I'm currently the only software developer at a 50-person company, and our part-time system administrator plans to leave in about four months. Management expects me to take over the IT environment, but I have very little recent sysadmin experience beyond a three-month internship several years ago. The current administrator does not seem interested in providing much training, and the only documentation so far is a text file containing user passwords.
The environment includes roughly 40 Windows laptops, hybrid Active Directory and Entra ID, Exchange, physical Windows servers, several cloud VMs, around five Synology NAS devices, and seven offices connected through Zyxel firewalls and VPNs. There are off-site backups, but nobody has verified that they can actually be restored. MFA is enabled only when a service requires it. Users also have predictable passwords and cannot change them themselves.
I know there are serious security, documentation, and business-continuity problems. Management says we cannot hire a managed service provider, and I'm concerned that taking on these responsibilities will leave no time for development or set me up to take the blame when something fails.
What should I prioritize during the next four months? How should I document the environment, secure access, verify the backups, and explain the risks and required resources to management?
5 Answers
Create a basic inventory and network map before attempting major changes. Record devices, servers, IP ranges, sites, VPN links, firewall configurations, applications, dependencies, service accounts, certificates, licenses, and renewal dates. Export configuration backups from the firewalls, switches, NAS devices, and cloud systems where possible. Review ticket history if one exists, but do not rely on undocumented tribal knowledge.
The security issues should be prioritized, but avoid changing everything at once in an undocumented environment. Start with MFA for administrator and remote-access accounts, unique passwords managed through a vault, least-privilege access, endpoint protection, patching, and a plan for compromised accounts. If management refuses outside help, at least obtain a short-term assessment or consulting engagement for identity, network security, and disaster recovery. If they refuse both help and the necessary time, finding another job may be the most realistic option.
Treat access and recovery as the immediate priorities. Obtain properly delegated administrator access to Entra ID, Active Directory, servers, cloud accounts, firewalls, VPNs, NAS devices, DNS, registrar accounts, backup systems, and any line-of-business services. Put credentials in an approved password manager rather than keeping them in a text file, and rotate shared or exposed passwords carefully so you do not accidentally break services.
Do not assume the password list is complete. Build an inventory of every system and account, then verify access with the current administrator while they are still available.
Backups need to be tested before you trust them. Identify what each backup protects, how long it is retained, where it is stored, and who can access it. Perform controlled test restores—ideally into an isolated environment—and record the steps and recovery times. A backup that has never been restored is only an assumption, not a recovery plan.
The first step is to make the situation and its risks explicit to management in writing. Explain that running infrastructure, security, backups, networking, identity, and end-user support is a separate full-time role, even for someone with experience. Also document which development work will be delayed if you are expected to take this on. Ask management to choose between hiring dedicated staff, bringing in an external engineering consultant for critical work, or formally accepting the risks.
Make sure the request and their decision are documented. That protects you from being blamed for risks you clearly identified before taking over.
Even if they will not approve a fully managed service, presenting specific projects with costs and business consequences may make limited consulting easier for them to approve.