The engineer who taught infrastructure to manage itself.
Since the late 1980s he has been making infrastructure run itself. The newest apprentice is a language model — trained one PowerShell script at a time.
SubjectMark Ringo
FiledAlberta Beach, AB
PracticeIndependent practice
StatusOperational, 35yr+
◆
01 ·
Profile12 min read
I have been building IT infrastructure since the late 1980s, and what is striking when I look at the arc isn't the variety of technologies — though there is plenty of that — but the consistency of the underlying instinct: find the waste, remove the manual step, make the system run itself.
It started with retail networks at Pier 1 Imports. Then Arthur Andersen, where I helped design server infrastructure and data center implementation for XM Satellite Radio, and architected directory services for the Chevron / Ultramar Diamond Shamrock energy merger. Hitachi Consulting hired me on its founding day. Seven years as Chief Technology Officer at Triencon Services — designing hybrid public-private clouds, deploying pervasive encryption, hardening Active Directory for electric grid control networks under NERC CIP. Citibank, as Senior Vice President of Global Infrastructure for North American Credit Cards Business Operations. Simmons Bank. Then Steeves & Associates, where the work converged on the strange and lovely intersection of cloud-native endpoint management, DSC v3, and the practice of training language models on the discipline itself. Since September 2026 I have been consulting independently again, under RingoSystems.
I live near Alberta Beach, where my home lab mirrors the enterprise patterns I deploy at scale — and where my cat, Chaos, continually stress-tests the exit door sensor automations. The work I am most engaged with right now sits at the intersection of agentic engineering and infrastructure: building tools that let tens of thousands of Intune-managed endpoints configure, secure, and remediate themselves, and training a custom LLM on the corpus of knowledge that makes that possible.
Lately that same instinct has opened a whole new line of work: Model Context Protocol servers built for a specific technology stack. Each one gives an AI client expert, hands-on command of one platform at a time, from Veeam Backup for Microsoft 365, to Homey Pro smart homes, to Reolink camera fleets. I ship much of this work free and open-source under the MIT license, published on Docker Hub and the public MCP Registry, because the fastest way to make infrastructure behave is to let everyone build on the same foundation.
He doesn't pursue technology for technology's sake — he brings a business-based perspective to infrastructure.
— Randy Green, Retired CTO · via LinkedIn
Enterprise endpoint management, from silicon to cloud — automated, secured, and built to outlast the next reorg.
01
Endpoint Management
Cloud-native device management at scale. Intune-first architectures with zero-touch provisioning, compliance policies, and automated remediation across large enterprise and retail fleets.
Intune·Autopilot·SCCM·Graph API·Entra ID
02
PowerShell & Automation
Production-grade modules, Proactive Remediations, custom DSC resources, and CI/CD pipelines. If it can be scripted, it should be — and it should run unattended.
Application control, conditional access, certificate-based auth, and security baselines that actually ship. From NERC CIP to retail PCI — security at every layer. CISSP certified.
App Control·CISSP·Conditional Access·LAPS
04
AI & LLM Engineering
Fine-tuning domain-specific models, building local inference infrastructure on consumer GPUs, and integrating AI into operational workflows. Not chatbots — real utility.
Ollama·QLoRA·GGUF·Claude API·Strix Halo / ROCm
05
Agentic Engineering
Designing AI-driven workflows where Claude acts as a collaborating engineer — not just a chatbot. Persistent project contexts, structured skill systems, tool orchestration, and iterative development loops that produce production-grade infrastructure code.
Claude Projects·MCP·Prompt Engineering·Tool Orchestration·IaC Pipelines
06
Cloud & Hybrid Architecture
Azure-first infrastructure design. From hybrid public/private clouds at energy companies to Azure Functions for config delivery — always with cost discipline.
Azure·Docker·REST APIs·NuGet·ProGet
07
Infrastructure & Home Lab
Unraid servers, Ubiquiti networking, smart home automation, and bespoke ESP32 firmware connecting to home automation via Matter over Thread. The home lab is where enterprise patterns get tested before they ship.
Unraid·UniFi·Homey Pro·ESP32·Matter/Thread
08
MCP Server Engineering
A new category of work: Model Context Protocol servers built for a specific technology stack, giving an AI client expert, LAN-direct command of one platform at a time. Read-heavy and safe by default, with opt-in action tiers. Shipped as hardened containers, most of it free and open-source.
Tools and platforms born from real problems in endpoint management.
Each one began as a problem I needed to solve at scale. Open the entries below to read the full feature on each.
001Recently Launched
RepoFabric
Stop downloading the same installer a thousand times.
A private winget source platform — three containers, one browser tab — that cuts repeat-download bandwidth via BranchCache and Delivery Optimization peering, ships an Entra-attributed audit trail, and exports Intune and GPO policy in one click. One WAN pull per app per subnet, not per device.
Desired state, assigned by Entra group and enforced on the endpoint.
Self-hosted, browser-managed DSC v3 distribution. Endpoints discover the configs assigned to them by Microsoft Entra device-group membership, apply them with dsc config set, and report compliance — with the PowerShell modules those configs depend on served from the same Gitea store. The desired-state layer of the Fabric suite.
Full-stack PowerShell SPA for building, validating, and deploying DSC v3 configurations. Multi-provider AI assistance, GPO import, ADMX knowledge base, and live package search.
PowerShell 7·DSC v3·HTML/JS SPA·Ollama·Claude API
Read the feature →
004Recently Launched
TractorBeeam365-MCP
Point an AI at your Microsoft 365 backups — read-only by default.
An independent MCP server for Veeam Backup for Microsoft 365. It talks straight to the VB365 REST API so Claude can review backup config, find protection gaps against Microsoft Graph, spot trend drift, and verify cloud immutability. The action and restore tier is opt-in, confirm-token gated, and fully audited. The pull is opt-in; review is the safe default.
Your smart home's only hope for natural-language control.
A self-hosted MCP server for Homey Pro, 60 tools and 3 knowledge prompts deep. It goes well past device on/off: Z-Wave and Zigbee mesh diagnostics with ranked remediations, live energy and Insights analysis, app memory and usage review, and full Flow and Advanced Flow authoring from scratch. No cloud broker, no paid connector plan.
MCP·TypeScript·Homey Web API·Z-Wave / Zigbee·MIT / Open Source
Read the feature →
006Alpha
Reo2-D2
The astromech that keeps an eye on your home.
An expert MCP server for Reolink cameras, doorbells, NVRs, and the Home Hub, built to run alongside Homey-Wan-Kenobi so one AI agent can author camera-driven home automations. Read-heavy analyze and diagnose tooling over the LAN: config audits, bandwidth budgeting, requirements matching, and a Homey event bridge, with an optional AI Vision plane. In alpha: working today, still rough.
MCP·Python·reolink-aio·Homey Bridge·AI Vision
Read the feature →
007Unreleased
Diagnoda
Root cause, the Jedi way. Diagnose it, Yoda will.
An MCP server that drives Windows root-cause investigations to a confirmed answer. It ingests Intune diagnostic ZIPs, memory dumps, ProcMon and Sysmon captures, and TSS output, normalizes them into a per-case store, and reasons from symptom to proximate cause to true root cause, then verifies the fix actually worked. Under active construction, not yet released.
The cloners. Every silent install, proven on a disposable machine.
Takes any Windows installer, works out how to install it with zero user interaction, then proves it in a throwaway Windows 11 VM. The proof is the deliverable — no window appeared, no consent prompt fired, the process exited clean, the product was actually detected afterward. Ships the proven result as a WinGet manifest set and an Intune Win32 .intunewin with detection, install and uninstall rules. Running live on the bench, not yet publicly released.
Silent-install proof·libvirt / KVM·WinGet manifests·Intune Win32·PowerShell 7 / Pode
Read the feature →
009Unreleased
Kamino Imprint
Configure it once by hand. Get the configuration document back.
The configuration-capture product. After a proven package installs on a real bench machine, Imprint watches an operator configure the application and turns what changed into a DSC v3 or PSADT configuration document — instead of a screenshot-and-notes handoff. Checkpoints are stored separately and merged on read, so it knows which wizard page produced which registry write. Standalone, or step seven of the Kamino pipeline.
Microsoft ships a genuinely no-code runtime for Agent Framework and deliberately ships no editor for it. DevUI's canvas is hard-coded read-only, AutoGen Studio is dead, and the one real drag-and-drop designer lives in the Foundry portal and retires on 1 December 2026. DroidForge fills the gap: a real visual designer, the JSON Schema Microsoft never published, and a bridge that turns every workflow into a chat model. Agents in YAML, in Git, on a local model. Zero Azure.
Microsoft Agent Framework·Declarative YAML·llama.cpp / Strix Halo·MCP·OpenAI-compatible bridge
Read the feature →
011Recently Launched
Toronto Utilities Atlas
Every large building in Toronto, coloured by what it burns.
An interactive 3D map of Toronto's large buildings, coloured and heat-mapped by the Ontario Energy and Water Reporting and Benchmarking dataset for 2018 to 2024. Click any building for its energy, water and greenhouse-gas figures, a seven-year trend, and every report filed nearby. Nine measures, three colour modes, a year animation and a 55-type use filter, on a keyless MapLibre stack with no framework and no bundler. The interesting part is what it had to do to the data first.
A personal knowledge system built around one hard-won lesson: an earlier attempt, same person and same hardware and same purpose, was finished and then never adopted, because it was not simple enough to use. So the success metric here is adoption, not capability, and the day-one path needs no running infrastructure at all. The substrate is plain markdown, YAML and [[wikilinks]] in git — every tool is a view over it and is allowed to die. In closed pilot, under active development.
A self-hosted, single-screen control plane that coordinates one AI coding agent per repo across the RingoSystems fabric. Per repo it surfaces open PRs, issues, and Actions runs, local-clone freshness, and a persisted chat — then drives a two-way contract: urgency-ranked directives out, broker-channel reports back, with an LLM service registry routing siblings to shared model endpoints. v1 complete — all eight phases shipped.
Two published models, one domain. v5.1, a Muse Glimmer 30B fine-tune for DSC v3, PowerShell 7, Intune and agentic work, lifts DSC v3 accuracy from 56% to 89% while scoring 5/5 on tool selection and 15/15 on argument extraction — matching the untouched base model. Narrow domain fine-tunes in this space usually destroy tool calling. v4.2, the Qwen3.6-27B build, stays published for Legacy DSC 1.1, which v5.1 refuses by design. Both public on HuggingFace and Ollama.
An agentic Claude Project that ingests CIS Benchmarks, Microsoft OSConfig baselines, HardeningKitty finding lists, and other hardening standards to generate production-ready DSC v3 YAML configurations. A back-burner project, currently unreleased.
Claude Project·DSC v3·CIS Benchmarks·OSConfig·HardeningKitty
Read the feature →
016Unreleased
Restraining Bolt
Limit the droid without disabling it.
A least-privilege investigation and remediation toolkit for Windows. It proves, with evidence, exactly which administrator rights a service or app actually uses, then removes the rest without breaking it. A differential ProcMon and AccessChk method attributes every real failure to one of four axes and hands back the single minimal grant that resolves it. Built to v1.0.0 internally, not yet publicly released.
PowerShell·ProcMon / AccessChk·User Rights Assignment·ACL / icacls·Least Privilege
Read the feature →
◆
Feature 04 · The Arc
A chronological reading of the career.
From the floor of Pier 1 in 1996 to an independent practice in Alberta Beach in 2026 — the detailed record of a career that began in the late 1980s.
2026— Present
Principal Infrastructure Architect & Consultant
RingoSystems
Independent practice. Cloud-native endpoint management, DSC v3, agentic engineering, and domain-specialised LLMs — delivered as consulting engagements and as open-source tooling.
2020— 2026
Principal Infrastructure Architect
Steeves & Associates
Cloud-native endpoint management at scale. Tens of thousands of Intune-managed devices. DSC v3 architecture, custom LLM fine-tuning, agentic engineering practice.
2017
Director, Infrastructure Architecture
Simmons Bank
Enterprise infrastructure leadership in regulated banking. Endpoint, identity, and security architecture across the bank's footprint. Served on the Enterprise Architecture committee.
2016
SVP, Global Infrastructure
Citibank — North American Credit Cards Business Operations
Global infrastructure leadership for one of the world's largest consumer credit operations. Scale and accountability at the highest level.
2009
Chief Technology Officer
Triencon Services
Seven years as CTO. Hybrid public-private clouds. Pervasive encryption rollout. Multi-node DirectAccess IPv6 VPN. Active Directory hardening for electric grid control networks under NERC CIP.
2005
Associate Director, IT
ORIX USA
Financial services infrastructure. The pivot from pure consulting into enterprise IT leadership.
2002
Senior Systems Engineer
Hitachi Consulting
Founding-day employee. Helping build the practice from zero.
1999
Senior Systems Engineer
Arthur Andersen
Server infrastructure and data center implementation for XM Satellite Radio. Directory services architecture for the Chevron / Ultramar Diamond Shamrock energy merger.
1996
Lead Network & Technical Analyst
Pier 1 Imports
The first chapter. Retail networks. Where the instinct to find the waste, remove the manual step first found a place to practice.