2KR IT Solutions

29/07/2026

If you deleted a OneDrive file recently and went looking for it in your Recycle Bin… surprise, it's not there.

Starting in May 2026, files deleted from OneDrive or SharePoint in the cloud no longer appear in your local Recycle Bin or Trash.

They are removed directly from your device and can only be recovered from the OneDrive or SharePoint web‑based recycle bin.

1. Go to onedrive.com or your SharePoint site

2. Click "Recycle bin" in the left menu

3. Right-click the file and select "Restore"

You typically have 30 days before files move to the second‑stage recycle bin (which most people don’t know about), and up to 93 more days there, depending on your organization’s settings.

After about 123 days, they’re gone for good.

21/07/2026

If you've ever spent 5 minutes hunting through Teams trying to find a meeting recording, there's a feature you should be using.

It's called the Meet app, and it's already built into Teams. No Copilot license required.

The Meet app gives you a single dashboard for every meeting you've had or are about to have. Click on any meeting and you get the agenda, recording, transcript, chat, and shared files, all in one place.

To find it:

1. Open Teams

2. Click the three dots on the left navigation bar

3. Search for "Meet"

4. Right-click and pin it so it stays in your sidebar

Once pinned, you'll see two views: upcoming meetings and past meetings. Click any past meeting to see everything tied to it.

Finding what was discussed in last month's leadership review used to take 5 minutes of digging through your calendar, recordings, and SharePoint.

With Meet, it takes 30 seconds.

21/07/2026

If you signed up for AI tools over the past 18 months and haven't reviewed them since, you're probably wasting money.

A March 2026 audit of 102 small businesses found that 87% had significant waste in their AI subscriptions, with a median of R200,000 wasted per year.

Most owners go through the same pattern. You signed up for ChatGPT, then Claude, then a transcription tool, then a meeting note-taker, then a writing assistant. Most of these tools now do what the others do.

Three signs your AI stack needs an audit:
▶️ You're paying for two tools that do the same thing
▶️ Your team stopped using a subscription you're still paying for
▶️ You can't quickly explain the ROI of each tool

While you're at it, check the security too:
✅ Make sure every tool is on a business plan with a "Do Not Train" clause. Consumer plans feed your data into the model.
✅ Remove access for ex-employees. AI tools get forgotten during offboarding.
✅ Check what's connected to your Microsoft 365 or Google Workspace. AI tools often have access to your email and files you never noticed.

15/07/2026

Your business email is worth more than your bank account.

Stolen Microsoft 365 credentials remain the most common starting point for SMB breaches in 2026, and the reason isn't just that attackers can read your messages.

Once someone has access to your email, they can reset the password for every other account tied to that address.

Your bank, your accounting software, your CRM, your cloud storage.

Email is the master key to your entire digital business.

What attackers typically do once they get in:

▶️ Set up mailbox forwarding rules so they keep seeing your replies after you change the password

▶️ Send invoice fraud emails to your clients from your real account, often changing wire transfer details

▶️ Sit for weeks, learning your business, before making a move

Three things that meaningfully reduce this risk:

✅ Use phishing-resistant MFA where possible (FIDO2 hardware keys or Windows Hello for Business). Authenticator app prompts are better than nothing, but they can still be bypassed.

✅ Set up Conditional Access policies in Entra ID to block logins from countries you don't operate in.

✅ Review your mailbox forwarding rules monthly. In Outlook, go to Settings > Mail > Forwarding. If you see a rule you didn't create, that's a sign your account is compromised.

The monthly audit takes 5 minutes and it’s one of the highest-leverage security habits you can build.

07/07/2026

If an email asks you to download a tool to "view a document," stop and verify before clicking.

A growing attack pattern is tricking employees into installing real IT software on their own machines.

The software is called RMM (Remote Monitoring and Management), and it lets IT companies remotely control computers for support purposes.

Tools like ConnectWise ScreenConnect, Datto RMM, SimpleHelp, N-able, and LogMeIn are all legitimate and digitally signed by reputable vendors.

That's exactly why attackers love them. Antivirus software doesn't flag them as malicious because they aren't malicious. They're just being installed by the wrong person.

In February 2026, Microsoft documented a campaign that hit 29,000 users across 10,000 organizations.

The lure was a fake "IRS Transcript Viewer" email. The download was actually a repackaged ScreenConnect installer.

Once an employee ran it, the attacker had full remote control of their machine.

The same trick is being used with fake Zoom invites, fake Teams calls, and fake DocuSign emails.

A few things you can do:

▶️ Ask your IT provider to maintain an allow-list of approved RMM tools. Anything outside that list gets blocked from installing automatically.

▶️ Train your team that "download this viewer to see your document" is almost always a phishing attempt. Real documents don't require a new program.

▶️ Audit your endpoints for RMM software your IT provider didn't install. If you see something unfamiliar, fla

30/06/2026

07/05/2026

Don’t treat Microsoft OneDrive or Google Drive as a guaranteed backup.

Many people assume that if their network gets hit by ransomware, they can just log into their cloud account and restore an older version of their files.

The problem is that modern ransomware can sync encrypted files to your cloud account, overwriting clean versions and potentially targeting version history or recycle bin contents before you even realize you have been attacked.

When malicious software reaches a synced laptop, the damage does not stay on that single device.

Because your cloud drive is designed to sync changes instantly, the system automatically uploads those locked, encrypted files straight into your company cloud.

It directly overwrites your clean data.

Cloud storage connects your data, without isolating it.

To have a higher level of security, you need a separate backup system that is completely offline or locked down.

You need an isolated copy of your files that a compromised network account cannot reach, alter, or delete.

23/04/2026

Granting AI agents access to your data comes with severe risks.

You should ONLY connect these automated systems to your live data if you have strict security boundaries.

Here are just a few of the permission controls you MUST implement:

✅ Restrict all AI agents to "read-only" access within your network.
✅ Deny the automated system any permission to authorize payments or move funds.
✅ Block the AI's ability to delete or permanently alter original files.
✅ Audit the API permissions of any third-party AI tool before connecting it.

That’s just the bare minimum.

You must define limitations and rules for every single process that AI touches.

If you want a full AI Acceptable Use Policy template to implement in your business, comment below with “AI” and we’ll send it to you.

22/04/2026

Your team is using ChatGPT. Your employees are pasting client data into free AI tools. Your engineers are uploading confidential designs to save time.

And you have no idea it's happening.

This is "shadow AI" — and for South African businesses, it's a POPIA compliance nightmare waiting to happen.

🚨 Here's the reality:

38% of employees have shared sensitive work data with AI tools without permission
POPIA fines go up to R10 million
The Information Regulator is watching

The good news? You don't need to ban AI. You need a shadow AI audit — a structured 5-step process to find the tools, understand the risk, and put guardrails in place.

👉 Read the full guide:

Staff using AI tools without IT oversight? Learn how Cape Town businesses can run a shadow AI audit and stay POPIA-compliant.

21/04/2026

You can open questionable files and test unverified software without risking your local operating system.

Employees occasionally need to open unverified email attachments or unfamiliar software tools. Executing these directly on a workstation risks malware infection.

Windows 11 Professional includes a built-in feature called Windows Sandbox. It generates a temporary, isolated desktop environment.

You can open files and install software within this isolated environment. If a file contains malware, it cannot access your primary hard drive or the broader company network.

Closing the Windows Sandbox window permanently deletes the temporary operating system and all associated files.

Search for "Turn Windows features on or off" in your taskbar to enable Windows Sandbox.