Sole IT for a place with
no maintenance window.

The environment, by the numbers

Users supported

~120

Sole IT since

2019

Windows endpoints

~70

iOS and iPadOS devices

~26

Hosts / VMs

2 / ~16

Wireless APs

~40

POS terminals

~60, 3 platforms

Mailboxes

~80, hybrid Exchange

Operating days / year

364

Owned end to end: ticketing, RMM, provisioning from directory account to POS login, patching, license renewals, runbooks, and the security awareness program. 30 to 40 tickets a month, though in a restaurant most support never becomes a ticket. It's someone catching you in a hallway during dinner service.

Finding the accounts that outlast the people

Problem

Nothing systematically told the directory when someone left, so it drifted from the HR record of truth. Accounts could stay active and licensed after a person was gone. I stopped treating manual notification as a control and built one that doesn't need it.

Built

PowerShell exports the current Active Directory user list. A Python script compares it against the monthly HR roster and reports every account with no match for review and disablement. Runs monthly as a standing access review.

Result

Departures are detected from HR's own records instead of a handoff that has to be remembered. Stops Microsoft 365 license spend on people who no longer work there.

The switching loop with no logs to read

A POS segment of about 26 terminals and their payment devices went down. The segment ran on unmanaged switches, so there were no logs and no port statistics to query. I isolated it by walking three floors and pulling uplinks switch by switch, then port by port on the suspect switch, until the segment recovered. The cause was a VoIP phone cabled backwards through its PC pass-through port, a switching loop on a segment with no spanning tree to break it. Resolved without escalating. The follow-up was cabling training for staff.

One report instead of two spreadsheets

Problem

I proposed the phishing simulation and training program, picked the platform, and run it solo across 366 accounts company-wide, past the 120 users I support directly. Training completion and simulation results come out of it as separate exports. The people who matter most are the ones in both, who failed a simulation and skipped the training, and finding them meant cross-referencing by hand every week.

Built

A parser that reads both exports and produces one weekly report, ranked so the highest-risk users are at the top.

Result

About an hour a week back, roughly fifty hours a year. Failed phishing simulations have more than halved since the program's first month.