SysAdmin Weekly

The kernel is just software. It happens to be the one program on the box with no guardrails, which is why one bad driver takes the whole system down with it.

Andy Syrewicze and Eric Siron walk the kernel from the bottom up: why running two programs at once needed a supervisor, how user mode and kernel mode split the work, and where IRQs, drivers, and the HAL fit. Andy strips a Gentoo kernel so thin it cannot find its own hard drive, and Eric argues a blue screen is the kernel protecting your data. Then they weigh whether Microsoft should push third-party code out of kernel space after CrowdStrike. Up front: Microsoft deleting nonprofit tenant data early, and a listener choosing between Network+ and the server certs.

Chapters:

00:00:00 - Cold Open: Kernels Are Not Magic

00:01:33 - Welcome and Show Plugs

00:05:05 - News React: Local AI and the Surface Laptop Ultra

00:07:47 - Anthropic, Bot Swarms, and the Local Model Threat

00:10:57 - Can You Trust the No-Training Checkbox?

00:14:05 - News React: Microsoft 365 Family Storage Cut

00:14:46 - Microsoft Deletes Nonprofit Data Early

00:17:33 - The Cloud Trust Problem

00:19:10 - Retention Is Not Backup

00:21:12 - Listener Question: Help Desk to Junior SysAdmin

00:23:51 - Get the Certs for the Job You Want

00:27:06 - Get the Job First, Then the Certs

00:30:44 - Is Security+ Worth It for a Generalist?

00:32:15 - Main Topic: What a Kernel Actually Is

00:33:54 - From One Program at a Time to Many

00:35:25 - Hand-Written Drivers and the Video Card Virus

00:36:05 - The HAL Ended a Whole Category of Attacks

00:37:29 - Where the Word Kernel Comes From

00:39:02 - Mandrake, Debian, and Gentoo

00:40:48 - Kernel Mode vs User Mode

00:42:48 - Before Memory Protection: DOS to Virtual Memory

00:45:14 - Kernel Mode Drivers Run Without Guardrails

00:45:51 - IRQs, TIE Fighter, and Windows 3.1

00:46:58 - A 2026 Kernel Bug That Fought Over an IRQ

00:49:56 - Install Gentoo Once to Learn the Kernel

00:52:44 - Andy's Razor-Thin Kernel Panic

00:54:14 - ARC Paths and NT Boot Failures

00:57:06 - What Happens When Kernel Code Misbehaves

00:57:51 - CrowdStrike and the Botched Kernel Update

00:58:39 - Why the Blue Screen Is the Right Call

01:01:32 - Should Microsoft Lock Down Kernel Access?

01:02:44 - Wrap Up and Outro

Resources / Show Notes:

- SysAdmin Weekly 036 - The Hidden Cost of Abstraction: https://youtu.be/5ic4Pozot44

- Eric Siron - Kernels, Shells, and Operating Systems (Re)Visited: https://projectrunspace.org/kernels-shells-and-operating-systems-revisited/

- Microsoft Learn - User mode and kernel mode: https://learn.microsoft.com/en-us/windows-hardware/drivers/gettingstarted/user-mode-and-kernel-mode

- Gentoo Handbook - Configuring the Linux kernel: https://wiki.gentoo.org/wiki/Handbook:AMD64/Installation/Kernel

- Microsoft - CrowdStrike outage response: https://blogs.microsoft.com/blog/2024/07/20/helping-our-customers-through-the-crowdstrike-outage/

- Microsoft - The Windows Resiliency Initiative: https://blogs.windows.com/windowsexperience/2025/06/26/the-windows-resiliency-initiative-building-resilience-for-a-future-ready-enterprise/

- PCWorld - Surface Laptop Ultra and local AI: https://www.pcworld.com/article/3255200/the-surface-laptop-ultra-is-an-ai-monster-with-a-laptop-problem.html

- The Register - Microsoft deletes nonprofit M365 data: https://www.theregister.com/saas/2026/09/28/microsoft-tells-nonprofits-their-deleted-m365-data-isnt-coming-back/5299433

- SysAdmin Weekly: https://www.sysadminweekly.com

- SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com

- AndyOnTech: https://www.andyontech.com

- Project Runspace: https://www.projectrunspace.org

- GitHub Discussions: https://github.com/ProjectRunspace/sysadmin-weekly/discussions

Free IT training is real and it is actually free. The exam that gets you past a resume screen is the part that still costs money.

Andy Syrewicze and Eric Siron go through the free IT training worth your evenings: Microsoft Learn, AWS Skill Builder, Cisco Networking Academy, the Linux Foundation, and the second tier nobody mentions. Why every big vendor gives this away, what a Credly badge proves to a hiring manager, and how to spot the outfit in your LinkedIn DMs guaranteeing you a CCIE. Eric's old employer paid for every cert he sat, and he explains why that path mostly does not exist anymore.

Chapters:

00:00:00 - Cold Open: Free Training and Getting Hired

00:01:14 - Welcome and Show Plugs

00:04:21 - News React: Microsoft Broke Copy Paste in Excel

00:09:59 - Nadella on Layoffs, and CEOs Who Will Not Stop Talking

00:12:58 - News React: Broadcom Deauthorizes Insight

00:15:17 - Punished for Selling Competing Products

00:17:13 - Broadcom Is Overplaying Its Hand

00:18:24 - Intel, AMD, and the Nasty Gram From 1999

00:20:53 - Gartner: 55 Percent Shopping the Exit by 2029

00:23:12 - Nerd Hour Lightning Round

00:23:49 - MSP Summit and a Tech Channel 101 Idea

00:25:40 - Eric's In-Laws, a Prowler, and Punctured Cans

00:27:40 - A Sixty Dollar Camera With No Account Required

00:30:11 - Main Topic: What Free Training Gets You Hired

00:30:58 - What "Free" Means When a Vendor Says It

00:32:17 - Microsoft Learn and the AI Documentation Worry

00:36:40 - AWS Skill Builder and Cisco Networking Academy

00:38:29 - Credly Badges and Whether Andy Claims Them

00:39:51 - The Linux Foundation and Open Source Everywhere

00:41:41 - Linux Takes You Further, Microsoft Gets You Hired

00:45:26 - PowerShell Aliases and Azure CLI's Linux Accent

00:48:14 - IBM SkillsBuild, Trailhead, and Google

00:48:55 - The Guaranteed Pass Pitch in Your LinkedIn DMs

00:56:50 - A Guaranteed CCIE Means Somebody Is Cheating

00:58:53 - Pluralsight and Where the Cheap Options Sit

01:02:10 - MSPs, Partner Tiers, and Why They Will Still Pay

01:05:33 - A Badge Proves You Finished a Module

01:06:36 - Turning Free Training Into a Callback

01:08:51 - Make Your Resume Look Like the Person Who Does the Job

01:11:22 - Do This Monday: Name the Gap, Then Fill It

01:13:32 - Anthropic, OpenAI, and Certing in Emerging Tech

01:14:13 - Novell NetWare, Dry Copper, and Refusing to Learn

01:17:32 - Jeffrey Snover: Embrace Learning, or Be a Lumberjack

01:18:46 - Wrap Up and the Call for SysAdmin Horror Stories

Resources / Show Notes:

- CRN, top VMware partner Insight deauthorized by Broadcom: https://www.crn.com/news/channel-news/2026/top-vmware-partner-insight-deauthorized-by-broadcom-in-north-america

- The Register, Microsoft patches Windows and Excel and breaks paste: https://www.theregister.com/os-platforms/2026/09/14/microsoft-patches-windows-and-excel-breaks-audio-remote-access-and-paste/5296085

- Microsoft Learn, free modules and learning paths: https://learn.microsoft.com/training/

- AWS Skill Builder: https://skillbuilder.aws

- Cisco Networking Academy: https://www.netacad.com

- Linux Foundation Training, free courses: https://training.linuxfoundation.org

- IBM SkillsBuild: https://skillsbuild.org

- Salesforce Trailhead: https://trailhead.salesforce.com

- Google Skills, formerly Cloud Skills Boost: https://www.skills.google

- Claude Academy, free AI courses from Anthropic: https://academy.claude.com

- OpenAI Academy: https://academy.openai.com

- Pluralsight, pricing and the 10 day trial: https://www.pluralsight.com/individuals/pricing/free-trial

- SysAdmin Weekly: https://www.sysadminweekly.com

- SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com

- AndyOnTech: https://www.andyontech.com

- Project Runspace: https://www.projectrunspace.org

- GitHub Discussions: https://github.com/ProjectRunspace/sysadmin-weekly/discussions

We throw an alert when a disk hits 85 percent. Nobody has ever built the monitoring system for the person who gets the alert.

Andy Syrewicze is joined by Paul Croker, a UK IT pro who founded 404 Stress Not Found, a nonprofit built because tech and cyber people had nowhere safe to talk about burnout. Paul walks through the perfect storm that put him on a Berlin stage telling his own story, and Andy gets into the MSP years that surfaced a generalized anxiety disorder. They get specific about hero culture, the all-nighter nobody asks questions about, and why a wellness app and a pizza do not touch the structural problem underneath.

Chapters:

00:00:00 - Cold Open: An Industry That Is Good at Breaking People

00:01:11 - Welcome and Episode Intro

00:02:12 - Meet Paul Croker and 404 Stress Not Found

00:03:15 - News React: AI Agents Climbing Out of the Sandbox

00:06:31 - The Agent That Hacked a Gym to Get Into Pilates

00:08:13 - News React: September Patch Tuesday

00:08:56 - A Record 974 CVEs and What Is Driving the Curve

00:11:53 - Where Do These Vulnerabilities Actually Live?

00:14:58 - Nerd Hour Begins

00:15:44 - Dan Scott's BES Server Post and the Flashbacks

00:16:27 - Andy's Novell, AS/400, and BES Nightmare

00:18:15 - Paul's First BlackBerry Deployment

00:20:21 - BlackBerry Messaging as a BCDR Channel

00:22:33 - Sonic on a Phone While Everyone Else Played Snake

00:23:23 - Nerd Hour: Andy's Static Site and Caddy

00:25:10 - A Two Line Config, and Why Simple Wins

00:26:19 - Main Topic: Burnout, Anxiety, and Mental Health in Tech

00:27:07 - Paul's Path From IT Generalist to MSP Owner

00:29:31 - The Pax8 Berlin Talk and the Perfect Storm

00:32:57 - Building the Meetups, and Richard Tubb in Newcastle

00:35:08 - Andy on Generalized Anxiety and the Job That Got Away

00:37:48 - Pressure Arrives in Layers

00:39:56 - The Nasty Gram That Was Not About Work

00:41:36 - We Alert on 85 Percent Disk and Nothing on People

00:42:39 - Heartbeats: The Monitoring Metaphor That Actually Fits

00:45:43 - The People Who Show Up to Learn the Warning Signs

00:47:37 - Why IT Is So Good at Breaking People

00:48:32 - Every Interaction Is a Problem, and It Wears You Down

00:51:08 - Attackers Need One Win, Defenders Need All of Them

00:52:04 - Hero Culture and the All Nighter

00:53:31 - Missing Documentation Is Why the All Nighter Happened

00:55:05 - What Does Not Work: Wellness Apps and Pizza

00:57:13 - Go Kick Some Leaves

00:58:28 - Communities Are the Fix Nobody Reaches For Soon Enough

01:00:10 - The Free 404 Portal and Resources

01:01:19 - The Mentor Who Taught Andy to Say "The End"

01:02:26 - You Are Not Your Job Title

01:03:12 - How to Reach Paul

01:04:07 - Wrap Up and Outro

Resources / Show Notes:

- 404 Stress Not Found - Paul Croker's nonprofit for IT and cyber mental health: https://404stressnotfound.org

- Paul Croker - LinkedIn: https://www.linkedin.com/in/paulcrokeruk/

- Richard Tubb - Tech Mental Health Spaces: https://richardtubb.co.uk/404-stress-not-found/

- The Cyber Express - Patch Tuesday hits a record 974 CVEs: https://thecyberexpress.com/patch-tuesday-september-2026/

- Anthropic - Claude Mythos Preview, AI finding and exploiting zero-days: https://www.anthropic.com/research/mythos-preview

- ABC News Australia - AI agent hacks a gym website to book a Pilates class: https://www.abc.net.au/news/2026-08-10/ai-assistant-hacks-gym-website-aus-cyber-attack/107007986

- Caddy - single binary web server with automatic HTTPS: https://caddyserver.com

- SysAdmin Weekly: https://www.sysadminweekly.com

- SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com

- AndyOnTech: https://www.andyontech.com

- Project Runspace: https://www.projectrunspace.org

- GitHub Discussions: https://github.com/ProjectRunspace/sysadmin-weekly/discussions

Microsoft has no intention of making 365 licensing simpler, because the complexity is what gives them room to negotiate.

Andy Syrewicze gets Paul Schnackenburg back on the show to map Microsoft 365 licensing as it actually stands in 2026. The July price increases and the one SKU that did not move, the Defender and Purview add-ons that let a 300 seat shop buy E5 capability without buying E5, the features that left E5 for the Entra Suite, and E7 at $99 per user per month with Agent 365 attached. Paul teaches this to Microsoft partners for a living, and he says the part out loud that most people only suspect.

Chapters:

00:00:00 - Cold Open: You Need a PhD for 365 Licensing

00:01:00 - Welcome and Show Plugs

00:07:11 - News React: The iPhone Duo and V1 Hardware

00:12:07 - News React: Companies Throttling Employee AI Use

00:13:59 - Nerd Hour: Andy's Claude Code Data Pipeline

00:20:15 - Nerd Hour: Cloudflare and Paying for AI Crawls

00:22:35 - Main Topic: Making the Imaginary Lawyers Happy

00:23:38 - Business, Enterprise, and the Office 365 Leftovers

00:25:51 - Business SKUs and the July Price Increase

00:28:14 - Why Paul Treats Business Premium as the Floor

00:28:42 - The 15 Person Firm He Put on E5

00:30:31 - Defender and Purview Add-Ons for Business Premium

00:32:47 - From the Outside, This Sounds Like Lunacy

00:33:41 - Licensing Is Now a Quarterly Job

00:34:58 - Mixing Business and Enterprise Past 300 Seats

00:36:29 - What Separates Basic, Standard, and Premium

00:37:18 - Conditional Access Is the Real Upgrade Trigger

00:38:33 - M365 Maps and the Periodic Table

00:40:07 - The No Teams SKUs and EU Antitrust

00:41:39 - Paying for the Top SKU and Turning Nothing On

00:42:17 - Third Party Security Tools vs the Microsoft Stack

00:47:17 - Thirty Portals and Nobody Can Cover Them All

00:50:04 - Tony Redmond: Too Complex for Humans to Understand

00:51:36 - The Intune Suite Folds Into E3 and E5

00:55:22 - The Add-On Maze and What Purview Gives You

00:59:10 - E5 Is Not the Kitchen Sink Anymore

01:01:10 - The Entra Suite: Governance and Private Access

01:03:02 - E7, Agent 365, and Agent ID

01:05:37 - Purview and Defender Watching Your Agents

01:07:12 - Who Is Running OpenClaw in Your Tenant?

01:07:59 - E7 at $99 Per User Per Month

01:09:07 - The Complexity Is Intentional

01:10:06 - Do This Monday: Audit Your Add-Ons and Renewal Date

01:11:19 - The New Conditional Access Overage Warning

01:12:12 - The One License Myth and Microsoft's Telemetry

01:14:53 - Wrap Up and Outro

Resources / Show Notes:

- Tony Redmond, Is Microsoft 365 Too Complex for Humans to Understand: https://365forall.com/article/is-microsoft-365-too-complex-for-humans-to-understand-blog-by-tony-redmond

- Office 365 for IT Pros, the subscription book Paul recommends: https://office365itpros.com

- M365 Maps by Aaron Dinnage, visual SKU and feature breakdowns: https://m365maps.com

- jumpto365, the Periodic Table of Microsoft 365: https://www.jumpto365.com

- Microsoft Learn, Microsoft 365 and Office 365 service descriptions: https://learn.microsoft.com/en-us/office365/servicedescriptions/office-365-service-descriptions-technet-library

- Microsoft, Business Basic, Standard and Premium comparison: https://aka.ms/M365BusinessPlans

- 404 Media, companies are throttling employee AI use because it is too expensive: https://www.404media.co/companies-are-throttling-employees-ai-use-because-its-too-expensive/

- Cloudflare, new AI traffic options for search, agent and training bots: https://blog.cloudflare.com/content-independence-day-ai-options/

- SysAdmin Weekly: https://www.sysadminweekly.com

- SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com

- AndyOnTech: https://www.andyontech.com

- Project Runspace: https://www.projectrunspace.org

- GitHub Discussions: https://github.com/ProjectRunspace/sysadmin-weekly/discussions

Which protocol you use to reach the box is the least interesting decision you will make about remote access.

Andy Syrewicze and Eric Siron go after the piece they cut from the tools episode. Eric lands the sharpest version half an hour in: what you are actually doing is moving from one-sided authentication to mutual authentication. Around that sit overlay networks against the VPN concentrator, the RMM console as the most attractive target in an MSP estate, the outbound tunnel nobody watches for, and whether just-in-time access holds up at 3am with something down and nobody awake to approve it.

Chapters:

00:00:00 - Cold Open: Remote Access Gets Its Own Episode

00:01:20 - Welcome and Show Plugs

00:04:16 - News React: Anthropic Safety Researcher Resigns

00:12:54 - News React: Broadcom Pulls Public VDDK Access

00:16:21 - Nerd Hour: Eric's Hugo Migration

00:17:24 - Three Gates Against a Runaway API Bill

00:20:38 - Main Topic: The Tooling Is the Small Part

00:23:08 - SSH on 22, and the Port Change Experiment

00:24:21 - Name a Reason to Expose a Management Port

00:27:10 - Overlay Networks, Tailscale, and WireGuard

00:29:31 - Eric: This Is About Mutual Authentication

00:32:20 - RMM Tools and the Central Console Problem

00:33:41 - Do You Need Remote Management All the Time?

00:34:36 - Just Enough Administration Meets Just in Time

00:36:00 - Eric: I Attack the Endpoint, Not the Protocol

00:40:16 - Risk Assessment Is a SysAdmin Skill

00:42:47 - The Firewall Is Also the VPN, and Fortinet

00:45:17 - Outbound Access, Attacker's Side

00:47:32 - Is Anyone Watching Outbound Traffic?

00:50:52 - The 3am Phone Call

00:52:46 - Eric: MFA Everything, No Remember Me

00:55:44 - PAM, PIM, and Where to Read Up

00:56:14 - Nothing Revokes Itself Unless You Build It

00:58:13 - Key Takeaways: Never Rely on One Control

00:59:40 - Access Should Be Ephemeral

01:01:46 - Risk Profiles: Tomcat vs Medical Records

01:03:52 - The Tools: Tailscale, SSH, Remmina

01:07:56 - Eric's Kit: PuTTY, WinSCP, rsync

01:11:17 - Do This Monday

01:13:52 - Wrap Up and Outro

Resources / Show Notes:

- NBC News, Anthropic researcher Jacob Coxon resigns: https://www.nbcnews.com/tech/tech-news/anthropic-safety-researcher-resigned-warning-rapid-ai-development-gamb-rcna596767

- RentAHuman, where AI agents hire people for real world tasks: https://rentahuman.ai

- Brandon Lee (vExpert), Broadcom pulled public VDDK access: https://www.virtualizationhowto.com/2026/09/leaving-vmware-just-got-harder-after-broadcom-pulled-vddk-downloads/

- CISA, hardening Fortinet devices after credential exposure: https://www.cisa.gov/news-events/alerts/2026/06/18/cisa-urges-hardening-fortinet-devices-after-reports-credential-exposure

- Microsoft Learn, Entra PIM, eligible versus active access: https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure

- Tailscale, free Personal plan covers 6 users: https://tailscale.com/pricing

- WireGuard, what Tailscale manages under the hood: https://www.wireguard.com

- Cisco Duo, free tier for teams of 10 or fewer: https://duo.com

- Remmina, open source RDP, VNC and SSH client: https://remmina.org

- PuTTY: https://www.chiark.greenend.org.uk/~sgtatham/putty/

- WinSCP: https://winscp.net

- SysAdmin Weekly: https://www.sysadminweekly.com

- SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com

- AndyOnTech: https://www.andyontech.com

- Project Runspace: https://www.projectrunspace.org

- GitHub Discussions: https://github.com/ProjectRunspace/sysadmin-weekly/discussions

The tools that stay in the kit for a decade are the ones that still work when the network, the domain, or the boot volume is the thing that broke.

Andy Syrewicze and Eric Siron open their real toolboxes and argue about what earns permanent residency. nmap and Wireshark for what is actually on the wire, Sysinternals for what a box is really doing, GParted and SystemRescue for the volume that will not mount, and the chkdsk, DISM, then SFC sequence Eric can run in his sleep. Andy's list skews hard toward triage because MSP work meant walking into a stranger's burning network every week. Remote access is missing on purpose; RDP, SSH, and overlay networks are getting their own episode.

Chapters:

00:00:00 - Cold Open: The Tools That Save Your Bacon

00:01:13 - Welcome and Show Plugs

00:03:11 - News React: Anthropic's Enterprise Frontier Safeguards

00:07:01 - News React: The US Goes Openly Offensive in Cyber

00:12:57 - Nerd Hour: CC Top and a Pomodoro Timer That Remembers

00:15:53 - What Earns a Permanent Spot in the Toolbox

00:17:32 - Why MSP Years Produce a Triage Kit

00:20:13 - nmap, and the Licensed Cisco Utility Story

00:22:31 - Sysinternals and Process Monitor

00:23:16 - Wireshark Past the Basics

00:24:09 - netstat and nslookup Are Not Wizardry

00:25:12 - dig, and Why ping Is Not a DNS Tool

00:27:22 - Test-NetConnection Instead of ping

00:27:59 - Why Anyone Blocks ICMP in the First Place

00:30:11 - MXToolbox, PingPlotter, and the Neighbor's Air Conditioner

00:33:18 - GParted, SystemRescue, and the Live CD Shelf

00:35:58 - chkdsk, DISM, then SFC, in That Order

00:38:06 - DBAN and Decommissioning Disks

00:40:51 - The Multi-Pass Wipe Myth

00:43:25 - Greenshot and Capture Last Region

00:46:07 - Spectacle, Client Hypervisors, Docker and Podman

00:47:33 - Get-Help and man: Nobody Remembers Syntax

00:48:28 - OpenSSL, Qualys SSL Labs, and testssl.sh

00:50:13 - WSL as the Whole Toolbox

00:51:37 - The Everyday List: Vim, Bitwarden, Git, Package Managers

00:54:20 - Remote Access Gets Its Own Episode

00:55:30 - The Platform Tax After Leaving Windows

00:58:18 - Edge on WSL on Windows, for Certificate Chains

01:01:02 - Do This Monday

01:03:31 - Eric's Advice: Go Look for the Tool

01:04:37 - Wrap Up and Outro

Resources / Show Notes:

- Anthropic, Developing Enterprise Frontier Safeguards: https://www.anthropic.com/news/enterprise-frontier-safeguards

- Nmap: https://nmap.org/

- Wireshark: https://www.wireshark.org/

- Microsoft Sysinternals, and Sysinternals Live: https://learn.microsoft.com/en-us/sysinternals/

- MXToolbox, external DNS and blacklist checks: https://mxtoolbox.com/

- PingPlotter, latency and packet loss per hop: https://www.pingplotter.com/

- GParted, and the live image: https://gparted.org/

- SystemRescue: https://www.system-rescue.org/

- DBAN, still there, spinning disk era, not for SSDs: https://sourceforge.net/projects/dban/

- Greenshot, Windows only: https://getgreenshot.org/

- Qualys SSL Labs, tick the box to stay off the public board: https://www.ssllabs.com/ssltest/

- testssl.sh, for internal sites: https://testssl.sh/

- DevToys, clipboard certificate parser: https://devtoys.app/

- SysAdmin Weekly, all show links: https://www.sysadminweekly.com

- SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com

- AndyOnTech: https://www.andyontech.com

- Project Runspace: https://www.projectrunspace.org

- GitHub Discussions, what is in your toolbox: https://github.com/ProjectRunspace/sysadmin-weekly/discussions

Somewhere inside that isolated network, port 22 is open, and it has been open since the outage six months ago that nobody wrote up.

Andy Syrewicze and Eric Siron take apart a term the industry uses constantly and almost never earns. They walk the management plane hole by hole: SSH and RDP so somebody can patch the thing, SMB for the files that have to move, DNS and NTP because nothing works without them, and the iDRAC, iLO, and IPMI boards that get parked on the management VLAN and then never patched at all. The argument they land on is not that a real air gap is impossible, it is that calling something an air gap ends the conversation, and a promise nobody re-verifies is worse than a risk everybody can see.

Chapters:

00:00:00 - Cold Open: Your Air Gap Probably Is Not an Air Gap

00:01:12 - Welcome and Show Plugs

00:04:19 - News React: An AirTag, a Rare Book, and an Amazon Scanning Facility

00:10:10 - News React: Bill Gates Changes His Mind on AI and Jobs

00:13:03 - What the Entry Level Job Market Looks Like Right Now

00:15:05 - When Nobody Is Left Who Knows How to Program It

00:19:25 - Nerd Hour: Claude Code, Agents, and Building CC Top

00:23:54 - Nerd Hour: Moving Project Runspace to Hugo, JavaScript Free

00:28:22 - What an Air Gap Actually Means

00:31:22 - Logical, Network, Virtual: How the Word Got Laundered

00:32:36 - Every Hole You Poke Just to Manage the Thing

00:34:18 - The One Nobody Segments: iDRAC, iLO, and IPMI

00:36:26 - A Brief and Deserved Detour About Printers

00:37:23 - NTP, DNS, License Activation, and Telemetry

00:40:34 - Why Leaving Hyper-V Out of the Domain Is Not Security

00:43:16 - VLANs, Switch Fabric, and Breakout Attacks

00:44:40 - Assume Breach: Zero Trust, JIT, and JEA

00:50:36 - Sneaker Net and Poisoned USB Drives

00:52:20 - Stuxnet and the Gap That Was Real

00:54:59 - How Would You Even Safely Clean a USB Drive?

00:56:58 - Say What You Have, Then Defend It

00:57:29 - The Real Danger Is the False Sense of Security

01:00:23 - The Windows Firewall Lesson

01:03:11 - What a Genuine Air Gap Actually Costs

01:04:59 - Wrap Up and Outro

Resources / Show Notes:

- Symantec Security Response, W32.Stuxnet Dossier, the canonical technical analysis: https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en

- Ralph Langner, To Kill a Centrifuge, on why post-Stuxnet air gap strategies miss the point: https://www.cs.yale.edu/homes/jf/Langner.pdf

- The 2008 USB breach of US military networks, Agent.btz and Operation Buckshot Yankee: https://en.wikipedia.org/wiki/2008_malware_infection_of_the_United_States_Department_of_Defense

- Microsoft Security Advisory 967940, the update that killed USB AutoRun: https://learn.microsoft.com/en-us/security-updates/securityadvisories/2009/967940

- NIST SP 800-82 Rev. 3, Guide to Operational Technology Security, for naming what you actually have: https://csrc.nist.gov/pubs/sp/800/82/r3/final

- 404 Media, tracking a shipment of rare books to an Amazon AI training facility: https://www.404media.co/we-tracked-a-shipment-of-rare-books-it-ended-at-an-amazon-ai-training-facility/

- Semafor, Bill Gates has changed his mind about AI and jobs: https://www.semafor.com/article/08/25/2026/this-is-crazy-this-is-insane-bill-gates-has-changed-his-mind-about-ai-and-jobs

Gates Notes, the essay itself: The turbulent AI era is here: https://www.gatesnotes.com/a-turbulent-ai-era-and-critical-choices-to-make

- SysAdmin Weekly, all show links: https://www.sysadminweekly.com

- SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com

- AndyOnTech: https://www.andyontech.com

- Project Runspace: https://www.projectrunspace.org

- GitHub Discussions, tell us about your air gap and why you have one: https://github.com/ProjectRunspace/sysadmin-weekly/discussions

Two careers, two completely different entry points, and the exact same first catastrophe: data gone, no idea if it was coming back.

Andy Syrewicze and Eric Siron trade full origin stories, from the 486 and the VIC-20 through the first paid tech jobs neither of them was qualified for. They get specific about the failures that rewired how they work, the mentor advice that still holds up decades later, the advice that aged badly, and the question underneath all of it: the on-ramp that produced both of them was cheap hardware, full access, and time to break things, and most of that is gone. Whether that actually matters for anyone starting in 2026 is the argument they finish on.

Chapters:

00:00:00 - Cold Open: How We Actually Got Into IT

00:01:01 - Welcome, Show Plugs, and Why There Was a Gap

00:05:03 - News React: Meta Goes Open Source Again With Muse Glimmer

00:07:55 - News React: Lithium Battery Farms, Data Centers, and Zoning Boards

00:16:39 - Nerd Hour: A Black Hat Demo on Local LLMs and M365 Spear Phishing

00:19:34 - Nerd Hour: Fish Tape, a Whole House Vacuum, and a 160 Degree Attic

00:24:51 - The Stuff We Broke Before Anyone Paid Us

00:26:31 - Andy: The 486, the Matrix Boot Screen, and Getting Told to Change It Back

00:30:41 - Eric: The VIC-20, a Xerox 286, and Overclocking With a Box Fan

00:37:53 - Andy's First IT Job: A K-12 Summer Gig and 30 Cables a Foot Short

00:44:05 - Eric's First IT Job: Freight Dock to Phone Support

00:49:14 - Would Either of These Paths Still Get You Hired Today?

00:56:02 - Andy Nukes the Application Share and Prays at a Tape Drive

01:00:11 - Eric's Version: Dad, I Deleted All Your Files

01:02:46 - Why Almost Every SysAdmin's First Disaster Involves Data

01:04:21 - Advice That Held Up: The Key to IT Is Laziness

01:10:06 - Being Decent Beats Being Smart, and Learning to Say I Don't Know

01:15:01 - Advice That Aged Badly: Always, Never, and Best Practice

01:17:31 - Nobody Ever Got Fired for Buying IBM

01:23:02 - Does This On-Ramp Still Exist in 2026?

01:26:07 - You Do Not Need Commercial Gear to Learn This

01:27:56 - Wrap Up and Outro

Resources / Show Notes:

- VentureBeat - Meta returns to open source with Muse Glimmer: https://venturebeat.com/technology/meta-returns-to-open-source-with-muse-glimmer-an-apache-2-0-licensed-30b-parameter-ai-model-optimized-for-agents-available-now

- MultiState - Federal AI data center policy meets resistance from state lawmakers: https://www.multistate.us/insider/2026/4/14/federal-ai-data-center-policy-meets-resistance-from-state-lawmakers

- Black Hat official YouTube, where the USA 2026 Briefings recordings post: https://www.youtube.com/@BlackHatOfficialYT

- SysAdmin Weekly, all show links: https://www.sysadminweekly.com

- SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com

- AndyOnTech: https://www.andyontech.com

- Project Runspace: https://www.projectrunspace.org

- GitHub Discussions, tell us your first broke something moment: https://github.com/ProjectRunspace/sysadmin-weekly/discussions

"No budget" is almost never no budget. It is no budget yet, and the thing that closes the gap is your ability to put a real dollar figure on the risk you are carrying.

Andy Syrewicze and Eric Siron have both run IT for organizations where getting the credit card out meant you had done something wrong. They walk through what that actually looks like: a PC DOS 4 machine still passing parts in a quality lab, an end of life Cisco ASA swapped for an open source firewall on scavenged workstations, NetGear ReadyNAS units kept on a shelf for SAN emergencies, and the iSCSI arguments that never die. Then the harder part: where the first dollar goes when budget finally shows up, and how to translate aging gear into risk language that a business owner will actually fund.

Chapters:

00:00:00 - Cold Open: Keeping the Lights On With No Budget

00:01:00 - Welcome and Show Plugs

00:03:32 - News React: 25 Companies Sign On for Open Weight Models

00:07:51 - News React: OpenAI, Profitability, and the Missing CFO

00:12:56 - Nerd Hour: A Baldur's Gate Randomizer on GitHub Pages

00:16:02 - Nerd Hour: Unicode, MiniForge, and Why the Human Said No

00:20:51 - Community Comments: Cable Pulls and Fat WIM Files

00:24:34 - The Reality of the Zero Budget Shop

00:29:56 - End of Life Cisco ASA to an Open Source Firewall

00:34:04 - You Do Not Have to Buy Cisco

00:40:00 - Where Open Source Wins: Monitoring, Logging, Nmap

00:43:35 - Budget Storage: NAS Stopgaps and the iSCSI Argument

00:51:31 - Spending the First Dollar on Maximum Risk Reduction

00:52:44 - Backups: The One Place Not to Go Free

00:57:02 - No Budget Usually Means No Budget Yet

01:01:40 - Document the Risk, Get the Decision in Writing

01:03:40 - Wrap Up and Outro

Resources / Show Notes:

- Microsoft - Open Weights and American AI Leadership, the letter itself: https://www.microsoft.com/en-us/corporate-responsibility/topics/open-weight/

- TechCrunch - Industry urges against broad open-weight restrictions: https://techcrunch.com/2026/07/24/as-us-weighs-response-to-chinese-ai-industry-urges-against-broad-open-weight-restrictions/

- Fortune - OpenAI CFO reportedly at odds with Altman over spending: https://fortune.com/2026/04/28/openai-cfo-sam-altman-missed-revenue-target/

- Andy's Infinity Engine party randomizer, the Nerd Hour web app: https://asyrewicze.github.io/infinity-engine-randomizers/

- PomoCLI, Andy's terminal Pomodoro timer: https://github.com/asyrewicze/pomocli

- Miniforge, the package manager Andy declined to add as a dependency: https://github.com/conda-forge/miniforge

- OPNsense, open source firewall: https://opnsense.org/

- pfSense, open source firewall: https://www.pfsense.org/

- Nagios, open source monitoring: https://www.nagios.org/

- Nmap, free network scanner: https://nmap.org/

- Restic, fast secure backup program: https://restic.net/

- SysAdmin Weekly, all show links: https://www.sysadminweekly.com

- SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com

- AndyOnTech: https://www.andyontech.com

- Project Runspace: https://www.projectrunspace.org

- GitHub Discussions, share your no budget stories: https://github.com/ProjectRunspace/sysadmin-weekly/discussions

Sources and clarifications (News React):

- The open weights letter had 25 signatories on July 24, 2026. OpenAI and Google were absent that day and signed by July 26; the list has since passed 270. Anthropic has not signed.

- Eric flagged the Sam Altman "no path to profitability" clip as possibly a deep fake, and we could not verify that specific video. The underlying reporting on OpenAI's CFO and spending tension is real; see the Fortune link above.

Windows Admin Center is a genuinely useful tool wrapped in an on-ramp so rough it took Andy four hours, a from-scratch certificate authority, and a pile of misleading error messages just to reach the login screen.

Andy rebuilt his lab on an all-Core Windows Server 2025 fleet, set out to manage it from a browser the way Microsoft keeps telling us to, and hit a certificate wall that most SysAdmins would never fight through. He and Eric Siron walk the full gauntlet: the 60-day self-signed cert trap, an ERROR_DS_RANGE_CONSTRAINT that pointed the wrong way, a web server template that blocks computer requests, a silent blank SAN that kills the HTTPS binding, and the bigger question of whether a web tool is even the right way to manage Windows. Along the way: a News React on open-source AI, China, and a possible federal clampdown, plus the domain-join debate that never dies.

Chapters:

00:00:00 - Cold Open: Four Hours to Install a Free Tool

00:01:15 - Welcome and Show Plugs

00:03:52 - News React: Apple, the EU, and the Walled Garden

00:08:55 - News React: Open-Source AI, China, and a Possible Federal Clampdown

00:16:00 - Nerd Hour: Ripping Out KVM, Putting Hyper-V Back

00:18:55 - Setting the Scene: An All-Core Lab and the Certificate Wall

00:30:08 - The Four-Hour Gauntlet: A Sequence of Failures

00:44:00 - What WAC Gets Right, and Where It Falls Down

00:59:24 - Azure Arc and the Real Agenda

01:07:45 - Does WAC Move the Needle? The Verdict

Resources / Show Notes:

- Microsoft - Windows Admin Center overview: https://learn.microsoft.com/en-us/windows-server/manage/windows-admin-center/overview

- Hornetsecurity (Eric Siron) - Public Key Infrastructure explained, including why to stop using self-signed certificates: https://www.hornetsecurity.com/en/blog/public-key-infrastructure/

Sources and clarifications (News React / AI segment):

We referenced several press claims from memory during the AI segment. The claims hold up, but a few were under-attributed on air, so here is the precise record.

- Moonshot AI - Kimi K3, the open-weight model released the week before we recorded that benchmarks near frontier US models. The whole news cycle is downstream of it: https://venturebeat.com/technology/chinas-moonshot-ai-releases-kimi-k3-the-largest-open-source-model-ever-rivaling-top-u-s-systems

- Dean Ball, OpenAI's Head of Strategic Futures and a former senior AI adviser in the Trump administration, is the source of the "AI communism" line, in a post on X. On air Andy first said "CEO of Claude" and "CEO of Anthropic," then corrected to "someone from OpenAI." The correct attribution is Ball at OpenAI, NOT Anthropic. Naming note: Claude is the model, Anthropic is the company: https://x.com/deanwball/status/2078133895766114412

- Dean Ball - follow-up clarifying he was predicting that outcome, not advocating for it: https://x.com/deanwball/status/2078619513575137330

- Axios (July 20, 2026) - the federal-action angle. Frame it as reportedly under consideration; no formal policy has been proposed. Mechanisms discussed include Commerce Entity List additions, security advisories, and federal procurement rules: https://www.axios.com/2026/07/20/ai-us-china-open-source-kimi

- David Sacks, former White House AI adviser, publicly argued that closed labs want the government to eliminate their open-source competition, in a post on X: https://x.com/DavidSacks/status/2078826291638522127

- Dario Amodei has called open-source AI a dangerous path; the source quotes are collected in this r/Anthropic thread: https://www.reddit.com/r/Anthropic/comments/1ui759l/amodei_says_open_source_is_dangerous/