Skip to content
Sign in
Artwork for SysAdmin Weekly
Technology

SysAdmin Weekly

Andy Syrewicze and Eric Siron

Welcome to the SysAdmin Weekly Podcast, your go-to source for IT-related content tailored to busy system administrators in the trenches. Hosted by longtime sysadmins and Microsoft MVPs Andy Syrewicze and Eric Siron, this show dives deep into the challenges and solutions that matter most to sysadmins on any given day. From technical know-how to real-world insights, SysAdmin Weekly is dedicated to those tireless professionals who keep our digital world running. Tune in for relevant topics, expert advice, and engaging discussions to make your busy schedule a little bit easier.

Play
Open in
  • 28 episodes
  • weekly
  • Avg 1 hr 12 min
  • English

Episodes 28

NewestOldestLongest
All20Unplayed20In progress0Played0
Counted on this page — what you have heard stays on this device, so it is not something the list can be paged by.
  • Monday · 1 hr 4 min

    063 - What Is a Kernel, and Why Does It Blue Screen Your Server?

    The kernel is just software. It happens to be the one program on the box with no guardrails, which is why one bad driver takes the whole system down with it. Andy Syrewicze and Eric Siron walk the kernel from the bottom up: why running two programs at once needed a supervisor, how user mode and kernel mode split the work, and where IRQs, drivers, and the HAL fit. Andy strips a Gentoo kernel so thin it cannot find its own hard drive, and Eric argues a blue screen is the kernel protecting your data. Then they weigh whether Microsoft should push third-party code out of kernel space after CrowdStrike. Up front: Microsoft deleting nonprofit tenant data early, and a listener choosing between Network+ and the server certs. Chapters: 00:00:00 - Cold Open: Kernels Are Not Magic 00:01:33 - Welcome and Show Plugs 00:05:05 - News React: Local AI and the Surface Laptop Ultra 00:07:47 - Anthropic, Bot Swarms, and the Local Model Threat 00:10:57 - Can You Trust the No-Training Checkbox? 00:14:05 - News React: Microsoft 365 Family Storage Cut 00:14:46 - Microsoft Deletes Nonprofit Data Early 00:17:33 - The Cloud Trust Problem 00:19:10 - Retention Is Not Backup 00:21:12 - Listener Question: Help Desk to Junior SysAdmin 00:23:51 - Get the Certs for the Job You Want 00:27:06 - Get the Job First, Then the Certs 00:30:44 - Is Security+ Worth It for a Generalist? 00:32:15 - Main Topic: What a Kernel Actually Is 00:33:54 - From One Program at a Time to Many 00:35:25 - Hand-Written Drivers and the Video Card Virus 00:36:05 - The HAL Ended a Whole Category of Attacks 00:37:29 - Where the Word Kernel Comes From 00:39:02 - Mandrake, Debian, and Gentoo 00:40:48 - Kernel Mode vs User Mode 00:42:48 - Before Memory Protection: DOS to Virtual Memory 00:45:14 - Kernel Mode Drivers Run Without Guardrails 00:45:51 - IRQs, TIE Fighter, and Windows 3.1 00:46:58 - A 2026 Kernel Bug That Fought Over an IRQ 00:49:56 - Install Gentoo Once to Learn the Kernel 00:52:44 - Andy's Razor-Thin Kernel Panic 00:54:14 - ARC Paths and NT Boot Failures 00:57:06 - What Happens When Kernel Code Misbehaves 00:57:51 - CrowdStrike and the Botched Kernel Update 00:58:39 - Why the Blue Screen Is the Right Call 01:01:32 - Should Microsoft Lock Down Kernel Access? 01:02:44 - Wrap Up and Outro Resources / Show Notes: - SysAdmin Weekly 036 - The Hidden Cost of Abstraction: https://youtu.be/5ic4Pozot44 - Eric Siron - Kernels, Shells, and Operating Systems (Re)Visited: https://projectrunspace.org/kernels-shells-and-operating-systems-revisited/ - Microsoft Learn - User mode and kernel mode: https://learn.microsoft.com/en-us/windows-hardware/drivers/gettingstarted/user-mode-and-kernel-mode - Gentoo Handbook - Configuring the Linux kernel: https://wiki.gentoo.org/wiki/Handbook:AMD64/Installation/Kernel - Microsoft - CrowdStrike outage response: https://blogs.microsoft.com/blog/2024/07/20/helping-our-customers-through-the-crowdstrike-outage/ - Microsoft - The Windows Resiliency Initiative: https://blogs.windows.com/windowsexperience/2025/06/26/the-windows-resiliency-initiative-building-resilience-for-a-future-ready-enterprise/ - PCWorld - Surface Laptop Ultra and local AI: https://www.pcworld.com/article/3255200/the-surface-laptop-ultra-is-an-ai-monster-with-a-laptop-problem.html - The Register - Microsoft deletes nonprofit M365 data: https://www.theregister.com/saas/2026/09/28/microsoft-tells-nonprofits-their-deleted-m365-data-isnt-coming-back/5299433 - SysAdmin Weekly: https://www.sysadminweekly.com - SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com - AndyOnTech: https://www.andyontech.com - Project Runspace: https://www.projectrunspace.org - GitHub Discussions: https://github.com/ProjectRunspace/sysadmin-weekly/discussions

  • October 11 · 1 hr 19 min

    062 - What Free IT Training Actually Gets You Hired in 2026 and 2027?

    Free IT training is real and it is actually free. The exam that gets you past a resume screen is the part that still costs money. Andy Syrewicze and Eric Siron go through the free IT training worth your evenings: Microsoft Learn, AWS Skill Builder, Cisco Networking Academy, the Linux Foundation, and the second tier nobody mentions. Why every big vendor gives this away, what a Credly badge proves to a hiring manager, and how to spot the outfit in your LinkedIn DMs guaranteeing you a CCIE. Eric's old employer paid for every cert he sat, and he explains why that path mostly does not exist anymore. Chapters: 00:00:00 - Cold Open: Free Training and Getting Hired 00:01:14 - Welcome and Show Plugs 00:04:21 - News React: Microsoft Broke Copy Paste in Excel 00:09:59 - Nadella on Layoffs, and CEOs Who Will Not Stop Talking 00:12:58 - News React: Broadcom Deauthorizes Insight 00:15:17 - Punished for Selling Competing Products 00:17:13 - Broadcom Is Overplaying Its Hand 00:18:24 - Intel, AMD, and the Nasty Gram From 1999 00:20:53 - Gartner: 55 Percent Shopping the Exit by 2029 00:23:12 - Nerd Hour Lightning Round 00:23:49 - MSP Summit and a Tech Channel 101 Idea 00:25:40 - Eric's In-Laws, a Prowler, and Punctured Cans 00:27:40 - A Sixty Dollar Camera With No Account Required 00:30:11 - Main Topic: What Free Training Gets You Hired 00:30:58 - What "Free" Means When a Vendor Says It 00:32:17 - Microsoft Learn and the AI Documentation Worry 00:36:40 - AWS Skill Builder and Cisco Networking Academy 00:38:29 - Credly Badges and Whether Andy Claims Them 00:39:51 - The Linux Foundation and Open Source Everywhere 00:41:41 - Linux Takes You Further, Microsoft Gets You Hired 00:45:26 - PowerShell Aliases and Azure CLI's Linux Accent 00:48:14 - IBM SkillsBuild, Trailhead, and Google 00:48:55 - The Guaranteed Pass Pitch in Your LinkedIn DMs 00:56:50 - A Guaranteed CCIE Means Somebody Is Cheating 00:58:53 - Pluralsight and Where the Cheap Options Sit 01:02:10 - MSPs, Partner Tiers, and Why They Will Still Pay 01:05:33 - A Badge Proves You Finished a Module 01:06:36 - Turning Free Training Into a Callback 01:08:51 - Make Your Resume Look Like the Person Who Does the Job 01:11:22 - Do This Monday: Name the Gap, Then Fill It 01:13:32 - Anthropic, OpenAI, and Certing in Emerging Tech 01:14:13 - Novell NetWare, Dry Copper, and Refusing to Learn 01:17:32 - Jeffrey Snover: Embrace Learning, or Be a Lumberjack 01:18:46 - Wrap Up and the Call for SysAdmin Horror Stories Resources / Show Notes: - CRN, top VMware partner Insight deauthorized by Broadcom: https://www.crn.com/news/channel-news/2026/top-vmware-partner-insight-deauthorized-by-broadcom-in-north-america - The Register, Microsoft patches Windows and Excel and breaks paste: https://www.theregister.com/os-platforms/2026/09/14/microsoft-patches-windows-and-excel-breaks-audio-remote-access-and-paste/5296085 - Microsoft Learn, free modules and learning paths: https://learn.microsoft.com/training/ - AWS Skill Builder: https://skillbuilder.aws - Cisco Networking Academy: https://www.netacad.com - Linux Foundation Training, free courses: https://training.linuxfoundation.org - IBM SkillsBuild: https://skillsbuild.org - Salesforce Trailhead: https://trailhead.salesforce.com - Google Skills, formerly Cloud Skills Boost: https://www.skills.google - Claude Academy, free AI courses from Anthropic: https://academy.claude.com - OpenAI Academy: https://academy.openai.com - Pluralsight, pricing and the 10 day trial: https://www.pluralsight.com/individuals/pricing/free-trial - SysAdmin Weekly: https://www.sysadminweekly.com - SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com - AndyOnTech: https://www.andyontech.com - Project Runspace: https://www.projectrunspace.org - GitHub Discussions: https://github.com/ProjectRunspace/sysadmin-weekly/discussions

  • September 27 · 1 hr 5 min

    061 - Why Does IT Burn People Out? SysAdmin Mental Health with Paul Croker

    We throw an alert when a disk hits 85 percent. Nobody has ever built the monitoring system for the person who gets the alert. Andy Syrewicze is joined by Paul Croker, a UK IT pro who founded 404 Stress Not Found, a nonprofit built because tech and cyber people had nowhere safe to talk about burnout. Paul walks through the perfect storm that put him on a Berlin stage telling his own story, and Andy gets into the MSP years that surfaced a generalized anxiety disorder. They get specific about hero culture, the all-nighter nobody asks questions about, and why a wellness app and a pizza do not touch the structural problem underneath. Chapters: 00:00:00 - Cold Open: An Industry That Is Good at Breaking People 00:01:11 - Welcome and Episode Intro 00:02:12 - Meet Paul Croker and 404 Stress Not Found 00:03:15 - News React: AI Agents Climbing Out of the Sandbox 00:06:31 - The Agent That Hacked a Gym to Get Into Pilates 00:08:13 - News React: September Patch Tuesday 00:08:56 - A Record 974 CVEs and What Is Driving the Curve 00:11:53 - Where Do These Vulnerabilities Actually Live? 00:14:58 - Nerd Hour Begins 00:15:44 - Dan Scott's BES Server Post and the Flashbacks 00:16:27 - Andy's Novell, AS/400, and BES Nightmare 00:18:15 - Paul's First BlackBerry Deployment 00:20:21 - BlackBerry Messaging as a BCDR Channel 00:22:33 - Sonic on a Phone While Everyone Else Played Snake 00:23:23 - Nerd Hour: Andy's Static Site and Caddy 00:25:10 - A Two Line Config, and Why Simple Wins 00:26:19 - Main Topic: Burnout, Anxiety, and Mental Health in Tech 00:27:07 - Paul's Path From IT Generalist to MSP Owner 00:29:31 - The Pax8 Berlin Talk and the Perfect Storm 00:32:57 - Building the Meetups, and Richard Tubb in Newcastle 00:35:08 - Andy on Generalized Anxiety and the Job That Got Away 00:37:48 - Pressure Arrives in Layers 00:39:56 - The Nasty Gram That Was Not About Work 00:41:36 - We Alert on 85 Percent Disk and Nothing on People 00:42:39 - Heartbeats: The Monitoring Metaphor That Actually Fits 00:45:43 - The People Who Show Up to Learn the Warning Signs 00:47:37 - Why IT Is So Good at Breaking People 00:48:32 - Every Interaction Is a Problem, and It Wears You Down 00:51:08 - Attackers Need One Win, Defenders Need All of Them 00:52:04 - Hero Culture and the All Nighter 00:53:31 - Missing Documentation Is Why the All Nighter Happened 00:55:05 - What Does Not Work: Wellness Apps and Pizza 00:57:13 - Go Kick Some Leaves 00:58:28 - Communities Are the Fix Nobody Reaches For Soon Enough 01:00:10 - The Free 404 Portal and Resources 01:01:19 - The Mentor Who Taught Andy to Say "The End" 01:02:26 - You Are Not Your Job Title 01:03:12 - How to Reach Paul 01:04:07 - Wrap Up and Outro Resources / Show Notes: - 404 Stress Not Found - Paul Croker's nonprofit for IT and cyber mental health: https://404stressnotfound.org - Paul Croker - LinkedIn: https://www.linkedin.com/in/paulcrokeruk/ - Richard Tubb - Tech Mental Health Spaces: https://richardtubb.co.uk/404-stress-not-found/ - The Cyber Express - Patch Tuesday hits a record 974 CVEs: https://thecyberexpress.com/patch-tuesday-september-2026/ - Anthropic - Claude Mythos Preview, AI finding and exploiting zero-days: https://www.anthropic.com/research/mythos-preview - ABC News Australia - AI agent hacks a gym website to book a Pilates class: https://www.abc.net.au/news/2026-08-10/ai-assistant-hacks-gym-website-aus-cyber-attack/107007986 - Caddy - single binary web server with automatic HTTPS: https://caddyserver.com - SysAdmin Weekly: https://www.sysadminweekly.com - SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com - AndyOnTech: https://www.andyontech.com - Project Runspace: https://www.projectrunspace.org - GitHub Discussions: https://github.com/ProjectRunspace/sysadmin-weekly/discussions

  • September 20 · 1 hr 16 min

    060 - Microsoft 365 Licensing in 2026: What Changed and What It Costs You

    Microsoft has no intention of making 365 licensing simpler, because the complexity is what gives them room to negotiate. Andy Syrewicze gets Paul Schnackenburg back on the show to map Microsoft 365 licensing as it actually stands in 2026. The July price increases and the one SKU that did not move, the Defender and Purview add-ons that let a 300 seat shop buy E5 capability without buying E5, the features that left E5 for the Entra Suite, and E7 at $99 per user per month with Agent 365 attached. Paul teaches this to Microsoft partners for a living, and he says the part out loud that most people only suspect. Chapters: 00:00:00 - Cold Open: You Need a PhD for 365 Licensing 00:01:00 - Welcome and Show Plugs 00:07:11 - News React: The iPhone Duo and V1 Hardware 00:12:07 - News React: Companies Throttling Employee AI Use 00:13:59 - Nerd Hour: Andy's Claude Code Data Pipeline 00:20:15 - Nerd Hour: Cloudflare and Paying for AI Crawls 00:22:35 - Main Topic: Making the Imaginary Lawyers Happy 00:23:38 - Business, Enterprise, and the Office 365 Leftovers 00:25:51 - Business SKUs and the July Price Increase 00:28:14 - Why Paul Treats Business Premium as the Floor 00:28:42 - The 15 Person Firm He Put on E5 00:30:31 - Defender and Purview Add-Ons for Business Premium 00:32:47 - From the Outside, This Sounds Like Lunacy 00:33:41 - Licensing Is Now a Quarterly Job 00:34:58 - Mixing Business and Enterprise Past 300 Seats 00:36:29 - What Separates Basic, Standard, and Premium 00:37:18 - Conditional Access Is the Real Upgrade Trigger 00:38:33 - M365 Maps and the Periodic Table 00:40:07 - The No Teams SKUs and EU Antitrust 00:41:39 - Paying for the Top SKU and Turning Nothing On 00:42:17 - Third Party Security Tools vs the Microsoft Stack 00:47:17 - Thirty Portals and Nobody Can Cover Them All 00:50:04 - Tony Redmond: Too Complex for Humans to Understand 00:51:36 - The Intune Suite Folds Into E3 and E5 00:55:22 - The Add-On Maze and What Purview Gives You 00:59:10 - E5 Is Not the Kitchen Sink Anymore 01:01:10 - The Entra Suite: Governance and Private Access 01:03:02 - E7, Agent 365, and Agent ID 01:05:37 - Purview and Defender Watching Your Agents 01:07:12 - Who Is Running OpenClaw in Your Tenant? 01:07:59 - E7 at $99 Per User Per Month 01:09:07 - The Complexity Is Intentional 01:10:06 - Do This Monday: Audit Your Add-Ons and Renewal Date 01:11:19 - The New Conditional Access Overage Warning 01:12:12 - The One License Myth and Microsoft's Telemetry 01:14:53 - Wrap Up and Outro Resources / Show Notes: - Tony Redmond, Is Microsoft 365 Too Complex for Humans to Understand: https://365forall.com/article/is-microsoft-365-too-complex-for-humans-to-understand-blog-by-tony-redmond - Office 365 for IT Pros, the subscription book Paul recommends: https://office365itpros.com - M365 Maps by Aaron Dinnage, visual SKU and feature breakdowns: https://m365maps.com - jumpto365, the Periodic Table of Microsoft 365: https://www.jumpto365.com - Microsoft Learn, Microsoft 365 and Office 365 service descriptions: https://learn.microsoft.com/en-us/office365/servicedescriptions/office-365-service-descriptions-technet-library - Microsoft, Business Basic, Standard and Premium comparison: https://aka.ms/M365BusinessPlans - 404 Media, companies are throttling employee AI use because it is too expensive: https://www.404media.co/companies-are-throttling-employees-ai-use-because-its-too-expensive/ - Cloudflare, new AI traffic options for search, agent and training bots: https://blog.cloudflare.com/content-independence-day-ai-options/ - SysAdmin Weekly: https://www.sysadminweekly.com - SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com - AndyOnTech: https://www.andyontech.com - Project Runspace: https://www.projectrunspace.org - GitHub Discussions: https://github.com/ProjectRunspace/sysadmin-weekly/discussions

  • September 11 · 1 hr 14 min

    059 - How Should SysAdmins Handle Remote Access in 2026?

    Which protocol you use to reach the box is the least interesting decision you will make about remote access. Andy Syrewicze and Eric Siron go after the piece they cut from the tools episode. Eric lands the sharpest version half an hour in: what you are actually doing is moving from one-sided authentication to mutual authentication. Around that sit overlay networks against the VPN concentrator, the RMM console as the most attractive target in an MSP estate, the outbound tunnel nobody watches for, and whether just-in-time access holds up at 3am with something down and nobody awake to approve it. Chapters: 00:00:00 - Cold Open: Remote Access Gets Its Own Episode 00:01:20 - Welcome and Show Plugs 00:04:16 - News React: Anthropic Safety Researcher Resigns 00:12:54 - News React: Broadcom Pulls Public VDDK Access 00:16:21 - Nerd Hour: Eric's Hugo Migration 00:17:24 - Three Gates Against a Runaway API Bill 00:20:38 - Main Topic: The Tooling Is the Small Part 00:23:08 - SSH on 22, and the Port Change Experiment 00:24:21 - Name a Reason to Expose a Management Port 00:27:10 - Overlay Networks, Tailscale, and WireGuard 00:29:31 - Eric: This Is About Mutual Authentication 00:32:20 - RMM Tools and the Central Console Problem 00:33:41 - Do You Need Remote Management All the Time? 00:34:36 - Just Enough Administration Meets Just in Time 00:36:00 - Eric: I Attack the Endpoint, Not the Protocol 00:40:16 - Risk Assessment Is a SysAdmin Skill 00:42:47 - The Firewall Is Also the VPN, and Fortinet 00:45:17 - Outbound Access, Attacker's Side 00:47:32 - Is Anyone Watching Outbound Traffic? 00:50:52 - The 3am Phone Call 00:52:46 - Eric: MFA Everything, No Remember Me 00:55:44 - PAM, PIM, and Where to Read Up 00:56:14 - Nothing Revokes Itself Unless You Build It 00:58:13 - Key Takeaways: Never Rely on One Control 00:59:40 - Access Should Be Ephemeral 01:01:46 - Risk Profiles: Tomcat vs Medical Records 01:03:52 - The Tools: Tailscale, SSH, Remmina 01:07:56 - Eric's Kit: PuTTY, WinSCP, rsync 01:11:17 - Do This Monday 01:13:52 - Wrap Up and Outro Resources / Show Notes: - NBC News, Anthropic researcher Jacob Coxon resigns: https://www.nbcnews.com/tech/tech-news/anthropic-safety-researcher-resigned-warning-rapid-ai-development-gamb-rcna596767 - RentAHuman, where AI agents hire people for real world tasks: https://rentahuman.ai - Brandon Lee (vExpert), Broadcom pulled public VDDK access: https://www.virtualizationhowto.com/2026/09/leaving-vmware-just-got-harder-after-broadcom-pulled-vddk-downloads/ - CISA, hardening Fortinet devices after credential exposure: https://www.cisa.gov/news-events/alerts/2026/06/18/cisa-urges-hardening-fortinet-devices-after-reports-credential-exposure - Microsoft Learn, Entra PIM, eligible versus active access: https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure - Tailscale, free Personal plan covers 6 users: https://tailscale.com/pricing - WireGuard, what Tailscale manages under the hood: https://www.wireguard.com - Cisco Duo, free tier for teams of 10 or fewer: https://duo.com - Remmina, open source RDP, VNC and SSH client: https://remmina.org - PuTTY: https://www.chiark.greenend.org.uk/~sgtatham/putty/ - WinSCP: https://winscp.net - SysAdmin Weekly: https://www.sysadminweekly.com - SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com - AndyOnTech: https://www.andyontech.com - Project Runspace: https://www.projectrunspace.org - GitHub Discussions: https://github.com/ProjectRunspace/sysadmin-weekly/discussions

  • September 4 · 1 hr 5 min

    058 - What Tools Do SysAdmins Actually Use Every Day?

    The tools that stay in the kit for a decade are the ones that still work when the network, the domain, or the boot volume is the thing that broke. Andy Syrewicze and Eric Siron open their real toolboxes and argue about what earns permanent residency. nmap and Wireshark for what is actually on the wire, Sysinternals for what a box is really doing, GParted and SystemRescue for the volume that will not mount, and the chkdsk, DISM, then SFC sequence Eric can run in his sleep. Andy's list skews hard toward triage because MSP work meant walking into a stranger's burning network every week. Remote access is missing on purpose; RDP, SSH, and overlay networks are getting their own episode. Chapters: 00:00:00 - Cold Open: The Tools That Save Your Bacon 00:01:13 - Welcome and Show Plugs 00:03:11 - News React: Anthropic's Enterprise Frontier Safeguards 00:07:01 - News React: The US Goes Openly Offensive in Cyber 00:12:57 - Nerd Hour: CC Top and a Pomodoro Timer That Remembers 00:15:53 - What Earns a Permanent Spot in the Toolbox 00:17:32 - Why MSP Years Produce a Triage Kit 00:20:13 - nmap, and the Licensed Cisco Utility Story 00:22:31 - Sysinternals and Process Monitor 00:23:16 - Wireshark Past the Basics 00:24:09 - netstat and nslookup Are Not Wizardry 00:25:12 - dig, and Why ping Is Not a DNS Tool 00:27:22 - Test-NetConnection Instead of ping 00:27:59 - Why Anyone Blocks ICMP in the First Place 00:30:11 - MXToolbox, PingPlotter, and the Neighbor's Air Conditioner 00:33:18 - GParted, SystemRescue, and the Live CD Shelf 00:35:58 - chkdsk, DISM, then SFC, in That Order 00:38:06 - DBAN and Decommissioning Disks 00:40:51 - The Multi-Pass Wipe Myth 00:43:25 - Greenshot and Capture Last Region 00:46:07 - Spectacle, Client Hypervisors, Docker and Podman 00:47:33 - Get-Help and man: Nobody Remembers Syntax 00:48:28 - OpenSSL, Qualys SSL Labs, and testssl.sh 00:50:13 - WSL as the Whole Toolbox 00:51:37 - The Everyday List: Vim, Bitwarden, Git, Package Managers 00:54:20 - Remote Access Gets Its Own Episode 00:55:30 - The Platform Tax After Leaving Windows 00:58:18 - Edge on WSL on Windows, for Certificate Chains 01:01:02 - Do This Monday 01:03:31 - Eric's Advice: Go Look for the Tool 01:04:37 - Wrap Up and Outro Resources / Show Notes: - Anthropic, Developing Enterprise Frontier Safeguards: https://www.anthropic.com/news/enterprise-frontier-safeguards - Nmap: https://nmap.org/ - Wireshark: https://www.wireshark.org/ - Microsoft Sysinternals, and Sysinternals Live: https://learn.microsoft.com/en-us/sysinternals/ - MXToolbox, external DNS and blacklist checks: https://mxtoolbox.com/ - PingPlotter, latency and packet loss per hop: https://www.pingplotter.com/ - GParted, and the live image: https://gparted.org/ - SystemRescue: https://www.system-rescue.org/ - DBAN, still there, spinning disk era, not for SSDs: https://sourceforge.net/projects/dban/ - Greenshot, Windows only: https://getgreenshot.org/ - Qualys SSL Labs, tick the box to stay off the public board: https://www.ssllabs.com/ssltest/ - testssl.sh, for internal sites: https://testssl.sh/ - DevToys, clipboard certificate parser: https://devtoys.app/ - SysAdmin Weekly, all show links: https://www.sysadminweekly.com - SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com - AndyOnTech: https://www.andyontech.com - Project Runspace: https://www.projectrunspace.org - GitHub Discussions, what is in your toolbox: https://github.com/ProjectRunspace/sysadmin-weekly/discussions

  • August 28 · 1 hr 6 min

    057 - Is Your Air Gap Actually an Air Gap? Port 22 Says No

    Somewhere inside that isolated network, port 22 is open, and it has been open since the outage six months ago that nobody wrote up. Andy Syrewicze and Eric Siron take apart a term the industry uses constantly and almost never earns. They walk the management plane hole by hole: SSH and RDP so somebody can patch the thing, SMB for the files that have to move, DNS and NTP because nothing works without them, and the iDRAC, iLO, and IPMI boards that get parked on the management VLAN and then never patched at all. The argument they land on is not that a real air gap is impossible, it is that calling something an air gap ends the conversation, and a promise nobody re-verifies is worse than a risk everybody can see. Chapters: 00:00:00 - Cold Open: Your Air Gap Probably Is Not an Air Gap 00:01:12 - Welcome and Show Plugs 00:04:19 - News React: An AirTag, a Rare Book, and an Amazon Scanning Facility 00:10:10 - News React: Bill Gates Changes His Mind on AI and Jobs 00:13:03 - What the Entry Level Job Market Looks Like Right Now 00:15:05 - When Nobody Is Left Who Knows How to Program It 00:19:25 - Nerd Hour: Claude Code, Agents, and Building CC Top 00:23:54 - Nerd Hour: Moving Project Runspace to Hugo, JavaScript Free 00:28:22 - What an Air Gap Actually Means 00:31:22 - Logical, Network, Virtual: How the Word Got Laundered 00:32:36 - Every Hole You Poke Just to Manage the Thing 00:34:18 - The One Nobody Segments: iDRAC, iLO, and IPMI 00:36:26 - A Brief and Deserved Detour About Printers 00:37:23 - NTP, DNS, License Activation, and Telemetry 00:40:34 - Why Leaving Hyper-V Out of the Domain Is Not Security 00:43:16 - VLANs, Switch Fabric, and Breakout Attacks 00:44:40 - Assume Breach: Zero Trust, JIT, and JEA 00:50:36 - Sneaker Net and Poisoned USB Drives 00:52:20 - Stuxnet and the Gap That Was Real 00:54:59 - How Would You Even Safely Clean a USB Drive? 00:56:58 - Say What You Have, Then Defend It 00:57:29 - The Real Danger Is the False Sense of Security 01:00:23 - The Windows Firewall Lesson 01:03:11 - What a Genuine Air Gap Actually Costs 01:04:59 - Wrap Up and Outro Resources / Show Notes: - Symantec Security Response, W32.Stuxnet Dossier, the canonical technical analysis: https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en - Ralph Langner, To Kill a Centrifuge, on why post-Stuxnet air gap strategies miss the point: https://www.cs.yale.edu/homes/jf/Langner.pdf - The 2008 USB breach of US military networks, Agent.btz and Operation Buckshot Yankee: https://en.wikipedia.org/wiki/2008_malware_infection_of_the_United_States_Department_of_Defense - Microsoft Security Advisory 967940, the update that killed USB AutoRun: https://learn.microsoft.com/en-us/security-updates/securityadvisories/2009/967940 - NIST SP 800-82 Rev. 3, Guide to Operational Technology Security, for naming what you actually have: https://csrc.nist.gov/pubs/sp/800/82/r3/final - 404 Media, tracking a shipment of rare books to an Amazon AI training facility: https://www.404media.co/we-tracked-a-shipment-of-rare-books-it-ended-at-an-amazon-ai-training-facility/ - Semafor, Bill Gates has changed his mind about AI and jobs: https://www.semafor.com/article/08/25/2026/this-is-crazy-this-is-insane-bill-gates-has-changed-his-mind-about-ai-and-jobs Gates Notes, the essay itself: The turbulent AI era is here: https://www.gatesnotes.com/a-turbulent-ai-era-and-critical-choices-to-make - SysAdmin Weekly, all show links: https://www.sysadminweekly.com - SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com - AndyOnTech: https://www.andyontech.com - Project Runspace: https://www.projectrunspace.org - GitHub Discussions, tell us about your air gap and why you have one: https://github.com/ProjectRunspace/sysadmin-weekly/discussions

  • August 22 · 1 hr 29 min

    056 - How People Actually Get Into SysAdmin Work

    Two careers, two completely different entry points, and the exact same first catastrophe: data gone, no idea if it was coming back. Andy Syrewicze and Eric Siron trade full origin stories, from the 486 and the VIC-20 through the first paid tech jobs neither of them was qualified for. They get specific about the failures that rewired how they work, the mentor advice that still holds up decades later, the advice that aged badly, and the question underneath all of it: the on-ramp that produced both of them was cheap hardware, full access, and time to break things, and most of that is gone. Whether that actually matters for anyone starting in 2026 is the argument they finish on. Chapters: 00:00:00 - Cold Open: How We Actually Got Into IT 00:01:01 - Welcome, Show Plugs, and Why There Was a Gap 00:05:03 - News React: Meta Goes Open Source Again With Muse Glimmer 00:07:55 - News React: Lithium Battery Farms, Data Centers, and Zoning Boards 00:16:39 - Nerd Hour: A Black Hat Demo on Local LLMs and M365 Spear Phishing 00:19:34 - Nerd Hour: Fish Tape, a Whole House Vacuum, and a 160 Degree Attic 00:24:51 - The Stuff We Broke Before Anyone Paid Us 00:26:31 - Andy: The 486, the Matrix Boot Screen, and Getting Told to Change It Back 00:30:41 - Eric: The VIC-20, a Xerox 286, and Overclocking With a Box Fan 00:37:53 - Andy's First IT Job: A K-12 Summer Gig and 30 Cables a Foot Short 00:44:05 - Eric's First IT Job: Freight Dock to Phone Support 00:49:14 - Would Either of These Paths Still Get You Hired Today? 00:56:02 - Andy Nukes the Application Share and Prays at a Tape Drive 01:00:11 - Eric's Version: Dad, I Deleted All Your Files 01:02:46 - Why Almost Every SysAdmin's First Disaster Involves Data 01:04:21 - Advice That Held Up: The Key to IT Is Laziness 01:10:06 - Being Decent Beats Being Smart, and Learning to Say I Don't Know 01:15:01 - Advice That Aged Badly: Always, Never, and Best Practice 01:17:31 - Nobody Ever Got Fired for Buying IBM 01:23:02 - Does This On-Ramp Still Exist in 2026? 01:26:07 - You Do Not Need Commercial Gear to Learn This 01:27:56 - Wrap Up and Outro Resources / Show Notes: - VentureBeat - Meta returns to open source with Muse Glimmer: https://venturebeat.com/technology/meta-returns-to-open-source-with-muse-glimmer-an-apache-2-0-licensed-30b-parameter-ai-model-optimized-for-agents-available-now - MultiState - Federal AI data center policy meets resistance from state lawmakers: https://www.multistate.us/insider/2026/4/14/federal-ai-data-center-policy-meets-resistance-from-state-lawmakers - Black Hat official YouTube, where the USA 2026 Briefings recordings post: https://www.youtube.com/@BlackHatOfficialYT - SysAdmin Weekly, all show links: https://www.sysadminweekly.com - SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com - AndyOnTech: https://www.andyontech.com - Project Runspace: https://www.projectrunspace.org - GitHub Discussions, tell us your first broke something moment: https://github.com/ProjectRunspace/sysadmin-weekly/discussions

  • August 14 · 1 hr 5 min

    055 - How Do You Run IT With No Budget?

    "No budget" is almost never no budget. It is no budget yet, and the thing that closes the gap is your ability to put a real dollar figure on the risk you are carrying. Andy Syrewicze and Eric Siron have both run IT for organizations where getting the credit card out meant you had done something wrong. They walk through what that actually looks like: a PC DOS 4 machine still passing parts in a quality lab, an end of life Cisco ASA swapped for an open source firewall on scavenged workstations, NetGear ReadyNAS units kept on a shelf for SAN emergencies, and the iSCSI arguments that never die. Then the harder part: where the first dollar goes when budget finally shows up, and how to translate aging gear into risk language that a business owner will actually fund. Chapters: 00:00:00 - Cold Open: Keeping the Lights On With No Budget 00:01:00 - Welcome and Show Plugs 00:03:32 - News React: 25 Companies Sign On for Open Weight Models 00:07:51 - News React: OpenAI, Profitability, and the Missing CFO 00:12:56 - Nerd Hour: A Baldur's Gate Randomizer on GitHub Pages 00:16:02 - Nerd Hour: Unicode, MiniForge, and Why the Human Said No 00:20:51 - Community Comments: Cable Pulls and Fat WIM Files 00:24:34 - The Reality of the Zero Budget Shop 00:29:56 - End of Life Cisco ASA to an Open Source Firewall 00:34:04 - You Do Not Have to Buy Cisco 00:40:00 - Where Open Source Wins: Monitoring, Logging, Nmap 00:43:35 - Budget Storage: NAS Stopgaps and the iSCSI Argument 00:51:31 - Spending the First Dollar on Maximum Risk Reduction 00:52:44 - Backups: The One Place Not to Go Free 00:57:02 - No Budget Usually Means No Budget Yet 01:01:40 - Document the Risk, Get the Decision in Writing 01:03:40 - Wrap Up and Outro Resources / Show Notes: - Microsoft - Open Weights and American AI Leadership, the letter itself: https://www.microsoft.com/en-us/corporate-responsibility/topics/open-weight/ - TechCrunch - Industry urges against broad open-weight restrictions: https://techcrunch.com/2026/07/24/as-us-weighs-response-to-chinese-ai-industry-urges-against-broad-open-weight-restrictions/ - Fortune - OpenAI CFO reportedly at odds with Altman over spending: https://fortune.com/2026/04/28/openai-cfo-sam-altman-missed-revenue-target/ - Andy's Infinity Engine party randomizer, the Nerd Hour web app: https://asyrewicze.github.io/infinity-engine-randomizers/ - PomoCLI, Andy's terminal Pomodoro timer: https://github.com/asyrewicze/pomocli - Miniforge, the package manager Andy declined to add as a dependency: https://github.com/conda-forge/miniforge - OPNsense, open source firewall: https://opnsense.org/ - pfSense, open source firewall: https://www.pfsense.org/ - Nagios, open source monitoring: https://www.nagios.org/ - Nmap, free network scanner: https://nmap.org/ - Restic, fast secure backup program: https://restic.net/ - SysAdmin Weekly, all show links: https://www.sysadminweekly.com - SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com - AndyOnTech: https://www.andyontech.com - Project Runspace: https://www.projectrunspace.org - GitHub Discussions, share your no budget stories: https://github.com/ProjectRunspace/sysadmin-weekly/discussions Sources and clarifications (News React): - The open weights letter had 25 signatories on July 24, 2026. OpenAI and Google were absent that day and signed by July 26; the list has since passed 270. Anthropic has not signed. - Eric flagged the Sam Altman "no path to profitability" clip as possibly a deep fake, and we could not verify that specific video. The underlying reporting on OpenAI's CFO and spending tension is real; see the Fortune link above.

  • July 24 · 1 hr 16 min

    054 - Windows Admin Center in 2026: Good Tool, Broken On-Ramp?

    Windows Admin Center is a genuinely useful tool wrapped in an on-ramp so rough it took Andy four hours, a from-scratch certificate authority, and a pile of misleading error messages just to reach the login screen. Andy rebuilt his lab on an all-Core Windows Server 2025 fleet, set out to manage it from a browser the way Microsoft keeps telling us to, and hit a certificate wall that most SysAdmins would never fight through. He and Eric Siron walk the full gauntlet: the 60-day self-signed cert trap, an ERROR_DS_RANGE_CONSTRAINT that pointed the wrong way, a web server template that blocks computer requests, a silent blank SAN that kills the HTTPS binding, and the bigger question of whether a web tool is even the right way to manage Windows. Along the way: a News React on open-source AI, China, and a possible federal clampdown, plus the domain-join debate that never dies. Chapters: 00:00:00 - Cold Open: Four Hours to Install a Free Tool 00:01:15 - Welcome and Show Plugs 00:03:52 - News React: Apple, the EU, and the Walled Garden 00:08:55 - News React: Open-Source AI, China, and a Possible Federal Clampdown 00:16:00 - Nerd Hour: Ripping Out KVM, Putting Hyper-V Back 00:18:55 - Setting the Scene: An All-Core Lab and the Certificate Wall 00:30:08 - The Four-Hour Gauntlet: A Sequence of Failures 00:44:00 - What WAC Gets Right, and Where It Falls Down 00:59:24 - Azure Arc and the Real Agenda 01:07:45 - Does WAC Move the Needle? The Verdict Resources / Show Notes: - Microsoft - Windows Admin Center overview: https://learn.microsoft.com/en-us/windows-server/manage/windows-admin-center/overview - Hornetsecurity (Eric Siron) - Public Key Infrastructure explained, including why to stop using self-signed certificates: https://www.hornetsecurity.com/en/blog/public-key-infrastructure/ Sources and clarifications (News React / AI segment): We referenced several press claims from memory during the AI segment. The claims hold up, but a few were under-attributed on air, so here is the precise record. - Moonshot AI - Kimi K3, the open-weight model released the week before we recorded that benchmarks near frontier US models. The whole news cycle is downstream of it: https://venturebeat.com/technology/chinas-moonshot-ai-releases-kimi-k3-the-largest-open-source-model-ever-rivaling-top-u-s-systems - Dean Ball, OpenAI's Head of Strategic Futures and a former senior AI adviser in the Trump administration, is the source of the "AI communism" line, in a post on X. On air Andy first said "CEO of Claude" and "CEO of Anthropic," then corrected to "someone from OpenAI." The correct attribution is Ball at OpenAI, NOT Anthropic. Naming note: Claude is the model, Anthropic is the company: https://x.com/deanwball/status/2078133895766114412 - Dean Ball - follow-up clarifying he was predicting that outcome, not advocating for it: https://x.com/deanwball/status/2078619513575137330 - Axios (July 20, 2026) - the federal-action angle. Frame it as reportedly under consideration; no formal policy has been proposed. Mechanisms discussed include Commerce Entity List additions, security advisories, and federal procurement rules: https://www.axios.com/2026/07/20/ai-us-china-open-source-kimi - David Sacks, former White House AI adviser, publicly argued that closed labs want the government to eliminate their open-source competition, in a post on X: https://x.com/DavidSacks/status/2078826291638522127 - Dario Amodei has called open-source AI a dangerous path; the source quotes are collected in this r/Anthropic thread: https://www.reddit.com/r/Anthropic/comments/1ui759l/amodei_says_open_source_is_dangerous/

  • July 17 · 1 hr 13 min

    053 - How to Survive as a Solo SysAdmin: Where to Start When You're the Only One

    When you are the only person standing between a working business and total collapse, the job stops being about doing everything and starts being about deciding what not to do this week. Andy and Eric Siron tackle a listener-requested topic: you just became the solo SysAdmin, whether by hire, downsizing, or promotion, and now you own the firewall, the servers, the backups, and the printer nobody wants to replace. This one is heavy on the career and survival skills that keep a team of one sane: triage before projects, documentation as an insurance policy, buying time back through automation and managed services, and speaking business value instead of acronyms to leadership. Plus a News React on Windows Server hot patching and 1Password for Claude, and a Nerd Hour on Debian 13.6 Secure Boot certs and SAML auth for Nagios. Chapters: 00:00:00 - You're the Only SysAdmin. Now What? 00:01:02 - Welcome and Show Plugs 00:05:13 - News React: Windows Server Hot Patching via Azure Arc 00:11:00 - News React: 1Password for Claude and AI Guardrails 00:13:50 - Nerd Hour: Debian 13.6 and Secure Boot Certificate Updates 00:16:33 - Nerd Hour: SAML Auth for Nagios via ADFS 00:23:20 - Main Topic: The Case of the Solo SysAdmin 00:28:23 - Triage Before Projects 00:30:57 - Note-Taking Systems: ARC, Bullet Journal, Rocketbook 00:46:40 - Documentation Is Survival and the Hit-By-A-Bus List 00:50:25 - Greenshot and Fast Screenshot Documentation 00:54:14 - Buying Time Back: Automation 00:58:16 - Buying Time Back: Managed Services 01:03:44 - Communicating Business Value to Leadership 01:09:09 - Managing and Documenting Risk 01:10:17 - Wrap-Up Resources / Show Notes: - MacRumors - 1Password for Claude lets AI log in without seeing your passwords: https://www.macrumors.com/2026/07/16/1password-claude-integration/ - Microsoft Learn - Enable Hotpatch for Azure Arc-enabled servers (now free for Windows Server 2025): https://learn.microsoft.com/en-us/windows-server/get-started/enable-hotpatch-azure-arc-enabled-servers - Debian - 13.6 release notes and Secure Boot CA guidance: https://www.debian.org/News/2026/20260711 - Greenshot, free open-source screenshot tool: https://getgreenshot.org/ - Rocketbook, reusable notebook: https://getrocketbook.com/ - Bullet Journal method: https://bulletjournal.com/ - SysAdmin Weekly, all show links: https://www.sysadminweekly.com - SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com - SysAdmin Weekly GitHub Discussions: https://github.com/ProjectRunspace/sysadmin-weekly/discussions - Andy on Tech: https://www.andyontech.com - Project Runspace: https://www.projectrunspace.org

  • July 10 · 1 hr 12 min

    052 - Why is Homelab Hardware So Expensive in 2026 (and When Will It Get Cheaper)?

    Somewhere between a $305 Raspberry Pi board and a used NVMe listing on eBay, the homelab hobby quietly stopped making financial sense. Andy and co-host Eric Siron dig into why memory, NAND, and storage prices went vertical in 2026, who is actually eating the supply, and what practitioners should do about it. They cover the AI buildout swallowing the manufacturing capacity, why prices probably never return to pre-shortage levels, and the return of a skill the industry let atrophy: right-sizing hardware to the workload instead of throwing spec at it. ## Chapters: 00:00:00 - The Hardware Market Is Fire and Brimstone 00:01:18 - Welcome and Intros 00:04:33 - News React: The First Fully AI-Run Ransomware (JadePuffer) 00:08:16 - News React: AI Job-Blame and the Unix Lawsuit That Won't Die 00:13:32 - Nerd Hour: Thunderbird Finally Speaks Exchange Online 00:18:47 - Nerd Hour: Hugo, AI, and the 80% Problem 00:23:13 - Show Plugs 00:24:09 - Why Homelab Hardware Broke Me: The eBay Moment 00:41:44 - Why This Is Happening: AI Is Eating the Supply Chain 00:46:43 - Local Models and the Willingness-to-Pay Problem 00:52:41 - The New Normal: Prices Aren't Coming Back 00:59:05 - Right-Size the Hardware to the Problem 01:06:02 - Could China Break the Bottleneck? 01:09:29 - One More Casualty, and Wrap-Up ## Resources / Show Notes - BleepingComputer, JadePuffer AI-run ransomware: https://www.bleepingcomputer.com/news/security/jadepuffer-ransomware-used-ai-agent-to-automate-entire-attack/ - Thunderbird Blog, native Microsoft Exchange (EWS) support in 145: https://blog.thunderbird.net/2025/11/thunderbird-adds-native-microsoft-exchange-email-support/ - Raspberry Pi Foundation, memory-driven price rises: https://www.raspberrypi.com/news/more-memory-driven-price-rises/ - GamersNexus, SSDs WTF (NAND makers sold out for 2026): https://gamersnexus.net/features/ssds-wtf - Gartner, surging memory costs (125% DRAM / 234% NAND surge): https://www.gartner.com/en/newsroom/press-releases/2026-02-26-gartner-says-surging-memory-costs-will-reduce-global-pc-and-smartphone-shipments-in-2026 - TechPowerUp, Samsung and SK Hynix $870B capacity plan and fab timelines: https://www.techpowerup.com/350478/samsung-and-sk-hynix-to-expand-semiconductor-capacity-with-usd-870-billion-plan - BBC, Samsung's memory-driven profit surge: https://www.bbc.com/news/articles/c1kyy8yrpxdo - IDC, why the memory market stays tight and makers aren't rushing capacity: https://www.idc.com/resource-center/blog/why-the-memory-market-is-still-tight-what-comes-next/ - Tom's Hardware, SK Group chairman says the shortage runs until 2030: https://www.tomshardware.com/pc-components/dram/sk-group-chairman-says-memory-chip-shortage-will-last-until-2030 - SemiAnalysis, China's CXMT challenging DRAM incumbents: https://newsletter.semianalysis.com/p/chinas-cxmt-is-set-to-challenge-dram - Tom's Hardware, China's YMTC and homegrown NAND tooling: https://www.tomshardware.com/pc-components/ssds/chinas-ymtc-moves-to-break-free-of-u-s-sanctions-by-building-production-line-with-homegrown-tools-aims-to-capture-15-percent-of-nand-market-by-late-2026 - TrendForce, China's GPU makers scaling as enterprise accelerators: https://www.trendforce.com/news/2025/10/07/news-chinas-gpu-trio-rise-as-nvidia-retreats-decoding-moore-threads-metax-and-cambricon/ - CSIS, China and global cyber supply chain risk: https://www.csis.org/blogs/strategic-technologies-blog/chinas-weaponization-global-cyber-supply-chains - AndyOnTech, Andy's hub for all his output: https://www.andyontech.com - Project Runspace, the organization behind the show: https://www.projectrunspace.org - SysAdmin Weekly GitHub Discussions, share your hardware battle stories: https://github.com/ProjectRunspace/sysadmin-weekly/discussions

  • July 3 · 1 hr 27 min

    051 - What's Actually in Our Homelabs (and Why)

    The hardest part of running a home lab in 2026 is not building it up; it is being honest about what earns its place. Andy is joined by returning guest and member of the SysAdmin Weekly community, Clay Tamam, a working SysAdmin over in the Netherlands, for a real tour of what is actually sitting in their labs: the hardware, the hypervisors, the services they use every day, and the reasoning behind each choice. Andy explains why he tore a four-node Kubernetes cluster down to five VMs on a single Debian box, Clay walks through building a rack from scratch on a practical budget, and both of them dig into what current memory and hardware prices are doing to the hobby. It closes with the Graveyard: the gear and services that got powered off, and why pruning is an important part of the discipline. ## Chapters 00:00:00 - Welcome and a Returning Guest: Clay from the Netherlands 00:07:20 - News React: A US Firm's Bid for the Dutch DigiD Infrastructure 00:15:21 - News React: An AI-Assisted Hack Hits US Festival Ticketing 00:18:11 - Nerd Hour: Scoping AI Agents and Building a Lab From Scratch 00:24:29 - Main Topic: What Is Actually in Our Home Labs 00:25:15 - The Hardware: Andy's Pared-Down Single-Box Lab 00:31:25 - The Hardware: Clay's From-Scratch Rack Build 00:45:52 - The Foundation: KVM vs. Proxmox 00:56:33 - The Services That Earn Their Keep 01:02:37 - Self-Hosting, the Plex Price Hike, and Leaving Discord 01:13:57 - Learning Goals and the Graveyard 01:24:19 - Local Inference and the Urge to Panic-Buy 01:25:49 - Wrap-Up ## Resources / Show Notes - Wired - Researcher used Claude to break Front Gate Tickets: https://www.wired.com/story/claude-helped-a-hacker-find-a-way-to-issue-tickets-to-almost-every-us-music-festival/ - NL Times - Netherlands blocks the US takeover of DigiD operator Solvinity: https://nltimes.nl/2026/05/26/netherlands-blocks-us-takeover-digid-operator-solvinity-security-concerns - Security Now with Steve Gibson: https://www.grc.com/securitynow.htm - Proxmox Virtual Environment and Backup Server: https://www.proxmox.com - Forgejo, the self-hosted Git forge (Gitea fork): https://forgejo.org - Tailscale, the overlay mesh VPN: https://tailscale.com - Foundry Virtual Tabletop: https://foundryvtt.com - Plex - New Lifetime Plex Pass pricing: https://www.plex.tv/blog/new-lifetime-plex-pass-pricing/ - Jellyfin, the free software media system: https://jellyfin.org - Vaultwarden, a self-hosted Bitwarden-compatible server: https://github.com/dani-garcia/vaultwarden - Framework Desktop: https://frame.work/desktop - Connect with Clay on LinkedIn: https://www.linkedin.com/in/clay-tamam-00b6441b3/ - AndyOnTech: https://www.andyontech.com

  • June 26 · 1 hr 1 min

    050 - How Do You Run a Blameless Incident Postmortem?

    A postmortem that ends with a name instead of a root cause wasted everyone's time in the room. Andy and Eric Siron pull from a combined several-decades of incident reviews to break down what a postmortem actually is, what kind of outage earns one, and who really needs to be at the table. The throughline: keep it blameless without making it unaccountable, separate root cause from contributing factors, and remember that the follow-through is the entire point. Whether your postmortem is sixty people in a war room or just you writing a summary for one nervous boss, the discipline scales. ## CHAPTERS 00:00:00 - Why Postmortems Matter 00:01:31 - Welcome and Show Plugs 00:04:29 - News React: AI Job Hype Walkbacks, Teams Pain, Oracle Layoffs, AMD Trust 00:17:42 - News React: Ubiquiti UniFi OS Max-Severity RCE CVEs 00:19:41 - Nerd Hour: Claude Code, Hugo, and Pandoc 00:23:36 - The Incident Postmortem Process 00:26:40 - What Actually Earns a Postmortem 00:29:22 - Who Needs To Be In the Room 00:38:49 - Blameless, Not Unaccountable 00:46:50 - What Information To Gather 00:50:33 - Running the Review 00:55:15 - Follow Through Is the Whole Point ## RESOURCES / SHOW NOTES - SysAdmin Weekly home and show links: https://www.sysadminweekly.com - SysAdmin Weekly companion newsletter: https://newsletter.sysadminweekly.com - AndyOnTech: https://www.andyontech.com - Project Runspace: https://www.projectrunspace.org - BleepingComputer - Ubiquiti patches three max-severity UniFi OS RCE flaws (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910): https://www.bleepingcomputer.com/news/security/ubiquiti-patches-three-max-severity-unifi-os-vulnerabilities/ - Postmortem markdown template (free, CC BY 4.0, version-tracked in the show repo): https://github.com/ProjectRunspace/sysadmin-weekly/blob/main/resources/postmortem_markdown_process_template.md - Pandoc, universal document converter (Markdown to docx): https://pandoc.org - Hugo, the Markdown-driven static site generator: https://gohugo.io

  • June 19 · 1 hr 2 min

    049 - How Do Attackers Use Local LLMs to Phish At Scale?

    Ask Claude or ChatGPT to write a phishing email and it politely refuses; pull the right open-weight model onto your own laptop and that refusal layer simply does not exist in many cases. Andy brings his InfoSecurity Europe session to the show, and Eric Siron joins to walk through how threat actors run local LLMs on their own hardware to generate targeted spear phishing at scale, in any language, with no internet connection and no guardrails. The guys break down what the attack workflow actually looks like, why these capabilities never disappear once a model is downloaded, and where the real defensive line sits. Spoiler: "spot the typo" awareness training is dead, and verification culture plus strong email authentication is what carries the load now. ## Chapters: 00:00:00 - Cold Open: Local LLMs and Phishing at Scale 00:01:37 - Welcome Back and InfoSecurity Europe 00:03:55 - News React: Washington Pumps the Brakes on Fable 00:06:46 - News React: NY Ghost Gun Printing Law and Google AI Liability 00:12:07 - Nerd Hour: Camera Gear and Mac Studio Dreams 00:13:27 - Nerd Hour: Building the InfoSec Demo 00:15:55 - Show Plugs and Community Links 00:17:00 - Main Topic: What Local LLMs Actually Are 00:21:23 - The Guardrail Gap: Cloud Refuses, Local Complies 00:26:55 - The Demo: 15 Tailored Spear Phishing Lures in 90 Seconds 00:30:04 - Why These Capabilities Never Go Away 00:32:59 - AI on the Defensive Side 00:39:01 - Voice Cloning, Deepfakes, and SPF for Phones 00:46:20 - The Low-Tech Deepfake Defense 00:47:26 - Why Spot-the-Typo Training Is Dead 00:50:09 - Verification Culture and Email Authentication 00:54:32 - Common Questions: Legality, Detection, and Adoption 01:00:18 - Wrap Up: Stay Safe Out There ## Resources / Show Notes: - Ollama, the easiest way to run open models locally: https://ollama.com - Hugging Face, open repository of machine learning models: https://huggingface.co - OpenCode, terminal coding agent that runs against local models: https://opencode.ai - Evilginx, reverse-proxy phishing framework referenced in the demo: https://github.com/kgretzky/evilginx2 - SysAdmin Weekly Episode 024 - On-Prem AI with Ollama (Spotify): https://open.spotify.com/episode/1Huz7fy7axxOqjXei1HLI0 - SysAdmin Weekly - all show links in one place: https://www.sysadminweekly.com - SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com - SysAdmin Weekly GitHub Discussions: https://github.com/ProjectRunspace/sysadmin-weekly/discussions - Project Runspace: https://www.projectrunspace.org - AndyOnTech: https://www.andyontech.com

  • June 14 · 1 hr 24 min

    048 - The AI Doom Narrative vs the Data: Layoffs, Energy, and Jobs in 2026

    The AI doom headlines do not line up with what the actual data says, and that gap is doing real damage. Andy and Eric Siron take a practitioner read on the fear stories: the layoff narrative, the data center energy and water panic, and the executive predictions that office workers are gone in 18 months. They put the WEF Future of Jobs numbers, the hyperscaler nuclear and cooling commitments, and the post-COVID overhiring correction next to the headlines, and walk through what AI looks like at a SysAdmin's keyboard versus what the press would have you believe. Also in this one: Elon Musk's OpenAI lawsuit, Linus Torvalds on AI-generated bug reports clogging the kernel security list, Edge storing passwords in clear text, Eric on the Samsung browser on Windows, and Andy's Forgejo and Restic lab cleanup. Plus listener comments on broken IT job postings and the SCVMM question for Hyper-V shops. --- ## Chapters 00:00 - Introduction to SysAdmin Weekly 04:39 - AI Doom and Gloom Narrative 07:36 - News React: Elon Musk vs OpenAI 10:18 - News React: Linus Torvalds on AI Bug Reports 13:36 - Nerd Hour: Exploring New Browsers 16:30 - Microsoft Edge Password Concerns 19:28 - AI's Impact on Jobs 22:20 - The Reality of AI in the Workplace 25:39 - AI's Role in Documentation 28:28 - Critique of AI Predictions 31:41 - Conclusion and Future Outlook 34:12 - The Responsibility of Executives in AI Predictions 38:16 - The Impact of AI on Job Markets 41:42 - Understanding Layoffs in the Tech Industry 49:56 - The Future of Jobs in the Age of AI 56:00 - Energy and Water Concerns in Data Centers 01:00:48 - The Shift in Carbon Neutral Promises 01:03:37 - Concerns Over Water and Energy Resources 01:05:32 - The Debate on Nuclear Power Safety 01:08:40 - Real-World Applications of AI in Sysadmin 01:11:12 - The Importance of Honest Communication in Tech 01:13:44 - Job Market Realities for IT Professionals --- ## Resources / Show Notes - The Register - Linus Torvalds on AI-powered bug hunters: https://www.theregister.com/security/2026/05/18/linus-torvalds-says-ai-powered-bug-hunters-have-made-linux-security-mailing-list-almost-entirely-unmanageable/5241633 - TechCrunch - A comprehensive archive of 2023 tech layoffs: https://techcrunch.com/2024/05/01/a-comprehensive-archive-of-2023-tech-layoffs/ - Crunchbase News - Tech Layoffs Tracker: https://news.crunchbase.com/startups/tech-layoffs/ - WEF - Future of Jobs Report 2025, 78 Million New Job Opportunities by 2030: https://www.weforum.org/press/2025/01/future-of-jobs-report-2025-78-million-new-job-opportunities-by-2030-but-urgent-upskilling-needed-to-prepare-workforces/ - NPR - Three Mile Island will reopen to power Microsoft data centers: https://www.npr.org/2024/09/20/nx-s1-5120581/three-mile-island-nuclear-power-plant-microsoft-ai - Data Center Dynamics - Google signs nuclear SMR deal with Kairos: https://www.datacenterdynamics.com/en/news/google-signs-nuclear-smr-deal-with-kairos-for-data-center-power/ - X-energy - Amazon invests in X-energy to support advanced SMRs: https://x-energy.com/news/amazon-invests-in-x-energy-to-support-advanced-small-modular-nuclear-reactors-and-expand-carbon-free-power/ - Microsoft Cloud Blog - Sustainable by design, next-generation datacenters consume zero water for cooling: https://www.microsoft.com/en-us/microsoft-cloud/blog/2024/12/09/sustainable-by-design-next-generation-datacenters-consume-zero-water-for-cooling/ - Consumer Reports - AI Data Centers, Big Tech's Impact on Electric Bills, Water, and More: https://www.consumerreports.org/data-centers/ai-data-centers-impact-on-electric-bills-water-and-more-a1040338678/ - Forgejo, the self-hosted lightweight software forge: https://forgejo.org/ - Restic, fast, secure, efficient backup program: https://restic.net/ - SysAdmin Weekly - past episodes referenced are at https://www.sysadminweekly.com

  • June 1 · 56 min

    047 - Is DNS Over HTTPS Actually Private? What ECH Fixes That DoH Doesn't

    Turning on DNS over HTTPS does not make your browsing private. The hostname you are trying to reach still leaks in the TLS handshake through the Server Name Indication field, and that is the part most coverage of DoH quietly skips. Andy and Eric pick up where the DNS deep dive in episode 045 left off, this time focused on the privacy half of the problem. The episode walks through why DoH on its own only solves part of the equation, what Encrypted Client Hello (ECH) is doing to close the SNI gap, and which browsers actually support it today. Andy also unpacks Cloudflare's quiet deprecation of cloudflared's proxy-dns feature, what that means for every Pi-hole plus cloudflared setup still in the wild, and the Quad9 plus UDM Pro stack he landed on instead. Also in this one: California's age verification law and the operating system level approach the state landed on, Microsoft Edge keeping decrypted passwords in memory at all times (and Microsoft initially calling it "working as intended"), the Humble Bundle SysAdmin and Linux book bundle that is live right now, and Andy retiring his last Windows machine in favor of Debian. ## Resources - SysAdmin Weekly Episode 045 - Why Is It Always DNS? (the prior DNS deep dive referenced throughout this episode): https://open.spotify.com/episode/2oAh0KzE7J2o7NQFJK8Mza?si=D0OO9XwkRb2GQ-hxM9duUA - Cloudflare announcement on the deprecation of cloudflared's proxy-dns feature (November 2025): https://developers.cloudflare.com/changelog/post/2025-11-11-cloudflared-proxy-dns/ - Pi-hole, network-wide ad blocking and DNS sinkhole: https://pi-hole.net - cloudflared, the Cloudflare Tunnel client referenced in the proxy-dns discussion: https://github.com/cloudflare/cloudflared - Quad9, the Swiss-based privacy-focused DNS resolver Andy migrated to: https://www.quad9.net - Ubiquiti UDM Pro, which Andy moved his DNS forwarding onto: https://techspecs.ui.com/unifi/cloud-gateways/udm-pro - Microsoft Edge password manager vulnerability, security researcher disclosure from May 4 showing credentials decrypted and held in memory: https://www.bleepingcomputer.com/news/microsoft/microsoft-edge-to-stop-loading-cleartext-passwords-in-memory-on-startup/ - Humble Bundle's SysAdmin and Linux book bundle from Packt (live for ~20 days from the recording date): https://www.humblebundle.com/books/ultimate-linux-sysadmin-bundle-books - Andy's prior AndyOnTech post on the state of web browsers, referenced for the Safari and Brave standardization context: https://www.andyontech.com/posts/there_are_no_good_web_browsers_left_and_thats_a_problem/ - Encrypted Client Hello, Cloudflare's reference write-up on how ECH works alongside DoH: https://blog.cloudflare.com/announcing-encrypted-client-hello - Apple iCloud Private Relay, referenced as Apple's likely answer to the SNI privacy problem in lieu of shipping ECH in Safari: https://support.apple.com/en-us/102602 - California's age verification law and the operating system level approach: https://www.theregister.com/software/2026/03/06/us-state-laws-push-age-checks-into-the-operating-system/4750249 - SysAdmin Weekly main site, all episode links and platforms: https://www.sysadminweekly.com - SysAdmin Weekly newsletter, the companion weekly newsletter: https://newsletter.sysadminweekly.com - Contact the show: contact@sysadminweekly.com ## Chapters 02:29 - Exploring Secure DNS Lookups 04:17 - Tech News Reactions 08:25 - Microsoft Edge Security Concerns 14:58 - Humble Bundle Book Recommendations 20:05 - Nerd Hour: Home Lab Updates 26:23 - Understanding DNS Over HTTPS and Its Importance 30:11 - The Role of Encrypted Client Hello (ECH) 36:13 - Rebuilding the DNS Stack: A Personal Journey 42:06 - Cloudflare's Changes and Privacy Concerns 47:11 - The Future of Privacy and Quantum Cryptography

  • May 15 · 58 min

    046 - Can Claude Code Help SysAdmins? Scripting, Log Analysis, and the Claude.md workflow

    The skepticism is earned. Most AI demos are built for developers. Most AI hype is vendor noise. And most SysAdmins have better things to do than adopt another tool that solves a problem they may or may not have. That said: this is Andy putting the grumpy SysAdmin argument aside for an hour to make the honest case for Claude Code in SysAdmin workflows. With caveats. With the parts that still fall short. With a clear line between where it helps and where you should keep your hands on the wheel. The episode also covers a rough few weeks for the Linux kernel: three local privilege escalation vulnerabilities publicly disclosed in quick succession. All local, not remote. Still worth knowing about before your next patch cycle. In this episode: - A rundown of the three recent Linux kernel LPE vulnerabilities (Fragnesia, DirtyFrag, and CopyFail) and what they mean for SysAdmins running Linux in their environments - Nerd Hour: Restic offsite backups via Hetzner storage, Beszel and Uptime Kuma monitoring running on K3S - What Claude Code actually is, and why the CLI-based workflow changes the value proposition compared to chatbot-style AI use - The CLAUDE.md file: the single biggest thing most SysAdmins are missing when they try AI tools. What it is, how to build one, and how it turns Claude into something that actually knows your environment - Practical use cases: script generation with real AD and environment context, incident triage as a thinking partner, log analysis, documentation from terminal history, run book drafting, and YAML/Kubernetes help - Where to stay skeptical: sensitive data, the "do whatever you want" permission mode, and always reviewing AI-generated scripts before running them anywhere near production The tool amplifies competence. It doesn't substitute it. That framing is the whole episode. --- ## Resources and Show Notes ### Linux Vulnerabilities: - Fragnesia (CVE-2026-46300): https://www.helpnetsecurity.com/2026/05/14/fragnesia-cve-2026-46300-linux-lpe-vulnerability/ - DirtyFrag (CVE-2026-43284 + CVE-2026-43500): https://www.helpnetsecurity.com/2026/05/08/dirty-frag-linux-vulnerability-cve-2026-43284-cve-2026-43500/ - CopyFail (CVE-2026-31431): https://www.helpnetsecurity.com/2026/04/30/copyfail-linux-lpe-vulnerability-cve-2026-31431/ ### Claude Code: - Claude Code Security Documentation: https://code.claude.com/docs/en/security - Claude Code Permissions Documentation: https://code.claude.com/docs/en/permissions ### Tools Mentioned: - Restic Backup: https://restic.net - Beszel Monitoring: https://beszel.dev - Uptime Kuma: https://github.com/louislam/uptime-kuma - Hetzner Object Storage: https://docs.hetzner.com/storage/object-storage/ - Hetzner Object Storage + Restic Setup Guide: https://docs.hetzner.com/storage/object-storage/howto-backups/restic/ ### Community: - Friends and Family IT Support Stories on GitHub Discussions: https://github.com/ProjectRunspace/sysadmin-weekly/discussions - Andy's Music TUI Terminal Apple Music Controller: https://github.com/asyrewicze/music_tui ### Previous Related Episodes: - SysAdmin Weekly 008 - Getting Started with GitHub Copilot: https://open.spotify.com/episode/2eTtoAgeKEikKeLzYExfOY?si=ySl9Ho7mQ861mHAKiTAQ5w - SysAdmin Weekly 016 - AI Agents for IT Admins episodes featuring Mike Nelson: https://open.spotify.com/episode/7u5T3Tp04EEP0hZRst3KPZ?si=zTpzVTXZR42vle4Gk0-tow ## Chapters 04:32 - Community Comments and News React 07:16 - Linux Vulnerabilities Overview 10:08 - Nerd Hour: Personal Projects and Backups 13:21 - Exploring Claude Code for Sysadmins 16:09 - The Grumpy Sysadmin and AI Adoption 19:24 - Understanding Claude Code's Functionality 22:35 - Use Cases for Claude Code 30:01 - The Importance of Documentation in Sysadmin Work 32:52 - Leveraging Claude.md for Enhanced Context 37:27 - Practical Applications of Cloud Code in Sysadmin Tasks 42:11 - Challenges and Limitations of Cloud Code 53:54 - Future of Cloud Code and Its Value in Sysadmin Work

  • May 8 · 1 hr 16 min

    045 - Why is It ALWAYS DNS?!?

    It's always DNS. Every SysAdmin has said it, usually at the worst possible moment. This episode is the explanation for why that joke is only half a joke. Andy and Eric walk through how DNS actually works from first request to final answer: recursive resolvers, root servers, authoritative name servers, TTLs, and caching. From there they get into Windows Server and Active Directory DNS integration, covering SRV records, dynamic registration, and scavenging. The back half covers DNS security: DNSSEC, DNS over HTTPS, Encrypted Client Hello, DNS-based content filtering, and how attackers use DNS for C2 traffic and exfiltration. Throughout, the guys pull from real war stories, including a ticketing system that silently failed every few weeks because one of four DNS servers had a stale record, and a BIND config that refused to load because of a trailing space. --- ## Show Notes and Resources ### News React - Cloudflare DNS filtering tiers: https://blog.cloudflare.com/introducing-1-1-1-1-for-families/ - AI token costs exceeding replacement labor costs: https://fortune.com/2026/04/28/nvidia-executive-cost-of-ai-is-greater-than-cost-of-employees/ - Claude deleting company data and backups: https://www.tomshardware.com/tech-industry/artificial-intelligence/claude-powered-ai-coding-agent-deletes-entire-company-database-in-9-seconds-backups-zapped-after-cursor-tool-powered-by-anthropics-claude-goes-rogue - Backyard RAM manufacturing: https://www.theregister.com/2026/04/23/youtuber_builds_working_dram/ ### Nerd Hour - Andy's PomoCLI app: https://github.com/asyrewicze/pomocli ### Main Segment Resources - Cloudflare: What is DNS?: https://www.cloudflare.com/learning/dns/what-is-dns/ - MXToolbox: https://mxtoolbox.com - DNS over TLS vs. DNS over HTTPS - Cloudflare Learning: https://www.cloudflare.com/learning/dns/dns-over-tls/ - Encrypted Client Hello - the last puzzle piece to privacy: https://blog.cloudflare.com/announcing-encrypted-client-hello/ ### Community - GitHub Discussions: Friends and family IT support stories: https://github.com/ProjectRunspace/sysadmin-weekly/discussions/15. ## Chapters 12:45 - Understanding DNS: The Final Boss 25:49 - The DNS Resolution Process 38:43 - Exploring DNS Services and Tools 39:45 - Managing DNS: Windows vs. BIND 43:36 - Active Directory and DNS Integration 48:38 - Dynamic Registration and Scavenging in DNS 52:42 - Understanding DNS Record Types 54:44 - Common DNS Tools and Their Uses 59:28 - DNS Security: Threats and Protections 01:06:27 - DNS Filtering and Content Control 01:12:36 - Should You Run Your Own DNS?

  • May 1 · 1 hr 8 min

    044 - Hyper-V Failover Clustering in 2026

    Failover clustering is the part of Hyper-V that trips up the most people, especially anyone arriving from the VMware side. In this episode Andy Syrewicze and Eric Siron pick up directly where episode 043 left off: you have standalone Hyper-V running, now what does it actually take to make it highly available in 2026? The guys start with the "why bother" question: Azure Local versus a traditional Hyper-V failover cluster comes down mostly to billing and governance overhead, not capability. From there the conversation moves into prerequisites: shared storage options (Storage Spaces Direct, iSCSI, SMB shares, Fiber Channel), Active Directory integration, and the heartbeat NIC myth Eric has been fighting against since he started seeing outdated Microsoft docs still getting passed around. The bulk of the episode is quorum: what split-brain means, why a two-node cluster needs a third vote, and the practical tradeoffs between a file share witness, a disk witness, and a cloud witness in Azure. Dynamic quorum gets its own explanation, including how graceful node shutdowns allow a cluster to shrink without taking everything offline. They close on the creation experience (PowerShell over Windows Admin Center, period), the gotcha that catches every VMware migrant (creating the cluster and adding VMs as clustered roles are two separate steps), live migration and shared nothing live migration. In the news and nerd hour segments this week: the FCC ban on foreign-made consumer routers (with Netgear already approved as an exception before anyone finished reading the press release), 3D printing of circuitry using microwave-based manipulation now down to the width of a human hair, Tim Cook stepping down from Apple, Andy using Claude Code to build a master index of every topic covered across all 43 episodes and every newsletter edition, and Eric deep in research on a home routing setup built around a mini PC with a separate router component so the internet does not require an IT degree to reset when he is traveling. --- ## Episode Resources SysAdmin Weekly Website: https://www.sysadminweekly.com SysAdmin Weekly Companion Newsletter: https://newsletter.sysadminweekly.com Community Discussion Board: https://github.com/ProjectRunspace/sysadmin-weekly Share Your Family/Friends IT Support Stories (community post): https://github.com/ProjectRunspace/sysadmin-weekly/discussions/15 AndyOnTech: https://www.andyontech.com Project Runspace: https://www.projectrunspace.org **Previous episodes referenced in this episode:** - Episode 043: Getting Started with Hyper-V in 2026: https://open.spotify.com/episode/4J77iiMVDWvvf8fshSurAL?si=D1hPaG7eSKiX6uU7UPBL3g - Episode 042: Should SysAdmins Job Hop or Stay Put?: https://open.spotify.com/episode/0o7EMW8JTGDm8rJv7Xu6Pg?si=uv1KIDZwS-y4l0g6yIV8jA - Episode 13: Should Hyper-V Be Domain Joined?: https://open.spotify.com/episode/0KWjIe5xgqZV9XYHuV2UF3?si=oK6XKjJiQ_mvpEEDqY_vyg - Episode 017: Hyper-V Management Story episode: https://open.spotify.com/episode/0rHwIc4U297R7I6KFayhlm?si=oTB7nX3bTgG7xekebnIU5g **Articles referenced in this episode:** - FCC ban on foreign-made consumer routers: https://www.wired.com/story/us-government-foreign-made-router-ban-explained/ - What's New with Hyper-V in Windows Server 2025 (Microsoft Docs): https://learn.microsoft.com/en-us/windows-server/get-started/whats-new-windows-server-2025#hyper-v-ai-and-performance --- ## Chapters 03:30 - Tech News Highlights 14:38 - Nerd Hour: Personal Projects and Innovations 21:02 - Listener Feedback and Career Insights 25:54 - Hyper-V Failover Clustering in 2026 32:56 - Automated Setup and Shared Storage Solutions 35:03 - Active Directory Integration and Clustering Best Practices 36:55 - Understanding Quorum in Failover Clustering 46:15 - Establishing a Failover Cluster: Tools and Processes 57:18 - Live Migration and Storage Migration in Hyper-V 01:01:14 - Day Two Operations and Cluster Management

Showing 1–20 of 28 episodes