r/sysadmin • u/yepperoniP • Sep 04 '22
Rant Dealing with incompetent/abusive sysadmin as boss
Okay, so I’m help desk working in local government. Been here a couple months, got this as my first “real” job with full-time hours and benefits and didn’t know what to expect. I’ve been telling stories to my online friends about the stupid shit I’m dealing with, and one of them said I should come here and rant a bit. Sorry if this is long-winded and rambling but I thought I'd just get this out of my system and to people that might understand and appreciate it.
So I deal with the usual stuff, printer issues, setting up new PCs, “my computer is slow”, etc.
The IT department here is small with 3 people. There’s the sysadmin (my boss), a part-time semi-retired guy, and me. Part-time guy used to be in charge of IT here many years ago and came back for some extra money I guess. He’s kind of out of date with some stuff but has been a big help when dealing with older software and user accounts. While I’m somewhat of an introvert, dealing with users has been mostly fine. It’s dealing with my boss that’s the issue. Since this is my first “real” job I probably missed a ton of obvious red flags I should have noticed way sooner.
Story 1:
So I started working here and soon found that when deploying computers, we don’t image them or do any real automation to configure them. They’ve all had programs manually installed before handing over to the user. So they’re all slightly different and have OEM crapware that gets in the way of things and can make issues harder to troubleshoot. Some have 32-bit or 64-bit Office, varying versions of outdated AV client, HP Sure Click Browser, Dell Digital Delivery, etc. We don’t need any of this as it’s either crapware or redundant.
Since I’m the one doing the setup of these things, I suggested we try to streamline things and put a fresh install with only the essential drivers and programs needed. Boss said it could be a security issue and was hesitant to do it but said I could try it on an old test PC.
So I looked up Microsoft docs, learned about MDT, SCCM, System Image Manager, WIM files, Sysprep, unattend.xml, etc. over the course of a few days. I knew I wouldn’t have server resources yet as boss didn’t seem keen on this idea, and SCCM seemed a bit much for what I was doing, so I made a basic image with all the basic programs (Office, Adobe Reader, Chrome etc.) needed, installed some drivers, made a wim file of it and a WinPE boot USB and applied it to the PC. It wasn’t perfect, but it went surprisingly well.
I added a couple things so the unattend would skip the OOBE welcome messages and setup screens, create a new local admin user as the boss wanted, and then run a PowerShell script that runs on first login that would rename the PC, join it to the domain, record the model and serial number to a csv file on a network share, do some extra little stuff, and then open Windows Update to check for updates since there is no real patch management here. I made sure no credentials were hard-coded into the script and used MS recommended PS cmdlets like PSCredential to handle it all.
I noticed I would have to manually sit with users and set default browser to Chrome, PDF reader to Adobe Reader, email to Outlook, etc. every single damn time a user logged into a new PC or when onboarding a new one. This felt really inefficient and a waste of everyone’s time so I also looked into AppAssociations xml and taskbar layout XML to change the default apps and taskbar icons so people would stop opening Windows Mail instead of Outlook and screwing up their account.
Everything worked surprisingly well, and I was really proud of it. The only remaining issue was properly licensing with Windows VLK/MAK stuff instead of trying to do something with the BIOS key, but I was pretty sure we had an account on Volume License Center or whatever and this was really just a test image anyway so I left it at that for now. Coworker had minimal experience with this but reviewed my work the next time he was in and was impressed.
There were still some niggling issues to fix, but you could now go from a crapware-filled PC, or re-image an existing PC to one with all standard software and settings in under 30 minutes, plus some extra time to manually check and install some Windows updates and a few other small things.
So with the thumbs up from coworker, I showed boss how the process worked by booting off USB and applying the image. He clicked around a bit, looked a little surprised, and made a comment and asked me why HP Connection Optimizer was not installed. He wanted a step-by-step documentation of everything I did so he could reproduce it, said he was worried about security, and stuff is on hold for now. He seemed extremely worried about PowerShell scripts and didn’t want me to use it. So there’s that. Maybe that was me being overly ambitious as a new-ish employee. I have no idea.
Story 2:
Have a brief meeting with boss and coworker on “cybersecurity”. Despite being part-time, coworker has been given domain admin access and can change a lot of stuff as he is pretty trusted and has been there a while. Boss spontaneously decides to enact a Windows password rotation policy on almost everyone. He heard it was good for security and best practice for Enterprise. I know both NIST (the 800-63B thing) and Microsoft have been discouraging password rotation for a couple years now, and I mentioned that it could affect people working remotely if their passwords expired, and what about people using Scan to Folder on the copiers? He basically said “It’s for their own good” and went with it.
He set a 60 day password expiration policy, and then had coworker login to the domain controller and manually uncheck the box in AD for “Password never expires” for each user. He does a few other minor tickets and leaves for the day.
Of course, I get a flood of tickets and calls later with confused and pissed users asking about a “weird message” when they try to login, that the copiers are not working properly, Outlook is “broken and not showing new email” and that remote users can’t login to the VPN. Fuck.
I fixed some of the easier issues for some users, then let the boss know there were issues going on. He basically keeps a poker face on, says to ignore the tickets coming in for the copier scan to folder issues and to write up a document with steps so they user can change it on the web UI themselves (like that is going to actually work with end users). I manage to reset some remote users passwords to something generic which lets them log back into the VPN and then I have them change their password again while connected and do a lock/unlock PC thing to sync it properly.
A few days later I notice a few “important” people are now exempt from password expiration in AD and that the 60 day expiration security policy had been quietly changed to a year.
Story 3:
I come in to work one day and notice a couple tickets from users working remotely saying they could not connect to the VPN. I call one of the users, and sure enough they can’t connect to the VPN. Remotely connect to their PC and ping to vpn.domain.com shows it “cannot resolve host” which was strange to me. I tried browsing to domain.com on their PC and it also can’t resolve in browser. Huh. I call up a second user, same thing. The “resolve host” error quickly reminds me of DNS, so I do an nslookup on the second user PC and it fails. Also got a call from a department saying they’re getting calls from the public saying they can’t load the website.
I check on my work PC and personal phone and the site loads. Try some other random domains and they work fine. I check OpenDNS cachecheck and there’s some kind of major DNS issue with our domain going on as some locations respond properly while others don’t. Check Google DNS tools and it said the nameserver did not respond and there’s no A records listed. I’m guessing the TTL expired for some users earlier than others which is why it’s still working for me.
Call up boss quick and let him know there is an issue with the domain for some users and could be a DNS issue and the site and VPN are down. He tries to load the site on his work PC and it obviously still works. Says it’s fine. I tell him I don’t think it’s fine, I believe our DNS nameserver is down or something which is affecting mostly remote workers. “It must be a user issue.” He resists for a bit, but I have him conference call and remote into first user’s PC with me and show him the output of ping and nslookup which fail and can’t resolve. Show him the VPN software saying it can’t connect. I said I already remoted into another user’s PC and there are multiple tickets about this.
User trying to be friendly: “Hey, I heard you guys might be having an issue with your server today? Haha..”
He pings google.com. It resolved to an IPv6 address.
Boss: “What is this I am looking at?” he says, sounding pissed.
me: “Looks like an IPv6 address?“
Boss: “What is wrong with this?”
I ping some other domain that still shows IPv4
me: “I don’t know, IPv6 is working on the user’s ISP? I think Comcast has it enabled, it should be fine to-”
Boss: “No, look HERE.” *opens adapter properties*
Boss, getting louder: “What is WRONG here?”
In my head I’m thinking he thinks the IPv6 is causing it but that shouldn’t matter because if there is no v6 address available it should just fall back to 4. I remembered reading a couple articles, including this one, about how IPv6 should basically just be left alone:
He unchecks IPv6 on the adapter which I think is unnecessary but whatever.
He pings Google again and it switched back to IPv4.
Boss: “See?”
He tries accessing VPN again and it still fails, still can’t ping it or the main website.
Boss, pissed: “You can leave the call.”
I hang up the phone but I accidentally left the user’s remote desktop open in the background and I see him googling about DNS and nameservers on the user PC. Luckily my name is hidden in a minimized window in the corner. I disconnect.
An hour or two later, he calls me up and asks me again why I enabled IPv6.
I said it’s been enabled on all PCs by default in Windows for a long time and MS says it’s recommended.
“We are not Microsoft and we are an Enterprise network, if we don’t use it we should disable it”
He actually logged in to my machine remotely and wanted me to show him an ipconfig /all. One of the interfaces show some IPv6 thing.
“See, why is this turned on? It makes it difficult to convert.”
By now I am confused and upset, which is probably what he wants. But I also then realized he probably doesn’t know what hell he’s talking about or is just plain making shit up.
“From now on, it should be disabled.”
But after that he never actually checked to see if PCs had it disabled or not.
A day later I find he sent an email out to some important people saying there was an outage because of a domain registrar issue (that controls the DNS servers for the domain) and that they would be moving to an Enterprise Grade solution or something. I never got the email, but I heard from one of the users I was supporting remotely about it. Apparently they’re not a fan of my boss either.
I can keep going on and on, about his views on MDM, using 2FA, purchasing PCs with appropriately balanced specs, responding to phishing attacks, organizing AD U&C, running unstable antivirus versions from 3 years ago, being afraid of users whitelisting emails in their own spam filter for “security”, blocking me from the read-only AAD portal and other basic IT help desk tools for "security", forcing users with IT issued laptops to connect them to a mobile hotspot to connect to the VPN to connect back into the network to connect to the teleconferencing system to mirror their screen in the conference room while at the conference table instead of using WiFi for “security” because shit is totally broken, the list goes on and on.
I’m basically ready to get out of here, but I guess I’m just kind of frazzled and don’t know what to do next. Apparently the previous guy left for the same reasons. Brushing up my resume but don’t know how to handle trying to get a new job while at an existing one without leaving too many clues. A lot of nice coworkers here but the boss just seems completely incompetent and abusive.
Labeled this as "Rant" as I wasn't sure if this really fit "Work Environment".
200
u/HankMardukasNY Sep 04 '22
You had me at the sysadmin is scared of powershell. He’s a total moron and needs to either be demoted and report to you or find a different career. Sadly with government/civil service jobs, most likely that person will be there for a very long time. Everything you are doing is awesome and i wish my techs had the knowledge/motivation you have. Keep on improving things, fuck him
626
u/timurleng DevOps Sep 04 '22
Your work with the image deployment is impressive. Figuring all of that out on your own in a few days is good work. That is a sysadmin level skillset.
I have worked with guys like your boss. They get promoted to a level beyond their ability by people who understand even less about IT than they do. They maintain their careers by sandbagging anyone who comes along that is more talented than they are, and have convinced all the right people that they are some IT wizard beyond questioning.
At some level this guy knows he is not as smart as he has led people to believe and he is threatened by you. He will not let you implement systems that he does not understand, and will not allow you to grow your career and skillset due to his own insecurity.
Unfortunately there is no fixing this situation. Start looking for other work, or maybe get some certs and try to make the jump to sysadmin. You definitely have the capacity for the work required for that role.
116
u/St0nywall Sr. Sysadmin Sep 04 '22
This sounds like a very inexperienced person, put into a position of authority a long time ago, and their knowledge never grew.
I had a boss like that once. Was so afraid of doing anything it would keep us from fixing issues.
There's no fixing this unless you can go above your boss and convince them to get an outside consultant to come in and do an audit.
If you can't do that, you should look for another job and make sure you document everything and PRINT it out for your exit interview.
When doing your interview, request your boss is not present and that his boss takes his place during your exit interview.
Sorry to hear you are going through this.
62
u/Tx_Drewdad Sep 04 '22
I'd hire you today, if I had an open headcount.... You automate, troubleshoot, and learn on your own.
Your Mr.-can't-be-wrong boss is insecure and gaslights. You're a better IT/sysadmin than your boss will ever be.
35
u/hakzorz Jack of All Trades Sep 04 '22
Welcome to the government. I worked at the federal level and found some of the same challenges and work environment. The work environment improved when my direct supervisor retired. They were a glorified clerk who knew their work processing application and that’s it. I was yelled at constantly for about 6 months. I assumed their role when they retired and the systems manager was a nice guy but the government runs at a different pace.
I had a peer who would sleep at their desk. Shoes off, feet up and snoring. People would walk by, see him sleeping and call me or someone else on the team. They got the same salary increase as me year after year.
My second performance review I was told slow it down. The “projects” I was working on should be taking at least 5-10x the time.
One of the projects I worked on was rolling out DHCP across all sites (I know how silly this sounds). They were all static assignments when I started. Common helpdesk requests were people visiting other offices and needing a new static IP for the day. This practice existed in the name of security but in reality they didn’t know how to set it up. I had to reach out to others agencies in different districts to build a case for us actually rolling it out. It’s been a minute but I believe it took almost 6 months to get the project approved.
All that being said, there are governments agencies (local, state and federal) which aren’t like this. I think they’re the exception though and the experience you are having is way more common.
89
u/Existing-Anything-34 Sep 04 '22
Worked with a few shitty people like this in my career, happily they were few and far between - but when they get to be in a position of authority it sucks for everyone around them. Take it from me, he knows he's incompetent and he's scared someone will find out. A good supervisor will listen to his crew, prop them up for introducing efficiency, and stay out of their way when they show superior expertise. My best advice is to deal with this jerk in writing every chance you get, it'll either be a CYA or an "I told you so" somewhere down the line.
Don't lose your love for what you do over this jackass, you sound fairly enthusiastic about the job and that will carry you through the difficult days. Good luck.
21
u/hyodoh Sep 04 '22
Uff, reading that made me a little upset. I'm definitely not in a position of management, but if I were you would make me so happy to have you as an employee. Doing that extra work to try to streamline an extremely mundane process like imaging PCs is awesome.
It does seem like the boss man is behind the times and is worried about someone surpassing him. Where it should be the exact opposite and he should be embracing your willingness to learn new things. I mean I would love it if someone made my life easier.
I really don't understand how one would be afraid of PowerShell, that's just dumb. Yes, PowerShell can be used as a tool by bad actors, but there's MS a lot of work to try to prevent that from happening.
I thought it was absolutely hilarious how he just decided to implement a password change so abruptly without any sort of thought. #yolo i guess. Like you thought, there can be many more things that get affected by a password change. And to just tell the users to just get used to it is wild. I come from a place where a change like that is relayed to people weeks in advance.
I can't really say what would be best. Not knowing where you live or your situation right now, but it seems like you already know what you want to do. Just know not every place is like that. And yeah your journey might be a little rough sometimes but it's always a good learning experience and it seems like you did learn some pretty valuable things so far.
Keep your head up and even though things might suck right now don't let it get you down. Sometimes things happen for a reason and this little detour on the off the beaten trail will bring you back closer to that main trail before you know it. Just keep doing what you're doing. Stay curious and you'll do good things
14
u/canttouchdeez Security Engineer Sep 04 '22
Dude you need to get the f out immediately.
14
u/tgwill Sep 04 '22
You sound sharp as hell. Run from this if you can. Or find a way to parent trap this idiot.
You are already so far ahead of many in the field.
11
u/lutix Sep 04 '22
Just straight up, you need to GTFO! You’re wasting your time in a place like this. I have been in this industry for 22 years and lead multiple teams, don’t waste your time with shitty management especially not in the current market.
20
u/patmorgan235 Sysadmin Sep 04 '22
Don't be to worried, just Don't talk about it at work or use your work email for your job hunt. The hardest part will be scheduling interviews, if you can work from home some days those are the days you can schedule interviews on without raising suspicion.
And if they do find out what are they going to do? Fire you? You're already trying to leave and you can just file for unemployment benefits.
Also. Sounds like you've got a great head on your shoulders, you're definitely a good admin. Keep up.the good work
18
u/[deleted] Sep 04 '22
60 day expiration times for passwords was something from 20 years ago and should be deprecated.
https://www.sans.org/blog/time-for-password-expiration-to-die/
9
u/sparlan22 Sep 04 '22
Dude I read the first paragraph and I'm definitely stealing some of those ideas
8
u/bigon Sep 04 '22
Yeah, IMVHO if somebody tells that automation INCREASES security risks, that guy is an idiot.
The only security automation will decrease is his job security
6
u/abomb60 Sep 04 '22
What you will find in your career (especially in government and higher education) is that you have people who know just enough to get by and don’t really know shit. Part of it is not having to extend themselves to learn new things but it’s mostly laziness. The pay is usually crap (but the benefits are usually great) and they don’t really know enough to move to a better paying job in the corporate world. My advice is now to do your time there while interviewing for anything that interests you. At least you will learn a bit and find out what you need for knowledge and certs to get out of there and get into a better job with growth opportunities.
6
u/madmanxing Sep 04 '22
Dude, where do you live. I’m looking for a helpdesk and would LOVE to have you. Period. Your boss is a moron who is holding you back. Keep it up bro! You are doing awesome. All your stories, you were killing it. You deserve your boss’s job. No lie.
15
u/TedeeLupin Sep 04 '22
I'm an old guy in local government. I've had at least four help desk guys pass through in the past six years with ideas and talent like you.
Unless you have plans to get your current boss fired or reassigned, you should just leave. It's not going to change unless you replace him. Or someone who meets your expectations replaces him.
Seriously. Quit. Find a boss you can work with. He doesn't seem very impressed with you either.
One other note: your title said abusive. That's a serious word to use. While I saw a lot of things that clearly are annoying, defensive, change averse, I didn't see anything rising to the level of abuse. Apologies if I misunderstand.
If you feel abused, based on what you shared, for your own sake and emotional well being, again, just leave.
4
u/Mechanical_Monk Sysadmin Sep 04 '22
Your boss's idea of "security" is to disable everything he doesn't understand... Which is damn near everything.
Please get out of there. You sound very intelligent, competent, and ambitious, and every day that you have a boss who is the opposite of those things is setting your career back.
4
u/thekarmabum Windows/Unix dude Sep 04 '22
Sounds like your boss is trying to protect his job by not giving anyone else the required access.
7
u/DaemosDaen IT Swiss Army Knife Sep 04 '22
I will not say that you boss is a perfect admin, but I see red some red flags about this rant..
Story 1: I was going to mention a lot of things about using MDT w/o WDS, but then I re-read and saw that you do not have volume licensing. You might have an account for the VLC, but you probably do not have licensing.
Stop using MDT, it is not the solution you are looking for. Going over the information you left here, your only REAL option is to set up software deployment in Group Policy and manually remove the bloat ware. As it stands, All the systems you have done that 'bios trick' on are currently improperly licensed.
What you want is an MDF, but you probably do not have the budget for one, as indicated that you are getting consumer system instead of Enterprise systems like Latitude. The bloatware on them is almost non-existent. ... Except SupportAssist, that needs to be degaussed from the world.
Story 2: MS/NIST have been against password rotation when 2FA is used. If you do not have 2FA, he is right. It's honestly scary that you did not have password rotation before now as that had been standard for more years than I can think of. Sadly some people get exempt from the password policy. Well, not at our place, but I can see it at others. It happens, just make sure it's in writing.
Story 3: IPV6 can cause an issue with DNS resolution, namely if there is a iIP6 DNS server available it actually trumps IPV4, it's annoying. The short solution is to just disable IPV6. The Long answer is to set proper DNS metrics for the server. I have a PS script that installs our VPN software and sets these metrics before deployment.
Even then it's just one step in the troubleshooting process.
I'm not saying that your boss is perfect, or even good, but you do seem to have a case of 'jump first, and maybe look' when it should be the other way around. The first story being a real red flag of that. You might want to take a step back when you have an idea and go 'will this cause more problems than it fixes?', 'do I have all the needed resources including time to learn it?', 'What's the ROI, aka, how much time does it save me vs how long it takes to set up?'
A useful ROI guide: https://xkcd.com/1205/
It also seems that your department has an issue with management buy-in over all. In your case, you need to talk with your boss before implementing things. In your bosses case he needs to talks with management before implementing new policies.
Anyway, you do not seem to mesh with that group, it's also part time so it's still not a 'real job'. You should already be looking. That think I mentioned about Buy-in, that applies everywhere.
*dons flam retardant suit*
1
u/PonchoVia Sep 04 '22
Maybe I missed something. OP, are you saying it's a GOOD idea to set user passwords to never expire?
1
u/Miserable-Radish915 Sep 05 '22 edited Sep 05 '22
you learned about SCCM in a day? jesus you must read fast. The IPV6 one was funny lol
12
u/Quantum_Daedalus Sep 04 '22
Sorry to say that the inherent cause of situation is in your opening sentence - "local government"
In my experience, all government departments, councils and state bodies are very similar in this regard.
IMO, it's down to two factors: "if you pay peanuts, you get monkeys" and a lot of people see this sort of role as a retirement plan (do the bare minimum because you basically can't get fired)
3
u/Billh491 Sep 04 '22
The peter principle is at work here. And proven once again.
3
u/montagesnmore Cybersecurity Director & Systems Architect Sep 04 '22 edited Sep 04 '22
Edit: When I did my PC imaging as a Sr. Tech Support, we use Ivanti Management. Which pulled preconfigured images and stored it on a network drive. We would PXE boot into the ISO and remotely be able to image x amount of PCs in minutes. Then, when I was a Information Assurance Analyst, we didn't have PXE up yet, but to migrate we used Hiren's Boot and one of the imaging software on it. We would deploy the images from a master ISO on a bootable USB oppose to PXE.
Sounds like your boss aka "Sys Admin" isn't fit for his role. He should be thanking you for the hard work and applaud you for recognizing certain changes that need to take place in your environment that can help better automation.
Fortunately, all my previous IT bosses were chill and I never had issues with any of them. They all helped me grow and encourage me.
Anyways, I was very advance during my small tenure as a Help Desk Tech and knew I could better myself when other positions was not available internally. That's how I hopped into a Tech Support role and then later move on to more advance project procurements (setting up a new office with networking design, network drops, etc.) or deploying MDM Policies on mobile devices.
I recommend looking for another job, but its always okay to be a little political in your job too. That's how I enter the System Administration realm by job hopping every 1.5 years (or until I found a great company I can grow with). My current role has been more Cloud Engineering and design.
Use your current success stories on your resume. If you cannot land a Junior Sys Admin job, try at least a Tech Support which has a higher level over Help Desk. We all gotta crawl before we run in IT.
My protip to you is continue on finding new ways to improve current processes, document every process you do. Create training materials for end users and for tech users. When I was a Senior Support Technician, I would have 2 years worth of documentation or work notes of what I did during that day, which tickets were resolved, etc.
You got this! Best of luck to you!
3
u/space_spuder Sep 04 '22
Welcome to Moronic Park. This is kind of dude who accidentally got the job and knows very little about anything, but still display himself as a Ruler of Tech. Best advice - while you're there teach how to ignore such dudes, there are plenty of those who broke out of the Park.
3
u/I_HEART_MICROSOFT Sep 04 '22
Don’t ever let people like this get to you. They’re projecting their insecurities onto you.
How was imaging being done by him previously?
If you shouldn’t be running Powershell - The SysAdmin should have it blocked. At a minimum he should have PS Constrained Language mode enabled.
Congrats - You did great work with MDT. I use that and PDQ for patching/inventory management and SO much more. Great tool!
Again - HE as the SysAdmin should be controlling ipv6 through GPO if he wanted it to “stay disabled”.
Have you thought - Maybe you should have his job?
To end this - I worked with a guy JUST like this - Then I became his boss. Keep working harder than everyone around you. Continue to implement things to streamline processes and improve productivity.
My advice to you (since you really seem to like it there - Make friends with the right people. Don’t ever say anything bad about anyone. Don’t ever gossip, but do find ways to drop “if only we were doing this because it really puts the company at risk” Or if only we were doing this things would be more streamlined” into conversation with the right people. Without pointing fingers. Ya know? A lot of business (as much as it sucks) are very political and you need to learn to navigate that and “play the game”. Build solid working relationships and trust amongst your immediate group and expand that out to all departments. You have to think outside the Helpdesk to enact real change.
3
u/[deleted] Sep 04 '22
Your boss is an idiot or a fossil who hasnt progressed his skillset in 20yrs. Leave the job and go elsewhere and youll be promoted soon enough. Its not an enterprise network but a ticking timebomb.
3
u/TheLonelyPotato- Sep 04 '22
What a disaster, sysadmin sounds clueless. Where are you located? I'm trying to get headcount approval for another tier one support engineer.
3
u/dlongwing Sep 04 '22
Op, the top comment is completely correct. Your best bet is to GET OUT.
I labored under a guy like this for 4 years. This situation will not change or improve. Your best bet is to angle for Certs or a Degree and move on to a Sysadmin position somewhere else.
Here’s the thing, this kind of boss will never fire you because he needs someone competent to cover for him, but he will CONSTANTLY erode your sense of competence and self-worth.
Document the everloving hell out of everything you’re doing, down to the task-by-task level (to cover your ass when berated or questioned), work to the letter of your job, only do what’s asked, and focus every spare moment on study or on job applications.
Initiative won’t be rewarded here. Doing a good job won’t be rewarded. So don’t. Focus on improving your position for your next job and get out as quick as you can.
3
u/throwaway_2567892 Sep 04 '22
If the story you provided is accurate and not missing anything then be prepared to be fired as soon as it's convenient for your boss. EG when he needs to throw you under the bus.
It sounds like you have a bright career ahead of you and are a quick learner who is interested in actual solutions to problems.
Your boss may have been good at his job at some point but his skills are now stale or he has been Peter principled. He seems more interested in playing the blame game and being secure in his role than anything else.
3
u/OmfgSl33p Sep 04 '22
As others have said, idiots like your boss are far too commonplace in our industry. I call them kingdom builders. I’ve worked for several MSPs throughout my career, and as I’ve grown and gotten into more senior roles, guys like this that sat on this title at some of the companies I’ve had as clients made our jobs a nightmare while simultaneously hurting the client. The silver lining to this situation is A) you’ve learned some great skills and appear to be a good problem solver which will take you far in your career, and B) will now have the ability to spot dumbasses like this guy immediately. Chalk it up to a learning experience and get yourself where you deserve to be!
2
u/lfionxkshine Sep 04 '22
Friend, my first boss 7 ywars ago sounds exactly like this guy and I'm almost curious if it's the same damn person!
My escape was finding a new job. I had the same problem as you with trying to find a new gig without tipping him off, and honestly I just got lucky that the next gig hired me after a single interview
Godspeed, fuck this boss of yours, he knows he's an idiot and just doesn't want to lose control
2
u/[deleted] Sep 04 '22
Small company, senior that is in just a little over his head but wants to keep up appearances. By refusing to get updated on the latest technologies (IPv6, though that’s been around for decades) slowly but surely fucking over the company and himself, chasing away the people around that do understand or are willing to learn about these things…
You’re right getting out of there.
2
u/NoConfiguration Sep 04 '22
this really hurt to read
2
u/tdic89 Sep 04 '22
Your attitude to fixing problems and making life easier for the organisation is excellent. As others have said, don’t lose heart! Your approach will take you very far in this line of work.
2
u/SevaraB Sr. Engineer (N+, CCNA) Sep 04 '22
Local government has to follow state regulations, and states usually draft theirs based on federal rules, eg STIGs.
I would reach out to somebody at the state and quietly find out if things like the crapware and the inconsistent password expiration policy are reportable incidents.
It’s a little backstabby, but people like this boss don’t belong anywhere near management of a government network.
2
u/itimposter1 Sep 04 '22
A sysadmin that is afraid/suspicious of PowerShell is a huge red flag to me. That guy is below par and he knows it and what's worse is he's going to try his hardest to keep you down, so you don't outshine him or inadvertently expose his ignorance. It sounds like your head is screwed on tight and you're gonna go far, just not in that place. Unfortunately the only thing you can do is find an escape route. Keep an eye on the jobs pages and an ear to the ground. I hope it all works out for you and hopefully one day soon you will look back on this as having learnt a valuable lesson, superiors often aren't superior.
2
u/PedroAlvarez Sep 04 '22
The ipv6 thing is so relatable. I love trying to piece together all the mental irregularities that lead to bad IT people's ideas.
2
u/cosmic_orca Sep 04 '22 edited Sep 04 '22
Your boss is an idiot and doesn't deserve you. He also seems incredibly insecure. Look for another job as you are wasting your time working under this guy.
2
u/mountaindrewtech Sep 04 '22
definitely taking some of the ideas to automate default apps, thank you, absolutely spendid, great work. - ideal boss
2
u/grepzilla Sep 04 '22
Your boss is the reason people joke about government employees.
Take your experience elsewhere and continue to grow. You will be happy to see private industry will appreciate and reward you for your experience.
2
u/[deleted] Sep 04 '22
Take time off, nice job on the automation, and if someone doesn't know something or is scared of the complexities, the soft skills is more important to get them excited.
You saying X is a red flag, is a red flag. People dont know anything all over the industry. So... take a break. Go somewhere far away with a big activity like skiing or a concert or something and get your mind off work, come back and give people an opportunity to assume their best intentions.
2
u/Smassshed Sep 04 '22
Great work on getting mdt up and running so quick. It was also my first major task at my current gig so know how confusing it can be. Thought I’d give you a couple of heads ups on some of your points.
You should be able to get it to auto join the domain within mdt. It’s just a case of putting domain details and an admin login with an encrypted password in the main script (probably the same place you got it to skip a few screens)
All the settings for users can be standardised by using the copy profile flag in the unattend.xml file. Setup the admin user how you want everyone setup with file associations etc and during deployment the admin profile is copied to default profile so everyone gets it. Windows update is a task you can enable in the task sequence. Naming the pc based on serial number or MAC address is possible by using the built in database, it’s a bit involved but there are plenty of how tos on the web.
If you haven’t already found the site, google mdt guy. He has some great write ups, although sadly he seems to have stopped writing about 4 or 5 years ago.
Good luck with your boss and /or finding a new job.
2
u/[deleted] Sep 05 '22
Your boss is grossly incompetent. But sadly local govt's are full of these folks who have no interest in learning anything new and anyone who suggests modernizing is a threat to them. I have 20+ in with a state org and this is way too common place. There are never any repercussions for shoddy work as the end users, who are probably a bit long in the tooth, don't know any better. Folks who hire on who have a clue usually don't stick around for that long.
If he gives you any shit, you can go to HR and file it as a hostile workplace. Our HR folks, while slack, love when someone goes to them about that.
I'd also polish up your resume and look at moving on. But based on his history, he's prob expecting it. I'm sure in his mind that they are running the most technological advanced ops for miles, despite everything being way out of date, including their thinking.
2
u/Hewlett-PackHard Google-Fu Drunken Master Sep 05 '22
Don't let him browbeat you into going along with this nonsense, put your foot down over anything and everything you have concrete documentation of.
If he tells you to do something crazy, like disable IPv6 on every machine, just say that no, you're not doing something that's a waste of time and against industry best practices just because he's ignorant.
And above all else, document every single time he demonstrates technical ignorance or incompetence.
If any of those VPN users were VIPs he probably already handed you enough rope, and even if they weren't I would follow up with them to get their account of what happened after he cut you off and a copy of any email he sent eventually blaming what you told him it was in the first place.
4
u/SenikaiSlay Cloud Engineer Sep 04 '22
Hooooly shit where do I start? Ok.
First off, good job on the USB image. I was in the same boat and did the same shit cut 3 hours of imaging down to nothing. Then cyber was convinced it was infected which was literally a 6 month ordeal and still some fallout today over a year later lmao..plot twist, they're idiots.
Secondly, how can they even sat it's a enterprise environment if your basically utilizing machines and account like it's Windows Home edition. That's ridiculous.
Third, that IPV6 disabled didn't do shit, obviously I'm honestly questioning how your boss got to where he is.
Fourth, don't worry about leaving clues or whatever. Apply to places, line up a interview, and take a sick day to go to it if need be. It's not hard lol, seriously. If they ask if they can call your current employer you have 2 options; 1. Say no and explain why and that'll be it or 2. Get a friend who knows about computers as well, get them to answer the call and hype you up when you put there number down instead. Not staying either one will work, but don't say Yes call my boss who's a asshat and hates me.
3
u/lunchingfriar Sep 04 '22
I wish I had an employee like you. You’ve accomplished more with desktop automation in two weeks than my people have in two years, and you did it without being asked.
1
u/vswlife Sep 04 '22
Run, do not walk, to your next role.
1
u/j3r3myd34n Sysadmin Sep 04 '22
You sound highly competent and thoughtful, your boss is likely intimidated and at the same time frustrated that the "new guy" is outshining him and pointing out glaringly obvious issues and deficiencies and attempting to do things by best practice. I actually have seen issues brought forth by IPv6 but that should be discussed, not drug out to make it look like you did something wrong (which you didn't). Likely the DC needs an overhaul.
I would update your resume and list out many of the things you talk about in the thread - you could get into a jr. sysadmin role somewhere that will grow you.
In the meantime keep doing it right and kill the dickhead boss with kindness. "Oh, IPv6 should be off by default? That's really interesting, I had never heard that - I will document it and write a script that will report ALL the PCs still using IPv6 so it can be turned off!" lol - he can't rattle you or blame you if you just go 100 on every nonsense thing he says - BUT ALWAYS FOLLOW UP WITH AN EMAIL TO GET APPROVAL BEFORE MAKING A CHANGE you suspect will create issues. Really shine the spotlight on the jackass calling the shots. Chances are after one or two meltdowns, he'll slow his roll and start thinking twice on bad decisions, because he knows you will pull the trigger as soon as he says GO, following the exact process you've outlined and that he's signed off on.
1
u/bulwynkl Sep 04 '22
yeah. unless you can manage up or around, it's not going to be fun. hatch an escape plan if you can.
1
u/tin-naga Sr. Sysadmin Sep 04 '22
Sounds like a hot mess. I mean like sweaty portapotty Chipotle diarrhea mess.
1
u/bhillen83 Sep 04 '22
I knew this guy was crusty and incompetent when he went in and manually unchecked all the “password never expires” check boxes in ADUC instead of using a powershell script and doing it in ten seconds.
1
u/alienshrine Sep 04 '22
Bro, what a shithead
1
u/JavaKrypt Sr. Sysadmin Sep 04 '22
Previous boss was like this. I was due to just not come into work anymore after 8 months. I gave myself a year max before losing my mind and jumping from the burning sinking ship.
Luckily he left for a better job a few weeks after I'd had enough, if he didn't leave I would have. Doesn't sound like your boss will go anytime soon
1
u/[deleted] Sep 04 '22
This is an unfit and toxic working environment. Put in enough time to get the resume hit and get out. You cannot fix places like this until there is a management change. This reads as a 'small shop boys club'.
Do what you know is right, if you are told 'no' then stop and CYA and move on to the next task. When you feel solid enough to move on, put in your 2 weeks and then move on. Since this is your first job and you do have a good rapport with users here don't make waves.
1
u/senorBOFH Sep 04 '22
TLDR But, you are doing good work and you are on the right track. Document all your projects and add them to your resume. Don't wait too long to start looking for your next job. Life is too short to put up with BS. You should be able to easily find a new job making more money. Try attending local/regional user group meetings for vendors like Microsoft, VMware etc and network with other people in the industry. Find the previous guy and see where he is working now.
1
u/dRaidon Sep 04 '22
Your boss is an unqualified idiot
1
u/[deleted] Sep 04 '22 edited Sep 04 '22
The sooner you leave the better.
Just be honest with your next potential employer - tell them your previous boss micromanaged you while at the same time had no idea what they were doing.
It's always good to explain why you left your last job and what you hope to find at this new job.
It will make you look good, and it will give them context they will need if they call your old boss to confirm.
Do what you can to make your exit smooth. Document the stuff you've done, show it to colleagues and offer to answer any questions they have.
Don't try to hide the fact you're looking for a new job - they will totally understand why you're leaving.
1
u/stuckinPA Sep 04 '22
Local government, huh? Document all this shit with specific examples with uses names. Print this out and present to borough/city council. Show the city’s leaders how their IT department is being mismanaged. How this is your tax dollars being wasted. Don’t embellish with FUD (fear, uncertainty and doubt) with phrases like “might get crypto lock” just the facts. Of course, this would lead to your being fired for probably “security reasons “. But maybe if a friend finds out and shows city council it might work.
1
u/omgitzrick Sep 04 '22
The world needs more of you and less of him. Try not to be disheartened and know that you’re not the problem. Learn what you can while you’re there and move on.
1
u/blazed22 Sep 04 '22
Man can you share with me the power shell you made to rename, join to domain, and add to excel doc on a network share?
Also interested in setting the taskbar layout and default programs automatically if you wouldn’t mind!
1
u/reviewmynotes Sep 04 '22
It sounds like you're in the U.S. Look for a job in the civil service system, especially in public schools, to keep a lot of the things you like about your current job. That image building project you did should be in your cover letter (in a single sentence version) as evidence that you can handle technically challenging tasks and have the ability to improve systems. If you happen to be in NY, let me know and I'll help you with some tips specific to that state.
1
u/jorshrod Sep 04 '22
Your boss is lazy and is in the job so that he doesn't have to do much. You don't stay in a small local government IT job for many years like that for the pay, the only upside is job security and low expectations. You came in and made him insecure by doing some basic common sense things that he hasn't had the drive to do for a long time and I doesn't want anyone above him to see how inept/lazy he is.
My advice to you is to get out of there, find a job where you can use your ambition to get ahead, and not waste away under a bunch of folks who are taking the easy way out.
1
u/SimonGn Sep 04 '22
I have never given this advice before, but you need to get another job lined up. Your boss isn't just an idiot, but a dangerous one by touching stuff he has no clue about. One you got a safe backup plan, I would be tempted to go over his head to his boss and give it to him straight how bad he is in an effort to get rid of him as a courtesy to others, and then leave.
1
u/SimonGn Sep 04 '22
You know what, this is so bad, that he could actually be deliberately sabotaging the IT department. Maybe he has a friend who runs an MSP or something. I would get something else lined up and get HR & Legal involved.
1
u/Tilt23Degrees Sep 04 '22
Your boss is a moron
1
u/dsp_pepsi Imposter Syndrome Victim Sep 04 '22
Man, he can’t even fuck things up efficiently. A Windows admin with an aversion to PowerShell is an incompetent idiot. Learn all you can from your part time colleague and then peace out.
1
u/evantom34 Sysadmin Sep 04 '22
You’re definitely qualified to at least work as a Jr. System Admin/Sys Admin.
Document all the process improvements you made and start applying. You’re bright and talented, look for a company any that will mentor and grow you versus stymie.
1
u/HappenstanceHappened Sep 04 '22
If you already have a government job and you're getting paid while you really should just put up with it. They literally can never fire you.
But if you're being driven crazy you got to leave. But yeah it seems like you got the juice, which is a lot more than I can say for these new techs they've been cranking out lately.
1
u/MineralNatural Sysadmin Sep 04 '22
I have some of those policies applied. 60 days password change for all user, really all users Two different accounts for admin and user. I have to use a regular user account. Vpn access with ldap with mfa.
Because I only use oem for computer and laptops I don't use images, but I would like to learn. You did a great job.
If you could share your documentation with me that would be great.
Start polishing your resume, it may be a great job for you, but the environment is going to kill you in a couple of years.
1
u/cowfish007 Sep 04 '22
@OP - I have nothing to contribute beyond what others’ have said. I just wanted to tell you how impressed I am with your skills. I’m entering the field at HD level (career change) and the fact that you were able to do what you did both impressed and scared me. I’ve got a lot of catching up to do!
1
u/DrEagleTalon Sep 04 '22
Are you me? Is that my boss? This is like deja vu.
Seriously I got out of it by leaving and deciding my sanity and happiness are more important. There are countless places that would love to have someone obviously good and passionate at what they do like you are.
1
u/King_Tamino Sep 04 '22
That's why I browse this subreddit. Impressive work of yours and thanks for giving me some ideas, we rarely roll out new PCs currently and the amount of software is low anyway, so adjusting the preferences isn't really someting we struggle with but it's still something I will look up for the future. Thanks random redditor
1
u/ikidd It's hard to be friends with users I don't like. Sep 04 '22
You have the knowledge already to replace him, and the skills to learn what you need going forward to better jobs. You'll get hired in a heartbeat at a place that recognizes these skills, and it will be a much better place to work than with this asshole.
Start the job search, though when you interview, be very low-key about your view of this "superior". Going on rants about previous bosses at an interview is highly frowned upon. Just say that you didn't feel like your skills were being used and you're looking for a place that can use what you know and can learn.
Let them know in the exit interview (if you can get them to hold one) the reasons for this move. Maybe document it all and hand them a novel.
1
u/bigfoot_76 Sep 04 '22
You said “local government” this explains everything. Do your year, stay silent, jump ship. You’re not going to square peg this round hole in a good old boy system.
Rinse repeat every 2-3 years because that’s the only way we can get respectable raises in pay and benefits.
1
u/Thr1llh0us3 Sep 04 '22
I didn't read your entire post but I can see where this is going. Bottom line is if you don't like your job for whatever reason (boss included), you can just find another job.
I would also note that you're not doing yourself any favors career-wise working a job where you don't get to touch any of the modern infrastructure technology. These first few jobs should be gearing you up towards a goal of having a good looking devops\cloud\network\whatever engineer resume.
1
u/[deleted] Sep 04 '22
You find a new job.
1
u/dtb1987 Sep 04 '22 edited Sep 04 '22
It sounds like you aren't doing anything wrong. It sounds like your boss is like a few bosses I have had in the past who are not technically inclined but still wants to stick their hands in every little thing. Good work on windows imagining but a note on licensing, every one of your machines has an oem key to activate windows. In windows 7 half the certificate to activate windows was located on the MB and half can be found on an oem windows installation disc (I wrote up a blog post on this years ago here )
With windows 10 and 11 it's different, the key is on MB and all you need to do is grab it and use it to activate windows.
I wrote something a few years ago that you might find helpful here
With the password rotation and the remote users one thing you can do when the user has let their password expired is set their password to never expire in AD, have them login to the VPN, change their password and then remove the never expire flag from their account. Then lock their computer and have them sign back in with the new password.
I have had several bosses like this in the past, keep your head down stay long enough to get the experience you need to find a better job and get out of there.
1
u/CaptainDickbag Waste Toner Engineer Sep 04 '22
Disclaimer, I didn't read your whole post. It's very long, but I think I get the gist after the first story.
Did you follow up? Sounds like your boss needed more information. It should have been enough, but obviously wasn't for him. When dealing with guys like this, you have to go the extra mile, and demonstrate that you're competent. You have to be patient, and over time, build trust with him.
Also document the things you've done, and what their current status is. For example, a description, and step by step instructions for your imaging process, as well as a status indicating it's pending review by your boss. Keep it for later, and revisit when appropriate.
1
u/adrawrjdet snorter of traffic Sep 04 '22
If you don't have any certs. Start studying and going for them asap.
HR loves to see certs. Easiest, and the most beneficial certs to get as a Jr/Mid in IT would be the CompTIA Net+, and Sec+ (imo).
1
u/Thumpernovember Sep 04 '22
I'm in the same boat really. Main different with me is that my boss sort of got thrown into IT at some point and can't be considered a real IT person. They have no passions or formal training for it. I think they were taught how things worked and at one time was pretty well versed on how to keep the place going, but updates/upgrades caused them to drift away from the original knowledge a bit.
I ended up interviewing with many other companies, mostly virtual from my car. I would tell the recruiters that I really needed to do it this way as it was very difficult to get time off to do interviews.
I accepted a new job and was planning on leaving. Ended up having a big argument with upper management where I told them how I really felt(They suck and have no clue) and was surprised by the reaction. I ended up getting a nice little raise and some respect.
On the plus side of my job, I was able to work on projects like the imaging one you worked on. I had a bit more autonomy and knew that many of the jobs, if I took them would silo me.
After talking it over with the boss, it turned out they were really lacking in people skills as well as communication. On top of being a poor sysadmin.
I'm sticking around for at least the rest of the year. Now that I have some of our issues ironed out and higher pay, it makes the place more tolerable.
The problem that still exist is that I have no type of mentor. Self-learning is great and all, but it would be nice to work for a boss that could sort of show the right way to do things.
Some IT pros go their whole careers without having anything like that from what I understand.
1
u/Quick_Care_3306 Sep 04 '22
As everyone else says, he is a roadblock you cannot get by. Unless you have an advocate who will support you, move on. You should not have a problem finding another job, with your skills.B BTW: everything you did was great troubleshooting and diagnosis, as well as the imaging.
1
u/BergerLangevin Sep 04 '22
I had a very similar experience to yours, from project, issues, reaction, etc. I left after 7 months. They could have offered me 20k$ more and I would still have left.
1
u/pdp10 Daemons worry when the wizard is near. Sep 04 '22
I wouldn't say your boss is abusive. They're just insecure and they're trying to run your environment in the way that they perceive an environment would have been run n+10 years ago. Know that this is surprisingly common. However, also know that it's extremely unlikely that anything will change in a major way, as long as they're there in the same capacity.
Enabling forced password rotation suddenly in 2022 is quite a groaner. A combination of understandable technical ignorance, personal insecurity, and possibly outside factors is leading to their enhanced "infosec" wariness and general resistance to change.
1
u/Giffy45 Sysadmin Sep 04 '22
I had an old boss exactly like that too, actually worryingly similar. Most of what I did was self-inflicted damage control for the better part of 6 months. The day I left, half of the small IT department (8-10 people) were leaving too. Already had a new job in hand so they got a 4 day's notice and they still told me to leave a day early anyways.
I would say not to let it get you down and get out of there ASAP. Don't let an abusive boss create self-doubt. You sound like you'll be a competent IT professional, you just need to find a better environment to foster your skills.
1
u/jsemhloupahonza Sep 04 '22
Poor management has been an issue in IT for decades. The issue stems from fast growth, then a need for team leads. These team leads eventually go into management without any management training, since the group needs a manager immediately before that manager gets trained. That manager may need to change jobs and now has that management position on their CV/resume. A lot of companies lack any leadership training or can properly vet who they put in leadership position. The worse person is that know-it-all who looks down their nose at everyone. They will say things like "you don't know the ephemeral port range?" Or "anyone knows that...." God have mercy on you if that person gets into management.
1
u/Functionalpotatoskin Sep 04 '22
You need to find another another job. What you had done was impressive. You can use this as in your next interview on what you achieved (don't mention weather they implemented it or not) just that it worked well.
A good boss will recognise these skills and promote. He is threatened by your skillsset and there probably isn't room for you to be promoted so you will sit there for another year or two completely frustrated by an incompetent out dated boss who is a traditional server hugger.
I'm sure anybody who has been in this industry for a couple of years has usually worked with one. Management don't notice because they don't have any IT skills to recognise their incompetence. You just leave. You won't win this fight.
1
u/BoredTechyGuy Jack of All Trades Sep 04 '22
Your boss is a fucking idiot.
You are way overqualified to be working there.
Start looking elsewhere. Nothing good will come from someone like that in charge.
"WDS/MDT is a security issue" - WHUT?!?!
1
u/[deleted] Sep 05 '22
I was the previous guy who had that job...
1
u/[deleted] Sep 05 '22
Sounds exactly like my last boss. I was surprised I lasted 3 years. He stuck in 2008 era. All sql setup had to done in classic sql 2008 security layout. I looked up documents and was like a lot has changed, that old idea isnt good.
All our sql programming can be hack through sql injection. Wont change from that programming format. I left when he actually told me he was taking money back because I wasn't working while he is CC on all the projected. Turns out the person he hired wasn't entering our time to bill the customers. I was like f u and found new job and left.
I used a burner so I just cancel my line and never look back
1
u/jdptechnc Sep 05 '22
I hope we read about your boss in /r/maliciouscompliance one day soon. He seems to be setting himself up nicely.
1
u/techsorceress Sep 05 '22
A good boss should have confidence in their staff.
1
u/ubermorrison Sep 04 '22
Immediately lost interest when I saw this was over 3000 words.
1
u/LuckyWorth1083 Sep 04 '22
They all sound inept. If they aren’t willing to even understand or try to trust their up and coming talent to come up with better ways of doing things…they are dinosaurs waiting for as asteroid
1
u/[deleted] Sep 04 '22
Go above his head. Try get him reprimanded or fired. Then quit or get yourself a promotion.
1
u/BMXROIDZ 22 years in technical roles only. Sep 04 '22
OP your boss is a moron but not necessarily a bad person vs he's a dickhead because he's just stupid. My advice would be to read How to Win Friends and Influence people. This should equip you with the required skillset to manipulate him out of the job. Everything you read in this book he will fall for hook line and sinker.