We have a small IT team that occasionally needs to share passwords for certain systems and service accounts.

For example, we might create a service account that reads AD, but I'm the only one who knows the password. A year later, someone on my team needs to rebuild or upgrade the server, and they have to come to me for the credentials.

What are you all using to manage and securely share passwords within your IT teams? I've been looking at Bitwarden, and it seems like a good fit, but I'd like to hear what others recommend.

Also, what do you typically store in a shared password manager versus keeping somewhere else? For example, service account passwords, API keys, secrets, etc.

Curious what everyone is doing and what best practices you've found work well.

A customer asked for a SOC 2 report and it landed on me in IT. No hire, no budget, just a deadline. We're around 200 people.

Do I push for a hire, bring in a consultant, or find something that does more of the actual work? What did you do when this landed on you?

​ Its a long post, please dont hate me 😭

I joined my current company as a Senior Data Analyst, expecting a primarily technical role. However, the projects turned out to be a mix of data analytics, development, engineering, and automation. It was quite a learning curve, and I spent countless hours, including nights, learning the technical side and figuring things out. We don't even have access to AI coding assistants due to budget constraints.

About three weeks after joining, I learned that the company had canceled its plan to hire a dedicated team lead due to budget issues. Instead, they decided to make me the lead because I was the most senior person on the team, although the experience gap between me and my closest teammate is only about 1.5 years.

Now I'm leading three people while still being a full-time technical contributor.

One teammate works on the same project as me, while the other two work on completely different projects.

My responsibilities suddenly include:

- Gathering requirements from business stakeholders and translating them into technical tasks.

- Planning projects, assigning work, and tracking progress.

- Overseeing other team members' projects, even when I'm not directly involved in their technical work.

- Coordinating with multiple teams to resolve access issues, dependencies, and blockers.

- Communicating with clients and stakeholders across different projects.

- Participating in interviews, sometimes with little advance notice.

- And, of course, delivering my own technical work.

The biggest challenge is that I've never been a lead before, and nobody has really shown me how to be one. My project manager has limited availability, so I often end up figuring out everything myself.

I recently made a mistake on one of my projects. Coming from a technical background, I wasn't experienced in properly scoping a project, gathering and documenting requirements, or managing changing expectations. The client kept adding or modifying requirements through chat, and I kept implementing them without formally assessing their impact on the timeline or scope.

Naturally, the project started getting delayed, and now I'm realizing how important requirement management, planning, and stakeholder communication actually are.

Another challenge is my personality. I'm naturally soft-spoken, polite, and somewhat shy. My manager has told me multiple times that I need to "act like a lead" and be more assertive.

But what does that even mean in practice?

When I'm interacting with stakeholders, especially those from my teammates' projects, I find myself responding like an individual contributor rather than someone responsible for the project. I'm often too agreeable, hesitant to push back, and unsure how to take control of discussions.

I also find it difficult to manage teammates, especially when expectations aren't met, because I'm not naturally confrontational.

Here's the confusing part: I actually enjoy learning all of this.

I'm genuinely interested in leadership, project planning, business discussions, and decision-making. I can see myself growing into a management-oriented career. But right now, I'm overwhelmed because I'm learning technical skills, leadership, stakeholder management, and project delivery simultaneously, mostly through trial and error.

I don't have a mentor or someone experienced I can regularly turn to for guidance.

For those who've transitioned from an individual contributor to a team lead:

How did you learn to manage projects and people without prior leadership experience?

How do you handle constantly changing client requirements without becoming the person who says yes to everything?

How do you become more assertive and establish yourself as a lead when you're naturally soft-spoken?

And most importantly, how do you balance your own technical deliverables with managing other people and their projects?

Are there any practical frameworks, processes, books, or resources that helped you during your first few months as a lead?

I'm not looking to quit or escape the responsibilities. I genuinely want to become good at this. I just feel like I've been thrown into the deep end without knowing how to swim.

Any advice, including things you wish you'd known before becoming a lead, would be greatly appreciated.

 Exchange transport rules and inbound display-name filtering keep our mailboxes clean. That layer works and attackers moved off the corporate mail flow entirely.

Within 72 hours of a new hire publishing a role update on LinkedIn, an SMS lands on their personal phone. The message uses the exact display name of our CFO, references their specific department, and asks for urgent assistance buying Apple gift cards for a partner event. Two junior employees complied last month before anyone in their reporting line knew about it.

Corporate IT maintains zero management profiles on personal devices. Scammers pull names from public professional profiles, match phone numbers against commercial breach dumps, and run the fraud off-network.

Where do you draw the boundary between external asset discovery and internal security training when the attacker never touches corporate infrastructure?

Hi everyone,

For those of you managing Nextcloud installations for customers, I'd like to introduce NC Connector.

Version 3.5.0 has just been released for both Thunderbird and Outlook Classic.

We're also celebrating one year on GitHub! The project itself started about three years ago.

NC Connector consists of three open-source components: a Thunderbird extension, an Outlook Classic add-in, and a self-hosted Nextcloud backend for central administration.

The backend is particularly relevant for companies and MSPs managing multiple users. It runs directly on the customer's Nextcloud instance and provides a central place to manage how the email integrations behave.

Central administration

Through the Nextcloud backend, administrators can manage:

Central settings and policies, including settings that users cannot override

Different configurations for individual users and groups

Centrally managed email signatures with templates and user-specific information

Templates and branding for file sharing, password notifications and Talk invitations

User and license seat assignments

Delegated administration

Managed deployment and configuration through Thunderbird policies and the Windows Registry for Outlook Classic

The goal is to configure the integrations centrally rather than having to set up and maintain each email client individually.

Email signature demo

File sharing and attachment handling

Users can share files and folders from their own Nextcloud directly while composing an email.

Large attachments can be uploaded automatically and replaced with Nextcloud sharing links. Sharing permissions, expiration dates and password protection can be configured without opening the browser.

Thunderbird also supports selecting files from additional storage sources through compatible provider extensions.

File sharing demo

Nextcloud Talk

Talk meetings can be created and managed directly from calendar appointments in Thunderbird and Outlook Classic.

Meeting links are added to the appointment, with options for passwords, lobby and other Talk settings.

Talk demo

Room and resource scheduling – new in 3.5.0

The latest release adds room and resource scheduling to both email clients.

When creating a calendar appointment, users can browse available Nextcloud rooms and resources, check their availability and add them directly to the event.

There's a daily schedule showing free and occupied time slots, along with filters for capacity, equipment, location and availability.

This works with Nextcloud's native Calendar Resource Management app and RoomVox.

Room and resource demo

Self-hosting and data handling

The backend is a Nextcloud app installed on the customer's own Nextcloud server. Its settings, policies and templates are stored in the customer's Nextcloud database.

Files are transferred directly between the email client and Nextcloud. Email contents, attachments and Talk data are not routed through NC Connector-hosted servers or proxies.

There are separate version checks and, where applicable, license checks, but these do not transfer file or email contents.

Licensing

The backend is free to install and includes one permanent Community seat with access to all features, including central management, signatures and room/resource scheduling.

For teams, Pro costs €1 per user/month excluding VAT, starting at five users. Administrators can assign and manage seats through the backend.

The basic client integrations can also be used without central management, but backend policies, central signatures and room/resource scheduling require an assigned seat.

Technical requirements

Outlook Classic is supported, not the new Outlook.

Calendar booking in Outlook Classic requires Outlook CalDav Synchronizer and a synchronized Nextcloud calendar.

Thunderbird uses its native Nextcloud CalDAV calendar with server-side scheduling enabled.

All three components are open source under AGPL-3.0.

GitHub repositories:

Thunderbird: https://github.com/nc-connector/NC_Connector_for_Thunderbird

Outlook Classic: https://github.com/nc-connector/NC_Connector_for_Outlook

Self-hosted Nextcloud Backend: https://github.com/nc-connector/Server_Backend

Website: https://nc-connector.de/

looking at document processing for a team in a regulated space, finance plus some healthcare paperwork. mostly contracts, claims and invoices, a fair amount of them messy or image only.

the model reading the text well is the easy part to evaluate. the stuff around it is where the shortlist keeps changing:

- where files get processed, and whether theres a self hosted or in-tenant option

- soc 2 and HIPAA paperwork, and whether a BAA is on the table

- an audit trail that ties every field back to the page it came from

- what happens on low confidence, does it go to a person or just pass through

- per page pricing vs a seat based contract

the older ocr suites have the compliance side sorted but take months to set up. the newer api style tools and open source stacks run in house move a lot faster but leave more of the review workflow on your own team. the list right now has things like docling, llamaparse and a couple of the older suites on it.

for anyone who rolled one of these out across a bigger org, what ended up mattering most once it was live? and did the human review step for low confidence stuff turn into the real cost??

Hi everyone,

I've been working in IT for well over a decade, starting in technical support and gradually progressing into IT operations, management and broader technology responsibilities.

I've recently moved into a more senior IT leadership position, with responsibilities covering IT strategy, governance, cybersecurity, risk and compliance, and managing external IT providers.

While I have plenty of technical and operational experience, I've realised that stepping into senior leadership is quite different. There's much more emphasis on strategic decisions, managing expectations and balancing business priorities.

One thing I've found particularly challenging is the isolation. Being the person responsible for technology decisions means there isn't always someone internally to bounce ideas off, challenge my thinking or simply discuss the day-to-day pressures of the role.

I'm keen to learn from more experienced IT leaders and connect with others navigating similar challenges.

For those who've made this transition, how did you find your feet? Did you have mentors or peer networks that helped? And how do you deal with the isolation that can come with senior IT leadership?

Would be great to hear your experiences and connect with others here.

A lot of orgs took sites offline this week over PHP2Shell, including dozens of UK government services. That was legit advice: the NSA literally said take it offline if you can't update right away.

But the fix shipped the same day the bugs went public, with a day of advance notice before that. So the orgs that stayed dark mostly weren't waiting on a patch. They were stuck on "where is PHP running, which version, and who owns it?"

And then someone has to make the call: patch these now, isolate those, keep the rest up. Without a person who has both the context and the authority, it tends to go to whoever's loudest, so you get either "wait till the weekend" or "unplug everything."

Who made that call at your place? Did they have an inventory to work from, or were people grepping through old wikis?

Longer write-up here, disclosure: I work at a consultancy that does this kind of work:
https://www.apidemia.com/knowledge-base/did-php2shell-scare-you-into-turning-your-site-offline-hire-a-cto/

We’re a ~100-person German B2B company with a very small internal IT team. Our MSP handles network, servers, backups, Microsoft administration, security, etc. They have 500+ employees, position themselves specifically towards SMEs, and we’ve worked with them for 8–10 years. We’re now spending low six figures annually including tools/licenses.

Day-to-day technical work is mostly fine. Our dedicated sysadmin works closely with us and is onsite once a week.

The problem is the manager who is supposed to be our main point of contact.

Three recurring issues:

Deadlines mean very little. Tasks with agreed scope and deadlines get delayed by weeks or months. I repeatedly get “next week” instead of a realistic timeline. I’d genuinely prefer “this will take six weeks” over six consecutive promises of “next week.”

Almost no proactive planning. I recently asked what projects/topics we should budget for next year and basically got “I think we’re good.” Once I suggested several things, the response was, “Oh yes, those are important, we should definitely do them.” This happens regularly.

It’s systemic. This has been happening for years and we’ve discussed it several times this year alone. Individual delays are always explained by sickness, vacation, another priority project, etc. All understandable individually, but at some point the pattern itself becomes the problem and it’s in no way acknowledged as such by the manager.

I’m not expecting the MSP to run our IT strategy for us. But at our level of engagement, I do expect agreed deadlines to mean something, realistic communication about capacity, and some proactive account/project management.

Instead, I feel like I’m increasingly project-managing the person who is supposed to be managing our account, without actually being able to move anything forward.

Am I expecting too much? Is this fairly normal with MSPs, or would you consider this poor service?

I don’t really want to switch because the technical relationship works reasonably well and migration would be painful. But after repeatedly raising this without much improvement, I’m wondering whether it’s time to formally escalate to his manager and, if that doesn’t change anything, start looking elsewhere.

I'm relatively new to the MSP world and work on the sales/client relations side.

One thing I'm realizing pretty quickly is that selling IT is completely different from selling most other services. There's a lot more trust involved when someone is responsible for a company's entire setup.

For the IT managers here, what's something an outside IT provider can do that immediately makes you respect them more? And what's an instant red flag?

Most of our employees desperately want to use AI workspace platforms, but we can't allow them due to our firewall.

I wanted to know how we can implement the AI usage policy for these platforms so we have full clarity and control over AI usage.

I have a 24 hour contract but I basically never do 24 hours at my job and iv worked there for nearly 2 years. I sometimes only do 28 but usually it’s 30+ even 40. I’m meant to only be 4 days a week but often I do 6 to 8 days in a row with 2 days off and then back in. I wanted to know if this is just normal ? Is this even good for the company? Because i noticed on my rota basically every other employee also gets quite a bit of overtime consistently. Surely this must be costing a fortune. And of course it can be very tiring. Welcoming any opinion!! If I’m just being daft I get it lol

We’re about 100–150 people with a small IT team. Windows is Intune/Autopilot, Macs are on Iru (formerly Kandji), and engineering has some Linux machines. Not tackling phones/tablets yet.

I’m trying to tighten things up without creating a bunch of busywork or breaking everyone’s workflow. We’re not a government contractor or chasing a particular certification. Just want to do a better job protecting our stuff.

What I’d like is normal access from company-issued, managed machines. On a personal computer, you could use Outlook/SharePoint/OneDrive in the browser, but no downloading files locally or syncing. Saving an attachment straight to work OneDrive would ideally still work.

I also don’t want someone enrolling their own laptop and having it suddenly qualify as a trusted company device.

We have Firefox, Chrome, Brave, and Safari in use. I know Edge makes some of the Microsoft stuff easier, but forcing everyone onto Edge wouldn’t be my first choice.

Anyone running something similar? Are you using CIS benchmarks, Microsoft baselines, NIST, or just picking what makes sense for your environment?

Really interested in how you’re handling Linux and different browsers with Conditional Access. Also curious whether Iru’s Microsoft compliance integration has been reliable for people.

Do you allow personal computers browser-only access, or did you decide it wasn’t worth the hassle and block them entirely? Any settings you rolled out thinking “this is a good idea” and then regretted?

Would appreciate hearing what’s actually working for other small teams.

P.S. Mods, if this breaks any rules or belongs somewhere else, please let me know. I’ve had posts removed before without understanding why, so I’m happy to edit it if needed.

Title. We're looking at some MS renewals and wanting to explore SHI as a competitive bid for our incumbent VAR.

Looking for contact info for a commercial rep in the southwest, prefer Arizona if possible. Someone you've worked with for a while and actually answers emails and has a responsive team.

I keep reading posts and articles talking about how "companies are deploying AI agents" and, for the life of me, few to none of my peers are actually doing so. Maybe it's because I spend most of my time in small to mid-sized business or that I define "AI agent" differently.

Curious, are you deploying agents at your company?

If so, what does an agent mean to you?

What are the tasks they are doing?

What is the experience like?

Help me understand! :)

Thank you.

Newish manager in a SMB.

I am currently looking for a new partner to purchase licenses for our Cloud Office Suite/IdP. Big purchase and we are looking to commit for 3 years. First time going with a partner on this as previously we have purchased direct. And this would be my first big purchase for an important piece of software the company lives on.

I have met with 4 different partners. 3 have given somewhat similar pricing with 1 having the lowest. The 4th vendor is the most expensive but also seems to have the more experience so that lines up with their pricing.

When you are all looking for something similar, what is most important for you? Is price the number 1 thing you are looking for or what other factors are you considering?

I feel conflicted because we are an SMB and always look to make sure not to spend too much, so I want to keep our spending low. But we also prefer longer term contracts (for savings) and I dont want to just go with the cheapest option and find out 6 months into the 3 year contract that the partner is just terrible at support.

Any advice is appreciated!

I work for a small aerospace/defence manufacturing company tha has an established AS9100 QMS. I lead the IT department, and am in charge of developing our ISMS, based off of ISO 27001. With that we’re also trying to build up a lightweight ITSM framework, using ISO 20000 as inspiration. We need structured, accountable IT operations, the previous IT manager was more ad-hoc/cowboy style of getting things done.

Our ISMS/ITSM is under development, and we havent persued 27001 certifictaion yet.

I am firm in my beliefs that the ISMS/ITSM, and QSM need to have clearly defined roles/responsiblities/authority, not having one management system be subordinate to another. I am getting serious pushback from the existing QMS manager, who thinks that the existing QMS is the overarching management system and that every thing falls under it.

I feel that the ISMS should be a peer of QMS, not subservient to it.

I do know that the QMS and ISMS/ITSM will need to interact to some degree, I would like to use the ITSM service catalog, SLOs and their associated assurance evidence to act as the “bridge” between ISMS and QMS

Specifically I’ve had pushback over document control. The QMS manager believes that all policies/procedures/work instructions fall under the QMS doc control authority ( numbering, formats, approvals & revisions) I’ve proposed ISMS specific doc control using git for versioning and LaTex for authoring. Even the choice of using LaTex has been challenged as being “incompatible with the company”

The QMS Manager has made statements that they expect the existing QMS representative ( He’s now been calling himself the Integrated Management System representative) should serve as the final authority over other management systems, regardless of scope or domain.

I do see that there are some ( limited )areas that could share responsibilities like user training. A lot of the existing tools/programs skew heavily to the QMS. For example Corrective Actions are tied to customer satisfaction. That may be okay for QMS, but not so much for the ISMS.

My main concern is that allowing the QMS manager to have such a wide swath of authority in the ISMS, I’ll be run roughshod over and the ISMS will be subordinate to QMS.

Please tell me Im not crazy or stupid for thinking that the ISMS and QMS should be equals and that there should be a clear deliniation between the two ( with shared information where appropriate)

If you are a salesperson, vendor, SaaS app, or anyone else who isn't an IT manager that wants to share news, ask questions/get feedback, etc. then please post below!

I'm starting to look for an audit firm for our SOC 2, and it's been harder than expected to figure out how to choose one. Pricing and timelines are easy enough to compare, but they don't tell you much about what the actual experience will be like.

For anyone who's gone through a Type I or Type II audit, what would you ask a firm before committing? I'm thinking about things like whether you work with the same auditor throughout, how they deal with evidence that doesn't fit their standard templates, how quickly they respond to questions, and whether they actually explain what's missing when something gets rejected.

I'd also love to hear if anything during the initial sales calls turned out to be a red flag in hindsight. I'm less concerned about who gives the best presentation and more about finding a team that communicates well and makes the process manageable instead of dragging it out unnecessarily.

Just wondering how others go about verifying users over the phone for things like password resets ect?

Relying on colleagues knowing their employee ID is problematic, and generic information such as who their manager is doesn't feel secure enough.

My company currently uses a managed print service, and I’m fairly new to the organization. I came from the MSP world, so I have quite a bit of experience with our current print vendor from my previous role. Let’s just say I’m not particularly impressed with them.

They’re quoting us over $40k per year to lease four printers, which seems insane to me. I’ve started looking into purchasing some higher-end HP printers instead. Obviously, there’s a larger upfront cost, and we’d be taking on more of the maintenance ourselves, but even accounting for that, purchasing looks significantly cheaper over the long term.

Has anyone here moved away from a managed print/lease agreement and purchased their printers outright instead? How did it work out? Were there any hidden costs or headaches that made you regret it?

I feel like I must be missing something, because the numbers on the managed service just don’t seem to make sense.

Got a question for IT managers? Please post it here! Got something silly to share with IT managers? This is the right place! Come share it with us.

If you are a salesperson, vendor, SaaS app, or anyone else who isn't an IT manager that wants to share news, ask questions/get feedback, etc. then please post below!