Hi, I’m Michael. I’ve been in the technology industry for over a decade. I founded Qutzl LLC to help small and medium businesses across central Pennsylvania with remote support, hosting, and practical technology consulting, and I write Qutzl Insights the same way I work: clear steps, real tradeoffs, and advice you can use on a Tuesday afternoon.
Through Qutzl and earlier roles throughout the years I’ve supported organizations across a wide range of industries, with clients all over the world. The stack changes; the job stays the same: keep systems reliable, keep people productive, and don’t overcomplicate what doesn’t need to be complicated.
That work has spanned oil and gas operations; finance and compliance environments including banks, financial advisors, and credit unions; videography shops; brick-and-mortar and online retail; religious organizations; hotels and motels; disaster cleanup; and more. I’ve also completed research and testing projects for companies, some of them among the largest in the world, and for universities.
Different sectors bring different constraints: audit expectations in finance, uptime pressure in hospitality and retail, field realities in energy, and careful handling of member or congregational data in community organizations. I treat each environment on its own terms and leave it better documented than I found it.
I earned an Associate of Science in Information Sciences and Technology from Penn State in 2016, then a Bachelor of Science in the same program in 2018. As a freshman work-study help desk technician, I spent 20 to 40 hours a week supporting Penn State systems: account resets, deployments, and the everyday tickets that show how people actually use technology.
From sophomore through senior year I interned with the lead technology instructor at Penn State DuBois. That role opened the door to real lab and production tooling: project work, help desk support for students and staff, classroom and lab maintenance, and deep exposure to Linux, macOS, Windows, VMware, Citrix, SANs, networking, and backup platforms. The hours stacked up quickly (thousands before graduation), and I kept learning by building.
A partial list of platforms I work with regularly.
80 published
By Michael NarehoodAnnouncements
A complete tour of Chef's Kiss: import recipes from links and photos, organize your cookbook, plan meals, build shopping lists, cook step by step, and keep it synced across web, iPhone, and Android.
Apple refreshed Mac mini with M6 and M5 Pro, and Mac Studio with M5 Max and M5 Ultra. Here is how the four desktops compare for SMB deployments.
Ubiquiti's August 2026 advisory covers 22 UniFi vulnerabilities. Here are the affected products, fixed versions, real risks, and a practical update checklist.
Chrome, Edge, and Apple Passwords are useful autofill stores, but they are not a shared business vault for payroll, banking, or infrastructure logins.
By Michael NarehoodMicrosoft 365
Security Defaults vs a short Conditional Access starter pack for Microsoft 365 shops under fifty people — MFA, legacy auth, and break-glass, not a 40-policy mess.
By Michael NarehoodMicrosoft 365
A five-minute Microsoft 365 sign-in log habit for small tenants: failed MFA, weird locations, legacy auth, admin devices, and new app consent.
An operator’s opinion: why 1Password is my default for personal use and small businesses, including the isolated Families account that comes with Business and MSP-provisioned seats.
Personal Apple IDs syncing Desktop and Documents feel convenient until someone leaves and the company cannot revoke the folder.
Apple Upgrade replaces the iPhone Upgrade Program in the U.S. with Klarna-backed leases for iPhone, Watch, Mac, and iPad. Terms, end-of-lease options, and what SMBs should watch.
CVE-2026-64531 is a local privilege escalation in the Linux Open vSwitch datapath with a public PoC. Who is exposed, which stables are fixed, and what to do today.
A look at Narehood/VM-Setup, the menu-driven Bash utility for XCP-ng guests and generic Linux hosts, plus the newer update, pin-sync, and installer-hardening work.
What’s in Narehood/dotfiles (bash/zsh, tmux, vim, screen) and the newer prompt.conf settings for emoji, colors, layouts, and safer install/uninstall.
Build guest Wi-Fi as an internet-only security zone, with real firewall isolation, sensible access, and tests that catch leaks into business networks.
A straightforward checklist for keeping Ubuntu Server or Desktop patched: apt update, upgrade, reboots, and what to verify before you walk away.
By Michael NarehoodMicrosoft 365
A practical path to require multifactor authentication in Microsoft 365 for a small business, without locking everyone out on Friday afternoon.
Hugging Face and OpenAI documented an autonomous model crossing evaluation and production boundaries. Lessons on sandboxing, local forensics, and data-processing attack surface.
A realistic endpoint baseline for small businesses: patching, MFA, EDR, backups, and least privilege, without pretending you need a Fortune 500 stack.
Critical unauthenticated RCE (wp2shell) hits WordPress 7.0.0–7.0.1 and 6.9.0–6.9.4. What the CVEs mean, which versions are fixed, and what SMBs should do today.
Grok 4.5 launched mid-July 2026 as a jointly trained SpaceXAI and Cursor model aimed at coding, agents, and knowledge work. What shipped, where to get it, and how to use it without buying the hype.
OpenAI's internal GPT-Red red-teaming model shows how automated prompt injection testing scales. Practical steps for businesses deploying Copilot, agents, and AI connectors.
Microsoft's 663-CVE July 2026 release reflects AI-assisted vulnerability discovery. What MSPs and SMBs should change in triage without freezing from volume anxiety.
A repeatable method for finding, owning, classifying, and safely retiring public websites and forgotten subdomains before a vulnerability lands.
A practical way to rank vulnerability work using exposure, exploitation evidence, business impact, and change risk instead of CVSS alone.
A practical first sixty minutes for scoping an incident, stopping active harm, preserving evidence, securing identity, and giving leadership facts instead of guesses.
By Michael NarehoodMicrosoft 365
A practical way to inventory Power Automate identities, control OAuth consent, assign durable ownership, and keep important flows alive through staff changes.
How SMBs should use Windows Hello for Business, device-bound passkeys, and synced passkeys without creating three half-finished passwordless projects.
Claude Fable 5 brings Mythos-class capability to general users, with classifiers that fall back to Opus 4.8 on high-risk topics. What launched, what Mythos 5 is for, and how to think about it for real work.
How small IT teams store shared admin passwords and API keys in a password manager without Spreadsheet-of-Doom habits.
By Michael NarehoodMicrosoft 365
How SharePoint inheritance, groups, sharing links, and unique permissions interact, plus a safe method for reviewing access without breaking the site.
Remote Desktop still runs small businesses. These gateway and access habits keep it off the open internet without breaking legitimate work.
Aggressive block lists feel productive until legitimate mail vanishes. How to tighten filtering without losing invoices, MFA codes, and vendor threads.
How to choose a genuinely independent backup circuit, size it for essential work, and test automatic failover before the primary ISP goes dark.
How to build a single network map your team will actually update after every change, not a shelf document from the last migration.
By Michael NarehoodMicrosoft 365
A practical starter for Microsoft Purview retention labels in a small Microsoft 365 tenant — keep what you must, delete what you should, and avoid a year-long taxonomy project.
By Michael NarehoodBackups & Continuity
A practical checklist for evaluating Microsoft 365 backup scope, retention, access, restore behavior, security, compliance, and testing.
Standing VPN accounts for vendors age badly. Just-in-time access with time bounds and approval beats a shared tunnel nobody reviews.
Inventory service identities, replace passwords where possible, and rotate remaining secrets without breaking the workloads that depend on them.
Anthropic's April 2026 Project Glasswing put Claude Mythos Preview to work finding critical flaws with major vendors. What that means for downstream patching at ordinary SMBs.
Why the CEO's mailbox is the first account that deserves FIDO2 or passkeys, not another SMS code.
By Michael NarehoodBackups & Continuity
A repeatable restore-testing drill for proving backup scope, access, timing, integrity, and recovery ownership before an incident.
By Michael NarehoodBackups & Continuity
A practical renewal-preparation checklist for collecting evidence, answering security questions accurately, and reviewing cyber-policy terms.
By Michael NarehoodBackups & Continuity
Two ways to keep ransomware from wiping your last good copy—and how to choose without overbuying.
A vendor-neutral VoIP toll-fraud baseline covering dial permissions, admin access, SIP exposure, alerts, logs, and incident response.
A single change record template so every rule edit has a name, a reason, and a rollback path.
A practical same-day IT offboarding runbook for identity, sessions, SaaS, devices, shared secrets, and company data without deleting first and asking later.
Hybrid connectors, old MX records, and ghost servers still cost you money and attack surface long after mail lives in the cloud.
A practical way for a 20-60 user firm to choose cloud-only identity, hybrid identity, and the right Windows device join without keeping domain controllers by habit.
Replace a firewall based on support, measured capacity, security requirements, and recoverability—not a birthday or a frightening sales chart.
A practical rollout for authorizing every legitimate sender, signing mail, enforcing DMARC, and catching gaps before messages get rejected.
When blocking bad domains at the resolver beats buying another appliance—and when it is not enough on its own.
How small businesses can recognize payment fraud, verify a request outside email, and respond quickly when money or a mailbox may be at risk.
A practical Autopilot / Intune enrollment path for small Microsoft shops so day-one laptops join the tenant instead of becoming help-desk tickets.
How to split a small fleet into pilot and production rings so Patch Tuesday does not become a company-wide outage.
How to move a critical line-of-business application off unsupported Windows without breaking the workflow the business depends on.
Single sign-on is not free to roll out — but neither is password sprawl. How SMBs decide which apps get SSO enforced and which can wait.
A practical iPhone management baseline for small businesses: ownership, enrollment, passcodes, updates, managed apps, loss, and offboarding.
By Michael NarehoodMicrosoft 365
Who waits in the lobby, who walks straight in, and how to keep client calls from turning into open doors — a practical Teams policy pass for SMBs.
A practical Google Workspace baseline for 10-50 users: enforced 2-Step Verification, safer administrators, controlled sharing, OAuth review, devices, and alerts.
When your PSA is full of noise, operators stop seeing real incidents. A practical filter list for SMB RMM alerting.
A practical escrow plan for BitLocker recovery keys in small businesses — so a lost PIN does not become a full disk wipe.
How to create and maintain emergency Microsoft 365 admin accounts so you can recover the tenant without leaving a permanent backdoor.
How small offices rotate and escrow local administrator passwords with Windows LAPS through Intune — without a spreadsheet of doom on every workstation.
Emergency browser updates do not wait for Patch Tuesday. How SMBs should force Chrome updates, control extensions, and close the relaunch gap before attackers do.
Cursor and similar tools can speed up PowerShell and bash work for MSPs, but only if you review output, protect secrets, and treat suggestions as starting points.
Ubuntu 25.04 shipped in April 2025 with GNOME 48, Linux 6.14, and refreshed toolchains. Here's when it fits your lab versus staying on 24.04 LTS.
By Michael NarehoodMicrosoft 365
What Copilot actually costs, how it uses your tenant data, and when it helps small teams versus generating expensive drafts nobody trusts.
By Michael NarehoodCloud & DevOps
Workers can replace a surprising amount of API and edge logic, but it is not a default for every app. A practical guide to when serverless at the edge beats traditional hosting.
DeepSeek's R1 models got ops and dev teams paying attention. Here is why, plus sober notes on local vs API use and why client data does not belong in random endpoints.
Apple Intelligence landed in late 2024 with on-device models and Private Cloud Compute. What MDM admins should decide before enabling it on managed devices.
An overview of XCP-ng 8.3: updated Xen and kernel stack, security and performance improvements, LTS direction, install/upgrade notes, and what to check before you move.
Microsoft's 2024 feature update is not a click-and-forget release. Pilot rings, app friction, and how to avoid surprise broad enablement on busy fleets.
What Xen Orchestra is, why Xen Tools matter, the VM sizing to use, and a straightforward path to install XO for managing your XCP-ng hosts.
macOS 15 is GA with iPhone Mirroring, a Passwords app, and continuity changes IT should pilot before a broad upgrade.
OpenAI's o1 preview changed how some tasks get done. Here is what is different from ChatGPT, where the cost makes sense, and where it is overkill for everyday MSP work.
A bad Falcon content update crashed millions of Windows systems. Here is what small IT teams should change without turning it into blame theater.
By Michael NarehoodSoftware & Releases
Mozilla's new ESR base landed in July 2024. Here is the cadence, extension policy work, and when ESR still beats rapid release for line-of-business apps.
By Michael NarehoodSoftware & Releases
Google finished the MV3 transition. Here is what broke, what still works, and a practical checklist for extension policy at work.
By Michael NarehoodCloud & DevOps
After Redis Inc. changed licensing, the Linux Foundation fork Valkey offers a BSD path forward. Here is when new builds should pick Valkey and when staying on Redis still makes sense.
CVE-2024-3094 hit rolling Linux distros hard. Here is what happened, who was exposed, and the checks SMB teams should run.
By Michael NarehoodSoftware & Releases
Redis moved new releases to RSALv2 and SSPLv1 in March 2024. Valkey forked the BSD line. Here is how to pick a path without panic.
