SysAdmin Weekly

Andy Syrewicze and Eric Siron
  • 5.0 (4)
  • Technology
  • Updated Weekly

Welcome to the SysAdmin Weekly Podcast, your go-to source for IT-related content tailored to busy system administrators in the trenches. Hosted by longtime sysadmins and Microsoft MVPs Andy Syrewicze and Eric Siron, this show dives deep into the challenges and solutions that matter most to sysadmins on any given day. From technical know-how to real-world insights, SysAdmin Weekly is dedicated to those tireless professionals who keep our digital world running. Tune in for relevant topics, expert advice, and engaging discussions to make your busy schedule a little bit easier.

  1. 1d ago

    064 - Backup and Recovery in 2026: Why Boring Backups Win

    Your backups should be boring: hardware you know, a copy that lives somewhere else, at least one copy nobody can change, and a restore test that proves the whole thing works. Andy Syrewicze and Eric Siron go back to basics on backup and recovery for 2026. They build the inventory, including the switch configs and firewall policies nobody thinks to protect, get honest RPO and RTO answers by asking what an hour of downtime costs, and explain why a Hyper-V checkpoint is not a backup. Then immutability, tape's write-protect tab, air gaps that are not air gaps, and the monthly restore test. Up front: a stolen ConnectWise Cloud Backup credential that signed in to at least 173 Microsoft 365 tenants, and whether Ukraine's strikes on Yandex data centers really silenced Russian bots. Chapters: 00:00:00 - Cold Open: The Backup Episode We Never Did 00:01:05 - Welcome and Show Plugs 00:04:04 - News React: Ukraine's Strikes and the Russian Bot Drop 00:06:47 - The Dead Internet Theory 00:08:46 - When Data Centers Become Military Targets 00:09:40 - News React: Stolen ConnectWise Credential Hits M365 Tenants 00:12:37 - Why a Compromised App Is Harder to Lock Out 00:13:50 - Nerd Hour: Tailscale Upgrades and a Look at NetBird 00:15:35 - Eric's Hugo Migration and GDPR-Friendly Analytics 00:16:28 - Umami vs Matomo 00:18:37 - On-Premise vs On-Premises 00:19:57 - Main Topic: Start With What You're Protecting 00:22:46 - The Second Tier: Switch Configs and Firewall Policies 00:25:43 - Are Your Desktops Actually Backed Up? 00:26:46 - Folder Redirection and the Root of C: 00:28:03 - The Window Hidden Under the Taskbar 00:28:53 - Back Up Your Power Users' Workstations 00:30:15 - RPO and RTO Explained 00:32:23 - Ask What an Hour of Downtime Costs 00:34:44 - Zero Downtime Means High Availability 00:36:40 - HA Workloads Still Need Backups 00:37:16 - Design Your Backups to Be Boring 00:40:03 - Why Won't Companies Pay for Backup? 00:41:17 - Hyper-V Checkpoints Are Not Backups 00:42:17 - Mattresses, Tires, and Backup Pricing 00:43:16 - Business Continuity Goes Beyond Backup 00:44:42 - Two Backup Copies, One Off-Site 00:45:43 - Ransomware Goes After Your Backups First 00:46:17 - Immutable Backups in 2026 00:48:06 - Is Anything Truly Immutable? 00:49:32 - Tape and the Write-Protect Tab 00:50:48 - How Long Does Tape Last? 00:51:25 - The Drive Dies Before the Tape Does 00:53:05 - USB Drives, Cold Sites, and Short Sync Windows 00:54:53 - Security vs Convenience and the Air Gap Label 00:56:00 - Run a Recovery Test, and Run It Often 00:57:37 - Why Total Data Loss Ends Businesses 00:59:15 - Business Continuity Follow-Up and Wrap Up 01:00:00 - Outro: Send Us Your Horror Stories Resources / Show Notes: - The Hacker News - Compromised ConnectWise credential used on 173 M365 tenants: https://thehackernews.com/2026/10/hackers-use-compromised-connectwise.html - Euronews - Did Ukraine's strikes on Yandex data centres silence Russian bots?: https://www.euronews.com/2026/10/12/did-ukrainian-strikes-on-yandex-data-centres-cause-russian-bot-activity-to-plummet - CISA - #StopRansomware Guide: https://www.cisa.gov/resources-tools/resources/stopransomware-guide - Umami, privacy-focused web analytics: https://umami.is/ - Matomo, open source web analytics: https://matomo.org/ - NetBird, open source zero trust networking: https://netbird.io/ - Tailscale: https://tailscale.com/ - SysAdmin Weekly: https://www.sysadminweekly.com - SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com - AndyOnTech: https://www.andyontech.com - Project Runspace: https://www.projectrunspace.org - GitHub Discussions: https://github.com/ProjectRunspace/sysadmin-weekly/discussions

  2. Oct 19

    063 - What Is a Kernel, and Why Does It Blue Screen Your Server?

    The kernel is just software. It happens to be the one program on the box with no guardrails, which is why one bad driver takes the whole system down with it. Andy Syrewicze and Eric Siron walk the kernel from the bottom up: why running two programs at once needed a supervisor, how user mode and kernel mode split the work, and where IRQs, drivers, and the HAL fit. Andy strips a Gentoo kernel so thin it cannot find its own hard drive, and Eric argues a blue screen is the kernel protecting your data. Then they weigh whether Microsoft should push third-party code out of kernel space after CrowdStrike. Up front: Microsoft deleting nonprofit tenant data early, and a listener choosing between Network+ and the server certs. Chapters: 00:00:00 - Cold Open: Kernels Are Not Magic 00:01:33 - Welcome and Show Plugs 00:05:05 - News React: Local AI and the Surface Laptop Ultra 00:07:47 - Anthropic, Bot Swarms, and the Local Model Threat 00:10:57 - Can You Trust the No-Training Checkbox? 00:14:05 - News React: Microsoft 365 Family Storage Cut 00:14:46 - Microsoft Deletes Nonprofit Data Early 00:17:33 - The Cloud Trust Problem 00:19:10 - Retention Is Not Backup 00:21:12 - Listener Question: Help Desk to Junior SysAdmin 00:23:51 - Get the Certs for the Job You Want 00:27:06 - Get the Job First, Then the Certs 00:30:44 - Is Security+ Worth It for a Generalist? 00:32:15 - Main Topic: What a Kernel Actually Is 00:33:54 - From One Program at a Time to Many 00:35:25 - Hand-Written Drivers and the Video Card Virus 00:36:05 - The HAL Ended a Whole Category of Attacks 00:37:29 - Where the Word Kernel Comes From 00:39:02 - Mandrake, Debian, and Gentoo 00:40:48 - Kernel Mode vs User Mode 00:42:48 - Before Memory Protection: DOS to Virtual Memory 00:45:14 - Kernel Mode Drivers Run Without Guardrails 00:45:51 - IRQs, TIE Fighter, and Windows 3.1 00:46:58 - A 2026 Kernel Bug That Fought Over an IRQ 00:49:56 - Install Gentoo Once to Learn the Kernel 00:52:44 - Andy's Razor-Thin Kernel Panic 00:54:14 - ARC Paths and NT Boot Failures 00:57:06 - What Happens When Kernel Code Misbehaves 00:57:51 - CrowdStrike and the Botched Kernel Update 00:58:39 - Why the Blue Screen Is the Right Call 01:01:32 - Should Microsoft Lock Down Kernel Access? 01:02:44 - Wrap Up and Outro Resources / Show Notes: - SysAdmin Weekly 036 - The Hidden Cost of Abstraction: https://youtu.be/5ic4Pozot44 - Eric Siron - Kernels, Shells, and Operating Systems (Re)Visited: https://projectrunspace.org/kernels-shells-and-operating-systems-revisited/ - Microsoft Learn - User mode and kernel mode: https://learn.microsoft.com/en-us/windows-hardware/drivers/gettingstarted/user-mode-and-kernel-mode - Gentoo Handbook - Configuring the Linux kernel: https://wiki.gentoo.org/wiki/Handbook:AMD64/Installation/Kernel - Microsoft - CrowdStrike outage response: https://blogs.microsoft.com/blog/2024/07/20/helping-our-customers-through-the-crowdstrike-outage/ - Microsoft - The Windows Resiliency Initiative: https://blogs.windows.com/windowsexperience/2025/06/26/the-windows-resiliency-initiative-building-resilience-for-a-future-ready-enterprise/ - PCWorld - Surface Laptop Ultra and local AI: https://www.pcworld.com/article/3255200/the-surface-laptop-ultra-is-an-ai-monster-with-a-laptop-problem.html - The Register - Microsoft deletes nonprofit M365 data: https://www.theregister.com/saas/2026/09/28/microsoft-tells-nonprofits-their-deleted-m365-data-isnt-coming-back/5299433 - SysAdmin Weekly: https://www.sysadminweekly.com - SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com - AndyOnTech: https://www.andyontech.com - Project Runspace: https://www.projectrunspace.org - GitHub Discussions: https://github.com/ProjectRunspace/sysadmin-weekly/discussions

  3. Oct 11

    062 - What Free IT Training Actually Gets You Hired in 2026 and 2027?

    Free IT training is real and it is actually free. The exam that gets you past a resume screen is the part that still costs money. Andy Syrewicze and Eric Siron go through the free IT training worth your evenings: Microsoft Learn, AWS Skill Builder, Cisco Networking Academy, the Linux Foundation, and the second tier nobody mentions. Why every big vendor gives this away, what a Credly badge proves to a hiring manager, and how to spot the outfit in your LinkedIn DMs guaranteeing you a CCIE. Eric's old employer paid for every cert he sat, and he explains why that path mostly does not exist anymore. Chapters: 00:00:00 - Cold Open: Free Training and Getting Hired 00:01:14 - Welcome and Show Plugs 00:04:21 - News React: Microsoft Broke Copy Paste in Excel 00:09:59 - Nadella on Layoffs, and CEOs Who Will Not Stop Talking 00:12:58 - News React: Broadcom Deauthorizes Insight 00:15:17 - Punished for Selling Competing Products 00:17:13 - Broadcom Is Overplaying Its Hand 00:18:24 - Intel, AMD, and the Nasty Gram From 1999 00:20:53 - Gartner: 55 Percent Shopping the Exit by 2029 00:23:12 - Nerd Hour Lightning Round 00:23:49 - MSP Summit and a Tech Channel 101 Idea 00:25:40 - Eric's In-Laws, a Prowler, and Punctured Cans 00:27:40 - A Sixty Dollar Camera With No Account Required 00:30:11 - Main Topic: What Free Training Gets You Hired 00:30:58 - What "Free" Means When a Vendor Says It 00:32:17 - Microsoft Learn and the AI Documentation Worry 00:36:40 - AWS Skill Builder and Cisco Networking Academy 00:38:29 - Credly Badges and Whether Andy Claims Them 00:39:51 - The Linux Foundation and Open Source Everywhere 00:41:41 - Linux Takes You Further, Microsoft Gets You Hired 00:45:26 - PowerShell Aliases and Azure CLI's Linux Accent 00:48:14 - IBM SkillsBuild, Trailhead, and Google 00:48:55 - The Guaranteed Pass Pitch in Your LinkedIn DMs 00:56:50 - A Guaranteed CCIE Means Somebody Is Cheating 00:58:53 - Pluralsight and Where the Cheap Options Sit 01:02:10 - MSPs, Partner Tiers, and Why They Will Still Pay 01:05:33 - A Badge Proves You Finished a Module 01:06:36 - Turning Free Training Into a Callback 01:08:51 - Make Your Resume Look Like the Person Who Does the Job 01:11:22 - Do This Monday: Name the Gap, Then Fill It 01:13:32 - Anthropic, OpenAI, and Certing in Emerging Tech 01:14:13 - Novell NetWare, Dry Copper, and Refusing to Learn 01:17:32 - Jeffrey Snover: Embrace Learning, or Be a Lumberjack 01:18:46 - Wrap Up and the Call for SysAdmin Horror Stories Resources / Show Notes: - CRN, top VMware partner Insight deauthorized by Broadcom: https://www.crn.com/news/channel-news/2026/top-vmware-partner-insight-deauthorized-by-broadcom-in-north-america - The Register, Microsoft patches Windows and Excel and breaks paste: https://www.theregister.com/os-platforms/2026/09/14/microsoft-patches-windows-and-excel-breaks-audio-remote-access-and-paste/5296085 - Microsoft Learn, free modules and learning paths: https://learn.microsoft.com/training/ - AWS Skill Builder: https://skillbuilder.aws - Cisco Networking Academy: https://www.netacad.com - Linux Foundation Training, free courses: https://training.linuxfoundation.org - IBM SkillsBuild: https://skillsbuild.org - Salesforce Trailhead: https://trailhead.salesforce.com - Google Skills, formerly Cloud Skills Boost: https://www.skills.google - Claude Academy, free AI courses from Anthropic: https://academy.claude.com - OpenAI Academy: https://academy.openai.com - Pluralsight, pricing and the 10 day trial: https://www.pluralsight.com/individuals/pricing/free-trial - SysAdmin Weekly: https://www.sysadminweekly.com - SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com - AndyOnTech: https://www.andyontech.com - Project Runspace: https://www.projectrunspace.org - GitHub Discussions: https://github.com/ProjectRunspace/sysadmin-weekly/discussions

  4. Sep 27

    061 - Why Does IT Burn People Out? SysAdmin Mental Health with Paul Croker

    We throw an alert when a disk hits 85 percent. Nobody has ever built the monitoring system for the person who gets the alert. Andy Syrewicze is joined by Paul Croker, a UK IT pro who founded 404 Stress Not Found, a nonprofit built because tech and cyber people had nowhere safe to talk about burnout. Paul walks through the perfect storm that put him on a Berlin stage telling his own story, and Andy gets into the MSP years that surfaced a generalized anxiety disorder. They get specific about hero culture, the all-nighter nobody asks questions about, and why a wellness app and a pizza do not touch the structural problem underneath. Chapters: 00:00:00 - Cold Open: An Industry That Is Good at Breaking People 00:01:11 - Welcome and Episode Intro 00:02:12 - Meet Paul Croker and 404 Stress Not Found 00:03:15 - News React: AI Agents Climbing Out of the Sandbox 00:06:31 - The Agent That Hacked a Gym to Get Into Pilates 00:08:13 - News React: September Patch Tuesday 00:08:56 - A Record 974 CVEs and What Is Driving the Curve 00:11:53 - Where Do These Vulnerabilities Actually Live? 00:14:58 - Nerd Hour Begins 00:15:44 - Dan Scott's BES Server Post and the Flashbacks 00:16:27 - Andy's Novell, AS/400, and BES Nightmare 00:18:15 - Paul's First BlackBerry Deployment 00:20:21 - BlackBerry Messaging as a BCDR Channel 00:22:33 - Sonic on a Phone While Everyone Else Played Snake 00:23:23 - Nerd Hour: Andy's Static Site and Caddy 00:25:10 - A Two Line Config, and Why Simple Wins 00:26:19 - Main Topic: Burnout, Anxiety, and Mental Health in Tech 00:27:07 - Paul's Path From IT Generalist to MSP Owner 00:29:31 - The Pax8 Berlin Talk and the Perfect Storm 00:32:57 - Building the Meetups, and Richard Tubb in Newcastle 00:35:08 - Andy on Generalized Anxiety and the Job That Got Away 00:37:48 - Pressure Arrives in Layers 00:39:56 - The Nasty Gram That Was Not About Work 00:41:36 - We Alert on 85 Percent Disk and Nothing on People 00:42:39 - Heartbeats: The Monitoring Metaphor That Actually Fits 00:45:43 - The People Who Show Up to Learn the Warning Signs 00:47:37 - Why IT Is So Good at Breaking People 00:48:32 - Every Interaction Is a Problem, and It Wears You Down 00:51:08 - Attackers Need One Win, Defenders Need All of Them 00:52:04 - Hero Culture and the All Nighter 00:53:31 - Missing Documentation Is Why the All Nighter Happened 00:55:05 - What Does Not Work: Wellness Apps and Pizza 00:57:13 - Go Kick Some Leaves 00:58:28 - Communities Are the Fix Nobody Reaches For Soon Enough 01:00:10 - The Free 404 Portal and Resources 01:01:19 - The Mentor Who Taught Andy to Say "The End" 01:02:26 - You Are Not Your Job Title 01:03:12 - How to Reach Paul 01:04:07 - Wrap Up and Outro Resources / Show Notes: - 404 Stress Not Found - Paul Croker's nonprofit for IT and cyber mental health: https://404stressnotfound.org - Paul Croker - LinkedIn: https://www.linkedin.com/in/paulcrokeruk/ - Richard Tubb - Tech Mental Health Spaces: https://richardtubb.co.uk/404-stress-not-found/ - The Cyber Express - Patch Tuesday hits a record 974 CVEs: https://thecyberexpress.com/patch-tuesday-september-2026/ - Anthropic - Claude Mythos Preview, AI finding and exploiting zero-days: https://www.anthropic.com/research/mythos-preview - ABC News Australia - AI agent hacks a gym website to book a Pilates class: https://www.abc.net.au/news/2026-08-10/ai-assistant-hacks-gym-website-aus-cyber-attack/107007986 - Caddy - single binary web server with automatic HTTPS: https://caddyserver.com - SysAdmin Weekly: https://www.sysadminweekly.com - SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com - AndyOnTech: https://www.andyontech.com - Project Runspace: https://www.projectrunspace.org - GitHub Discussions: https://github.com/ProjectRunspace/sysadmin-weekly/discussions

  5. Sep 20

    060 - Microsoft 365 Licensing in 2026: What Changed and What It Costs You

    Microsoft has no intention of making 365 licensing simpler, because the complexity is what gives them room to negotiate. Andy Syrewicze gets Paul Schnackenburg back on the show to map Microsoft 365 licensing as it actually stands in 2026. The July price increases and the one SKU that did not move, the Defender and Purview add-ons that let a 300 seat shop buy E5 capability without buying E5, the features that left E5 for the Entra Suite, and E7 at $99 per user per month with Agent 365 attached. Paul teaches this to Microsoft partners for a living, and he says the part out loud that most people only suspect. Chapters: 00:00:00 - Cold Open: You Need a PhD for 365 Licensing 00:01:00 - Welcome and Show Plugs 00:07:11 - News React: The iPhone Duo and V1 Hardware 00:12:07 - News React: Companies Throttling Employee AI Use 00:13:59 - Nerd Hour: Andy's Claude Code Data Pipeline 00:20:15 - Nerd Hour: Cloudflare and Paying for AI Crawls 00:22:35 - Main Topic: Making the Imaginary Lawyers Happy 00:23:38 - Business, Enterprise, and the Office 365 Leftovers 00:25:51 - Business SKUs and the July Price Increase 00:28:14 - Why Paul Treats Business Premium as the Floor 00:28:42 - The 15 Person Firm He Put on E5 00:30:31 - Defender and Purview Add-Ons for Business Premium 00:32:47 - From the Outside, This Sounds Like Lunacy 00:33:41 - Licensing Is Now a Quarterly Job 00:34:58 - Mixing Business and Enterprise Past 300 Seats 00:36:29 - What Separates Basic, Standard, and Premium 00:37:18 - Conditional Access Is the Real Upgrade Trigger 00:38:33 - M365 Maps and the Periodic Table 00:40:07 - The No Teams SKUs and EU Antitrust 00:41:39 - Paying for the Top SKU and Turning Nothing On 00:42:17 - Third Party Security Tools vs the Microsoft Stack 00:47:17 - Thirty Portals and Nobody Can Cover Them All 00:50:04 - Tony Redmond: Too Complex for Humans to Understand 00:51:36 - The Intune Suite Folds Into E3 and E5 00:55:22 - The Add-On Maze and What Purview Gives You 00:59:10 - E5 Is Not the Kitchen Sink Anymore 01:01:10 - The Entra Suite: Governance and Private Access 01:03:02 - E7, Agent 365, and Agent ID 01:05:37 - Purview and Defender Watching Your Agents 01:07:12 - Who Is Running OpenClaw in Your Tenant? 01:07:59 - E7 at $99 Per User Per Month 01:09:07 - The Complexity Is Intentional 01:10:06 - Do This Monday: Audit Your Add-Ons and Renewal Date 01:11:19 - The New Conditional Access Overage Warning 01:12:12 - The One License Myth and Microsoft's Telemetry 01:14:53 - Wrap Up and Outro Resources / Show Notes: - Tony Redmond, Is Microsoft 365 Too Complex for Humans to Understand: https://365forall.com/article/is-microsoft-365-too-complex-for-humans-to-understand-blog-by-tony-redmond - Office 365 for IT Pros, the subscription book Paul recommends: https://office365itpros.com - M365 Maps by Aaron Dinnage, visual SKU and feature breakdowns: https://m365maps.com - jumpto365, the Periodic Table of Microsoft 365: https://www.jumpto365.com - Microsoft Learn, Microsoft 365 and Office 365 service descriptions: https://learn.microsoft.com/en-us/office365/servicedescriptions/office-365-service-descriptions-technet-library - Microsoft, Business Basic, Standard and Premium comparison: https://aka.ms/M365BusinessPlans - 404 Media, companies are throttling employee AI use because it is too expensive: https://www.404media.co/companies-are-throttling-employees-ai-use-because-its-too-expensive/ - Cloudflare, new AI traffic options for search, agent and training bots: https://blog.cloudflare.com/content-independence-day-ai-options/ - SysAdmin Weekly: https://www.sysadminweekly.com - SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com - AndyOnTech: https://www.andyontech.com - Project Runspace: https://www.projectrunspace.org - GitHub Discussions: https://github.com/ProjectRunspace/sysadmin-weekly/discussions

  6. Sep 11

    059 - How Should SysAdmins Handle Remote Access in 2026?

    Which protocol you use to reach the box is the least interesting decision you will make about remote access. Andy Syrewicze and Eric Siron go after the piece they cut from the tools episode. Eric lands the sharpest version half an hour in: what you are actually doing is moving from one-sided authentication to mutual authentication. Around that sit overlay networks against the VPN concentrator, the RMM console as the most attractive target in an MSP estate, the outbound tunnel nobody watches for, and whether just-in-time access holds up at 3am with something down and nobody awake to approve it. Chapters: 00:00:00 - Cold Open: Remote Access Gets Its Own Episode 00:01:20 - Welcome and Show Plugs 00:04:16 - News React: Anthropic Safety Researcher Resigns 00:12:54 - News React: Broadcom Pulls Public VDDK Access 00:16:21 - Nerd Hour: Eric's Hugo Migration 00:17:24 - Three Gates Against a Runaway API Bill 00:20:38 - Main Topic: The Tooling Is the Small Part 00:23:08 - SSH on 22, and the Port Change Experiment 00:24:21 - Name a Reason to Expose a Management Port 00:27:10 - Overlay Networks, Tailscale, and WireGuard 00:29:31 - Eric: This Is About Mutual Authentication 00:32:20 - RMM Tools and the Central Console Problem 00:33:41 - Do You Need Remote Management All the Time? 00:34:36 - Just Enough Administration Meets Just in Time 00:36:00 - Eric: I Attack the Endpoint, Not the Protocol 00:40:16 - Risk Assessment Is a SysAdmin Skill 00:42:47 - The Firewall Is Also the VPN, and Fortinet 00:45:17 - Outbound Access, Attacker's Side 00:47:32 - Is Anyone Watching Outbound Traffic? 00:50:52 - The 3am Phone Call 00:52:46 - Eric: MFA Everything, No Remember Me 00:55:44 - PAM, PIM, and Where to Read Up 00:56:14 - Nothing Revokes Itself Unless You Build It 00:58:13 - Key Takeaways: Never Rely on One Control 00:59:40 - Access Should Be Ephemeral 01:01:46 - Risk Profiles: Tomcat vs Medical Records 01:03:52 - The Tools: Tailscale, SSH, Remmina 01:07:56 - Eric's Kit: PuTTY, WinSCP, rsync 01:11:17 - Do This Monday 01:13:52 - Wrap Up and Outro Resources / Show Notes: - NBC News, Anthropic researcher Jacob Coxon resigns: https://www.nbcnews.com/tech/tech-news/anthropic-safety-researcher-resigned-warning-rapid-ai-development-gamb-rcna596767 - RentAHuman, where AI agents hire people for real world tasks: https://rentahuman.ai - Brandon Lee (vExpert), Broadcom pulled public VDDK access: https://www.virtualizationhowto.com/2026/09/leaving-vmware-just-got-harder-after-broadcom-pulled-vddk-downloads/ - CISA, hardening Fortinet devices after credential exposure: https://www.cisa.gov/news-events/alerts/2026/06/18/cisa-urges-hardening-fortinet-devices-after-reports-credential-exposure - Microsoft Learn, Entra PIM, eligible versus active access: https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure - Tailscale, free Personal plan covers 6 users: https://tailscale.com/pricing - WireGuard, what Tailscale manages under the hood: https://www.wireguard.com - Cisco Duo, free tier for teams of 10 or fewer: https://duo.com - Remmina, open source RDP, VNC and SSH client: https://remmina.org - PuTTY: https://www.chiark.greenend.org.uk/~sgtatham/putty/ - WinSCP: https://winscp.net - SysAdmin Weekly: https://www.sysadminweekly.com - SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com - AndyOnTech: https://www.andyontech.com - Project Runspace: https://www.projectrunspace.org - GitHub Discussions: https://github.com/ProjectRunspace/sysadmin-weekly/discussions

  7. Sep 4

    058 - What Tools Do SysAdmins Actually Use Every Day?

    The tools that stay in the kit for a decade are the ones that still work when the network, the domain, or the boot volume is the thing that broke. Andy Syrewicze and Eric Siron open their real toolboxes and argue about what earns permanent residency. nmap and Wireshark for what is actually on the wire, Sysinternals for what a box is really doing, GParted and SystemRescue for the volume that will not mount, and the chkdsk, DISM, then SFC sequence Eric can run in his sleep. Andy's list skews hard toward triage because MSP work meant walking into a stranger's burning network every week. Remote access is missing on purpose; RDP, SSH, and overlay networks are getting their own episode. Chapters: 00:00:00 - Cold Open: The Tools That Save Your Bacon 00:01:13 - Welcome and Show Plugs 00:03:11 - News React: Anthropic's Enterprise Frontier Safeguards 00:07:01 - News React: The US Goes Openly Offensive in Cyber 00:12:57 - Nerd Hour: CC Top and a Pomodoro Timer That Remembers 00:15:53 - What Earns a Permanent Spot in the Toolbox 00:17:32 - Why MSP Years Produce a Triage Kit 00:20:13 - nmap, and the Licensed Cisco Utility Story 00:22:31 - Sysinternals and Process Monitor 00:23:16 - Wireshark Past the Basics 00:24:09 - netstat and nslookup Are Not Wizardry 00:25:12 - dig, and Why ping Is Not a DNS Tool 00:27:22 - Test-NetConnection Instead of ping 00:27:59 - Why Anyone Blocks ICMP in the First Place 00:30:11 - MXToolbox, PingPlotter, and the Neighbor's Air Conditioner 00:33:18 - GParted, SystemRescue, and the Live CD Shelf 00:35:58 - chkdsk, DISM, then SFC, in That Order 00:38:06 - DBAN and Decommissioning Disks 00:40:51 - The Multi-Pass Wipe Myth 00:43:25 - Greenshot and Capture Last Region 00:46:07 - Spectacle, Client Hypervisors, Docker and Podman 00:47:33 - Get-Help and man: Nobody Remembers Syntax 00:48:28 - OpenSSL, Qualys SSL Labs, and testssl.sh 00:50:13 - WSL as the Whole Toolbox 00:51:37 - The Everyday List: Vim, Bitwarden, Git, Package Managers 00:54:20 - Remote Access Gets Its Own Episode 00:55:30 - The Platform Tax After Leaving Windows 00:58:18 - Edge on WSL on Windows, for Certificate Chains 01:01:02 - Do This Monday 01:03:31 - Eric's Advice: Go Look for the Tool 01:04:37 - Wrap Up and Outro Resources / Show Notes: - Anthropic, Developing Enterprise Frontier Safeguards: https://www.anthropic.com/news/enterprise-frontier-safeguards - Nmap: https://nmap.org/ - Wireshark: https://www.wireshark.org/ - Microsoft Sysinternals, and Sysinternals Live: https://learn.microsoft.com/en-us/sysinternals/ - MXToolbox, external DNS and blacklist checks: https://mxtoolbox.com/ - PingPlotter, latency and packet loss per hop: https://www.pingplotter.com/ - GParted, and the live image: https://gparted.org/ - SystemRescue: https://www.system-rescue.org/ - DBAN, still there, spinning disk era, not for SSDs: https://sourceforge.net/projects/dban/ - Greenshot, Windows only: https://getgreenshot.org/ - Qualys SSL Labs, tick the box to stay off the public board: https://www.ssllabs.com/ssltest/ - testssl.sh, for internal sites: https://testssl.sh/ - DevToys, clipboard certificate parser: https://devtoys.app/ - SysAdmin Weekly, all show links: https://www.sysadminweekly.com - SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com - AndyOnTech: https://www.andyontech.com - Project Runspace: https://www.projectrunspace.org - GitHub Discussions, what is in your toolbox: https://github.com/ProjectRunspace/sysadmin-weekly/discussions

  8. Aug 28

    057 - Is Your Air Gap Actually an Air Gap? Port 22 Says No

    Somewhere inside that isolated network, port 22 is open, and it has been open since the outage six months ago that nobody wrote up. Andy Syrewicze and Eric Siron take apart a term the industry uses constantly and almost never earns. They walk the management plane hole by hole: SSH and RDP so somebody can patch the thing, SMB for the files that have to move, DNS and NTP because nothing works without them, and the iDRAC, iLO, and IPMI boards that get parked on the management VLAN and then never patched at all. The argument they land on is not that a real air gap is impossible, it is that calling something an air gap ends the conversation, and a promise nobody re-verifies is worse than a risk everybody can see. Chapters: 00:00:00 - Cold Open: Your Air Gap Probably Is Not an Air Gap 00:01:12 - Welcome and Show Plugs 00:04:19 - News React: An AirTag, a Rare Book, and an Amazon Scanning Facility 00:10:10 - News React: Bill Gates Changes His Mind on AI and Jobs 00:13:03 - What the Entry Level Job Market Looks Like Right Now 00:15:05 - When Nobody Is Left Who Knows How to Program It 00:19:25 - Nerd Hour: Claude Code, Agents, and Building CC Top 00:23:54 - Nerd Hour: Moving Project Runspace to Hugo, JavaScript Free 00:28:22 - What an Air Gap Actually Means 00:31:22 - Logical, Network, Virtual: How the Word Got Laundered 00:32:36 - Every Hole You Poke Just to Manage the Thing 00:34:18 - The One Nobody Segments: iDRAC, iLO, and IPMI 00:36:26 - A Brief and Deserved Detour About Printers 00:37:23 - NTP, DNS, License Activation, and Telemetry 00:40:34 - Why Leaving Hyper-V Out of the Domain Is Not Security 00:43:16 - VLANs, Switch Fabric, and Breakout Attacks 00:44:40 - Assume Breach: Zero Trust, JIT, and JEA 00:50:36 - Sneaker Net and Poisoned USB Drives 00:52:20 - Stuxnet and the Gap That Was Real 00:54:59 - How Would You Even Safely Clean a USB Drive? 00:56:58 - Say What You Have, Then Defend It 00:57:29 - The Real Danger Is the False Sense of Security 01:00:23 - The Windows Firewall Lesson 01:03:11 - What a Genuine Air Gap Actually Costs 01:04:59 - Wrap Up and Outro Resources / Show Notes: - Symantec Security Response, W32.Stuxnet Dossier, the canonical technical analysis: https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en - Ralph Langner, To Kill a Centrifuge, on why post-Stuxnet air gap strategies miss the point: https://www.cs.yale.edu/homes/jf/Langner.pdf - The 2008 USB breach of US military networks, Agent.btz and Operation Buckshot Yankee: https://en.wikipedia.org/wiki/2008_malware_infection_of_the_United_States_Department_of_Defense - Microsoft Security Advisory 967940, the update that killed USB AutoRun: https://learn.microsoft.com/en-us/security-updates/securityadvisories/2009/967940 - NIST SP 800-82 Rev. 3, Guide to Operational Technology Security, for naming what you actually have: https://csrc.nist.gov/pubs/sp/800/82/r3/final - 404 Media, tracking a shipment of rare books to an Amazon AI training facility: https://www.404media.co/we-tracked-a-shipment-of-rare-books-it-ended-at-an-amazon-ai-training-facility/ - Semafor, Bill Gates has changed his mind about AI and jobs: https://www.semafor.com/article/08/25/2026/this-is-crazy-this-is-insane-bill-gates-has-changed-his-mind-about-ai-and-jobs Gates Notes, the essay itself: The turbulent AI era is here: https://www.gatesnotes.com/a-turbulent-ai-era-and-critical-choices-to-make - SysAdmin Weekly, all show links: https://www.sysadminweekly.com - SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com - AndyOnTech: https://www.andyontech.com - Project Runspace: https://www.projectrunspace.org - GitHub Discussions, tell us about your air gap and why you have one: https://github.com/ProjectRunspace/sysadmin-weekly/discussions

See All (65)

Ratings & Reviews

5
out of 5
4 Ratings

About

Welcome to the SysAdmin Weekly Podcast, your go-to source for IT-related content tailored to busy system administrators in the trenches. Hosted by longtime sysadmins and Microsoft MVPs Andy Syrewicze and Eric Siron, this show dives deep into the challenges and solutions that matter most to sysadmins on any given day. From technical know-how to real-world insights, SysAdmin Weekly is dedicated to those tireless professionals who keep our digital world running. Tune in for relevant topics, expert advice, and engaging discussions to make your busy schedule a little bit easier.

Information

  • Creator
    Andy Syrewicze and Eric Siron
  • Years Active
    2025 - 2026
  • Episodes
    65
  • Rating
    Clean
  • Copyright
    © Andy Syrewicze and Eric Siron
  • Show Website
    SysAdmin Weekly

You Might Also Like