neal@fleming:~$

online · metro Atlanta, GA

Neal Fleming

IT Technician & Systems Administrator

$ ./do --task

I keep small businesses running, secure and patched, and I build the tooling that makes that repeatable. After hours, my home lab is where the bigger ideas get tested.

./view-projects ./contact
neal@fleming: ~

$ whoami

Neal Fleming, IT Technician & Systems Administrator

$ cat focus.txt

Microsoft 365 · Endpoint security · Networking · Automation

Type help to look around.

~/about

user
neal@fleming
role
IT Tech / SysAdmin
env
MSP, SMB clients
shell
pwsh · bash · python
focus
M365 · security · network
lab
Unraid · Proxmox · OPNsense
certs
CompTIA Network+
base
Metro Atlanta, GA

I'm an IT technician and systems administrator at a managed service provider in metro Atlanta. I support a mixed portfolio of small and mid-size businesses: construction, real estate, automotive, finance, healthcare, design and manufacturing. The work runs from Tier 1 helpdesk through Tier 3 escalations.

Most days I'm somewhere between a Microsoft 365 tenant, a firewall console and a PowerShell window. I like turning repetitive work into scripts and dashboards, and turning an alert into a clear answer: what happened, whether it matters and what to do next.

Outside work I run a home lab with Docker, Proxmox containers, an OPNsense firewall and Cloudflare Zero Trust. That's where I build tools I actually use, and a few that friends now rely on too.

~/skills

Microsoft 365 & identity

  • Exchange Online, SharePoint, Teams, OneDrive
  • Entra ID, Conditional Access, MFA
  • Intune, Defender for Business
  • Purview / eDiscovery, Graph API
  • User lifecycle: onboarding and offboarding

Endpoint & email security

  • EDR / XDR alert triage and incident analysis
  • MITRE ATT&CK mapping, IOC handling
  • Email filtering, phishing and BEC response
  • Compromised account remediation
  • Duo, FortiToken and other MFA tooling

Networking & infrastructure

  • FortiGate, Zyxel USG FLEX, SonicWall, OPNsense
  • IKEv2 / SSL VPN, Tailscale, Cloudflare Tunnel
  • Ubiquiti, mesh Wi-Fi, structured cabling
  • Hyper-V, Proxmox, Docker, Unraid, Synology
  • Backup: Active Backup for M365, cloud backup

Scripting & automation

  • PowerShell: Graph, PnP, Exchange Online
  • Python: APIs, scrapers, parsers, web services
  • RMM script and scheduled-task deployment
  • Ansible, Bash, systemd, Linux administration
  • AI and LLM integrations, MCP, Claude Code

~/projects

work/pi-kiosk-fleet.mddeployed

Raspberry Pi kiosk fleet

Display kiosks across the offices of a multi-company real estate group, showing live dashboards on wall screens with nobody touching them.

  1. fresh SD card
  2. bootstrap.sh
  3. Tailscale
  4. Ansible canary
  5. fleet
cat README.md
  • Bootstrap scripts take a freshly flashed card to a working kiosk with no hands-on setup: autostart, Wi-Fi power management and display configuration
  • Every unit is reachable over a private Tailscale network, with no inbound ports open at any site
  • Fleet-wide changes go out through Ansible, tested on a single canary unit before the rollout
  • Cut SD card wear by moving logs and browser cache into RAM, the main cause of failures on long-running Pis

Raspberry PiLinuxTailscaleAnsibleBash

work/hosted-mcp-servers.mddeployed

Hosted MCP servers for business systems

Model Context Protocol servers that let an AI assistant query a client's shop-management and call-tracking platforms in plain English.

  1. AI assistant
  2. HTTPS proxy
  3. FastMCP
  4. vendor API
cat README.md
  • Python FastMCP services that wrap each vendor's REST API, scoped to read access
  • Run as Windows services on a Hyper-V VM, published over HTTPS through a reverse proxy
  • Added to the assistant as custom connectors by URL, so non-technical staff can use them without exporting reports

PythonFastMCPHyper-VReverse proxyREST APIs

work/soc-triage-workflow.mdin use

SOC triage workflow

A repeatable process for endpoint detection alerts, so every alert ends with a consistent verdict and an audit trail.

  1. EDR alert
  2. playbook
  3. evidence
  4. verdict
  5. write-up
cat README.md
  • Playbooks by detection family: process trees, command lines, network destinations, identity anomalies
  • A standard write-up for each alert: MITRE techniques, defanged IOCs, escalation decision, remediation and verdict
  • A catalog of recurring false positives (OS telemetry, signed driver installs, OEM firmware tools) to speed up triage without lowering the bar
  • Daily read-only alert digests so nothing ages unnoticed

EDR/XDRMITRE ATT&CKIncident responseDocumentation

work/maintenance-dashboard.mddeployed

MSP maintenance dashboard

Quarterly maintenance status lived in a separate Excel checklist per client. Now one page shows every client and every device.

  1. SharePoint
  2. Graph API
  3. openpyxl
  4. JSON
  5. dashboard
cat README.md
  • A Python job pulls the checklist workbooks from SharePoint through an Entra app limited to read-only Sites.Selected access
  • Workbooks are parsed into a single JSON feed, served as a static dashboard behind a reverse proxy
  • A per-device work log shows what's done and what's still pending at each site
  • Standardized the checklist templates so the data stays parseable as new clients are added

PythonGraph APISharePointEntra IDHTML/JS

work/integration-recovery.mdin progress

Rebuilding integrations after a vendor walked away

A client's integration vendor disengaged and took its cloud middleware with it. I audited what was left and moved the data feeds back under the client's control.

  1. audit tenant
  2. map orphans
  3. service account
  4. rotate secrets
  5. rebuild
cat README.md
  • Audited Entra app registrations, Power Platform connections and flows to find what the vendor had built and what still depended on it
  • Moved ingestion under a dedicated, least-privilege service account the client owns
  • Flagged and rotated orphaned secrets, and re-issued third-party API credentials
  • Coordinated the rebuild with a new development vendor working natively in M365

Entra IDPower PlatformDataverseSecrets hygiene

work/teams-to-tickets.mddeployed

Teams-to-helpdesk ticket automation

Requests posted in Microsoft Teams turn into helpdesk tickets automatically, so nothing typed into chat gets lost.

  1. Teams message
  2. automation
  3. helpdesk API
  4. ticket
cat README.md
  • Captures the request, the requester and the context from the Teams message
  • Creates the ticket through the helpdesk platform's REST API instead of by hand
  • Cuts out the "I messaged you about this last week" gap between chat and the ticket queue

Microsoft TeamsREST APIAutomation

work/rmm-self-healing-paths.mddeployed

Self-healing report paths over RMM

Excel and Power Query reports broke whenever a different user opened them, because synced OneDrive paths are different for every user.

  1. RMM push
  2. logon task
  3. check junction
  4. repair
  5. report refresh
cat README.md
  • A fixed local path (a directory junction) points to the current user's synced library, so every report uses one path
  • A logon-triggered scheduled task checks the junction and rebuilds it only when it's missing or points to the wrong user
  • Deployed through the RMM with no Intune dependency, and safe to re-run

PowerShellRMMScheduled tasksOneDrivePower Query

work/workstation-health-check.mdin use

Workstation health-check kit

A one-click script that turns a maintenance visit into consistent, reviewable evidence for every PC.

  1. double-click
  2. self-elevate
  3. checks
  4. host log
  5. review
cat README.md
  • A self-elevating script that runs system-file and image health checks, disk, update and protection status
  • Writes one log per host, collected per client for review and sign-off
  • Built-in triage notes: which flags are usually stale and which ones are real findings

BatchPowerShellDISM / SFCMaintenance

work/firewall-recovery-mfa.mddeployed

Firewall recovery & shared-admin MFA

Brought a locked-out next-gen firewall back from the serial console, then designed MFA that works for a whole team sharing admin access.

  1. serial console
  2. factory reset
  3. config restore
  4. MFA design
cat README.md
  • Recovered access over the console, reset to factory defaults and restored the saved configuration
  • Set up token-based MFA for admin sign-in
  • Worked out why vendor tokens can't be shared across a team (the seeds live on the server) and recommended RADIUS-backed MFA for shared admin access

FortiGateFortiTokenDuoRADIUS

work/backup-rescue.mdin progress

Backup rescue

At a first maintenance visit I found a company's live data on a failing external drive, with every local backup already dead.

  1. discover
  2. verify cloud copy
  3. image data
  4. internal SSD
  5. rebuild backups
cat README.md
  • Confirmed the cloud backup was the only working copy before touching the failing disk
  • Moving the data to an internal SSD, then rebuilding local backups so the company has more than one good copy again

BackupData recoveryRisk triage

lab/job-search-pipeline.mdrunning 24/7

Job search pipeline

A self-hosted job search engine and application tracker. I run it for myself, and separate instances for friends.

  1. job APIs + boards
  2. score
  3. tracker
  4. Gmail sync
  5. AI résumés
cat README.md
  • Pulls postings from job APIs and employers' own career boards three times a week, filters out repost spam, and scores fit with weights learned from past applications
  • Read-only Gmail sync over IMAP classifies confirmations, rejections and interview invites, and updates the tracker on its own
  • Insights tab: which skills and certifications employers are asking for, pay bands, and reply rate by source
  • Tailored résumés written by Claude Code running in a container, with a guard that rejects any number not in the source profile
  • Python standard library only, in Docker on Unraid. Each instance is published through a Cloudflare Tunnel behind Access, and the app verifies the signed Access JWT itself
  • 60+ tests, and a deploy script that refuses dirty trees and catches drift from edits made on the server

PythonDockerIMAPCloudflare AccessClaude Code

lab/home-lab.mdrunning 24/7

Home lab

A small production environment at home, run with the same discipline as client networks.

  1. OPNsense
  2. Unraid + Proxmox
  3. Cloudflare Tunnel
  4. Access
  5. Uptime Kuma
cat README.md
  • OPNsense firewall at the edge; Unraid for Docker workloads and Proxmox LXC containers for services
  • Public apps go out through Cloudflare Tunnel behind Zero Trust Access (Google or one-time PIN), never through open ports
  • Uptime Kuma watches every service and receives check-ins from scheduled jobs; failures push to my phone through ntfy
  • A local LLM on Ollama, a start page with live status for every web UI, and nightly backups pulled off-box

OPNsenseProxmoxUnraidCloudflare Zero TrustUptime KumaOllama

lab/pricewatch.mdrunning 24/7

Pricewatch

A flight-fare and housing-market tracker built entirely on free data. It works out when to book and whether to rent or buy.

  1. fares + indices
  2. SQLite
  3. stats
  4. deals
  5. push alert
cat README.md
  • Prices hundreds of round trips a day, politely throttled, and builds a booking-window curve for each route
  • Flags a deal when a fare falls in the bottom 15% for the same route and lead time
  • Housing tab combines rent and home-value indices, mortgage rates and FX into an own-vs-rent estimate for each city
  • Runs on systemd timers in a Proxmox container, with heartbeats to Uptime Kuma; config-driven instances run for friends in other cities
  • An animated route-map canvas: real airports, flight arcs and comet-trail planes

PythonSQLitesystemdCanvasData analysis

lab/this-website.mdyou are here

This website

Hand-written HTML, CSS and JavaScript with no framework and no build step, served from Cloudflare's edge.

  1. index.html
  2. Pages
  3. edge CDN
  4. you
cat README.md
  • Strict Content-Security-Policy and security headers; no inline scripts, no trackers
  • A working terminal in the hero (try help), a canvas network background and colour themes
  • Respects reduced-motion settings, and still reads fine with JavaScript turned off

HTMLCSSJavaScriptCloudflare Pages

~/training

Certifications

  • CompTIA Network+

Hands-on security labs

Ongoing offensive and defensive training on TryHackMe:

  • Nmap enumeration, Wireshark traffic analysis
  • Metasploit and msfvenom payloads
  • Password cracking with John the Ripper

~/contact

Let's talk.

Open to conversations about IT, systems administration and security roles.

[email protected]