Field notes: real-world IT situations
Typical problems, root causes and fixes, plus lessons from well-known public incidents.
What it looks like, why it happens, how it's fixed.
Printer keeps disappearing
- What people see
- Staff print fine in the morning, then the shared printer shows offline by afternoon.
- Root cause
- The printer takes a changing address from DHCP, and every PC points to the old one.
- The fix
- Reserve a fixed address (DHCP reservation or static outside the DHCP pool), re-add the printer by that address, and share one queue from a single place.
- Lesson
- Name and document every fixed-address device.
Wi-Fi drops in the meeting room
- What people see
- Full signal bars, but video calls stutter.
- Root cause
- One AP in the corridor behind a concrete wall, with 80 MHz channels overlapping neighbouring APs.
- The fix
- Move an AP into the room, use 40 MHz in 5 GHz, lower power on adjacent APs.
- Lesson
- Survey on site; design for capacity, not just signal.
Whole floor slow every morning
- What people see
- Network crawls when people arrive; then recovers.
- Root cause
- Someone plugged a small unmanaged switch into two wall ports, creating a loop and a broadcast storm.
- The fix
- Remove the loop, enable RSTP with loop protection and storm control on edge ports.
- Lesson
- Managed switches and port-level protections pay for themselves.
CCTV ran out of storage early
- What people see
- Retention was planned for 30 days but footage only goes back 12.
- Root cause
- 24×7 recording at high bitrate with older compression; settings were never sized.
- The fix
- Switch to H.265, tune bitrate and frame rate, use schedules or motion for low-risk cameras, add disks to match the calculation.
- Lesson
- Size storage up front; verify after install.
Remote desktop open to the internet
- What people see
- Constant failed-login alerts; unusual logins at night.
- Root cause
- Port 3389 forwarded to a server so staff could work from home.
- The fix
- Close the port; use VPN with MFA; add EDR; change exposed credentials; review logs for compromise.
- Lesson
- Never expose remote desktop. Treat it as an incident until proven otherwise.
Green backups, failed restore
- What people see
- Backup reports said 'success' for a year.
- Root cause
- Backup copied only to a folder on the same server; nobody tested a restore.
- The fix
- Move to NAS plus immutable cloud copy, verify, and test restores monthly and quarterly.
- Lesson
- A backup you have not restored is a hope, not a backup.
Ex-employee still has access
- What people see
- A leaver's mailbox and VPN account still worked after the domain account was disabled.
- Root cause
- Accounts were created in several systems with no checklist.
- The fix
- Introduce a leaver checklist across AD, email, VPN, cloud apps, access cards and device return, tied to the asset register.
- Lesson
- Offboarding is an IT process, not just HR.
Cameras reboot when APs are added
- What people see
- After adding access points, cameras restart randomly.
- Root cause
- Total PoE draw exceeded the switch's power budget.
- The fix
- Calculate watts per device, move to a higher-budget switch or split the load, add UPS.
- Lesson
- Count watts, not ports.
Firewall slower than the internet link
- What people see
- 1 Gbps link, but only about 250 Mbps through the firewall.
- Root cause
- Datasheet 'firewall throughput' was quoted, but IPS and application control were enabled.
- The fix
- Replace with a model rated on threat-protection throughput, or tune inspection.
- Lesson
- Read the right line in the datasheet.
What well-documented events teach.
Summarised from public reporting. Details are simplified.
WannaCry (May 2017)
A ransomware worm spread through the Windows SMB protocol using a vulnerability that Microsoft had patched two months earlier. Organisations that had not applied the patch, or still ran exposed legacy systems, were hit hard.
What it means for you: Patch on a schedule, retire unsupported systems and segment the network so one infection cannot reach everything.
Colonial Pipeline (May 2021)
Public reporting and later testimony indicated the attackers got in through a compromised VPN account that did not use multi-factor authentication. Operations were halted as a precaution.
What it means for you: Put MFA on every remote-access path and remove unused accounts.
Log4Shell (December 2021)
A critical flaw in the widely used Log4j library affected countless products. Many teams struggled to answer a simple question: where do we use it?
What it means for you: Keep an asset and software inventory so you can find affected systems in hours, not weeks.
Recognise one of these?
If a scenario sounds familiar, you do not have to wait for it to become an outage. Our IT health check is a quick first step, and an IT audit turns it into a prioritised plan.
Need a reliable IT partner?
Tell us about your environment, priorities and support needs. We will suggest a sensible next step.