Working in tech can be challenging at times – even for the most skilled of experts.

Especially when you work in a hospital, in which tech issues can be literally life or death.

But not every day working for an IT helpdesk is like the others.

And one day the helpdesk employee in this story came across a situation they’d never forget.

Read on to find out what happened.

I’m on tonight, you know my logs don’t lie and I’m starting to feel I’m right.

Way back I used to work the night shift at a hospital that ran 24/7.

Helpdesk was 24/7, but all other IT operations were mainly done during business hours.

Important to this story is that the helpdesk was a different physical location to the helpdesk hospital.

As helpdesk resources were kept minimal after hours, even if we were onsite, anything after hours that required actually looking at something at the user’s work location was a ticket to be looked at during business hours.

Let’s see how this policy started causing problems.

There was one user who only worked nights, and they would somewhat frequently call with their PC being offline.

When they called, their PC was always actually offline (not pingable, they can’t access network resouces).

The call would usually go with can you check cables, is it only affecting you?, have you restarted?, OK we’ll get someone to take a look at it in person tomorrow.

Strangely enough, when someone went to go look at it the next day, the PC was always back online, working perfectly.

Read on to find out what they concluded.

As no other fault could be found, it was assumed to be an intermittent issue with the PC or network cable. The PC was swapped out and network cable changed.

However, we would still get the occasional “My PC isn’t working again” calls from this user.

Suspecting next there might be an issue with the network rather than the PC, a ticket was logged to the networks team.

Luckily, the network team used syslog, so they had a good record of logs from the network switches.

Let’s see what the network team discovered.

What they could see was that at the time the calls were logged by this user, a few minutes after their shift began, the network logs showed the network port the computer was attached to as going down.

A few minutes before their shift ended, the network logs showed the network port the computer was attached to as coming up.

There were no other related log entries between these two entries, and they always occurred at the same time of day, only when this user was on shift.

It almost seemed as if this person was unplugging their network cable when they started their shift, and plugging it back in when they went home, but we couldn’t really outright accuse the use of this without proof.

Uh-oh! Let’s see how the team worked with this crafty employee.

To eliminate a switchport issue, the networks team replaced the patch cable, moved to a different switchport and even went so far as to change to using a different port between the patch panel and wallport.

So now literally everything had been replaced between the switchport and the computer, including the actual computer itself.

Another IT team was performing some other unrelated works at that hospital that night after hours, and this user was about due for another unexpected PC offline issue.

I mentioned to that team what was going on and asked, although it’s not something that we usually do, if this user called up again, could they quickly go over and see what cause was. I did mention that “It almost seems as if they are unplugging the network cable for the duration of their shift”, but in a way that isn’t directly accusing them of that.

And the employee was not prepared for what happened next.

As predicted, the user called and I did my usual logging of a ticket, and then I contacted the team onsite. They went to that location and sure enough, the network cable was unplugged, but still resting on the port so it appeared plugged in.

They covertly took a photo.

The next morning, the usual onsite team took another photo: this time it showed the cable fully plugged in. Now, we were sure the user was intentionally disconnecting the network, very likely to avoid doing work due to “IT issues”.

Performance management and discipline aren’t IT’s role, but we did let the employee’s manager know, and forwarded all the proof we had. They did mention that user “seemed to be having a lot of IT issues lately.”

A few days later, we get a user termination request, and I’m sure you can guess who it was for.

Let’s be honest, this was a smart way for the employee to not have to do any work.

They clearly figured out that no one would come to fix their computer until the next morning, and acted accordingly.

Unfortunately they weren’t smart enough in the long run!

Let’s see what folks on Reddit had to say about this.

This help desk employee found this very relatable.

While others wondered how the employee expected this to continue working.

And this Redditor had been the victim of a similar situation – with very different roots.

It’s not everyday that IT gets someone fired, but this was absolutely justified.

As if he thought he could just not do any work for days at a time.

It’s no wonder they got rid of him as soon as they could – one can only wonder what he was doing with all this free time.

This was very shifty behavior.

If you liked that post, check out this post about a woman who tracked down a contractor who tried to vanish without a trace.