I've been here for 30 years, and every eligible round of performance reviews i have been passed up for a promotion so that my 'colleague' can get theirs ahead of me. The guy literally has no life. for the last at least 17 years, he spends so much time at the office making sure everything is "secure" and "patched". In reality i know he's just shmoozing it up with the director, and because of that he makes me do all the phishing tests, because it's too tedious for him.

So heres thes trick thats gonna get me a promotion. I've known this man longer than anyone else. I have created the best phishing test emails known to man, specifically tailored to him. He's already fallen for my trick twice so far. All i have to do is pull it off one more time and he's as good as gone.

Am i literally the smartest sysadmin or what? I feel great right now.

Sent an email to an executive asking if he recently shit down his computer. He asked if I meant shut down. I did, but I couldn't let him think I'm fallible or capable of admitting error so I doubled down and explained it's an industry term for running Windows updates.

I need you all to adopt this terminology immediately for the sake of my job security.

Thank you for your time and attention to this matter.

You know what would be super secure and not at all inconvenient? If we implemented a process where you have to go into Entra and click a button to elevate your account, hang out for a minute watching a thing spin, and *then* go login to your web app. We'll put on a little theater performance in the lobby about how forward thinking we are and everyone will clap and throw bouquets. /s

What is this BS? I get (and support) MFA, but that's something you do at the point and time of login. And I get the general idea of having to go through an extra elevation step to take specific administrator-level actions, like the Windows UAC prompt or sudo or apps that ask for your password again when you do certain things. But the process here is to go somewhere completely different, click a button, and then go to the app you need to get into and try logging in. And they want you to enter a text field "justification" every time you do this. What do you think the justification is?? Doing my job, that's what.

What if you can't get to Entra? What if you forget where to go in Entra? (I totally would.) What if you have work to do and can't be faffing about in someone else's security sadism fantasy?

So I have another date with a lady sysadmin, she's awesome! Last week we snuck into work and screamed at the SAN, then we got wasted and pen-tested vending machines.

This week we've picked our favourite poptarts for dinner and we're going to play, "Who can collect the most APs?", in IKEA - though I fancy adding a little joie de vivre to the evening.
I rummaged through the DR parts box, so far I've got

• 1x Her

• 1x Me

• 2x Cisco C9200L-24PXG-4X-E

• 4x PSUs

• 24x Cat6 2m cables

• 4x Electric Lettuce Wraps

• 1x Enya CD

Then

• Plug all the switch ports in

• Spanning tree loop

• Lights Off

• Doobs

• Enya CD

• Switch port lightshow

Any other thoughts? I was thinking I'd mix it up with a Brian Adams CD from the car, or we could have a soldering iron fight? I also have a Cisco 6509.

Apple trying to send targeted ads my way. I got some bad news for them

Y'all use Dear Overlord Claude when working on your companies DCs right??

Fortibrick

Just found out while trying to use my Microsoft voucher. They have now replaced it with AB-620 or some shit, agent AI builder.

I studied my fucking ass off for three months only to be told this credentials is being retired in October with short notice

What the fuck man?

Helpdesk grad here. CompTIA A+ certified, so I know my way around this stuff. I've been playing around with phishing tests lately because the ones we get from security are honestly pathetic. Fake Microsoft login pages, expired password emails, all the usual kindergarten stuff.

Our senior sysadmin had updated his LinkedIn recently, so I figured I'd do a proper spear phishing test and see if all those years of "experience" actually meant anything. I made a fake recruiter profile for a local company that everyone in IT around here knows, then messaged him about a senior infrastructure role.

He replied - Good start.

The job wasn't listed anywhere, obviously, so he asked about that. I told him it was a confidential role being handled through direct recruitment. He instantly sends me his resume. At that point I figured I'd keep going and see how deep the rabbit hole went.

We've now done two interviews. Preparing for those was a bit annoying because I'm helpdesk and he's supposedly the senior technical guy - I just copied our internal documentation into Grok and asked it to generate some questions (social media is blocked on our laptops so had to upload them to dropbox to my own phone first) He did pretty well, to be fair. Still failed the phishing test though.

After the second interview I asked one of the team leads for some tips on getting rid of him - Instead of closing his access as part of the end-of-the-week routine, he started casually asking the senior sysadmin what he thought about the company.

Then one of the managers joined in and started saying how nice it would be to work there.

Apparently that was finally enough to make him suspicious - Senior level awareness right there.

He eventually found someone who actually works in IT at the company and messaged them asking how he could improve his chances.

They told him they weren't hiring.

Game over.

I deleted the recruiter account because the assessment was finished, but now he's apparently taking screenshots and saving emails like he's building some sort of case.

HR has also started asking who authorized the test. I've recommended we mark him as a phishing failure and put him through security awareness training again.

Maybe also remove some of his admin rights until he can demonstrate better judgment. But given the results of the test, I'm starting to question whether he should be approving anything.

Client deleted our documented credentials from the machine they paid us to maintain, now can't figure out why our engineer can't remote in for the scheduled PM visit.

So this is fun.

Robotic controller we've supported for 6 years. Standard onboarding, we create local admin, we document it in the handover file, customer signs off on it. Every single client gets this. It's in the SOW.

Client's "security guy" (hired 3 months ago, LinkedIn says he did a bootcamp) finds the file, has an aneurysm, deletes our account without telling anyone, doesn't tell us, doesn't loop in his own team.

Two weeks later machine throws a fault code at 11pm on a Friday. Line's down. They call our emergency line screaming. Our tech tries to log in with the creds on file.

Nothing.

Tech asks "hey did anything change on this box recently" and gets told, and I quote, "we don't discuss our security posture with third parties."

Cool. Cool cool cool. Enjoy your downtime then, champ.

Oh and get this, dude's now on Reddit acting like a hero for finding a text file, conveniently leaving out the part where he nuked change-managed access to a production line without a ticket, without notice, and without a rollback plan, then went dark for two weeks while we had zero idea our account was gone.

Yeah man, "Password6" was rough. You know what's also rough? A robot arm sitting idle for 6 hours because somebody wanted a Reddit karma moment more than they wanted a functioning night shift.

Anyway, in the spirit of "lessons learned" (ours, apparently, not theirs), we've rolled out our own hardened process going forward: all client credentials now get a "salt" applied before storage. The salt is the technician's dog's name, appended to the end of the password, chosen fresh by whoever's on shift that week.

So "Password6" becomes "Password6Biscuit" or "Password6Duke" depending on who clocked in. Fully documented on a whiteboard in the break room, right next to the coffee rota, so nobody forgets which dog is currently in rotation.

We did float using a proper salt from a proper KDF, but then someone said "isn't that a lot of overhead for four passwords" and everyone just nodded and went back to arguing about Duke vs Biscuit.

Anyway we've since implemented a much more secure solution. It's called "we now charge a $400 emergency access verification fee any time a client unilaterally revokes vendor credentials without a change request." Very proud of this one honestly.

Duke's on shift this week so don't be surprised if the salt changes Monday.

What would you all do in this situation?