# OpenTech Consulting

> IT consulting, identity management, cloud, security, and automation for small businesses and schools.

OpenTech Consulting is operated by Mike Sheldon. The canonical website is https://mosheldon.com/. Article Markdown copies carry the same authorship, dates, references, and historical notices as their HTML pages. Archive examples are version-specific historical material.

## About and services

- [Home](https://mosheldon.com/): IT consulting and practical technology guidance.
- [Services](https://mosheldon.com/services/): Consultancy, managed IT services, web development, and custom solutions.
- [About Mike Sheldon](https://mosheldon.com/about/): Background and experience of the owner of OpenTech Consulting.
- [Company facts](https://mosheldon.com/facts/): Business identity, owner, service categories, and sources.
- [Contact](https://mosheldon.com/contact/): Private enquiry form for discussing work with OpenTech.
- [Insights](https://mosheldon.com/blog/): All published articles and topic filters.
- [Topics](https://mosheldon.com/topics/): Guides organized by subject and historical context.

## Topics

- [Identity management](https://mosheldon.com/topics/identity-management/): Plan account provisioning, onboarding, password recovery, and access removal. Compare NIM with other identity tools using practical evaluation criteria.
- [Security](https://mosheldon.com/topics/security/): Practical guidance on authentication, permissions, incident preparation, and security standards, with primary sources and implementation limits.
- [Automation and integration](https://mosheldon.com/topics/automation/): Design reliable workflows, connect systems, and evaluate automation with explicit ownership, useful error handling, and verifiable results.
- [Cloud and Microsoft 365](https://mosheldon.com/topics/cloud/): Explore Microsoft 365, cloud identity, email, and historical Google Apps integrations. Current guidance is separated from version-specific archive material.

## Current guides

- [Cut SaaS Spend by Reviewing Access First](https://mosheldon.com/blog/cut-saas-spend-by-reviewing-access-first/index.md): Use Microsoft Entra access reviews and entitlement management to find unused SaaS access, then turn those findings into license cleanup and renewals.
- [How to Build a Simple Software License Review Process](https://mosheldon.com/blog/software-license-review-process/index.md): Use Microsoft guidance to find unused licenses, align renewals to real usage, and assign owners for a repeatable renewal review.
- [NIM, Entra, Okta, SailPoint, or ManageEngine: where to start](https://mosheldon.com/blog/choosing-identity-automation-nim-entra-okta-sailpoint-manageengine/index.md): Compare identity automation tools by the work you need done: provisioning, delegated support, access governance, and verified offboarding.
- [NIST identity guidance in 2026: what to change in your plan](https://mosheldon.com/blog/nist-digital-identity-guidelines-2026/index.md): Apply NIST SP 800-63 revision 4 to a 2026 identity review, with precise password rules, phishing-resistant options, and recovery checks.
- [Cyber Resilience Act: the 2026 and 2027 dates to plan around](https://mosheldon.com/blog/cyber-resilience-act-2026-2027-identity/index.md): Separate CRA reporting obligations already in effect from the 2027 full application date, and assign identity and product-security responsibilities.
- [Use CISA’s no-cost security resources with a practical work plan](https://mosheldon.com/blog/cisa-no-cost-security-tools-practical-plan/index.md): Choose CISA resources by the security gap you need to close, confirm service eligibility, and assign an owner to findings before adding tools.
- [NIM and MCP: connect an assistant without skipping access controls](https://mosheldon.com/blog/nim-mcp-server-security/index.md): Evaluate NIM’s MCP server with controlled credentials, limited data exposure, a test environment, and human review of consequential identity changes.
- [Emergency termination in NIM: verify access is actually removed](https://mosheldon.com/blog/nim-emergency-termination-checklist/index.md): Build an urgent offboarding procedure around NIM, with authorized requests, target checks, session limits, and protection against accidental reactivation.
- [Delegate password resets in NIM without broad admin access](https://mosheldon.com/blog/nim-delegated-password-reset/index.md): Give local support a defined password reset role in NIM, with restricted user scope, identity checks, audit records, and clear escalation rules.
- [Moving to Cloud-Only IT with Microsoft 365 E3 or E5](https://mosheldon.com/2025/08/16/from-hybrid-to-cloud-only-maximizing-value-with-microsoft-365-e3-e5/index.md): Plan a move to Microsoft 365: check identity dependencies, compare E3 and E5, pilot devices, and test recovery before retiring servers.
- [Shared Passwords: How to Delegate Access Safely](https://mosheldon.com/2025/08/11/passwords-and-delegation-the-hidden-risks-of-convenience/index.md): Give staff access without sharing personal logins. Use named accounts, delegated permissions, controlled secrets, device locks, and clear offboarding.
- [Plan NIM self-service password reset around recovery failures](https://mosheldon.com/blog/nim-self-service-password-reset/index.md): Evaluate NIM self-service password reset with realistic lockout cases, secure verification, target synchronization checks, and a help desk fallback.
- [Using 4DX and KPIs to Improve IT Team Execution](https://mosheldon.com/2025/07/21/asking-the-hard-question-is-4dx-the-missing-link-to-achieving-your-goals/index.md): Connect IT goals to weekly actions with 4DX. Choose lead and lag measures, build a useful scoreboard, and check whether the work improves results.
- [Business Process Automation: Choosing a Useful First Project](https://mosheldon.com/2025/07/18/flying-blind-why-business-without-automation-is-a-high-risk-flight/index.md): Choose an automation pilot with clear rules, reliable inputs, and measurable results. Plan approvals, exception handling, monitoring, and rollback.
- [Custom Domain Email: Setup and Security for Small Businesses](https://mosheldon.com/2025/07/12/why-its-important-for-small-businesses-to-have-email-addresses-with-their-own-domain/index.md): Set up business email on your own domain, protect account ownership, configure SPF, DKIM, and DMARC, and plan a mailbox migration without losing access.
- [MFA for Small Businesses: A Practical Rollout Plan](https://mosheldon.com/2025/07/11/why-mfa-is-essential-for-small-businesses-protecting-what-matters-most/index.md): Roll out MFA to email, administrator accounts, and remote access. Compare methods, prepare recovery, test a pilot, and check that enforcement works.
- [Privilege Creep: How to Review and Remove Unneeded Access](https://mosheldon.com/2025/07/10/managing-user-privilege-creep-why-its-critical-for-security-and-efficiency/index.md): Find permissions left behind by role changes and old projects. Assign resource owners, review effective access, record decisions, and verify removals.
- [Contractor Account Management: A Small Business Checklist](https://mosheldon.com/2025/06/01/simplifying-non-employee-account-management-for-small-businesses/index.md): Manage contractor and vendor access with a named sponsor, approved permissions, an end date, regular reviews, and verified offboarding across applications.
- [Small Business Websites: What to Build First](https://mosheldon.com/2025/05/07/why-even-a-small-10-50-employee-business-should-build-a-website-to-drive-traffic-and-growth/index.md): Plan a small business website with clear services, local information, fast mobile pages, and a tested contact route. Measure actual enquiries.
- [Use NIM onboarding to let new starters claim their own accounts](https://mosheldon.com/blog/nim-secure-user-onboarding/index.md): Separate account preparation from account claiming with NIM onboarding, then test identity verification, duplicate records, and support fallbacks.
- [Design joiner, mover, and leaver automation with NIM](https://mosheldon.com/blog/nim-joiner-mover-leaver-automation/index.md): Plan NIM lifecycle automation around trusted source records, safe account matching, role changes, and target verification before scheduling jobs.

## Retrospectives

- [2025 retrospective: start security planning with identity owners](https://mosheldon.com/blog/identity-first-security-2025-retrospective/index.md): A 2025 retrospective on account ownership, joiner and leaver responsibilities, and governance, using primary sources published before the cutoff.
- [2024 retrospective: map identity workflows with BPMN first](https://mosheldon.com/blog/bpmn-identity-workflows-2024-retrospective/index.md): A retrospective using BPMN concepts available by December 2024 to define identity approvals, exceptions, and responsibilities before automation.

## Optional

- [Complete article text](https://mosheldon.com/llms-full.txt): All articles with sources and historical notices; larger download.
- [Sitemap](https://mosheldon.com/sitemap.xml): Canonical HTML pages.
- [RSS feed](https://mosheldon.com/feed/): Article updates.
- [Lowercase Active Directory Usernames with PowerShell: 2022 Note](https://mosheldon.com/2022/08/27/2022-08-update-ad-username-casing-html/index.md): A 2022 PowerShell example for normalizing sAMAccountName casing within a selected Active Directory organizational unit.
- [PowerShell Self-Signed Certificate Example: 2022 Archive](https://mosheldon.com/2022/07/26/2022-07-generate-self-signed-certificate-with-html/index.md): A historical PowerShell certificate example for an Adobe API integration, retained with notes about damaged formatting and certificate lifetime.
- [Monitoring Servers and Networks with NetXMS: 2014 Notes](https://mosheldon.com/2014/10/26/2014-10-servernetwork-monitoring-html/index.md): A 2014 troubleshooting note on using NetXMS agents and SNMP to create a dashboard for selected servers and network devices.
- [GaPoSh v0.04: Google Apps PowerShell Release Notes](https://mosheldon.com/2013/09/14/2013-09-gaposh-v004-released-over-50-commands-html/index.md): September 2013 release notes for GaPoSh v0.04, a Google Apps PowerShell client with more than 50 commands at that release.
- [GaPoSh v0.01 Alpha: Google Apps PowerShell Client](https://mosheldon.com/2013/09/07/2013-09-google-apps-powershell-client-gaposh-html/index.md): The September 2013 GaPoSh alpha announcement, describing the first user-information commands and the original project feedback process.
- [Building GaPoSh for Google Apps: September 2013 Plan](https://mosheldon.com/2013/09/06/2013-09-google-apps-powershell-client-in-works-html/index.md): A 2013 development plan for a Google Apps PowerShell client using the .NET library to manage users, groups, and other resources.
- [PXE Network Booting with Ultimate Deployment Appliance](https://mosheldon.com/2013/08/18/2013-08-network-booting-html/index.md): A 2013 account of using Ultimate Deployment Appliance for a server installation without a local optical or USB drive.
- [Google Apps Service Accounts and Delegation: 2013 Reference](https://mosheldon.com/2013/06/10/2013-06-using-service-account-with-google-apis-html/index.md): A 2013 reference to Google API service accounts and domain-wide delegation, with the original documentation link.
- [Google Admin SDK Discovery with .NET: 2013 Example](https://mosheldon.com/2013/06/05/2013-06-google-discovery-service-with-net-html/index.md): A 2013 service-generator example for the Google Admin SDK Directory API using the Google .NET client and discovery document.
- [MONyog and Graylog2: Database and Syslog Notes from 2012](https://mosheldon.com/2012/10/25/2012-10-monyog-graylog2-html/index.md): A 2012 account of investigating MySQL activity with MONyog and evaluating Graylog2, PartyLog, and Logstash for centralized logs.
- [FlashPanel for Google Apps: 2012 Evaluation Note](https://mosheldon.com/2012/09/17/2012-09-flashpanel-for-google-apps-html/index.md): A September 2012 note on evaluating FlashPanel for Google Apps domain administration and auditing, with the original screenshot.
- [Android Notification Firewall Troubleshooting: 2012 Note](https://mosheldon.com/2012/06/28/2012-06-android-notifications-firewall-port-html/index.md): A brief 2012 troubleshooting note identifying TCP 5228 in an Android notification issue on a filtered wireless network.
- [T-Mobile Wi-Fi Calling Firewall Ports: 2012 Test Notes](https://mosheldon.com/2012/06/28/2012-06-t-mobile-wifi-calling-firewall-ports-html/index.md): Ports tried during a 2012 T-Mobile Wi-Fi calling setup, including an explicit uncertainty about whether TCP 5060 was needed.
- [Google Apps Password Sync for AD: 2012 Release Note](https://mosheldon.com/2012/05/31/2012-05-google-apps-update-alerts-new-product-html/index.md): A 2012 announcement reference and implementation comment about synchronizing Active Directory password changes to Google Apps.
- [Blackboard Connect 5 SOAP API with PHP 5.3: 2012 Example](https://mosheldon.com/2012/05/21/2012-05-blackboard-connect-5-api-with-php-html/index.md): A historical PHP 5.3 example for Blackboard Connect 5 SOAP authentication, XML submission, response inspection, and request debugging.
- [Google Apps for Education Integration Tools: 2012 List](https://mosheldon.com/2012/05/03/2012-05-google-apps-education-implementation-html/index.md): A 2012 school integration resource list covering password sync, CAS, GAM, directory sync, PHP clients, and training.
- [Presenting Bethel’s Google Apps Migration at NCCE 2012](https://mosheldon.com/2012/03/14/2012-03-google-apps-at-ncce-2012-html/index.md): A March 2012 session announcement covering Bethel’s Google Apps migration decisions, training, technical work, and adoption.
- [An IKEA Glass Whiteboard for a Home Office: 2012 Build](https://mosheldon.com/2012/03/14/2012-03-inexpensive-glass-whiteboard-html/index.md): A 2012 home-office glass whiteboard project with a photo and a link to the IKEA Hackers inspiration.
- [Apple Configurator Launch: March 2012 Reference](https://mosheldon.com/2012/03/08/2012-03-apple-configurator-releases-today-html/index.md): A March 2012 reference to Apple Configurator and its use for deploying groups of iOS devices, with the original announcement link.
- [HP N40L NAS Build with Unraid: 2012 Planning Note](https://mosheldon.com/2012/02/11/2012-02-nas-build-in-progress-html/index.md): A 2012 home-storage planning note listing an HP N40L, Unraid, and a proposed 15 TB capacity before the final build write-up.
- [Password Strength and Passphrases: An XKCD Reference](https://mosheldon.com/2012/01/24/2012-01-password-strength-html/index.md): A 2012 link to XKCD’s password-strength comic, with the original illustration and a related practical account-security guide.
- [vSphere 5 Web Client: Inventory Service Reset Notes](https://mosheldon.com/2011/12/10/2011-12-vsphere-5-web-client-issues-html/index.md): Archived vSphere 5 troubleshooting notes for an Inventory Service error, including the original reset and registration commands.
- [Bethel Google Apps Migration: NCCE 2012 Session Preview](https://mosheldon.com/2011/11/22/2011-11-google-apps-whole-kit-and-caboodle-html/index.md): A 2011 preview of a Bethel Schools NCCE 2012 presentation on its Google Apps migration, support, training, and technical integration.
- [GoogleHashUpdater on Windows Server 2008 R2: 2011 Notes](https://mosheldon.com/2011/11/16/2011-11-google-password-sync-windows-server-html/index.md): Historical troubleshooting notes for Hashing Password Filter and GoogleHashUpdater on Windows Server 2008 R2 with Google Data API 1.4.0.2.
- [Drupal 7 Modules Used in a School Portal: 2011 Notes](https://mosheldon.com/2011/10/17/2011-10-drupal-modules-for-your-portal-html/index.md): A 2011 list of Drupal 7 portal modules for dashboards, LDAP, CAS, video sharing, navigation, and access control.
- [Pearson LMS with Google Apps Integration: 2011 News Link](https://mosheldon.com/2011/10/14/2011-10-googles-free-lms-is-coming-soon_13-html/index.md): An October 2011 reference to a Pearson learning platform announcement with Google Apps integration for education.
- [Dart and Improving the DOM: October 2011 Reference](https://mosheldon.com/2011/10/13/2011-10-google-on-improving-dom-html/index.md): An October 2011 reaction to Dart and its Improving the DOM article, retained with the original documentation link.
- [A Drupal 7 K–12 Portal: 2011 Project Update](https://mosheldon.com/2011/08/04/2011-08-creating-k12-portal-with-drupal-html/index.md): A 2011 school portal launch note discussing Drupal 7 integration with CAS, LDAP, Kaltura, BigBlueButton, and Google Apps.
- [OS X Server 10.6 on vSphere 5: 2011 Compatibility Notes](https://mosheldon.com/2011/07/13/2011-07-os-x-server-106-on-vsphere-5-html/index.md): Historical notes on OS X Server 10.6 guest support in vSphere 5, Apple hardware requirements, and the documentation available in 2011.
- [Firefox Default and Locked Preferences: 2011 Reference](https://mosheldon.com/2011/06/27/2011-06-deploy-firefox-html/index.md): A 2011 reference to configuring Firefox default and locked preferences, with a link to the original configuration guide.
- [Gluster 3.1 to 3.2 Upgrade: 2011 Notes](https://mosheldon.com/2011/06/02/2011-06-gluster-31-to-32-upgrade-html/index.md): Notes from a 2011 Gluster upgrade, including the CentOS kernel, rsync, Python prerequisites, and package-versus-source paths.
- [Accessing Drupal 7 Sessions from a PHP Script](https://mosheldon.com/2011/05/25/2011-05-using-drupal-session-variables-outside-html/index.md): A historical Drupal 7 bootstrap example for an external PHP script that needs Drupal session variables.
- [Google Docs 3.0 API with Zend and OAuth: 2011 Notes](https://mosheldon.com/2011/05/25/2011-05-example-of-google-docs-30-apis-html/index.md): Historical Google Docs 3.0 API integration notes using Zend GData, OAuth settings, and a school district portal.
- [CAS 3.4.7 with Active Directory Attributes: 2011 Setup](https://mosheldon.com/2011/04/21/2011-04-cas-sso-347-with-ldapad-attributes-html/index.md): Archived CAS 3.4.7, Tomcat 6, and Maven 2 setup notes for returning LDAP and Active Directory attributes during single sign-on.
- [BigBlueButton for a Drupal School Portal: 2011 Notes](https://mosheldon.com/2011/04/08/2011-04-run-your-own-online-classroom-html/index.md): A 2011 evaluation note on BigBlueButton for web conferencing in a Drupal 7 school portal, with the original project link.
- [vSphere Client for iPad: March 2011 Announcement](https://mosheldon.com/2011/03/18/2011-03-vmwares-management-client-for-ipad-html/index.md): An archived March 2011 reference to the vSphere Client for iPad announcement, with its original article and image links.
- [Building iPad Work-Order Apps with Titanium: 2011 Notes](https://mosheldon.com/2011/03/14/2011-03-building-ios-apps-html/index.md): A 2011 school IT project using Appcelerator Titanium to give technicians mobile work orders and a staff and student directory.
- [Self-Hosting Gitorious on Ubuntu 9.10: 2011 Notes](https://mosheldon.com/2011/02/23/2011-02-gitorious-server-build-your-own-html/index.md): A 2011 account of running Gitorious on Ubuntu 9.10, with installation references and the goal of sharing school district code.
- [Apple XRAID Drive Replacement: 2011 Progress Update](https://mosheldon.com/2011/02/13/2011-02-xraid-progress-html/index.md): A February 2011 update on replacing Apple XRAID drives with notebook disks and formatting five arrays for a storage project.
- [Ubuntu 9.10 on ESX: Intel e1000 Driver Notes](https://mosheldon.com/2011/02/01/2011-01-ubuntu-910-and-intel-e1000-driver-html/index.md): Historical troubleshooting steps for an Intel e1000 network adapter in an Ubuntu 9.10 guest on an ESX environment.
- [First Gitorious Server Build: January 2011](https://mosheldon.com/2011/01/27/2011-01-gitorious-html/index.md): A January 2011 project update on building a self-hosted Gitorious server, preceding the longer installation note.
- [Renaming a Google Apps User with GAM: 2011 Example](https://mosheldon.com/2011/01/11/2011-01-google-apps-management-html/index.md): A historical GAM command for changing a Google Apps username and surname, with the original Python-based tool reference.
- [Mac App Store Licensing Discussion: January 2011](https://mosheldon.com/2011/01/06/2011-01-mac-apple-store-licensing-html/index.md): A January 2011 link and short comment about Mac App Store installation terms at launch, retained as a historical reference.
- [Replacing Apple XRAID Drives with Notebook Disks: 2010 Test](https://mosheldon.com/2010/12/17/2010-12-replacement-hard-drives-for-xraid-html/index.md): A 2010 hardware experiment using a StarTech IDE-to-SATA adapter and a 750 GB notebook drive in an Apple XRAID enclosure.
- [DHTMLX Touch Alpha: First Impressions in 2010](https://mosheldon.com/2010/12/14/2010-12-dhtmlx-touch-alpha-released-html/index.md): First impressions from a brief 2010 test of the DHTMLX Touch alpha release, with a link to the original announcement.
- [Gluster 3.1 Storage Build with Dell Servers and XRAID](https://mosheldon.com/2010/12/09/2010-12-gluster-progress-html/index.md): A 2010 Gluster 3.1 build log using Dell PowerEdge servers, Apple XRAID storage, and a USB installer for shared storage.
- [Logging Apache Requests to MySQL with mod_log_sql](https://mosheldon.com/2010/12/09/2010-12-logging-apache-in-mysql-html/index.md): Archived 2010 setup notes for Apache mod_log_sql, MySQL libraries, log-table creation, and the relevant module documentation.
- [Google Documents in the Windows New Menu: 2010 Link](https://mosheldon.com/2010/12/06/2010-12-how-to-add-google-documents-to-windows-html/index.md): A 2010 reference to adding Google Documents shortcuts to the Windows Explorer New menu, linking to the original tutorial.
- [Planning a Gluster Storage Cluster: 2010 Notes](https://mosheldon.com/2010/12/03/2010-12-cluster-with-gluster-html/index.md): Initial 2010 plans for using Gluster as shared storage for a web-server cluster, followed by links to the build notes.
- [DHTMLX Mobile Library Announcement: October 2010](https://mosheldon.com/2010/10/21/2010-10-mobile-dhtmlx-on-way-html/index.md): An October 2010 archive note on the announced DHTMLX mobile library for iOS and Android, with a link to the original announcement.
- [Google Apps mailto Handlers on Windows and Mac: 2010 Notes](https://mosheldon.com/2010/10/21/2010-10-fixing-mailto-protocol-for-google-apps-html/index.md): Archived Windows registry and Mac Webmailer notes for opening mailto links in a Google Apps domain in 2010.
- [Active Directory to Google Apps Password Sync: 2010 Notes](https://mosheldon.com/2010/06/30/2010-06-google-password-syncing-html/index.md): A historical account of Hashing Password Filter, a custom Active Directory attribute, and Google Apps password synchronization in 2010.
- [Google Apps OAuth Integration with PHP: 2010 Notes](https://mosheldon.com/2010/04/30/2010-04-google-api-integration-part-2-html/index.md): Archived 2010 notes on connecting a school portal to Google Apps with PHP and the domain OAuth controls available at the time.
- [Google Apps Mail and Calendar Portal Integration: 2010 Notes](https://mosheldon.com/2010/04/27/2010-10-google-api-integration-html/index.md): A 2010 school portal integration note covering CAS sign-in, Gmail unread-mail feeds, and embedded Google Calendar views.
- [Building a Ticketing System with DHTMLX: 2010 Notes](https://mosheldon.com/2010/03/14/2010-03-simplify-coding-projects-html/index.md): A 2010 project note on using DHTMLX components to build a school district ticketing system, with the original screenshot reference.