remember… you may be the one-man (or woman!) army standing between threat-actors and your business data. Or, you may be in the trenches with a team doing the same. In either case you’re bringing VALUE to your organization whether they realize it or not. Find the measurable success in your efforts, document it, and shout it from the rooftops for all (especially the C-Suite!) to hear.

And now, back to our regularly scheduled programming….

🎹 The Latest on the SysAdmin Weekly Podcast

🎧 The SaaS Cyber Kill Chain
Andy and Paul take a look at how the cyber kill chain has evolved in a cloud-first, SaaS-heavy world. Identity is the perimeter, tokens are the targets, and persistence techniques are getting wild. If you manage SaaS apps, you’ll want to catch this one.

🎧 In Case You Missed It on SysAdmin Weekly

🎧 Microsoft’s SFI Moves: Are They Serious About Security Yet?
A look back at Microsoft’s Secure Future Initiative and whether Redmond is walking the talk or just rebranding security basics as groundbreaking progress.

🎧 Sneak Peek of the Next Episode

In our next episode, Eric and Andy sit down to revive an age-old debate in Hyper-V circles. Hypervisor in the domain, or not? There are pros and cons to each….. and maybe even a secret option C! That said, the guys both clearly landed on one side of the fence. Be sure to check that out coming later in the week on the SysAdmin Weekly Podcast!

🔍 From Andy On Tech and Project Runspace

📄 Understanding the Two VM Licenses with Windows Server Standard
Eric breaks down the often misunderstood VM rights included in Windows Server Standard. A great refresher (or first-timer explainer) for those planning small-to-mid hypervisor deployments.

📄 Azure Local: What Is It and Why Should SysAdmins Care?
If you’ve seen the term “Azure Local” floating around and thought, “Is this just marketing fluff for on-prem Azure?” you’re not alone. In this post, I break down what Azure Local actually is, where it fits with other Azure Edge solutions, and what it means for sysadmins juggling hybrid environments.

🧱 Core Fundamentals

📘 What is DNS?
Cloudflare delivers a clean, beginner-friendly explainer on DNS, perfect for folks just starting their SysAdmin journey or those of us who’ve set it up a thousand times but still quietly fear reverse lookups in our sleep.

🩵 Helpful Community Content

🧠 Why You Should Set Up Terraform MCP Server with GitHub Copilot
This blog post from Thomas Thornton seemed like an apt follow up on our Agentic AI and GitHub Copilot themes from the last few Podcast Episodes, Thomas gives a solid breakdown on pairing Terraform MCP server with GitHub Copilot for streamlined IaC deployments.

🌐 Build a Hub and Spoke with Azure’s Virtual Network Manager
Aidan Finn shows us how to use Azure’s Virtual Network Manager to spin up a solid hub-and-spoke network. Great for those tired of deploying networks in the cloud and just…. hoping for the best.

🔐 The SaaS Kill Chain in Practice
Paul Schnackenburg (yep, again!) writes about the identity-driven tactics that attackers use in modern SaaS environments. TL;DR: credentials are the new rootkits.

🧵 Password Rotation Debate on r/sysadmin
Solid thread discussing NIST’s updated stance AGAINST regular password rotation. The community weighs in with agreement, compliance headaches, practical exceptions, and existential frustration.

🎟️ Other SysAdmin Content from Vendors and Official Publications

💻 Run LLMs Locally on OpenSUSE
The official OpenSUSE blog shows you how to deploy Ollama and run local LLMs using Tumbleweed. A great option for those who want the power of AI without sending everything to the cloud.

🔊 Security Headlines for SysAdmins

🩹 Microsoft Patches 130 Vulnerabilities
Patch Tuesday this month was a lot. Remote code execs, privilege escalations, and more. Prioritize the criticals and test carefully, it’s a minefield this month.

🚨 CitrixBleed 2 Now Exploited in the Wild
CISA says it’s go-time. If you’ve got NetScaler appliances, patch immediately. Citrix has been a little quiet, but the attacker chatter is anything but.

🔥 Fortinet FortiWeb RCE Exploits Go Public
Proof-of-concept exploits are now public for a pre-auth RCE affecting FortiWeb. If your appliance is exposed and unpatched, you’re on borrowed time and possibly pwned already.

🛠️ Tool of the Week

🗂️ WinDirStat
Sure, it’s not new. But when you need to hunt down that one 100GB folder someone swears “just appeared,” WinDirStat still delivers the goods. If you’ve got a solid FOSS alternative, hit reply and tell us!

Note: WinDirStat can be installed via WinGet.

🧠 Quick Win of the Week:
Don’t forget, WinDirStat also lets you export CSVs for scripting and tracking storage sprawl over time. Pair it with a scheduled task and you’re halfway to a poor man’s monitoring solution.

📄 Bonus Template: Outage Postmortem Markdown Template

Outages happen. What separates the chaos from the clarity is whether you document the aftermath like a pro. This template helps you break down what went wrong, what was done, and what can be learned, without digging through Slack threads, memory fog, or those 2 am post-it-notes you can’t read.

📥 Grab the Outage Postmortem Template via Andy’s GitHub Gist

Use it for internal reviews, status updates, or as ammo for the “why we need to fix this properly” conversation.

🧠 Fun Retro SysAdmin Fact

Back in 1992, IBM sold a ThinkPad… with a butterfly keyboard.

No joke. The keyboard folded out as you opened the lid, expanding to full size. It looked like origami for nerds and made typing on a small laptop actually tolerable — in the pre-chiclet era.

☕ Wrap-Up

Another week, another pile of patches, news, AI hype, and low-level sysadmin wizardry. If you learned something, forward this to a fellow IT warrior who’s probably still googling Citrix patches while sipping reheated coffee.

And as always: stay curious. Stay caffeinated. And keep showing the bots who’s boss.

Until next week,

__
Andy