@ in ↓

Open to roles · hybrid or remote

I build infrastructure, process & reliability.

Systems administrator and IT project manager. I build and run the infrastructure a company depends on: Windows Server and Hyper-V, Microsoft 365 and Active Directory, email security, and the network underneath it.

I also design the processes around that infrastructure — client onboarding, employee provisioning, incident response — so the work repeats without depending on me. The projects below are the ones I can show in detail rather than just claim.

The five layers I work across A single bracket spans five stacked layers: delivery, process, identity and email, compute, and network at the base. Each layer names the systems worked on at that level. The bracket shows that one person covers all five. ONE PERSON · FIVE LAYERS Delivery client onboarding, scoping, handover Process provisioning, deprovisioning, incident response Identity & email Microsoft 365, Exchange, Active Directory Compute Windows Server, Hyper-V, storage Network Sophos firewall, subnets, DNS and DHCP Every layer here is work I have built and run. The projects below are the evidence for it.

Selected Work

Infrastructure · identity · delivery

Everything below I designed and built myself, rather than inheriting or maintaining someone else’s setup.

MSP Client Onboarding

Service delivery · project management

I manage onboarding for multiple managed-services clients at the same time, from signed agreement through to steady-state support. That covers the network assessment, the project plan, the technical build, and communication with both the client and the engineering team.

Assess
Network assessment and infrastructure recommendations before anything is agreed
Plan
Timelines, technical deliverables and stakeholder communication
Implement
Technical build, coordinated with the client and the engineering team
Tooling
RMM agent, antivirus, disk encryption and Proofpoint email security deployed and configured across the estate
Hand over
Transition to the steady-state support team
Project delivery Network assessments Stakeholder comms Sophos deployments Process improvement

Network Discovery & Documentation

Network discovery · documentation

When a client comes on board I map the network they already have. I trace IP addresses, switch ports and the physical location of devices across their buildings, then produce a diagram and written record the support team can work from.

Trace
IP addresses, switch ports, and the physical location of each device
Scope
Devices spread across multiple buildings and floors, per client
Firewall
Running configuration exported and documented
Output
A network diagram and written record handed to the support team
network trace
Tracing a device back through the network A trace runs from the client firewall through the core switch out to edge switches in two separate buildings, ending at individual devices. Each hop records the switch port, the address and the physical location, so any device can be found from its address alone. ONE TRACE, ADDRESS TO FLOOR PLATE Firewall config exported Core switch uplinks mapped Building A edge switch · floor 2 Building B edge switch · floor 1 Device port 14 · 10.20.4.31 Device port 06 · 10.20.9.12 example values — every client’s addressing and port map differs
Network documentation IP and port tracing Firewall configuration Diagramming Multi-site

Server Discovery & Documentation

Server audit · documentation

Every server a new client owns is reviewed and documented before we take it on. That covers Active Directory settings, group policy, administrator accounts, and the protocols and services actually running on the machine. Physical or virtual, and whatever operating system it runs.

Directory
Active Directory configuration and the group policy applied to each machine
Access
Administrator accounts identified, local and domain
Running state
Services and listening protocols enumerated per server
Coverage
Physical hosts and virtual machines, any operating system
Output
A written record of what each server does and who depends on it
server record
The record produced for every server A server documentation record listing the fields captured for each machine: host name, whether it is physical or virtual, operating system, directory membership and group policy, administrator accounts, running services and protocols, and the business purpose of the server. ONE RECORD PER SERVER, BEFORE WE TAKE IT ON Host SRV-APP-01 Type virtual machine on a client hypervisor Operating system recorded as found, whatever it runs Directory domain membership and group policy applied to it Admin accounts local and domain administrators identified Services running services and listening protocols enumerated Purpose what the business actually uses this server for
Active Directory Group Policy Server auditing Virtualization Documentation

Employee Onboarding & Offboarding Process

Identity & access · process design

I audited the existing environment first, then designed a repeatable process on top of it. I led the project and worked with HR, compliance and every department.

Audit
Security groups, employee roles, network folder access, shared mailboxes and distribution lists, application access and licenses
Provision
Account creation, permissions, license assignment, equipment issue, documentation and training
Imaging
Custom Windows build deployed to workstations through Microsoft Deployment Toolkit
Offboard
Access revoked, company data secured, equipment and licenses recovered
joiner / leaver loop
The joiner and leaver loop Four stages left to right: provision, support, deprovision, recover. A return path runs from recover back to provision, showing that equipment and licenses re-enter the pool for the next hire. 1Provision account, groups,license, equipment 2Support day to day, throughthe service desk 3Deprovision access revoked,company data secured 4Recover equipment and licenseback into the pool equipment and licenses return to the pool for the next hire
Active Directory Microsoft 365 Exchange Online MDT imaging Security groups Process design

IT Training Program

Enablement · documentation

I built and delivered the company’s IT training. Sessions ran in person and virtually, and each one came with written material staff could keep.

Audiences
New hires, staff struggling with technology, people moving to remote work
Triggers
Onboarding, new application rollouts, work-from-home transitions
Formats
In-person and virtual sessions, with interactive exercises and quizzes
Material
Knowledge base articles, printed reference sheets, presentations
Training delivery Knowledge base Documentation Change enablement

Work From Home Program

Remote access · enablement

I designed the company’s work-from-home program end to end, from the requirements staff had to meet through to their configured remote access. Completion was recorded for every employee.

Requirements
Defined what staff had to meet before they could work remotely
Training
Delivered alongside the requirements, in person and virtually
Tracking
A system recording who had completed what, and who was still outstanding
Access
Remote access configured and issued per employee
Remote access Endpoint configuration Training Compliance tracking

Asset Tracking System

Asset management · inventory

Equipment had been issued for years before I took the role with no reliable record. I traced what existed and who held it, then built a system that keeps that history and records every issue and return from then on.

Scope
IT infrastructure and every device issued to an employee
Reconstruction
Traced equipment issued before the system existed back to a holder
Record
Device, assigned employee and date held together as one history
Forward
Every issue and return recorded against the same device record
chain of custody
One device, reconstructed then tracked A single device timeline. The earlier portion is dashed, marking history reconstructed from before the system existed. From the point the system was built the line is solid, and each issue and return is recorded against the same device. ONE DEVICE, END TO END Purchased date unknown Issued holder unrecorded System built history reconstructed Returned condition logged Reissued new holder, same record reconstructed from what I could trace recorded as it happens
Asset lifecycle Inventory Auditing Reporting

Printer Fleet Replacement

Network · endpoint deployment

I replaced the company’s printer fleet and configured each device on the network and in DHCP. I also standardized how printers were named and labeled so staff could identify one without looking it up.

Network
A DHCP reservation per device, placed on the correct VLAN
Drivers
Deployed to every employee whose department used that device
Naming
Company-standard name, with name and IP address on a visible label
Handover
Added to inventory, with ongoing troubleshooting support
printer onboarding path
How each printer was brought onto the network Each replacement printer moves through four steps: a DHCP reservation fixes its address, it is placed on the correct VLAN, drivers are pushed to the department that uses it, and it is added to inventory. A sample label shows the standardized name and IP address. New printer racked and cabled DHCP reservation fixed address per device VLAN placed on the right segment Department drivers pushed to its users EVERY UNIT LABELED TO THE SAME STANDARD PRN-FIN-02 · 172.16.20.41 name and address readable on the device itself
DHCP reservations VLAN segmentation Print servers Driver deployment Endpoint support

Lifecycle Automation

Automation · scripting

A script that turns the employee onboarding process into code. It reads a new-hire CSV, creates the Active Directory user, assigns groups, provisions a home folder, and generates the welcome documentation.

Input
A new-hire CSV, the same fields the manual process already collects
Creates
Active Directory user, group membership, home folder on the file server
Output
Welcome documentation generated from the same run
Environment
Written and tested against the homelab domain
PowerShell Active Directory Python

Windows Server Homelab

Infrastructure · virtualization

A Windows Server 2025 domain on bare metal, built to practice work that cannot safely be tested on a client network: forest promotion, cross-subnet firewall policy and storage pooling. Everything described below is running.

Windows Server 2025 Hyper-V Active Directory DNS / DHCP Sophos XG 125 Storage Spaces SMB / NFS
topology — lab.local
Homelab network topology A Sophos XG 125 firewall separates a primary LAN on 172.16.16.0/24 — carrying the Hyper-V host with DC01 and FS01 virtual machines — from a wireless subnet on 192.168.30.0/24 used for remote management. WAN Sophos XG 125 · v22 Port 1 172.16.16.16 · Port 4 172.16.16.1 PRIMARY LAN · 172.16.16.0/24 2× TL-SG108E managed switch OptiPlex 9020 · host Windows Server 2025 DC · Hyper-V DC01 AD DS · DNS · DHCP · lab.local 172.16.16.60 FS01 File Server · SMB / NFS \\FS01\Shared HomeLabPool · 4.5 TB · SCSI passthrough WIRELESS · 192.168.30.0/24 Archer C7 · AP mode macOS workstation RDP + Hyper-V Manager cross-subnet firewall rule

Fig. 1 — Flat two-subnet topology. Management traffic crosses from the wireless segment to the server segment through an explicit Sophos rule rather than a flat allow. VLAN segmentation is staged next in this lab, once the domain is stable.

Host
Dell OptiPlex 9020 · Windows Server 2025 Datacenter
Directory
DC01 — forest promoted; AD DS, DNS and DHCP for lab.local
File services
FS01 — domain-joined, File Server role, SMB/NFS
Storage
Storage Spaces pool — 2×2 TB + 1×500 GB, thin-provisioned 4 TB NTFS virtual disk, SCSI passthrough to FS01
Edge
Sophos XG 125 (v22) — multi-port LAN/WAN separation, cross-subnet policy
DHCP scopes
172.16.16.100–200 and 192.168.30.100–150
fault log — 7 incidents, all resolved
Symptom Root cause Resolution
01 Hyper-V install fails, 0x800f0916 Component store corrupted by Windows Update; feature payload left DisabledWithPayloadRemoved. DISM /RestoreHealth from ISO failed on version mismatch. Clean reinstall from ISO, then install Hyper-V before running updates.
02 “Invalid Trusted Execution Technology configuration” at boot TXT enabled in BIOS against a TPM configuration that could not satisfy it. Disabled TXT; kept VT-x and VT-d enabled so virtualization stayed intact.
03 No bootable device after a successful install Installer split boot files onto Disk 4 while the OS landed on Disk 0 — UEFI found no loader. Disconnected every drive but C:, reinstalled, reconnected after first boot.
04 DC01 loses network; AD/DNS install fails Static IP assigned on 192.168.20.0/24 — a SERVERS subnet that did not exist on the physical network yet. Moved DC01 onto the live 172.16.16.0/24. Segmentation deferred until the domain was stable.
05 DC01 cannot resolve; gateway pings time out DNS pointed at 172.16.16.1 — Sophos Port 4, not the gateway. Gateway was right, resolver was not. Repointed DNS to 172.16.16.16 (Port 1).
06 Storage Spaces sees no eligible disks All three drives sat OFFLINE in Disk Manager and carried partitions from prior use. Brought each disk online, cleared old partitions; the pool wizard picked them up immediately.
07 Virtual switch configured correctly but no traffic Switch never completed its bind to the physical Intel NIC. Restarted the Hyper-V Virtual Machine Management Service (vmms) to force rebinding.

Applied to client work since: install hypervisor roles before patching, isolate disks during OS installs, and confirm which firewall port is actually the gateway before blaming the virtual switch.