I'm currently the company's only software developer, and our part-time sysadmin is leaving in about four months. I have essentially no systems administration experience, and there is very little documentation beyond a text file containing every user's password.
The environment includes about 40 Windows laptops, hybrid Active Directory and Entra ID, Exchange, physical Windows servers, several cloud VMs, a NAS, seven offices connected with Zyxel firewalls and VPNs, and off-site backups that have never been tested by performing a restore. MFA is enabled only when a service requires it. Users also share predictable passwords that they cannot change themselves.
Management seems to expect me to take over these responsibilities while continuing my software development work, without additional compensation or a reduction in my current workload. I know there are serious security and reliability problems, so where should I start? Should I try to learn and document everything myself, or push for outside help or a dedicated administrator?
5 Answers
Preserve whatever knowledge the departing administrator has, even if formal training is limited. Ask for recorded walkthroughs of critical systems, network diagrams, recovery procedures, renewal dates, vendor details, and the exact steps for common incidents. Build a small internal wiki as you go, and never keep passwords in a plain-text file; move credentials into a properly secured password manager with controlled access.
The company should hire a sysadmin or contract one, rather than quietly turning your development job into two full-time roles. Even a part-time administrator with real experience would be safer than expecting you to learn everything while keeping your current workload. Get the request, responsibilities, and compensation in writing before accepting ownership of production systems.
Bring in an experienced consultant or managed IT provider immediately. This is far too much responsibility for someone with no administration background, especially with undocumented infrastructure, weak passwords, incomplete MFA, and untested backups. They can perform an assessment, secure the highest-risk areas, document the environment, and either support you or help hire a proper sysadmin.
Start with an inventory and risk register, but do not treat that as a substitute for professional help. Record every device, server, account, service, dependency, backup, firewall, VPN, certificate, and vendor contact. Secure and rotate the exposed passwords, enforce unique user passwords and MFA, remove unnecessary access, and verify that administrator accounts are separate from normal accounts. Before trusting the backups, perform a documented restore test in a controlled environment.
Treat this as a business-risk issue, not just a learning challenge. A ransomware incident or failed recovery could seriously harm a 50-person company. Tell management clearly that the current arrangement is unsafe and ask them to fund an assessment, remediation plan, and ongoing support. If they refuse while still holding you responsible, consider whether staying is worth the personal and professional risk.
That would still be a side job unless management reduces your development responsibilities. Running infrastructure for multiple offices is not something that can be squeezed into spare moments.