Assess local prerequisites, confirm Azure Arc enrolment, plan baseline restarts and prove the patch outcome. Includes a reusable PowerShell toolkit, official portal screenshots and evidence templates.
97 published articles
Engineering notes for Microsoft environments
Long-form engineering pieces on Microsoft infrastructure, identity, messaging and security: the problem, the evidence, the mechanism and the fix. Articles include tested versions and clear implementation limitations.
Featured technical guide
Identity security after sign-in: five checks for your next application review
MFA protects authentication. These five checks examine what follows: continued access, temporary privilege, session revocation, workload identities and emergency recovery.
Read the featured articlePublished articles
When an External ID sign-up says it sent a verification code but no email arrives, use correlation evidence to separate configuration, recipient filtering, throttling and platform delivery failures.
AADSTS50011 is an exact-string comparison failure. Capture the redirect URI sent by the application, identify the correct registration and avoid wildcard-style fixes.
The domain controller records which computer submitted the bad credentials. Follow Event 4740, then inspect services, tasks, mapped resources and cached credentials on that source.
Clients locate domain controllers through DNS SRV records. When they disappear, test the query, secure dynamic update, Netlogon registration and AD-integrated zone replication in sequence.
The portal reports one extension state, but the root cause lives in instance view, Guest Agent health, handler status and logs inside the VM.
A connected BGP peer proves only that the session formed. Traffic still depends on advertised prefixes, learned routes, propagation, UDRs, NAT and the return path.
Error 53003 only says Conditional Access blocked the request. The fix comes from correlating the exact sign-in event, policy result, device state and resource dependency.
Inactive, impaired communications and no sensor data are different states. Start with device identity and local evidence before repeatedly onboarding the endpoint.
Microsoft Entra ID now blocks risky hard-match operations that could let an on-premises Active Directory object take control of a privileged cloud account. Prepare migrations by proving identity, source anchor and role state before synchronization.
Revoking refresh tokens is not the same as deleting every application session. Diagnose which token still authorizes access and whether the workload supports Continuous Access Evaluation.
Hybrid availability has two directions and several trust layers. Test a single mailbox pair, identify the failing direction and then follow Autodiscover, OAuth and routing evidence.
A stalled move can be healthy workload protection, database pressure, replication lag or a permanent failure. The move report tells you which before you change throttling.
5.7.1 is a permanent rejection family, not one cause. Read the enhanced status text and message path before changing connectors, transport rules or spam policy.
A failed Win32 deployment can be assignment, applicability, download, installer, exit-code or detection failure. The Intune Management Extension logs show the stage.
Most Windows enrollment failures happen before policy delivery. Separate licensing, MDM scope, device limits, restrictions and stale enrollment state using local and cloud evidence.
KRB_AP_ERR_MODIFIED means the service could not decrypt the ticket. Duplicate SPNs, wrong service accounts, stale machine passwords and name resolution produce the same symptom.
A practical implementation sequence that connects Microsoft Entra, Intune, Defender, Purview and Sentinel around one attack path and a measurable control loop.
A successful PIM request proves that an assignment was created. It does not prove the target service has refreshed its authorization cache or that the activation scope is correct.
A missing policy tip can be client configuration, policy scope, sensitive-information matching, threshold or service evaluation. Test one controlled message and follow the evidence.
An enabled connector is only the control plane. Prove heartbeat, DCR association, source selection, agent configuration and table ingestion in that order.
A rule can run successfully and still produce no alert. Reconstruct its lookback, threshold, grouping and ingestion delay before rewriting the KQL.
Changing the clock fixes one machine temporarily. The durable fix is to restore the domain hierarchy from members to domain controllers and the forest-root PDC emulator.
Repeated update failure can be scan, download, servicing-stack, component-store or pending-action trouble. DISM health state and CBS evidence decide the repair path.
Microsoft Sentinel now separates fast operational analytics from lower-cost long-term security retention. The difficult decision is not enabling the lake; it is deciding which telemetry must remain available for immediate detection.
Azure Lighthouse lets one SOC operate across separate Microsoft Sentinel tenants while customer data, billing and ownership remain in each tenant. The design succeeds or fails on delegated scope, identity and role engineering.
The October 2026 Windows update can automatically replace insecure AD FS DKM container permissions. Audit the events, preserve the current descriptor, remediate deliberately and validate the farm.
A KQL query becomes a reliable SOC detection only after its data, timing, entities, grouping, false positives and operational health have been tested.
Passkeys resist phishing, but attackers are targeting registration, recovery and active sessions. Detect the identity changes and cloud collection that follow.
A practical Microsoft guide to discovering MCP servers, controlling their identities and tools, monitoring activity and testing containment.
How a small business or remote office can combine two Windows servers into a highly available Hyper-V cluster without purchasing a separate shared-storage appliance.
Tiering fails as a diagram and succeeds as an enforcement mechanism. This is the dependency order that decides which one you end up with.
Namespace, zone storage and forwarder choices are made once and inherited for twenty years. These are the ones that are expensive to reverse, and the ones that are not.
Forest recovery is not restoring a domain controller. It is rebuilding the authentication layer that every other recovery plan quietly assumes is already working.
ASR rules block the behaviours malware relies on — and some of the behaviours a twenty-year-old line-of-business application relies on. Audit mode is the entire deployment strategy.
A backup job reporting success is a claim about a job. The only evidence that matters is a restore you performed, timed, and validated against what the business actually needs.
Peering is not transitive, which is the fact the whole topology is built around. Knowing why it is chosen also tells you the point at which Virtual WAN replaces it.
The reference architecture assumes a dedicated platform function. Most organisations do not have one. The subset that still earns its keep is smaller than the diagram suggests.
Policy is the only control that stops a permitted action producing an unacceptable resource. Deploying it in the wrong order is how you break a platform team's deployments on a Monday.
A private endpoint is a network interface and a DNS problem. Almost every failure I have seen was the DNS half, resolving the public address from somewhere nobody checked.
Role assignments inherit downward and there is no deny. Where you assign a role matters more than which role you assign, and the subscription limit is closer than you think.
Auto-enrolment fails silently until certificates expire and authentication breaks. A read-only script that finds the certificates about to lapse, tests the certification authorities and reports who actually holds enrol rights.
Co-management lets Configuration Manager and Intune manage the same device. Each workload has exactly one authority, and moving a slider transfers it for every device in scope.
A policy set that works in a demo tenant and locks out a real organisation is the normal outcome. Report-only mode, exclusion design and a deliberate rollout order prevent it.
Two products that overlap enough to confuse the boundary. Defender XDR covers the Microsoft estate; Sentinel is for everything else and for correlation across it.
A user exists on-premises, does not exist in the cloud, and sync reports success. A read-only triage script that finds the objects Entra ID quarantined and explains which attribute caused it.
Application secrets expire quietly and fail loudly, usually out of hours. A read-only script that lists every credential in the tenant with its expiry, owner and blast radius.
Delegated and application permissions are not two settings on the same dial. One is bounded by the signed-in user and one is not, and the difference decides your exposure.
Two provisioning engines with overlapping names and genuinely different architectures. The decision turns on transformation complexity and forest topology, not on which is newer.
Break-glass accounts fail for the same reason everything else fails during an incident: they were configured once and never exercised. The controls that keep them usable are specific.
Six generations of Exchange, and the same four problems each time. The products changed completely; the design questions barely moved.
The last Exchange server is no longer a licensing footnote. Subscription Edition, the dedicated hybrid app and the Graph transition have changed what hybrid coexistence actually requires.
Quorum is a voting problem, and the witness is the vote that breaks ties. Each of the three options fails in a different way, and the right choice depends on what you expect to lose.
The SDK asks for the permissions you name, and most people name too many. Two discovery cmdlets tell you exactly what a command needs, which makes least privilege straightforward.
The sign-in log answers questions the portal makes awkward: legacy authentication by application, failures by error code, and which accounts are risky right now.
A setting that does not apply is rarely a broken GPO. It is usually a GPO that applied and was then overwritten by one you forgot was linked. Here is how to prove which.
Directory synchronisation works for years and then fails in a way the pilot never covered. These are the failures I check for, and the evidence that identifies each one.
Hybrid join failures are diagnosed by a tool that prints eighty lines of state nobody reads. A script that parses it, names the failing phase and checks the service connection point.
Live migration fails in a small number of reproducible ways. The most confusing one is authentication, where migrating from the console works and migrating remotely does not.
An agent acting on a user's behalf inherits that user's access, including everything they could reach but never did. The oversharing problem stops being theoretical.
The detection rule is the part that decides whether an application is installed. Get it wrong and Intune reinstalls forever, or reports success for software that is not there.
Compliance is only a report until Conditional Access reads it. Connecting the two is a single checkbox and the most effective way to lock out your entire organisation.
The Intune portal tells you a device is non-compliant. It takes several clicks to learn which policy, and there is no clicking your way through nine hundred devices. A script that answers it in one pass.
Intune does not arbitrate conflicts. Two policies setting the same value differently means neither applies, which is the opposite of what most administrators assume.
Three delegation models, one of which should not exist in your directory any more. The differences decide who can impersonate whom, and who gets to configure it.
An Owner who cannot read a secret, a firewall that looks open, and a private endpoint resolving to the wrong address all produce the same status code. A script that separates them.
Enforcing LDAP signing and channel binding is a five-minute change that breaks printers, scanners and appliances nobody documented. A script that finds them first, from the domain controllers' own evidence.
Audits, incidents and reviews all ask the same questions about a tenant. Collecting the answers the same way every time turns an ad-hoc scramble into a comparable record.
A tenant move is an identity project wearing a migration costume. The mailboxes are the easy part; the domain name can only exist in one tenant at a time.
Classification tells you where sensitive data is. It does not reduce who can reach it. Deploying labels over broken permissions produces an accurate map of a problem you still have.
NTLM is deprecated, NTLMv1 is already removed from the newest Windows releases, and nobody has an inventory. A read-only script that collects what is actually authenticating with NTLM, from the machines that know.
A script that works is not the same as a script someone else can run at two in the morning. The difference is a small number of habits, and they cost almost nothing to adopt.
Moving to phishing-resistant authentication is mostly not a passkey problem. It is a recovery, enrolment and exception problem, and those need solving first.
PIM turns standing administrative access into time-bound, justified and reviewable access. Most deployments stall because the role inventory was never done.
Two distinct protections with overlapping names, both now on by default in recent Windows. Knowing which one blocks which attack tells you what remains exposed.
A read-only assessment that collects privileged membership, delegation, stale accounts and password policy exposure — and changes nothing, deliberately.
Replication rarely fails suddenly. It fails quietly for weeks, then becomes an outage on the day a tombstone lifetime expires. This is how to read the evidence early.
Deleting a dormant account is easy. Knowing whether something still depends on it is the actual work, and LastLogonDate will not tell you.
The defaults optimise for collaboration, which is the right default for Microsoft and the wrong one for most organisations. Six settings change the exposure considerably.
Three DNS records that only work in a specific order. Publishing a strict DMARC policy before the inventory is complete is how organisations stop their own invoices arriving.
The storage engine is largely the same software. The operating model is not. Separating those two facts is what makes the platform decision answerable.
The cluster reports its own health accurately. The difficulty is that a degraded volume, a stuck repair job and a failing drive produce overlapping symptoms and need different responses.
Group Policy applies differently depending on which domain controller a client used. A read-only health check for DFSR SYSVOL, and the one recovery step that is safe to automate.
Message trace answers where a message went. Getting a useful answer depends on knowing which tool covers which window, and on reading the event sequence rather than the final status.
Windows 10 reached end of support in October 2025. A script that reports, per device, which Windows 11 requirement it fails — and says plainly which answers it cannot give you.
A browser-based console that replaces a dozen MMC snap-ins, and a gateway that can reach every server you own. The second half is why its placement is a security decision.
Autopilot failures happen in front of the person receiving the device, which raises the stakes. Almost all of them fall into four categories, distinguishable within minutes.
Ingestion is charged by volume and most of what Windows logs has no investigative value. A small, deliberate set of events answers the questions an incident actually asks.
A shared local administrator password across an estate is one compromised machine away from being every machine's password. Windows LAPS is built in, and the deployment is four steps.
Disk queue length is the counter everyone quotes and the one that misleads most often. Latency is the number that corresponds to what users experience.
In-place upgrade is supported, faster and carries forward everything — including the accumulated configuration nobody understands. That last part is usually the deciding factor.
What identity teams should verify before the mandatory Entra Connect Sync upgrade deadline, and how to reduce cutover risk.
A practical readiness plan for discovering EWS dependencies, controlling temporary access and moving Exchange Online integrations forward.
How electronics, local computer support and successive Microsoft platforms shaped the way I approach infrastructure, identity and security.
An architectural view of what changes across Microsoft platform generations, and the operational questions that still need an answer.
A practical guide to governing AI agents with Entra Agent ID, Conditional Access, Defender and Purview, including PowerShell, Graph requests and validation.