Salary expectations?

Hi everyone, I had some questions regarding the salary in the field as I’m nearing graduating college with a B.S. in Cybersecurity and spoke to my boss about a full-time position post graduation.

For context, I have been working part-time (~24 hours a week, 40 hours a week over summers) as a Junior IT Analyst for about a year and a half now at a mid size government contracting company in the Washington D.C. area (~400 employees, most on government sites while only about 40-50 work in HQ). Although my noscript is Junior IT Analyst, I manage myself and report directly to the CFO. He was in charge of all IT things before alongside his actual work, and I am the first and only IT hire in the company. This is actually my first job in my career, other than like retail stuff in highschool. My work basically consists of this:

Assisted the CFO in the migration of all employees from commercial Microsoft 365 to Microsoft GCC High. This allowed a level of CMMC compliance that opens up many contracts.

Created the first internal IT ticketing system for employees. It’s basically just an app I made built into our employees MS Teams. It allows to submit tickets, software requests, view FQAs, etc. I use this to manage the tickets and requests people have.

I deploy any software our employees might need, especially our software developers that always need different things deployed.

Use PowerShell to automate lots of process for HR, like new user creation.

Set up devices for all new hires.

And overall keep the day to day IT procedures running, managing the system from Microsoft Admin Center, Entra, Intune, etc.


I’m currently payed $20 an hour. However, once I graduate and can work as a full-time employee, I’m obviously hoping for a decent salary. I’ll have my degree and a TS clearance. So basically my question is, what would be a fair salary to request? I just want to have a good idea of the average salaries in the industry before discussing finances with my boss.

https://redd.it/1nd3dq3
@r_systemadmin

Help understanding how laptop was compromised

Hi guys, reaching out for some understanding on how someone has got around some security controls...

Situation: We have a laptop that has been "borrowed" by someone and they have been able to create a local admin account on the device and install a hyper-v vm, disable ASR rules and run hacky tools etc.


We want to understand how this may be possible. For context:

* The person had physical access to the device away from where it was borrowed - we have since regained possession
* Dell Latitude Laptop
* No evidence the person has any admin credentials or that an admin has modified anything
* Bitlocker not enabled currently - we are unsure as to whether it was already off or they have turned it off
* BIOS admin password was set (and still is )
* Kali Live USB was seen on the device (Defender Timeline)
* Person has deleted security event logs
* MCM reporting is flaky - but a small percentage of laptops from the same area reporting bitlocker off - the person may have had access to these at some point

My questions

* If bitlocker was on - is there a way to disable it / bypass it without Local admin?
* If bitlocker was already off (or if turned off by the person) - I understand there are ways to create a local admin account via Registry/SAM offline, so that would explain that
* If bios has admin pw - how were they able to boot Kali Live?

Thanks!



https://redd.it/1nd21ss
@r_systemadmin

I Launched a Federal Investigation into Microsoft

So I was recently employed at Microsoft and previously, I've worked for big tech companies like Meta, and the general consensus seems to be that the work culture has declined significantly, especially with the advent of AI and after the death of Satya Nadella's son.

What I started to see was a culture of gaslighting, psychological projection, and scapegoating. Critical internal documentation was missing, coworkers behaved in a passive aggressive manner - there was deliberate information siloing, and all the on campus IT support was offshored to third party contracting companies causing significant delays on tasking that would frequently reach boiling points. I was shamed for asking completely relevant questions about legacy systems and processes that would be perfectly reasonable to ask about as a new employee (such as questions about their database).

Then came the mass layoffs - thousands of people every month were not only suddenly let go - entire departments and teams - but thousands more started receiving PIPs and then terminated. Now, neither of these things crosses a line into illegally, but then I started noticing my manager blatantly lying about my performance - in particular, delays on my feature work which my manager claimed was the reason for issuing my PIP were completely outside of my control - in fact it took 3 months just to get a replacement laptop that could at minimum access teams and a month delay because of yubikey shortages alone (I would go to the campus, call IT support, and send DMs/ emails every day).

I was told I had an option between a severance or a 45 day PIP period to "improve" my performance, and then for the entire duration of my PIP I did not have access to any basic functional assets required to do any tasking at all that could even at minimum turn on. Then, only 4 days in to my PIP after having a coworker message my manager on teams (because I no longer had access to teams and I had to ask a coworker I met in one of the ERG groups to DM him and he wasn't answering my emails), I was terminated citing "performance."

What is troubling is that once going public with my story people who both have been wrongfully terminated and even who still work there in director level roles have messaged me thanking me for saying what they are afraid to bring up - what is going on at Microsoft is not legal.

There are refusal to provide ADA accomodations, firing employees on family medical leave, whistleblower retaliation, physical intimidations outside of work - they create more and more "security" processes for engineers to jump through but then dont provide any documentation for them - all while offshored IT contractors in other lands seemingly don't have to jump through them, and then microsoft gets hacked by those other countries. I've even had folks in India message me claiming that Microsoft has violated worker protections and lied to them there. There seems to be a culture of institutionalized gaslighting, denials of reality, clear lack of accountability, pathological lying, passing the buck around, dysfunctions of critical support, passive aggressiveness, poor communications, psychological projection, and gaslighting.

Apparently Microsoft has also formed agreements with many law firms to just simply not sue them, and an employee was even recently found dead on campus.

So now I have a federal investigation into Microsoft, and I will not be accepting this sort of behavior, and if attorneys and agencies are not doing their jobs, they have to realize the amount of bad PR they are receiving over this. Every day on LinkedIn and blind I've seen more and more folks upset.

https://redd.it/1nd5vdr
@r_systemadmin

Is it a bad idea to block Temu from a data security perspective?

I have recently blocked Temu due to concerns surrounding the excessive amount of information their site stores. Am I being paranoid?

https://redd.it/1nd5l5o
@r_systemadmin

Stopping GenAI data leaks when staff use ChatGPT at work

We’ve had a few close calls where employees pasted sensitive client info into ChatGPT while drafting responses. Leadership doesn’t want to ban AI tools entirely, but compliance is worried. We’re trying to figure out the best way to prevent data leakage without killing productivity. Curious if anyone has found approaches that actually work in practice.

https://redd.it/1nd7ynt
@r_systemadmin

User reported someone remoted into his virtual machine

Hi Everyone,

One of our users reported that while his workstation was in sleep state, it turned itself on and looked like someone was navigating through some excel files. He reported that this happened for like 15-30 seconds. User primarily works on a windows virtual desktop and it is being monitored by Defender for Endpoint.

My colleagues where first to respond and have tried to reach out to the user but he was unreachable. They did check on the security event log and did not see any logins besides service accounts. His office 365 activity was also checked from the Defender activity portal and Entra ID.

I first ran a full scan for his virtual machine from the defender portal and it did not came back with anything. Checked the TerminalServices-LocalSessionManager event logs for both the local and virtual machine but only user's account was seen to login. Can't get the network information from the logins since it was unavailable.

No other remote connection program was installed besides remote desktop and screenconnect both for the local and virtual machine. Have checked on the scheduled task, startup programs and processes but nothing really stood out to be malicious. My seniors checked on the firewall logs and they weren't able to detect suspicious connections either.

Considered someone from IT logged accidentally and tried to review the application logs to see if anyone have logged in with screenconnect within the time user reported but none was observed. Even looked for cleared log events but none have been found. Not sure if this could be caused by faulty hardware since user said that it was shifting through excel tabs.

I know this should have been done in the first place but i have suggested that a malwarebytes/hitmanpro scan should be done on the local and virtual machine to rule out any undetected malware. My boss doesn't really like me reaching out to client or remoting in to their workstation yet since we have someone from the team that does that and I'm the one with the least experience. Can only remote in via the backstage feature in ConnectWise Automate with limited access.

May I please know what else to check or if I'm missing anything? Really appreciate for any help. I've been at this for already for more than a week and can't find anything.

https://redd.it/1nd6eli
@r_systemadmin

Heads-up: Atlassian is sunsetting Data Center by March 2029.

That means:

Dec 2025 → no new DC apps on Marketplace
Mar 2026 → no new DC licenses
Mar 2028 → no expansions, no Marketplace app sales
Mar 2029 → Data Center goes read-only

If you’re running Confluence/DC on-prem, this effectively forces a cloud migration unless you move elsewhere.

Next week there’s a webinar with Nextcloud + XWiki showing how some orgs migrated off Confluence and what a full self-hosted stack looks like (docs, files, project management).

📅 Sept 17, 3:00pm CEST / 9:00am EDT
🔗 https://go.nextcloud.com/r/20it

Recording will be available if you can’t join live.

Are you planning to stick it out with Atlassian until 2029, or already testing alternatives?

https://redd.it/1ndac56
@r_systemadmin

Bit of a rant

My first post here I think.

I have been the sole IT person for over 23 years in the same business, my tenure has been mostly because of the people I work amongst, all have been there for similar amounts of time and we are more than just colleagues but great friends too.

My role includes maintaining the infrastructure and everything else you can imagine. I have even created a custom CRM, portal and customer portal that is used every day and has become the center of the whole business saving him tens of thousands in licencing.

I am running the infrastructure on a very limited budget, I won't bore you with the details but we have a hybrid cloud phone system that used to be on it's own internet line that is now shared with the main network internet connection as the boss wanted to save £30 a month on what he's sees as a waste (don't go there).

Currently earning £36k but just asked for a salary of £45k with 2 days from home (75 mile daily commute for me). Since then he has not dismissed it but has said he will think about it and we will revisit in a few weeks. He has also got me consulting an external company to "assist if I am ill or unavailable" under the guise that his insurance is asking for it.

Here's the kicker, I do basic finance related duties daily as well as he didn't want to pay for another member of staff that won't be full time.

If you were in my position what would your next move be?

https://redd.it/1ndamiz
@r_systemadmin

Windows BitLocker Vulnerability Let Attackers Elevate Privileges

Windows BitLocker allows an authorized attacker to elevate privileges locally.
Windows BitLocker Vulnerability Let Attackers Elevate Privileges


CVE page: CVE-2025-54911 - Security Update Guide - Microsoft - Windows BitLocker Elevation of Privilege Vulnerability


https://redd.it/1ndbqfj
@r_systemadmin

Is it weird for my employer to ask me to make a direct line to our IT team for guests?

Good morning all,

I currently work in hospitality, and I’m looking for some outside perspective on a change at work.

Traditionally, when a guest has an issue, they contact Guest Services, who create a ticket explaining the problem. We then go to the room and resolve it.

Our boss now wants to change this process: if a guest has a “Do Not Disturb” sign, instead when we go up to fix the issue, we’re supposed to leave a note with an email address so they can contact our IT team directly. Initially, they asked if we could provide guests with the email address for our internal ticketing system (we said no), but now they’re pushing for a separate shared mailbox for guest issues.

From my perspective, it feels strange to give guests a direct line to the company’s internal IT department, even if it’s a separate mailbox.

I’d love to hear how other companies handle similar situations. Do you allow guests to directly email IT, or do you have a different process in place?

https://redd.it/1nddhqg
@r_systemadmin

What would you do?

So Leaving my current role in just over 2 weeks . My total cock-womble of a boss has hired an "amazing" third line engineer...

Today's example of the skills of the man - we, like many, use group memberships to assign permissions to Windows file storage. Today I had to show him how to add a user to an AD group - both my 1st & 2nd liners popped their heads up over the screens with a WTF look.

Yesterday's example, he confidently informed us that we didn't need Server backup software, Hyper-V checkpoints would do it instead....

Last Week gem was "one of my monitors isn't working" - yet asked me to fix it...

They have both separately asked me to speak to our boss about this. But since I'm leaving under a cloud I'm not on doing anything!

So - WWWSAD (What Would a Wise Sys Admin Do?)

Thanks

Pete


https://redd.it/1ndgcnl
@r_systemadmin

Saved a user hundreds of woman-hours by introducing them to the radical concept of ZIP files

So user comes to me, sweating bullets.
They have been uploading PDFs into our system. One. At. A. Time.
Hundreds of them. Each file hand-selected and uploaded like some artisanal craft project.

They are about 20 percent of the way through and already ready to quit life.

I ask:
"Wait... you know you can just zip them, right?"

Them: "..."
Me: "Put all the files in a folder, right click -> Send to -> Compressed (zipped) folder. Then upload that. Our app accepts files. A zip is a file. The app will unzip it on the other side. Done."

It was like I had just parted the Red Sea with my badge swipe.

User jaw: unzipped
My hero meter: maxed out
Time saved: conservatively hundreds of woman hours

https://redd.it/1ndkpfh
@r_systemadmin

Enough rants, let’s talk positives

I see a lot of rants, so I wanted to post one positive thread. What do you like about the job?

I enjoy cloud administration and backup & recovery logic. You?

https://redd.it/1ndkjyx
@r_systemadmin

got fired for screwing up incident response lol

Well that was fun... got walked out friday after completely botching a p0 incident 2am alert comes in, payment processing down. im oncall so my problem. spent 20 minutes trying to wake people up instead of just following escalation. nobody answered obviously database connection pool was maxed but we had zero visibility into why.

Spent an hour randomly restarting stuff while our biggest client lost thousands per minute. ceo found out from customer email not us which was awkward turns out it was a memory leak from a deploy 3 days ago. couldve caught it with proper monitoring but "thats not in the budget"

according to management 4 hours to fix something that shouldve taken 20 minutes. now im job hunting and every company has the same broken incident response shouldve pushed for better tooling instead of accepting that chaos was normal i guess

https://redd.it/1ndk9do
@r_systemadmin

RingCentral's Poor Customer Service

Just so others don't repeat my mistake, my recommendation is to avoid using RingCentral.

Pros:
\- Getting signed up was easy and the rep was very responsive during that process. And, for the most part, phone service was OK. But...

Cons:
\- Once you've signed, you'll never reach your rep again.
\- When you have a problem, getting help is almost impossible (especially billing concerns).
\- You're stuck with the number of lines you started with (you can increase, but never decrease).
\- And, when times are tight and you need to cancel service, they make it very difficult. You'll probably miss your window of time to cancel... then you're locked in for a couple more years (over-paying for average VOIP service).

IMPORTANT: If you do choose them, read and understand all the fine print of the contract, because you're locked in for a long time.



https://redd.it/1ndr1fw
@r_systemadmin

Tell One of Your Oops Stories

A couple of jobs ago, I built a SQL query for finance that would fix sales discrepancies at the end of each month. These discrepancies were mistakes and typos done by the closing manager in our retail stores.

Finance would tell me what they were expecting based on the deposits. I was methodical about the process. I summarized all the individual transactions and dumped everything into a temp table for review before writing it to the production table.

I was comparing the production table to my temp to make sure what was already correct, was still correct, and what wrong, is now fixed. I discovered an issue, which happened, so I wanted to make a change and run the query again. Anyway, for some ungodly reason, I decided to manually type "DELETE * FROM TABLE", when I had the DELETE statement already build into my query and all I had to do was rerun it. Anyway, the table name I typed was the production table. I already had the left mouse button pressed to execute the command. The signal from my brain to my right pointer finger to release the button was already sent. I knew I screwed up as my finger was releasing the mouse button. I just deleted the entire production table.

Instant meat-sweats. I panicked for about 10 minutes until I was able to gather my thoughts. In that time, someone from finance called me letting me know that something was now really wrong with the sales data, which I already knew. I'm dreading telling my boss that we have to pull a backup. I then realized I could rebuild the summary table by using a few other tables. It took me about four hours to write a new SQL query to rebuild the table and test the output. The finance employee validated and all was good.

No one in my department ever found out. As far as the finance employee knew, there was already an issue that I was working on.

https://redd.it/1ndx3a8
@r_systemadmin

RIFd after 14 years 355 days.

It happened.

Three hours into my shift in the middle of the workweek my boss is let go, within 5 minutes I get a ping and a meeting invite. I ask when I join if it’s about the boss, or me. It was for me.

10 days short of 15 years. Very different company now, different name a few times over, acquisitions, etc. Very few of the people I initially trained with are left, so it was bittersweet. The mental stress lifted immediately. I can’t feel like a failure when it’s part of a RIF action… but I definitely feel angry, or maybe just annoyed. And a little sad.


I met my (now) wife in the service desk when I was green, found out my son was ready to enter the world during an overnight shift. Grilling with the guys during clean ticket queues overnight. I was 19 and still in college. Now I’m 33, going on 34 in a month.

Haven’t interviewed since 2010, but I’ve been on so many bridge calls, P1 calls, technical discussions and troubleshooting sessions with vendors, carriers, end users, c suite… doesn’t make me feel nervous thinking about the interviews…. But making a resume again? That scares me.

Sorry to post this, it’s not particularly on topic. I just don’t really know how to feel. I know what to do, brushed up linked in, made phone calls to social network and put my feelers out, already have a call with a recruiter tomorrow to discuss some opportunities. Chatted with my wife, agreed we will get through this and she’s been primarily concerned with whether or not I’m okay. Bless her.

I dunno guys. I’m not a technologist, and I don’t eat live and breathe IT. I just like solving problems. I guess I just didn’t foresee having to solve this one.

https://redd.it/1ndzitt
@r_systemadmin

Manager yells at me in front of everyone and makes me do office-boy type work. Is this normal in desktop support?

I work in IT desktop support in a startup (just me and my manager). He’s nice most of the time, but he doesn’t explain things clearly, no documentation, and if I make a small mistake, he yells at me in front of everyone sometimes.

A lot of my work feels like grunt work like carrying laptops, swapping monitors, setting up meeting rooms, etc.

I’m also introverted, so being put in the spotlight is uncomfortable for me.

Is this actually normal for entry-level desktop support, or is my manager just dumping everything on me? And how do I deal with the public yelling part?

https://redd.it/1ne10u2
@r_systemadmin

Im gonna lose my job

I work for a developer of hotel property management. I see the end is near im 56. Sysadmin. Attrition is real both hotels and staff. We are legacy what do i do? We host in aws many properties but im a weird way


https://redd.it/1ndzva5
@r_systemadmin

wish i knew sooner

I was today years old when I learned how to actually use a tool I thought I already knew: SSH.

I stopped doing sysadmin work about two years ago to focus on my own projects. Now that I’m connecting my homelab to my business lab, I’ve started using SSH more and it blew my mind.

Back in my sysadmin days, I saved the day more than once with the CLI because not everyone was comfortable there. I used SSH constantly to configure servers and make changes without touching the web UI (i never read into SSH so never did my homework).

But yesterday I discovered SSH tunnels. Forwarding a remote web UI (like Jellyfin) straight to the machine I’m sitting at… insane!

And today… i not only forwarded a couple of webUIs, shared file systems and being able to browse (I2P) without having to install it machine im using! Got too exited and had to share my thoughts and i will start reading more docs on the tools i use.

https://redd.it/1ndzfh9
@r_systemadmin

Sysadmins: how are you handling M365 retention and backup for small orgs?

Got a couple of 20–80 seat orgs leaning completely on M365 and most of them honestly think Microsoft is just backing up everything for them. Spoiler: nope.
Stuff I keep running into:

Deleted items vanish way sooner than they expect.
SharePoint/OneDrive restores are… painful at best.
Nobody’s thinking about compliance or long-term archive.
And of course, users swear the recycle bin = backup 🤦.
For bigger orgs it’s usually sorted, they’ll pay for a proper tool. But for the small ones with tight budgets, I’m kinda stuck in the middle here.
So what are you all doing? Just cranking up retention policies? Rolling your own noscripts? Paying for something lightweight? Or just praying nothing gets nuked?

https://redd.it/1ndzzet
@r_systemadmin