If you want a company to purchase tools for you to do you job, you need to tell the company what the cost will be if you do not have the tools in place.

This will include the cost of your time to perform the job without the proper tools. It will also include the potential costs of any issues that arise from not have the proper tools in place, like the cost of a security breach or maybe loss of clientele if a security breach occurs.

Basically you try to present what it cost to go without the tools you need and all of the issues that come along with that, and then compare that to the cost of buying the tools.

I am writing a report about this which I am not sure if I should send or not.

When asked if you are complying with whatever polices you say you are unable to determine that without X tool.

Second comment, but make sure to put stuff like that into an email. Project yourself by making those permanent, semi public notes.

Just curious, what RMM software are you using?

So, the way Active Directory policies work is quite interesting under the hood. They are essentially served over SMB, and then clients query them, before applying them locally, or you can "push", requesting clients to do this. To be explicit: group policies are the same local security policies, but synced. Of course their is a little bit more nuance, technically they are separate but group policies always win in case of conflict. Regardless, what I mean is that it's not magic, it's not really technically superior to other ways to do it, and you could theoretically get something of equivalent resilience.

scripts are not reliable and tend to break with updates, they won’t stack well

The cool thing about Active Directory policies, is that they are declarative, and idempotent. This means, that rather than say, editing a config file, or installing some program, you are just setting variables to values. A script that sets secpols.whatever to X value won't really care about things like the order of the script, or whether the value has already been set, or whatever.

Because of this group/security policies this way will be fairly reliable. Using powershell to set goup/security policies, isn't really the same thing as doing scripting that does logic. Like, say I have a script that checks for something, then does something else — that's where things begin to get brittle.

Now, this is one half of the end, system management. The other half of what Active Directory provides is centralized accounts (IDM/IAM). Other services connect to active directory for authentication, so people use it to log into say, their file server, or their firewall, or the servers, or whatever. When a user leaves, or is compromised, or whatever, you can simply lock their account. This is much, much better, both in security wise, and ease of use wise for provisioning/onboarding users. The previous model, is "password sprawl". Where a spreadsheet of passwords for services gets passed around, and sometimes makes it into the hands of attackers. There is no easy way to audit all the services, ensure that the passwords are up to date

Now, if you are avoiding Active Directory, there exist alternatives for centralized accounts. For example, you can use Microsoft's Cloud stuff, and then use that to authenticate the local machines. Don't give the users admin, and then managing the group/security You can then use Microsoft 365, or Entra ID as a centralized authentication point for external, non microsoft cloud services.

This can be superior to Active Directory for a few reasons. One reason is that Active Directory is a hard, toilsome service to deploy and secure. You have to sit on top of it, watch for CVE's, and patch them. On the other hand, a small, specialized RMM server is much easier to secure, and way less attack surface. Also, if it's push based to agents, it can be updated without any downtime, compared to users not being able to log into services when LDAP goes down. By offloading security onto cloud services like Microsoft's authentication methods, you can gain a big increase in uptime and security, at a very low cost.

Another is cost. A smaller RMM will be cheaper... or free if you are using an open source solution (like TacticalRMM which is built on Meshcentral (but Meshcentral can also be deployed seperately)). Active Directory on the other hand, costs money.

"this is how we were advised to proceed”

But, let's be honest. What I wrote above is a charitable interpretation, where I am assuming what they are doing is good. What is described above is cool, but only 0.01% of environments you encounter will have novel, well thought solutions like this. It is way more likely that intuition is correct, and the infrastructure is simply brittle and insecure.

Now, you probably want to change it, and that's good! But you need to understand, that changing it is not so simple. At many businesses, security is treated as an expense with no benefit. It doesn't actively make a profit, or save money, so it is ignored. Even free solutions that cost labor will be tough to push through. Active Directory is paid, but is honestly not that much ­— but the migration and deployment phase might cost a lot. You need to understand that, you are trying to fight through that, when convincing people in charge of making these decisions.

You also need to understand, that when you argue or make points towards AD, or any better security solution, the people you are arguing with will not always be honest about the reasons. Perhaps they themselves don't understand why.

If you attempt to debate, you are may hear a bunch of excuses that obfuscate the real reason why better security isn't pursued.

• "this is how we were advised to proceed”
• "We need administrators trained"
• Various technical reasons, ranging from absurd BS to legitimate critique
  • "Our firewalls block SMB"
  • "Laptops"
  • "We have Linux servers"
• AD Costs money

And then, even if you grind down all these arguments, sometimes you are still just met with simple flat out rejection.

So. If you want to increase security, you have to think like them. You have to translate it to $$$, and put that on a page, on a report, that you can summarize and present. One assumption I would like to correct in advance is the idea that "Labor hours = dollars". From what I've seen, arguing that "automating xyz process saves my engineering hours" arguments, don't really seem to work. What is arguably the most effective, is presenting a way to either save money (and I mean raw cash, not engineering hours), or make money, that incidentally increases security.

Of course, not everybody is motivated by dollars. Sometimes it's a senior engineer who wants things done "their way", for specific reasons. Sometimes an executive is incapable of remembering a password other than "Password123!". You have to understand why and work with their motivations.

This is politics. Balancing peoples interests, making concessions, and granting them what they want in order to advance your own interests. Unfortunately, it's a skill, that you will probably need in order to advocate for security.

Good luck.

Focus on the business needs. What do you need? Why do you/they need it? What will they have that they don't have now? This part is very important. If you can't come up with a compelling business case, then there's no reason to move forward on it.

How much will it cost? Are there any cheaper options? Some places would rather hire a $100k/year sysadmin rather than buy a $10k/year license. Other places will get excited when you talk about reducing support staff. Keep that in mind. Also, some places are more concerned about how replaceable someone is, so using standard products are more valuable than price or capability.

When you're evaluating options to recommend, try to get information about the entire landscape. There's a very good chance that they're already paying for Microsoft E5, which means you already have a license for Intune that you aren't using. If not, you can pitch it as a total package with other benefits.

ETA: Security is a really big deal at most companies. Internal and external threats, data loss, exfiltration, legal compliance requirements, etc. But smaller places often won't care until they've been burned.

Possible, but it's gonna be real difficult. What kind of management are they expecting? Are you held to any kind of compliance?

If you have Windows server licensing available, I'd just stand up AD anyway. Hopefully you're not running Windows Home on all the devices.

If the org is not giving you the right tools you either leave or force the issue.

When asked if you are complying with whatever polices you say you are unable to determine that without X tool.
Because when something goes wrong you will get the blame for lying about compliance.

If the issue is resolved server-side, verify whether Google updated their header normalization logic to comply with RFC 5322 regarding From header quoting. It would be valuable to see if they published a changelog entry or a specific commit hash explaining the fix to prevent future regressions in their DKIM validation pipeline.

True you have to be smart.

Its generally ok and accepted. Where it gets tricky is when you pull ALL the source code of company XYZ product and then use it at a new job to undercut your old one. Or try to sell a copy with the same code. Essentially when money and licensing comes into play.

Also depending on where you coded said solution, if it holds up to court, etc..etc... But generally, if LLMs can siphon up the entire internet for code, you can keep your own.

But one off scripts? Oh yeah those are safe. People have been sharing their dot files for ages.

I personally have spun off a couple of libraries making it easier for people to use said commercial product. Its been wildly successful for my career over the long run.

Be careful with that, depending on employment laws and your contract any code you write while working for your employer might be legally theirs and can't just be taken with you like that

Respect that. They’re lucky to have you.

I should have also mentioned:

1. At these shops are also plenty of over-qualified people for whom compensation was secondary to flexibility, work-life balance, autonomy, or what have you.
2. More importantly, they’re popular foot-ins for people new to the field or stepping-stones for those in career transition. (Especially during hiring droughts like this, I suspect.) Consequently, these places are where I had the privilege of meeting many brilliant, diamond-in-the-rough types on their way up.

Best of luck ✊

I can say that most job postings sound like this. Reading through parts of it sound like your spearheading a new initiatiative, some sounds like you will run a team, and some sounds like your running the ticket queue. I don't know if its the lets get someone and expect them to do everything thing or if its the thing where they gather all sorts of things around a job and similar jobs and just plaster them into tha listing without having the direct report look it over. I actually did work for a small place. I was hired by a guy running the IT but he left and the guy who owned the company decided he would save money and take over the role. He did not know what he was doing. He ended up having me move everything to google apps and then when another employee left and did not back up important files he wanted me to say it was my fault for some reason (I think his reasoning was I should have foreseen this and put something up but I had been telling him the whole time we should make sure people keep their stuff on the backed up file server) and I said no and he let me go. I was annoyed to have to go find work and not be getting a regular paycheck for awhile until I did but otherwise was not unhappy to be away from the place. Should have started looking for a new gig after my boss quit and he decided he could just cover the IT management himself.

100% agree with you on all points.

Company I worked for was owned by private equity. We didn't make enough money so they said we're bankrupt. a month or so later my first child was born. It has been 9 months and I need a job. My résumé is very Linux, CI/CD, devops heavy. I've been applying to everything. No idea why a windows shop even considered me but here we are. I'll be driving an hour away from home for the privilege of being abused, underpaid, and being away from my family.

I'd also recommend, especially once established, not working more than 40 hours.

If they want more help, they can pay for more help. Don't sell yourself for free.

In many, if not most, startups and small companies titles don't mean much. You have to do more than you were usually hired for.

Try and learn as much as you can as fast as you can and then either ask for more money or look for another job.

As long as the environment is not bad, it may be a good learning experience. When I compare my startup years to some of my co-workers who never worked at a startup I was able to learn a lot more than them. Many of my co-workers have only worked at large companies so they were never exposed to a wide range of tasks because in larger companies jobs are far more segregated and specialized.

This could be a growth opportunity but you have to put your management hat on. You're one person with part time help. You need more resources which will come in the form of contractors and consultants. To get these you need a plan of what has to be done and how it drives value to the business. Financial risk is going to be a big driver for most businesses.

First thing is you need actionable intelligence. You want to assess the state of things, figure out what kind of risks exist and do business impact assessments on the most severe issues. This is what leadership needs to authorize budget. Your CEO having global adminis not a business problem. Over permissive permissions that could lead to a compromise that causes a regulatory penalty is. Things have to tie to money.

Microsoft has a pile of assessments you can run here:

https://learn.microsoft.com/en-us/assessments/

Fixing M365 sounds like a priority. Getting help doing a CIS assessment wouldn't be a bad idea either. Using cybersecurity as a driver for change works very well because you surface a lot of risk.

If they want you to grow into a senior or manager role then don't be everything guy, delegate. It sounds like there's lots of higher value stuff to attack if you can convince leadership to let you offload some tasks.

Also keep your scripts somewhere. Git/github/codeberg/etc... or hell a flash drive. It help later on when job jumping. Think of it as wisard spells and a spell book.

One other thing: get all requests in writing, or confirm them back to the requester in an email if they insist on giving verbal instructions. This will save a lot if miscommunication and misunderstanding. Instigate a ticketing system if you can, and only process tasks through that. Add the tasks yourself if you have to. Users may start off hating it, but they'll come to appreciate being able to see how their request is progressing, and what else you're being asked to do.

Saw this post while taking my morning dump and came back to specifically make a similar comment.

This sort of job is a decision. You'll be objectively underpaid. Be real, everyone here knows the reason they hired a junior admin is because they only wanted to pay for a junior admin. Anything other than that they say is spin.

But, they're right that there's room to grow. If you're capable of it, this job will give opportunity to massively expand your skillset. They've brought growth into conversation, so see if they'll spring for training or at least books (after you've identified specific ones that would be helpful). They've already forgiven some mistakes, so take the opportunity to be a little more adventurous for the sake of learning something. You won't be getting your full value in salary, so extract some through the opportunities to gain experience that's beyond the normal scope of a junior role.

After a year or two, push for a promotion. Raise would be good, but settle for formally dropping the "junior" in your job title if you have to. You'll have more experience, more skills, and a resume showing a quickly earned promotion. That's when you can begin the earnest search for the next role. How earnest will be a function of how much you like it there, how much you feel you've left to learn, and how open they are to the idea of paying you on par with your growth to that point.

Also, since it wasn't said, "Learn Powershell in a month of lunches" is available as a free pdf download.

This sounds pretty normal for a small company that doesn't really understand its I.T. needs yet.

Aim to automate as much as you can, you'll be busy enough without having to perform the boring, but necessary, repetitive tasks like handling user on-boarding, off-boarding, password resets, and permission changes. I've generally found that it's best to do a job manually first, noting down everything, then aim to automate it the second time, because, if there was a second time, there'll be a third, fourth, fifth, and so on ad-nausiam.

Try to also automate testing. A script that can sanity check permissions, paths, and the like will save you many painful hours of debugging as you can test every change, rather than working out that the quick fix you did last Tuesday has broken the CEOs access to a critical slide deck today, and needs to be fixed 5 minutes ago.

Document the why, the how, and the what of everything you do. It doesn't need to be fancy, a set of text files is more than enough, but I've been using Obsidian, or vimwiki on Linux, and it will save your bacon when you need to figure why something is the way it is, how you can fix it, and what to change. If you do use a wiki, keep a daily journal, but link the entries to pages about the relevant services. Don't store the wiki on sharepoint, or you risk not having access when you need to fix sharepoint.

Set up an internal monitoring service that can notify you if a service goes down, or one of those tests you automated starts to fail. You will seem like a wizard when you're already fixing a problem before anyone else notices.

Seen as the CEO has admin access, as, presumably, does the external IT person, enable audit logging on everything. That way, when something breaks, you'll know who did it, and what they did, even if it was you.

As others have said, this will be hard, but it's a massive opportunity to grow your skillset rapidly, in an environment that sounds like it may tolerate some mistakes.

Good luck.

I don’t know how many employees the m365 platform needs to serve but where i work there are multiple dedicated teams to manage it all.

But we also do have hundreds of unique functions and roles that all need their own set of rights and permissions with regular audits wether permissions are to loose/underused.

No one in IT has local admin anymore but we do have a (logged) way to temporary elevate ourselves to local admin when needed.

CEO with global admin privileges is a red flag

They will get hacked.

It will be his fault.

You will get blamed for it.

They didn’t hire a it manager because they don’t want to pay for one. I don’t know how the culture is there but from your description, it doesn’t sound good. I would keep my options open outside the company if it were me

Pretty normal for a small company. The boss thinks they’re an IT god (I need global admin), they think they are outsourcing everything, and you just need to do a few little things here and there.

It can be a good way to learn, but you need an exit strategy. It’s a small company, so documenting everything won’t protect you (outside of a legal issue), because it’s not going to be read by someone other than the one firing you and you probably won’t accrue enough time to make a wrongful dismissal suit worthwhile if that were to occur. But the mindset can help with making the right choice instead of the easy one.

They might spring for some certifications, see what you can get.

It’s an extremely common small business pattern across North America. The “CEO” is usually the owner, evidenced here by absorption of non-fiduciary (unnecessary) liability of roles elevation. Only a handful of hires are traditionally qualified for their roles by education or experience. These few are usually found in client-facing roles and usually at least partially compensated by stake. Most employees are budget hires working well outside the usual expectations of their title.

Employer abusiveness in these shops goes mostly unchecked. Wanting someone who can “grow with the company” with clearly no intent to grow them (i.e., no mentor, no reporting senior to justify the title “junior”) is code for a lot of things including this. Part of why these companies only prefer to hire younger or underqualified people is because they don’t want anyone who knows what they’re worth, how things are done better elsewhere, who might expose management incompetence, or who are simply less likely to accept abuse (because even if management hasn’t rationalized it totally, they do not intend to change).

On the other hand, the subtle upside to lack of training and oversight is the opportunity for self-directed (and thus potentially much higher value) up-skilling and continued job-hunting, for those inclined.

So companies like these are viable, but crucibles, and for most should only be considered a last resort.

Document everything and try to force a title change to better reflect the position (even without more money) so that you'll have an easier time finding a higher position when you leave.