Pages

Wednesday, June 25, 2025

Dabbling with Qwen3 LLM and RAG

I am in between contracts at the moment and gainfully employed, but I always feel the need to continually improve onself. Lately, the thought of using open-source LLM to run locally AND use local data for additional context had me studying this for days on end. So, I decided to get the Qwen3-8b LLM, and use the much smaller Qwen3-Embedding-0.6b for creating the vector database.

The setup then is to simply use 18 documents/emails (from my previous employer) where I found the keyword "RTO". This equated to only 118 KB, but with my modest system (AMD 8845HS, 32 GB RAM, no GPU), it still took 5 minutes and 16 GB of RAM to create the embeddings. I tried earlier with a bigger sample size of 3 MB, and it was 100% CPU with 128 GB RAM allocated for hours and still failed as it couldn't allocate/page more memory.

I asked the 2 models the same question: What are the sentiments with company's return to office mandate?

Note that I have changed the actual company name to just "Company" in the results

Here's the generic answer from the Qwen3-8b model:

As of my last update in July 2024, there is no widely publicized or official "return to office mandate" specifically tied to Company (Company is a subsidiary of "e***", which has its own corporate policies). However, if you're referring to broader trends in the tech industry—such as companies revisiting hybrid or in-office work policies post-pandemic—here's an analysis of general sentiments around such mandates:

### **1. Mixed Reactions Among Employees:**
- **Supporters:**
- Some employees appreciate structured in-office time for collaboration, spontaneous idea-sharing, and team cohesion.
- Remote work can sometimes lead to burnout or blurred work-life boundaries, and returning to the office may offer a sense of normalcy.
- Employees in roles requiring physical presence (e.g., customer service, design, or hardware development) may benefit from in-office work.

- **Critics:**
- Many employees, especially younger generations (e.g., Gen Z and Millennials), value flexibility and work-life balance. A strict return-to-office policy could be seen as inflexible or outdated.
- Remote work has become a standard expectation, and mandates may lead to dissatisfaction, reduced retention, or even mass resignations.
- Employees with caregiving responsibilities, health concerns, or geographic constraints may find it difficult to comply with in-office requirements.

### **2. Industry Trends and Company Policies:**
- **Hybrid Models:** Many tech companies (e.g., Google, Microsoft, Meta) have adopted hybrid models, allowing employees to split time between in-office and remote work. This approach balances collaboration with flexibility.

- **Company Culture:** Some companies prioritize in-office culture for innovation and leadership development, while others emphasize trust and autonomy. Company’s stance would depend on its internal priorities and leadership.

### **3. Potential Implications:**
- **Retention and Recruitment:** A return-to-office mandate could deter talent, especially in competitive markets where remote work is a key perk.
- **Productivity and Morale:** If not well-communicated, such a policy might harm morale. Conversely, clear guidelines and support (e.g., subsidies for commuting, flexible hours) could mitigate resistance.

### **4. Company’s Specific Context:**
- Company has historically allowed remote work for many roles, particularly in its global workforce. If there were a shift toward stricter in-office requirements, it would likely face similar challenges as other tech firms.

- Public statements from Company leadership (e.g., CEO D** S******) have emphasized flexibility and employee well-being, suggesting a preference for hybrid models.

### **Conclusion:**
If Company were to implement a return-to-office mandate, sentiments would likely be mixed. While some employees might support it for collaboration and structure, others could resist due to preferences for flexibility or personal circumstances. The success of such a policy would depend on how it’s framed, the level of flexibility offered, and alignment with employee needs. For the most accurate and up-to-date information, checking recent announcements from Company or employee surveys would be advisable.


Whereas here's the result with just 18 documents/emails as an additional context, again the exact same question was asked.

The sentiments regarding Company's return to office (RTO) mandate are mixed, with both positive and negative perspectives expressed across internal (Slack) and external (Blind) platforms.

- **Positive Sentiment**:
- Employees acknowledged the challenges of adapting to RTO but noted that managers provided empathy and flexibility, addressing concerns.

- Some employees shared positive experiences, though these were balanced with personal struggles (e.g., stress, fatigue, and difficulty tracking days).

- **Negative Sentiment**:
- On **Slack**, 12% of messages expressed negative sentiment, reflecting frustrations with the transition, such as increased stress and fatigue.
- On **Blind**, 50% of sentiment was negative, with concerns about attendance tracking practices. Employees worried about individuals "badge-in" without working, and there were warnings about accountability and potential disciplinary actions.

Overall, while some employees appreciated managerial support, the discussions highlight significant concerns about the RTO policy's implementation and its impact on work-life balance and trust.


Quite amazing how even a small dataset can alter the result. For bigger datasets, I may need to update to 128 GB of DDR5, and get an RTX 5060Ti at a minimum. I understand you can buy cloud/compute resources for this, but a 5060Ti will also allow me to run games at 4k and high FPS, so win-win.
Just at look at the memory needed, it balooned to 128GB before failing and my disk was just paging constantly.


A bit more update on this... I think I made a better "chunking" of the Company data and the result seems to be even better.

The sentiments surrounding Company's Return to Office (RTO) mandate, as outlined in the provided documents, reflect a mix of **organizational efforts to manage transitions** and **potential challenges** that may influence employee perceptions. Here's a structured analysis:

### **1. Organizational Focus on Compliance and Support**
- **Compliance-Driven Mandate**: The RTO policy emphasizes **statutory compliance**, requiring employees to update their residential addresses for legal and administrative purposes. This is framed as a **mandatory obligation**, with potential corrective actions (including termination) for inaccuracies. While this underscores the company's focus on compliance, it may raise concerns about **employee autonomy** and **privacy** (e.g., tracking in-office presence via badge swipes).
- **Tools and Resources**: Company has developed **toolkits**, FAQs, and communication channels (e.g., Global Bridge Address Refresh) to guide employees through the transition. These efforts aim to **reduce confusion** and **support compliance**, which could mitigate negative sentiments.

### **2. Hybrid Work Flexibility and Exceptions**
- **Hybrid Model**: The RTO mandate is not a strict return to full-time office work. Instead, it promotes a **hybrid model** (3 days/week in-office) with exceptions for **volume employees** (e.g., GCS L24 and below, GFCCP L27 and below) who may work fully virtual if within a 30-mile radius of an office. This flexibility is designed to **balance business needs** with employee preferences, potentially reducing resistance.
- **Accommodations**: Employees can request exceptions via the **Location Discrepancy Tool** or **Employee Moves Tool**, with approvals based on factors like **commutable distance**, **specialized skills**, or **legal requirements** (e.g., visa implications). This suggests a **nuanced approach** to managing individual needs.

### **3. Challenges and Potential Concerns**
- **Tech Readiness**: The **modernization of hybrid collaboration tools** (e.g., AI-driven cameras, directional microphones) is critical for ensuring an inclusive in-office experience. Delays in hardware installation or outdated equipment could lead to **frustration** if the transition is not smooth.
- **Compliance Pressure**: The emphasis on **address verification** and **attendance tracking** may create **perceived micromanagement**, especially for employees who prefer remote work. The mention of "corrective actions" (up to termination) for non-compliance could heighten anxiety.
- **Global Variability**: Country-specific labor laws and cultural nuances (e.g., France’s Works Council, Brazil’s legal requirements for flexible work) complicate the rollout, potentially leading to **disparities in employee experiences**.

### **4. Sentiment Management Strategies**
- **Communication**: Company is prioritizing **transparent, centralized communication** to ensure employees understand expectations, exceptions, and the rationale behind the RTO mandate. This includes **site-specific briefings** and **tool updates**.
- **Leadership Involvement**: Site leaders and managers are encouraged to **support employees** through the transition, reinforcing a culture of **collaboration** and **community**. This aligns with the stated goal of achieving **neutral to positive sentiment** with **curiosity and energy** about the future.

### **Conclusion**
The sentiments around Company's RTO mandate are **mixed but managed**:
- **Positive Aspects**: Clear compliance frameworks, hybrid flexibility, and tools for exceptions suggest an effort to balance business needs with employee autonomy.
- **Potential Concerns**: Compliance pressures, tech readiness, and global variability may lead to **resistance or anxiety**, particularly if the transition is not smooth or perceived as overly restrictive.
- **Overall Tone**: Company aims to **mitigate negative sentiments** through proactive communication, accommodations, and a focus on **employee experience**, though the success of this approach will depend on the **execution of these strategies**.

Tuesday, June 10, 2025

Service principals and certificates

I never did formally test this one out so I used 2 versions of PowerShell and installed the certificate of the service principal in the first test in the user store, then the computer store for the 2nd one. Additionally when I installed the certificate, I set it such the private key is non-exportable.

PowerShell Current User Local Computer
5.x Works Works
7.x Works Works

As you can see from the above, both worked. How you configure yours is up to you, but I can imagine a scenario where a shared management server that needs to run automation (created by different admins) will have its certificate installed in the computer store.

Update: I notice that every time I reboot, the certificate authentication stops working when the certificate is in the computer store. But after I delete and re-import, it works again. Not sustainable and I am not sure yet why this is the case, but will dig thru...

Friday, June 6, 2025

Email escalation, EOP and headers

When I get an escalation from HR or Legal (or an exec) for blocking or whitelisting emails (like vendor organization surveys, or business partners), there are 2 areas that I use: message trace and headers. Below is my cheat sheet.

https://winsa2.blogspot.com/p/notes-on-exchange-online-protection.html

Thursday, June 5, 2025

Entra-joined and WHfB

Just looking at the process for device registration, whfb provisioning, and auth info we can find.

https://winsa2.blogspot.com/p/windows-hello-for-business-whfb.html

Restricting the devices for passkeys or FIDO2

In this tenant, I have Yubikey and Microsoft Authenticator passkey registered. The FIDO2 authentication policy by default allows all types, in this post I tested limiting those devices.

https://winsa2.blogspot.com/p/restricting-passkeysfido2-devices.html

More info on FIDO2 attestation

https://winsa2.blogspot.com/p/dig-little-deeper-onto-passkeyfido.html

Wednesday, June 4, 2025

Taking stock of the different user authentication methods in your tenant

Like any start of a project or task, it helps to get a baseline of where you are before you proceed, this helps check our progress too. With the ever increasing need to protect the identities of your users, this simple script will get all the Entra ID users and the authentication methods they have registered.

It runs at a pace of about 2 accounts per second, hence if your tenant has a lot of accounts, you can either filter it first or simply wait it out.

Below is a sample output:

#microsoft.graph.emailAuthenticationMethod: 21 #microsoft.graph.fido2AuthenticationMethod: 4 #microsoft.graph.microsoftAuthenticatorAuthenticationMethod: 50 #microsoft.graph.passwordAuthenticationMethod: 657 #microsoft.graph.phoneAuthenticationMethod: 83 #microsoft.graph.softwareOathAuthenticationMethod: 1 #microsoft.graph.temporaryAccessPassAuthenticationMethod: 1 #microsoft.graph.windowsHelloForBusinessAuthenticationMethod: 5 Authentication methods saved to authentication-methods.csv

Link here: https://github.com/panoy86/sysadmin/blob/main/graphAPI/get-mfa.ps1

Aside from the console output, it saves the results in a CSV file with the auth-methods in a comma-separated string.

Notes on implementing PIM and JIT

Simple steps to implement Privileged Identity Management and Just In Time roles

https://winsa2.blogspot.com/p/simple-pim-implementation.html

Testing the Temporary Access Pass

Tested a scenario where a new user account is created, and a passkey/FIDO2 was created directly without ever using the account's password.

https://winsa2.blogspot.com/p/testing-out-temporary-access-pass-tap.html

Tuesday, June 3, 2025

Please use CAP for your service principals

I am guily of it too, most M365 admins after they switched employers do keep their PowerShell scripts for typical re-use. For instance, a script to expand an Exchange Distribution List (that can contain hundreds of child DLs) is handy for all organizations. Unfortunately some of them may contain credentials of service principals.

https://winsa2.blogspot.com/p/cap-for-security-principals.html

Cloud authentication in Entra ID

My thoughts on moving from federated identity to Entra ID

https://winsa2.blogspot.com/p/cloud-user-authentication-in-entra-id.html

Setting up a phishing-resistant MFA in Entra ID

https://winsa2.blogspot.com/p/setting-up-phishing-resistant-mfa-in.html