065 - How Do You Give a Good Technical Presentation as an IT Pro?

Every status update, budget ask, and post-outage readout is public speaking, and most technical presentations go wrong before the first slide because nobody asked who is in the room.Andy flies solo with the advice he gets asked for most on the conference circuit: how IT pros get better at presenting, from a five-person boardroom to a thousand-seat hall. He covers tailoring the talk to the audience, slides that don't bury people in text, demos with a recorded fallback, surviving the first two minutes, saying "I don't know" in Q&A, talking to a webcam, and where to get your early reps. Up front: listener questions on patch quality and immutable cloud storage, a November Patch Tuesday that broke printing, activation, and SQL Server, and the hunt for a local AI inference rig.Chapters:00:00:00 - Cold Open: Public Speaking for Tech Pros00:00:59 - Welcome00:02:50 - Housekeeping: The Travel Hiatus00:05:00 - Show Plugs00:05:49 - Listener Comment: Are We Patching Too Fast?00:08:29 - Listener Comment: Immutable Cloud Storage00:12:26 - Discord or Matrix for the Community?00:14:09 - News React: The M365 Outage and the FAA Ground Stop00:17:18 - News React: November Patch Tuesday Breaks Printing00:19:45 - Nerd Hour: Shopping for a Local Inference Rig00:21:11 - Framework Desktop vs a Mac Mini Cluster00:22:30 - Main Topic: Giving a Good Technical Presentation00:23:33 - In-Person vs Virtual Speaking00:24:25 - Presenting Is Part of the Job00:25:27 - Quiet Competence Only Counts When People See It00:28:18 - Who Am I Speaking To?00:30:25 - One Sentence, One Action00:31:39 - Don't Murder People With PowerPoint00:33:51 - Speaker Notes as a Crutch00:35:58 - Demos: Zoom In and Check From the Back Row00:37:26 - Colorblind-Friendly Contrast00:38:22 - Keep a Recorded Fallback Demo00:39:12 - Bill Gates and the Windows 98 Blue Screen00:40:19 - The Case Story Typo00:41:28 - Nerves Don't Go Away00:42:49 - My First TechNet Radio Episode00:44:16 - Nail the First Two Minutes00:44:37 - The Q&A Question You Can't Answer00:45:46 - Normalize Saying "I Don't Know"00:47:52 - Virtual Presenting00:50:13 - Talk to the Cat00:50:55 - Stand Up for Webinars00:51:29 - Getting the Reps In00:53:07 - The Worst Presentation I Ever Gave00:54:32 - User Groups, Universities, and Toastmasters00:55:18 - Wrap Up: Know Your Audience00:56:51 - OutroResources / Show Notes:- BleepingComputer - Microsoft says November security updates cause printing issues: https://www.bleepingcomputer.com/news/microsoft/microsoft-says-november-security-updates-cause-printing-issues/- Microsoft Learn - Immutable storage for Azure Blob data: https://learn.microsoft.com/en-us/azure/storage/blobs/immutable-storage-overview- AWS - S3 Object Lock: https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html- Google Cloud - Bucket Lock: https://docs.cloud.google.com/storage/docs/bucket-lock- The Register - Windows 98 crashes live on stage with Bill Gates: https://www.theregister.com/2018/04/20/windows_98_comdex_bsod_video/- Framework Desktop: https://frame.work/desktop- Toastmasters International: https://www.toastmasters.org/- SysAdmin Weekly: https://www.sysadminweekly.com- SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com- AndyOnTech: https://www.andyontech.com- Project Runspace: https://www.projectrunspace.org

Your backups should be boring: hardware you know, a copy that lives somewhere else, at least one copy nobody can change, and a restore test that proves the whole thing works.Andy Syrewicze and Eric Siron go back to basics on backup and recovery for 2026. They build the inventory, including the switch configs and firewall policies nobody thinks to protect, get honest RPO and RTO answers by asking what an hour of downtime costs, and explain why a Hyper-V checkpoint is not a backup. Then immutability, tape's write-protect tab, air gaps that are not air gaps, and the monthly restore test. Up front: a stolen ConnectWise Cloud Backup credential that signed in to at least 173 Microsoft 365 tenants, and whether Ukraine's strikes on Yandex data centers really silenced Russian bots.Chapters:00:00:00 - Cold Open: The Backup Episode We Never Did00:01:05 - Welcome and Show Plugs00:04:04 - News React: Ukraine's Strikes and the Russian Bot Drop00:06:47 - The Dead Internet Theory00:08:46 - When Data Centers Become Military Targets00:09:40 - News React: Stolen ConnectWise Credential Hits M365 Tenants00:12:37 - Why a Compromised App Is Harder to Lock Out00:13:50 - Nerd Hour: Tailscale Upgrades and a Look at NetBird00:15:35 - Eric's Hugo Migration and GDPR-Friendly Analytics00:16:28 - Umami vs Matomo00:18:37 - On-Premise vs On-Premises00:19:57 - Main Topic: Start With What You're Protecting00:22:46 - The Second Tier: Switch Configs and Firewall Policies00:25:43 - Are Your Desktops Actually Backed Up?00:26:46 - Folder Redirection and the Root of C:00:28:03 - The Window Hidden Under the Taskbar00:28:53 - Back Up Your Power Users' Workstations00:30:15 - RPO and RTO Explained00:32:23 - Ask What an Hour of Downtime Costs00:34:44 - Zero Downtime Means High Availability00:36:40 - HA Workloads Still Need Backups00:37:16 - Design Your Backups to Be Boring00:40:03 - Why Won't Companies Pay for Backup?00:41:17 - Hyper-V Checkpoints Are Not Backups00:42:17 - Mattresses, Tires, and Backup Pricing00:43:16 - Business Continuity Goes Beyond Backup00:44:42 - Two Backup Copies, One Off-Site00:45:43 - Ransomware Goes After Your Backups First00:46:17 - Immutable Backups in 202600:48:06 - Is Anything Truly Immutable?00:49:32 - Tape and the Write-Protect Tab00:50:48 - How Long Does Tape Last?00:51:25 - The Drive Dies Before the Tape Does00:53:05 - USB Drives, Cold Sites, and Short Sync Windows00:54:53 - Security vs Convenience and the Air Gap Label00:56:00 - Run a Recovery Test, and Run It Often00:57:37 - Why Total Data Loss Ends Businesses00:59:15 - Business Continuity Follow-Up and Wrap Up01:00:00 - Outro: Send Us Your Horror StoriesResources / Show Notes:- The Hacker News - Compromised ConnectWise credential used on 173 M365 tenants: https://thehackernews.com/2026/10/hackers-use-compromised-connectwise.html- Euronews - Did Ukraine's strikes on Yandex data centres silence Russian bots?: https://www.euronews.com/2026/10/12/did-ukrainian-strikes-on-yandex-data-centres-cause-russian-bot-activity-to-plummet- CISA - #StopRansomware Guide: https://www.cisa.gov/resources-tools/resources/stopransomware-guide- Umami, privacy-focused web analytics: https://umami.is/- Matomo, open source web analytics: https://matomo.org/- NetBird, open source zero trust networking: https://netbird.io/- Tailscale: https://tailscale.com/- SysAdmin Weekly: https://www.sysadminweekly.com- SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com- AndyOnTech: https://www.andyontech.com- Project Runspace: https://www.projectrunspace.org- GitHub Discussions: https://github.com/ProjectRunspace/sysadmin-weekly/discussions

The kernel is just software. It happens to be the one program on the box with no guardrails, which is why one bad driver takes the whole system down with it.Andy Syrewicze and Eric Siron walk the kernel from the bottom up: why running two programs at once needed a supervisor, how user mode and kernel mode split the work, and where IRQs, drivers, and the HAL fit. Andy strips a Gentoo kernel so thin it cannot find its own hard drive, and Eric argues a blue screen is the kernel protecting your data. Then they weigh whether Microsoft should push third-party code out of kernel space after CrowdStrike. Up front: Microsoft deleting nonprofit tenant data early, and a listener choosing between Network+ and the server certs.Chapters:00:00:00 - Cold Open: Kernels Are Not Magic00:01:33 - Welcome and Show Plugs00:05:05 - News React: Local AI and the Surface Laptop Ultra00:07:47 - Anthropic, Bot Swarms, and the Local Model Threat00:10:57 - Can You Trust the No-Training Checkbox?00:14:05 - News React: Microsoft 365 Family Storage Cut00:14:46 - Microsoft Deletes Nonprofit Data Early00:17:33 - The Cloud Trust Problem00:19:10 - Retention Is Not Backup00:21:12 - Listener Question: Help Desk to Junior SysAdmin00:23:51 - Get the Certs for the Job You Want00:27:06 - Get the Job First, Then the Certs00:30:44 - Is Security+ Worth It for a Generalist?00:32:15 - Main Topic: What a Kernel Actually Is00:33:54 - From One Program at a Time to Many00:35:25 - Hand-Written Drivers and the Video Card Virus00:36:05 - The HAL Ended a Whole Category of Attacks00:37:29 - Where the Word Kernel Comes From00:39:02 - Mandrake, Debian, and Gentoo00:40:48 - Kernel Mode vs User Mode00:42:48 - Before Memory Protection: DOS to Virtual Memory00:45:14 - Kernel Mode Drivers Run Without Guardrails00:45:51 - IRQs, TIE Fighter, and Windows 3.100:46:58 - A 2026 Kernel Bug That Fought Over an IRQ00:49:56 - Install Gentoo Once to Learn the Kernel00:52:44 - Andy's Razor-Thin Kernel Panic00:54:14 - ARC Paths and NT Boot Failures00:57:06 - What Happens When Kernel Code Misbehaves00:57:51 - CrowdStrike and the Botched Kernel Update00:58:39 - Why the Blue Screen Is the Right Call01:01:32 - Should Microsoft Lock Down Kernel Access?01:02:44 - Wrap Up and OutroResources / Show Notes:- SysAdmin Weekly 036 - The Hidden Cost of Abstraction: https://youtu.be/5ic4Pozot44- Eric Siron - Kernels, Shells, and Operating Systems (Re)Visited: https://projectrunspace.org/kernels-shells-and-operating-systems-revisited/- Microsoft Learn - User mode and kernel mode: https://learn.microsoft.com/en-us/windows-hardware/drivers/gettingstarted/user-mode-and-kernel-mode- Gentoo Handbook - Configuring the Linux kernel: https://wiki.gentoo.org/wiki/Handbook:AMD64/Installation/Kernel- Microsoft - CrowdStrike outage response: https://blogs.microsoft.com/blog/2024/07/20/helping-our-customers-through-the-crowdstrike-outage/- Microsoft - The Windows Resiliency Initiative: https://blogs.windows.com/windowsexperience/2025/06/26/the-windows-resiliency-initiative-building-resilience-for-a-future-ready-enterprise/- PCWorld - Surface Laptop Ultra and local AI: https://www.pcworld.com/article/3255200/the-surface-laptop-ultra-is-an-ai-monster-with-a-laptop-problem.html- The Register - Microsoft deletes nonprofit M365 data: https://www.theregister.com/saas/2026/09/28/microsoft-tells-nonprofits-their-deleted-m365-data-isnt-coming-back/5299433- SysAdmin Weekly: https://www.sysadminweekly.com- SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com- AndyOnTech: https://www.andyontech.com- Project Runspace: https://www.projectrunspace.org- GitHub Discussions: https://github.com/ProjectRunspace/sysadmin-weekly/discussions

Free IT training is real and it is actually free. The exam that gets you past a resume screen is the part that still costs money.Andy Syrewicze and Eric Siron go through the free IT training worth your evenings: Microsoft Learn, AWS Skill Builder, Cisco Networking Academy, the Linux Foundation, and the second tier nobody mentions. Why every big vendor gives this away, what a Credly badge proves to a hiring manager, and how to spot the outfit in your LinkedIn DMs guaranteeing you a CCIE. Eric's old employer paid for every cert he sat, and he explains why that path mostly does not exist anymore.Chapters:00:00:00 - Cold Open: Free Training and Getting Hired00:01:14 - Welcome and Show Plugs00:04:21 - News React: Microsoft Broke Copy Paste in Excel00:09:59 - Nadella on Layoffs, and CEOs Who Will Not Stop Talking00:12:58 - News React: Broadcom Deauthorizes Insight00:15:17 - Punished for Selling Competing Products00:17:13 - Broadcom Is Overplaying Its Hand00:18:24 - Intel, AMD, and the Nasty Gram From 199900:20:53 - Gartner: 55 Percent Shopping the Exit by 202900:23:12 - Nerd Hour Lightning Round00:23:49 - MSP Summit and a Tech Channel 101 Idea00:25:40 - Eric's In-Laws, a Prowler, and Punctured Cans00:27:40 - A Sixty Dollar Camera With No Account Required00:30:11 - Main Topic: What Free Training Gets You Hired00:30:58 - What "Free" Means When a Vendor Says It00:32:17 - Microsoft Learn and the AI Documentation Worry00:36:40 - AWS Skill Builder and Cisco Networking Academy00:38:29 - Credly Badges and Whether Andy Claims Them00:39:51 - The Linux Foundation and Open Source Everywhere00:41:41 - Linux Takes You Further, Microsoft Gets You Hired00:45:26 - PowerShell Aliases and Azure CLI's Linux Accent00:48:14 - IBM SkillsBuild, Trailhead, and Google00:48:55 - The Guaranteed Pass Pitch in Your LinkedIn DMs00:56:50 - A Guaranteed CCIE Means Somebody Is Cheating00:58:53 - Pluralsight and Where the Cheap Options Sit01:02:10 - MSPs, Partner Tiers, and Why They Will Still Pay01:05:33 - A Badge Proves You Finished a Module01:06:36 - Turning Free Training Into a Callback01:08:51 - Make Your Resume Look Like the Person Who Does the Job01:11:22 - Do This Monday: Name the Gap, Then Fill It01:13:32 - Anthropic, OpenAI, and Certing in Emerging Tech01:14:13 - Novell NetWare, Dry Copper, and Refusing to Learn01:17:32 - Jeffrey Snover: Embrace Learning, or Be a Lumberjack01:18:46 - Wrap Up and the Call for SysAdmin Horror StoriesResources / Show Notes:- CRN, top VMware partner Insight deauthorized by Broadcom: https://www.crn.com/news/channel-news/2026/top-vmware-partner-insight-deauthorized-by-broadcom-in-north-america- The Register, Microsoft patches Windows and Excel and breaks paste: https://www.theregister.com/os-platforms/2026/09/14/microsoft-patches-windows-and-excel-breaks-audio-remote-access-and-paste/5296085- Microsoft Learn, free modules and learning paths: https://learn.microsoft.com/training/- AWS Skill Builder: https://skillbuilder.aws- Cisco Networking Academy: https://www.netacad.com- Linux Foundation Training, free courses: https://training.linuxfoundation.org- IBM SkillsBuild: https://skillsbuild.org- Salesforce Trailhead: https://trailhead.salesforce.com- Google Skills, formerly Cloud Skills Boost: https://www.skills.google- Claude Academy, free AI courses from Anthropic: https://academy.claude.com- OpenAI Academy: https://academy.openai.com- Pluralsight, pricing and the 10 day trial: https://www.pluralsight.com/individuals/pricing/free-trial- SysAdmin Weekly: https://www.sysadminweekly.com- SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com- AndyOnTech: https://www.andyontech.com- Project Runspace: https://www.projectrunspace.org- GitHub Discussions: https://github.com/ProjectRunspace/sysadmin-weekly/discussions

We throw an alert when a disk hits 85 percent. Nobody has ever built the monitoring system for the person who gets the alert.Andy Syrewicze is joined by Paul Croker, a UK IT pro who founded 404 Stress Not Found, a nonprofit built because tech and cyber people had nowhere safe to talk about burnout. Paul walks through the perfect storm that put him on a Berlin stage telling his own story, and Andy gets into the MSP years that surfaced a generalized anxiety disorder. They get specific about hero culture, the all-nighter nobody asks questions about, and why a wellness app and a pizza do not touch the structural problem underneath.Chapters:00:00:00 - Cold Open: An Industry That Is Good at Breaking People00:01:11 - Welcome and Episode Intro00:02:12 - Meet Paul Croker and 404 Stress Not Found00:03:15 - News React: AI Agents Climbing Out of the Sandbox00:06:31 - The Agent That Hacked a Gym to Get Into Pilates00:08:13 - News React: September Patch Tuesday00:08:56 - A Record 974 CVEs and What Is Driving the Curve00:11:53 - Where Do These Vulnerabilities Actually Live?00:14:58 - Nerd Hour Begins00:15:44 - Dan Scott's BES Server Post and the Flashbacks00:16:27 - Andy's Novell, AS/400, and BES Nightmare00:18:15 - Paul's First BlackBerry Deployment00:20:21 - BlackBerry Messaging as a BCDR Channel00:22:33 - Sonic on a Phone While Everyone Else Played Snake00:23:23 - Nerd Hour: Andy's Static Site and Caddy00:25:10 - A Two Line Config, and Why Simple Wins00:26:19 - Main Topic: Burnout, Anxiety, and Mental Health in Tech00:27:07 - Paul's Path From IT Generalist to MSP Owner00:29:31 - The Pax8 Berlin Talk and the Perfect Storm00:32:57 - Building the Meetups, and Richard Tubb in Newcastle00:35:08 - Andy on Generalized Anxiety and the Job That Got Away00:37:48 - Pressure Arrives in Layers00:39:56 - The Nasty Gram That Was Not About Work00:41:36 - We Alert on 85 Percent Disk and Nothing on People00:42:39 - Heartbeats: The Monitoring Metaphor That Actually Fits00:45:43 - The People Who Show Up to Learn the Warning Signs00:47:37 - Why IT Is So Good at Breaking People00:48:32 - Every Interaction Is a Problem, and It Wears You Down00:51:08 - Attackers Need One Win, Defenders Need All of Them00:52:04 - Hero Culture and the All Nighter00:53:31 - Missing Documentation Is Why the All Nighter Happened00:55:05 - What Does Not Work: Wellness Apps and Pizza00:57:13 - Go Kick Some Leaves00:58:28 - Communities Are the Fix Nobody Reaches For Soon Enough01:00:10 - The Free 404 Portal and Resources01:01:19 - The Mentor Who Taught Andy to Say "The End"01:02:26 - You Are Not Your Job Title01:03:12 - How to Reach Paul01:04:07 - Wrap Up and OutroResources / Show Notes:- 404 Stress Not Found - Paul Croker's nonprofit for IT and cyber mental health: https://404stressnotfound.org- Paul Croker - LinkedIn: https://www.linkedin.com/in/paulcrokeruk/- Richard Tubb - Tech Mental Health Spaces: https://richardtubb.co.uk/404-stress-not-found/- The Cyber Express - Patch Tuesday hits a record 974 CVEs: https://thecyberexpress.com/patch-tuesday-september-2026/- Anthropic - Claude Mythos Preview, AI finding and exploiting zero-days: https://www.anthropic.com/research/mythos-preview- ABC News Australia - AI agent hacks a gym website to book a Pilates class: https://www.abc.net.au/news/2026-08-10/ai-assistant-hacks-gym-website-aus-cyber-attack/107007986- Caddy - single binary web server with automatic HTTPS: https://caddyserver.com- SysAdmin Weekly: https://www.sysadminweekly.com- SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com- AndyOnTech: https://www.andyontech.com- Project Runspace: https://www.projectrunspace.org- GitHub Discussions: https://github.com/ProjectRunspace/sysadmin-weekly/discussions

Microsoft has no intention of making 365 licensing simpler, because the complexity is what gives them room to negotiate.Andy Syrewicze gets Paul Schnackenburg back on the show to map Microsoft 365 licensing as it actually stands in 2026. The July price increases and the one SKU that did not move, the Defender and Purview add-ons that let a 300 seat shop buy E5 capability without buying E5, the features that left E5 for the Entra Suite, and E7 at $99 per user per month with Agent 365 attached. Paul teaches this to Microsoft partners for a living, and he says the part out loud that most people only suspect.Chapters:00:00:00 - Cold Open: You Need a PhD for 365 Licensing00:01:00 - Welcome and Show Plugs00:07:11 - News React: The iPhone Duo and V1 Hardware00:12:07 - News React: Companies Throttling Employee AI Use00:13:59 - Nerd Hour: Andy's Claude Code Data Pipeline00:20:15 - Nerd Hour: Cloudflare and Paying for AI Crawls00:22:35 - Main Topic: Making the Imaginary Lawyers Happy00:23:38 - Business, Enterprise, and the Office 365 Leftovers00:25:51 - Business SKUs and the July Price Increase00:28:14 - Why Paul Treats Business Premium as the Floor00:28:42 - The 15 Person Firm He Put on E500:30:31 - Defender and Purview Add-Ons for Business Premium00:32:47 - From the Outside, This Sounds Like Lunacy00:33:41 - Licensing Is Now a Quarterly Job00:34:58 - Mixing Business and Enterprise Past 300 Seats00:36:29 - What Separates Basic, Standard, and Premium00:37:18 - Conditional Access Is the Real Upgrade Trigger00:38:33 - M365 Maps and the Periodic Table00:40:07 - The No Teams SKUs and EU Antitrust00:41:39 - Paying for the Top SKU and Turning Nothing On00:42:17 - Third Party Security Tools vs the Microsoft Stack00:47:17 - Thirty Portals and Nobody Can Cover Them All00:50:04 - Tony Redmond: Too Complex for Humans to Understand00:51:36 - The Intune Suite Folds Into E3 and E500:55:22 - The Add-On Maze and What Purview Gives You00:59:10 - E5 Is Not the Kitchen Sink Anymore01:01:10 - The Entra Suite: Governance and Private Access01:03:02 - E7, Agent 365, and Agent ID01:05:37 - Purview and Defender Watching Your Agents01:07:12 - Who Is Running OpenClaw in Your Tenant?01:07:59 - E7 at $99 Per User Per Month01:09:07 - The Complexity Is Intentional01:10:06 - Do This Monday: Audit Your Add-Ons and Renewal Date01:11:19 - The New Conditional Access Overage Warning01:12:12 - The One License Myth and Microsoft's Telemetry01:14:53 - Wrap Up and OutroResources / Show Notes:- Tony Redmond, Is Microsoft 365 Too Complex for Humans to Understand: https://365forall.com/article/is-microsoft-365-too-complex-for-humans-to-understand-blog-by-tony-redmond- Office 365 for IT Pros, the subscription book Paul recommends: https://office365itpros.com- M365 Maps by Aaron Dinnage, visual SKU and feature breakdowns: https://m365maps.com- jumpto365, the Periodic Table of Microsoft 365: https://www.jumpto365.com- Microsoft Learn, Microsoft 365 and Office 365 service descriptions: https://learn.microsoft.com/en-us/office365/servicedescriptions/office-365-service-descriptions-technet-library- Microsoft, Business Basic, Standard and Premium comparison: https://aka.ms/M365BusinessPlans- 404 Media, companies are throttling employee AI use because it is too expensive: https://www.404media.co/companies-are-throttling-employees-ai-use-because-its-too-expensive/- Cloudflare, new AI traffic options for search, agent and training bots: https://blog.cloudflare.com/content-independence-day-ai-options/- SysAdmin Weekly: https://www.sysadminweekly.com- SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com- AndyOnTech: https://www.andyontech.com- Project Runspace: https://www.projectrunspace.org- GitHub Discussions: https://github.com/ProjectRunspace/sysadmin-weekly/discussions

Which protocol you use to reach the box is the least interesting decision you will make about remote access.Andy Syrewicze and Eric Siron go after the piece they cut from the tools episode. Eric lands the sharpest version half an hour in: what you are actually doing is moving from one-sided authentication to mutual authentication. Around that sit overlay networks against the VPN concentrator, the RMM console as the most attractive target in an MSP estate, the outbound tunnel nobody watches for, and whether just-in-time access holds up at 3am with something down and nobody awake to approve it.Chapters:00:00:00 - Cold Open: Remote Access Gets Its Own Episode00:01:20 - Welcome and Show Plugs00:04:16 - News React: Anthropic Safety Researcher Resigns00:12:54 - News React: Broadcom Pulls Public VDDK Access00:16:21 - Nerd Hour: Eric's Hugo Migration00:17:24 - Three Gates Against a Runaway API Bill00:20:38 - Main Topic: The Tooling Is the Small Part00:23:08 - SSH on 22, and the Port Change Experiment00:24:21 - Name a Reason to Expose a Management Port00:27:10 - Overlay Networks, Tailscale, and WireGuard00:29:31 - Eric: This Is About Mutual Authentication00:32:20 - RMM Tools and the Central Console Problem00:33:41 - Do You Need Remote Management All the Time?00:34:36 - Just Enough Administration Meets Just in Time00:36:00 - Eric: I Attack the Endpoint, Not the Protocol00:40:16 - Risk Assessment Is a SysAdmin Skill00:42:47 - The Firewall Is Also the VPN, and Fortinet00:45:17 - Outbound Access, Attacker's Side00:47:32 - Is Anyone Watching Outbound Traffic?00:50:52 - The 3am Phone Call00:52:46 - Eric: MFA Everything, No Remember Me00:55:44 - PAM, PIM, and Where to Read Up00:56:14 - Nothing Revokes Itself Unless You Build It00:58:13 - Key Takeaways: Never Rely on One Control00:59:40 - Access Should Be Ephemeral01:01:46 - Risk Profiles: Tomcat vs Medical Records01:03:52 - The Tools: Tailscale, SSH, Remmina01:07:56 - Eric's Kit: PuTTY, WinSCP, rsync01:11:17 - Do This Monday01:13:52 - Wrap Up and OutroResources / Show Notes:- NBC News, Anthropic researcher Jacob Coxon resigns: https://www.nbcnews.com/tech/tech-news/anthropic-safety-researcher-resigned-warning-rapid-ai-development-gamb-rcna596767- RentAHuman, where AI agents hire people for real world tasks: https://rentahuman.ai- Brandon Lee (vExpert), Broadcom pulled public VDDK access: https://www.virtualizationhowto.com/2026/09/leaving-vmware-just-got-harder-after-broadcom-pulled-vddk-downloads/- CISA, hardening Fortinet devices after credential exposure: https://www.cisa.gov/news-events/alerts/2026/06/18/cisa-urges-hardening-fortinet-devices-after-reports-credential-exposure- Microsoft Learn, Entra PIM, eligible versus active access: https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure- Tailscale, free Personal plan covers 6 users: https://tailscale.com/pricing- WireGuard, what Tailscale manages under the hood: https://www.wireguard.com- Cisco Duo, free tier for teams of 10 or fewer: https://duo.com- Remmina, open source RDP, VNC and SSH client: https://remmina.org- PuTTY: https://www.chiark.greenend.org.uk/~sgtatham/putty/- WinSCP: https://winscp.net- SysAdmin Weekly: https://www.sysadminweekly.com- SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com- AndyOnTech: https://www.andyontech.com- Project Runspace: https://www.projectrunspace.org- GitHub Discussions: https://github.com/ProjectRunspace/sysadmin-weekly/discussions

The tools that stay in the kit for a decade are the ones that still work when the network, the domain, or the boot volume is the thing that broke.Andy Syrewicze and Eric Siron open their real toolboxes and argue about what earns permanent residency. nmap and Wireshark for what is actually on the wire, Sysinternals for what a box is really doing, GParted and SystemRescue for the volume that will not mount, and the chkdsk, DISM, then SFC sequence Eric can run in his sleep. Andy's list skews hard toward triage because MSP work meant walking into a stranger's burning network every week. Remote access is missing on purpose; RDP, SSH, and overlay networks are getting their own episode.Chapters:00:00:00 - Cold Open: The Tools That Save Your Bacon00:01:13 - Welcome and Show Plugs00:03:11 - News React: Anthropic's Enterprise Frontier Safeguards00:07:01 - News React: The US Goes Openly Offensive in Cyber00:12:57 - Nerd Hour: CC Top and a Pomodoro Timer That Remembers00:15:53 - What Earns a Permanent Spot in the Toolbox00:17:32 - Why MSP Years Produce a Triage Kit00:20:13 - nmap, and the Licensed Cisco Utility Story00:22:31 - Sysinternals and Process Monitor00:23:16 - Wireshark Past the Basics00:24:09 - netstat and nslookup Are Not Wizardry00:25:12 - dig, and Why ping Is Not a DNS Tool00:27:22 - Test-NetConnection Instead of ping00:27:59 - Why Anyone Blocks ICMP in the First Place00:30:11 - MXToolbox, PingPlotter, and the Neighbor's Air Conditioner00:33:18 - GParted, SystemRescue, and the Live CD Shelf00:35:58 - chkdsk, DISM, then SFC, in That Order00:38:06 - DBAN and Decommissioning Disks00:40:51 - The Multi-Pass Wipe Myth00:43:25 - Greenshot and Capture Last Region00:46:07 - Spectacle, Client Hypervisors, Docker and Podman00:47:33 - Get-Help and man: Nobody Remembers Syntax00:48:28 - OpenSSL, Qualys SSL Labs, and testssl.sh00:50:13 - WSL as the Whole Toolbox00:51:37 - The Everyday List: Vim, Bitwarden, Git, Package Managers00:54:20 - Remote Access Gets Its Own Episode00:55:30 - The Platform Tax After Leaving Windows00:58:18 - Edge on WSL on Windows, for Certificate Chains01:01:02 - Do This Monday01:03:31 - Eric's Advice: Go Look for the Tool01:04:37 - Wrap Up and OutroResources / Show Notes:- Anthropic, Developing Enterprise Frontier Safeguards: https://www.anthropic.com/news/enterprise-frontier-safeguards- Nmap: https://nmap.org/- Wireshark: https://www.wireshark.org/- Microsoft Sysinternals, and Sysinternals Live: https://learn.microsoft.com/en-us/sysinternals/- MXToolbox, external DNS and blacklist checks: https://mxtoolbox.com/- PingPlotter, latency and packet loss per hop: https://www.pingplotter.com/- GParted, and the live image: https://gparted.org/- SystemRescue: https://www.system-rescue.org/- DBAN, still there, spinning disk era, not for SSDs: https://sourceforge.net/projects/dban/- Greenshot, Windows only: https://getgreenshot.org/- Qualys SSL Labs, tick the box to stay off the public board: https://www.ssllabs.com/ssltest/- testssl.sh, for internal sites: https://testssl.sh/- DevToys, clipboard certificate parser: https://devtoys.app/- SysAdmin Weekly, all show links: https://www.sysadminweekly.com- SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com- AndyOnTech: https://www.andyontech.com- Project Runspace: https://www.projectrunspace.org- GitHub Discussions, what is in your toolbox: https://github.com/ProjectRunspace/sysadmin-weekly/discussions

Somewhere inside that isolated network, port 22 is open, and it has been open since the outage six months ago that nobody wrote up.Andy Syrewicze and Eric Siron take apart a term the industry uses constantly and almost never earns. They walk the management plane hole by hole: SSH and RDP so somebody can patch the thing, SMB for the files that have to move, DNS and NTP because nothing works without them, and the iDRAC, iLO, and IPMI boards that get parked on the management VLAN and then never patched at all. The argument they land on is not that a real air gap is impossible, it is that calling something an air gap ends the conversation, and a promise nobody re-verifies is worse than a risk everybody can see.Chapters:00:00:00 - Cold Open: Your Air Gap Probably Is Not an Air Gap00:01:12 - Welcome and Show Plugs00:04:19 - News React: An AirTag, a Rare Book, and an Amazon Scanning Facility00:10:10 - News React: Bill Gates Changes His Mind on AI and Jobs00:13:03 - What the Entry Level Job Market Looks Like Right Now00:15:05 - When Nobody Is Left Who Knows How to Program It00:19:25 - Nerd Hour: Claude Code, Agents, and Building CC Top00:23:54 - Nerd Hour: Moving Project Runspace to Hugo, JavaScript Free00:28:22 - What an Air Gap Actually Means00:31:22 - Logical, Network, Virtual: How the Word Got Laundered00:32:36 - Every Hole You Poke Just to Manage the Thing00:34:18 - The One Nobody Segments: iDRAC, iLO, and IPMI00:36:26 - A Brief and Deserved Detour About Printers00:37:23 - NTP, DNS, License Activation, and Telemetry00:40:34 - Why Leaving Hyper-V Out of the Domain Is Not Security00:43:16 - VLANs, Switch Fabric, and Breakout Attacks00:44:40 - Assume Breach: Zero Trust, JIT, and JEA00:50:36 - Sneaker Net and Poisoned USB Drives00:52:20 - Stuxnet and the Gap That Was Real00:54:59 - How Would You Even Safely Clean a USB Drive?00:56:58 - Say What You Have, Then Defend It00:57:29 - The Real Danger Is the False Sense of Security01:00:23 - The Windows Firewall Lesson01:03:11 - What a Genuine Air Gap Actually Costs01:04:59 - Wrap Up and OutroResources / Show Notes:- Symantec Security Response, W32.Stuxnet Dossier, the canonical technical analysis: https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en- Ralph Langner, To Kill a Centrifuge, on why post-Stuxnet air gap strategies miss the point: https://www.cs.yale.edu/homes/jf/Langner.pdf- The 2008 USB breach of US military networks, Agent.btz and Operation Buckshot Yankee: https://en.wikipedia.org/wiki/2008_malware_infection_of_the_United_States_Department_of_Defense- Microsoft Security Advisory 967940, the update that killed USB AutoRun: https://learn.microsoft.com/en-us/security-updates/securityadvisories/2009/967940- NIST SP 800-82 Rev. 3, Guide to Operational Technology Security, for naming what you actually have: https://csrc.nist.gov/pubs/sp/800/82/r3/final- 404 Media, tracking a shipment of rare books to an Amazon AI training facility: https://www.404media.co/we-tracked-a-shipment-of-rare-books-it-ended-at-an-amazon-ai-training-facility/- Semafor, Bill Gates has changed his mind about AI and jobs: https://www.semafor.com/article/08/25/2026/this-is-crazy-this-is-insane-bill-gates-has-changed-his-mind-about-ai-and-jobsGates Notes, the essay itself: The turbulent AI era is here: https://www.gatesnotes.com/a-turbulent-ai-era-and-critical-choices-to-make- SysAdmin Weekly, all show links: https://www.sysadminweekly.com- SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com- AndyOnTech: https://www.andyontech.com- Project Runspace: https://www.projectrunspace.org- GitHub Discussions, tell us about your air gap and why you have one: https://github.com/ProjectRunspace/sysadmin-weekly/discussions

Two careers, two completely different entry points, and the exact same first catastrophe: data gone, no idea if it was coming back.Andy Syrewicze and Eric Siron trade full origin stories, from the 486 and the VIC-20 through the first paid tech jobs neither of them was qualified for. They get specific about the failures that rewired how they work, the mentor advice that still holds up decades later, the advice that aged badly, and the question underneath all of it: the on-ramp that produced both of them was cheap hardware, full access, and time to break things, and most of that is gone. Whether that actually matters for anyone starting in 2026 is the argument they finish on.Chapters:00:00:00 - Cold Open: How We Actually Got Into IT00:01:01 - Welcome, Show Plugs, and Why There Was a Gap00:05:03 - News React: Meta Goes Open Source Again With Muse Glimmer00:07:55 - News React: Lithium Battery Farms, Data Centers, and Zoning Boards00:16:39 - Nerd Hour: A Black Hat Demo on Local LLMs and M365 Spear Phishing00:19:34 - Nerd Hour: Fish Tape, a Whole House Vacuum, and a 160 Degree Attic00:24:51 - The Stuff We Broke Before Anyone Paid Us00:26:31 - Andy: The 486, the Matrix Boot Screen, and Getting Told to Change It Back00:30:41 - Eric: The VIC-20, a Xerox 286, and Overclocking With a Box Fan00:37:53 - Andy's First IT Job: A K-12 Summer Gig and 30 Cables a Foot Short00:44:05 - Eric's First IT Job: Freight Dock to Phone Support00:49:14 - Would Either of These Paths Still Get You Hired Today?00:56:02 - Andy Nukes the Application Share and Prays at a Tape Drive01:00:11 - Eric's Version: Dad, I Deleted All Your Files01:02:46 - Why Almost Every SysAdmin's First Disaster Involves Data01:04:21 - Advice That Held Up: The Key to IT Is Laziness01:10:06 - Being Decent Beats Being Smart, and Learning to Say I Don't Know01:15:01 - Advice That Aged Badly: Always, Never, and Best Practice01:17:31 - Nobody Ever Got Fired for Buying IBM01:23:02 - Does This On-Ramp Still Exist in 2026?01:26:07 - You Do Not Need Commercial Gear to Learn This01:27:56 - Wrap Up and OutroResources / Show Notes:- VentureBeat - Meta returns to open source with Muse Glimmer: https://venturebeat.com/technology/meta-returns-to-open-source-with-muse-glimmer-an-apache-2-0-licensed-30b-parameter-ai-model-optimized-for-agents-available-now- MultiState - Federal AI data center policy meets resistance from state lawmakers: https://www.multistate.us/insider/2026/4/14/federal-ai-data-center-policy-meets-resistance-from-state-lawmakers- Black Hat official YouTube, where the USA 2026 Briefings recordings post: https://www.youtube.com/@BlackHatOfficialYT- SysAdmin Weekly, all show links: https://www.sysadminweekly.com- SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com- AndyOnTech: https://www.andyontech.com- Project Runspace: https://www.projectrunspace.org- GitHub Discussions, tell us your first broke something moment: https://github.com/ProjectRunspace/sysadmin-weekly/discussions