Current focus · IT/AV Support Specialist · Drake Hotel Properties · Toronto
The Drake is a boutique hotel, restaurant, venue, and gallery all at once — which means one specialist touches Active Directory in the morning, a wedding's PA system in the afternoon, and the OPERA night audit interface after dinner. This hub is the single home for every domain the role covers, plus the SC-300 study track. Progress is saved locally in your browser.
Windows, AD accounts & GPO, printers, tickets, and the art of keeping a front desk running at 7am check-out rush.
VLANs, Wi-Fi, guest HSIA, PoE, firewalls — summarised here, with the full Property Network Handbook as its own deep-dive page.
Signal flow, mixers, mics, gain structure, projectors, HDBaseT — and surviving a live event when the DJ's laptop won't output audio.
Oracle OPERA PMS, Silverware POS, Tripleseat events, Sage accounting, payment terminals, and the interfaces that glue them together.
Cloud identity and endpoint management for the property — and the full SC-300 Identity and Access Administrator study plan.
DNS, SSL, hosting, WordPress, uptime — enough full-stack literacy to troubleshoot the hotel's sites and talk to web vendors as an equal.
The posting is four jobs stapled together. Knowing which hat you're wearing — and who you answer to in each — is half the job.
Property + corporate users. Desktops, printers, mobile, accounts. You're the face of IT — service mindset is graded as hard as technical skill.
Meeting rooms, live music, weddings, art programming. Evenings and weekends live here. Vendors, artists, and production teams are your counterparts.
PMS, POS, events, accounting. You keep them running, configure users, run updates, and manage the vendors who actually own the code.
Sites, hosting, DNS, SSL. Mostly maintenance + vendor coordination, occasionally hands-on front-end fixes.
| Issue type | You own it | Escalate to |
|---|---|---|
| Password reset, printer, desktop, peripherals | Fully — resolve and document | — |
| AD permissions beyond standard groups, server changes | Diagnose, propose | Director of IT |
| PMS/POS software bugs, licensing, upgrades | First-line triage, reproduce, gather logs | Vendor support (with Director looped in) |
| ISP circuit down, phone trunk down | Verify it's truly the carrier (bypass test) | Carrier — have the circuit ID ready |
| Large event AV beyond house kit | Coordinate, patch into house system | External AV production company |
7:45am: front desk agent can't log in ("account locked"). 9:00am: sales manager's Outlook won't open. 10:30am: a printer in accounting jams and then goes offline. 1:00pm: tonight's private event host asks for a mic check and HDMI to the ballroom screen. 3:30pm: Silverware terminal in the café freezes mid-service. None of these are hard individually — the job is triage: what's revenue-blocking (POS during service, check-in at rush) beats what's annoying (one person's Outlook). Log everything in the ticket system as you go, not at 5pm from memory.
This is the bread and butter: a Windows/AD shop with property-level and corporate users. Your goal is to be fast, calm, and to know exactly which of the five usual suspects is guilty.
| Concept | What it is | When you touch it |
|---|---|---|
| Domain / DC | The security boundary; domain controllers authenticate everyone | If a DC is down, logins fail everywhere — check this first on "nobody can log in" |
| OU | Folder for users/computers; GPOs link here | New hires go in the right OU or their policies won't apply |
| Security group | Grants access to shares, printers, apps | "I can't open the S: drive" = group membership, 90% of the time |
| GPO | Pushed configuration: drive maps, printers, password policy, lockdown | gpupdate /force + gpresult /r when settings aren't applying |
| DNS (on the DC) | AD is DNS-dependent | Wrong DNS on a workstation = can't find the domain = weird everything |
# Unlock an account + reset password (AD module) Unlock-ADAccount -Identity jsmith Set-ADAccountPassword -Identity jsmith -Reset -NewPassword (Read-Host -AsSecureString) Set-ADUser jsmith -ChangePasswordAtLogon $true # Where is this user locked out from? (find the source device!) Get-ADUser jsmith -Properties LockedOut,LastBadPasswordAttempt,BadLogonCount # Group membership Get-ADPrincipalGroupMembership jsmith | Select Name Add-ADGroupMember -Identity "GG-FrontDesk" -Members jsmith # Workstation-side essentials gpupdate /force # re-pull group policy gpresult /r # what actually applied, and from where whoami /groups # what the logged-in token contains klist purge # stale Kerberos tickets after group changes
An account that re-locks every few minutes after you unlock it means a saved old credential somewhere is retrying: a phone's mail profile, a mapped drive with stored creds (cmdkey /list), a scheduled task, or a second logged-in session on another machine. Find the source in the DC security log (event 4740 shows the caller computer name) — don't just keep unlocking.
Test-ComputerSecureChannel -Repair first, it's less disruptive)..bak in ProfileList registry key, don't rebuild the profile as step one.C:\Windows\System32\spool\PRINTERS, start Spooler.ping the gateway then 1.1.1.1 then a name.cmdkey).net use to see current maps; try mapping by IP vs by name to split DNS from SMB issues.klist purge) to take effect — tell the user this before they test.DRK-FD-01 (property-area-number) makes tickets and AD tidy.The full deep-dive lives in its own page: Property Network Handbook → — 23 sections covering VLANs, Wi-Fi design, HSIA, Mitel voice, PoE, firewalls, troubleshooting trees, and sizing calculators. Below is the working summary you should know cold.
Guests, staff, PMS, POS, voice, cameras all live on separate VLANs. If a guest device can reach the POS, that's a PCI incident, not a convenience.
Link light (L1) → right VLAN (L2) → can ping gateway (L3) → port open (L4) → service running (L7). Walk up the stack; don't guess.
"The internet is down" is often just DNS. ping 1.1.1.1 works but ping google.com fails = DNS, and on a domain that means check the DC.
Guests reporting "slow Wi-Fi" are usually on a congested radio, not a saturated circuit. Check AP client counts and RF before blaming the ISP.
APs, phones, and cameras all draw from the switch's PoE budget. A "dead" AP after adding cameras may just be an exhausted budget.
# From any Windows machine on the staff VLAN ipconfig /all # do I have a real IP, right gateway, right DNS? ping <gateway> # can I leave the subnet? ping 1.1.1.1 # does routing + WAN work? nslookup google.com # does DNS work? tracert 8.8.8.8 # where does it die? Test-NetConnection pms-server -Port 3389 # is a specific service reachable?
Memorize (or wallet-card) the property's: gateway IPs per VLAN, DNS servers, public IP block, ISP circuit ID + support number, and the management IPs of the firewall, core switch, and HSIA gateway. During an outage, looking these up costs the minutes that matter.
The Drake runs live music, weddings, corporate buyouts, art programming, and daily meetings. AV is where this role differs from a normal help-desk job — and where evenings and weekends come from. The core skill is signal flow: if you can trace the path from source to output, you can fix almost anything in the room.
| Level | Roughly | Comes from | Needs |
|---|---|---|---|
| Mic level | ~ -50 dBu (tiny) | Microphones | Preamp (the mixer's gain knob) · XLR balanced |
| Instrument level | ~ -20 dBu | Guitars, keyboards | DI box to convert to balanced mic level |
| Line level | +4 dBu (pro) / -10 dBV (consumer) | Laptops, DJ gear, playback | Line input; DI box for long runs or hum |
| Speaker level | Amplified | Amp outputs | Speaker cable (never plug into anything else) |
Gain structure in one rule: set the channel gain so the loudest input peaks around 0 dB on the meter with the fader at unity — then mix with faders. Gain too low = hiss when you turn it up later; too hot = distortion that no fader can fix.
Balanced audio, locks in place. Mics, mixer I/O, DMX lighting (don't mix the cables — DMX is 110Ω). Balanced = long runs without hum.
TRS = balanced line/headphones. TS = unbalanced instrument. Visually: two rings vs one.
Consumer unbalanced. Fine for short runs; hum magnets over distance. Keep DI boxes and ground-lift handy.
Video+audio, EDID handshake, HDCP copy protection. Most "no signal" mysteries are handshake problems — reseat, power-cycle display, try another input.
HDMI over category cable up to ~70–100m via TX/RX baluns. How ballroom projectors are usually fed. If video drops: check both baluns' link lights.
Pro video coax / video-over-IP / audio-over-IP. Know they exist; production vendors bring them. Dante needs its own VLAN with QoS.
That ringing howl = a mic hearing its own speaker in a loop. Immediate: pull the channel fader down, then bring it back slowly. Structural fixes: mic behind the speakers' coverage, mic closer to the mouth (then less gain needed), cut the ringing frequency on EQ, fewer open mics. Never solve feedback by walking the mic in front of the mains.
The best man's phone won't play the slideshow sound through the PA. Trace it: phone → 3.5mm adapter → DI box → mixer channel 8. Channel meter shows nothing. The phone's output? Playing (screen shows audio). The adapter? Swap it — meters jump. It was a broken lightning-to-3.5mm dongle. Lesson: the failure is almost always at the cheapest link in the chain, and you carry spares of exactly those: dongles, 3.5mm cables, batteries, HDMI. Total fix time with spares: 90 seconds. Without: a very long walk to the office.
These platforms run the business. You won't own their internals — vendors do — but you own uptime, users, interfaces, and first-line triage. Understanding the guest-money flow tells you what's critical when.
OXI (OPERA Exchange Interface — reservations/CRS/channel data) and IFC/FIAS (property devices: HSIA, PBX, locks, POS, movies). These run as services on an interface server/PC. Know where that machine is and what runs on it — it's the most important PC in the building.Front desk reports every new key fails on doors, at 4pm on a Friday. Existing guests' keys work — so doors and locks are fine; the problem is encoding. Check: encoder powered and connected? Interface service running on the interface PC? (Restart it — most vendors bless this.) Can the desk cut a key from the lock-vendor's standalone utility as a workaround? Notify the Director, open a vendor ticket with timestamps, and give the desk the manual fallback (physical/master key escort) while you work. Pattern: old keys OK + new keys fail = interface/encoder; one door fails = that lock; all keys fail everywhere = lock server or clock drift.
Most hotel shops today are hybrid: on-prem AD for the property, Entra ID + M365 for mail, files, and Teams, often synced via Entra Connect. This track is both job-practical and the on-ramp to SC-300.
| Task | Where | Gotcha |
|---|---|---|
| New hire mailbox + license | M365 admin center / Entra | If synced from AD, create on-prem first; license via group-based licensing if set up |
| Password reset (cloud) | Entra admin center | Synced accounts: reset on-prem unless password writeback is enabled |
| MFA problems / new phone | Entra > user > authentication methods | Delete old method, issue Temporary Access Pass to re-enroll cleanly |
| Shared mailbox / distro list | Exchange admin center | Shared mailboxes need no license under 50GB; delegate via full access + send-as |
| Company phone/laptop setup | Intune | Enrollment profile + compliance policy; check device shows compliant before promising CA access works |
| Sign-in "why was it blocked?" | Entra sign-in logs | The failure reason + which Conditional Access policy applied is all in the log — read it before guessing |
Almost every "I can't get into my email" cloud ticket is answered by Entra's sign-in logs: wrong password vs MFA denied vs CA policy blocked vs risky sign-in vs stale token. Location, device, app, and the exact policy that failed are all there. Habit: logs first, theory second.
SC-300 certifies you can run Microsoft Entra ID: identities, authentication, app access, and identity governance. It's the perfect cert for this role — everything on it maps to real Drake work. Passing score 700/1000, ~40–60 questions, case studies included.
| Domain | Weight | Core topics |
|---|---|---|
| 1 · Implement & manage user identities | 20–25% | Tenants, users/groups, external (B2B) identities, hybrid identity & Entra Connect/Cloud Sync |
| 2 · Implement authentication & access management | 25–30% | MFA, passwordless, SSPR, password protection, Conditional Access, Identity Protection, device identity, PIM & role management |
| 3 · Plan & implement workload identities and app access | 20–25% | Enterprise apps, app registrations, SSO (SAML/OIDC), app consent & permissions, Defender for Cloud Apps basics, managed identities |
| 4 · Plan & implement identity governance | 25–30% | Entitlement management (access packages), access reviews, lifecycle workflows, PIM deep-dive, monitoring with logs & workbooks |
CA policies are if-then statements evaluated at sign-in: assignments (who/what/where — users, apps, conditions like location, device platform, risk) → access controls (block, or grant with requirements: MFA, compliant device, hybrid-joined, app protection).
MS Learn SC-300 path modules on user identities + hybrid. Build your dev tenant; create users, groups, dynamic groups; install Entra Connect concepts (lab the cloud parts).
MFA, SSPR, passwordless, then live in Conditional Access: build the classic policy set (require MFA for admins, block legacy auth, require compliant device for M365) in report-only. Use What If daily.
Register an app, configure SAML SSO for a gallery app, wrangle consent. Understand managed identities conceptually.
PIM end-to-end (make yourself eligible, activate with approval), access package with an approval policy, an access review that auto-applies. This domain is heavily weighted — don't skim it.
MeasureUp/practice assessments until consistently 80%+. Re-lab every weak area. Book the exam — a date makes it real.
You're not the web developer — but you are the person who answers "the website is down" at 8am. That means DNS, SSL, hosting, and WordPress literacy, plus knowing when it's the vendor's problem and how to prove it.
| Record | Maps | Hotel example |
|---|---|---|
A / AAAA | name → IPv4/IPv6 | thedrake.ca → 203.0.113.10 (the web host) |
CNAME | name → another name | www → thedrake.ca, booking widget subdomains → vendor |
MX | mail destination | → Microsoft 365 (*.mail.protection.outlook.com) |
TXT | verification & mail auth | SPF (who may send), DKIM (signing), DMARC (policy) — wrong = hotel email lands in spam |
NS | who answers for the zone | Registrar vs DNS host vs web host can be three different vendors — map them once |
# Prove where the problem is in 60 seconds nslookup thedrake.ca # does the name resolve, and to what? nslookup thedrake.ca 1.1.1.1 # same answer from public DNS? (splits local vs global) ping / tracert to that IP # is the host reachable? curl -I https://thedrake.ca # status code + headers + cert handshake
thedrake.ca and www.thedrake.ca both need coverage (SAN or wildcard).http:// asset on an https:// page — vendor fix, but you can identify it in DevTools console in seconds.admin username, MFA on wp-admin, limit login attempts, keep PHP version current with host support.Marketing switched newsletter vendors and now even normal replies land in guest junk folders. Check the TXT records: the new vendor was never added to the SPF record and doesn't sign with DKIM, so DMARC fails. Fix: add the vendor's include to SPF (mind the 10-lookup limit), enable DKIM signing in the vendor's dashboard with the CNAMEs they provide, wait for TTL, verify with a mail-tester tool. This exact ticket appears in every business that touches its own DNS.
Tap a card to flip. Cycle by category — do ten a day with coffee. Decks cover ports, AD, AV, hospitality, and SC-300.