Series

IntuneScriptLab 11

One PowerShell module for testing Intune remediation, platform and detection scripts before Intune runs them, taken apart one piece per post: the rules, the local harness, Win32 detection, assignment filters, the agent logs, the tenant audit, the PSScriptAnalyzer wrapper, the pull request gate and the lab that measured it all.

  1. Testing Intune Scripts Before Intune Does 5 Oct 2026
  2. Linting Intune Scripts With Rules Measured on Real Devices 6 Oct 2026
  3. Running Intune Scripts Locally the Way the Agent Does 7 Oct 2026
  4. What the Intune Agent Counts as Installed 8 Oct 2026
  5. Intune Assignment Filters That Never Match 9 Oct 2026
  6. Reading the Intune Management Extension Logs as Objects 12 Oct 2026
  7. Auditing the Scripts Already in Your Intune Tenant 13 Oct 2026
  8. Intune Rules Inside PSScriptAnalyzer 14 Oct 2026
  9. Gating Intune Scripts in a Pull Request 15 Oct 2026
  10. Measuring the Intune Agent on Three Proxmox VMs 16 Oct 2026
  11. Where to Start With a Broken Intune Script 19 Oct 2026

TestEnvironment 8

Hand-built lab data agrees with the script it was meant to test, because both came out of the same head. TestEnvironment is one PowerShell module that seeds Entra ID, Active Directory, Okta, Authentik, FreeIPA, PingOne and OneLogin with data designed to disagree, and tears it down again proving ownership of every object first. The first post is the shape of the module; each provider gets its own after it.

  1. Test Data That Breaks Scripts on Purpose 12 Sep 2026
  2. Active Directory Test Data, a Year and Six Providers Later 13 Sep 2026
  3. Seeding Entra ID When There Is Nothing to Paste 14 Sep 2026
  4. Eight Okta Users, and Everything That Changed Around Them 16 Sep 2026
  5. Seeding Authentik, Where the Directory Is Only the Floor 24 Sep 2026
  6. Seeding FreeIPA, Where Teardown Starts Revoking 25 Sep 2026
  7. A Directory Full of Question Marks: Seeding PingOne 28 Sep 2026
  8. A Role With Nothing but a Name: Seeding OneLogin 29 Sep 2026

FreeIPA 3

A Linux-only lab wants a directory that speaks Kerberos and LDAP without a Windows server in it. Standing FreeIPA up on a Dell Wyse thin client, hardening it before the first client joins, and adding a replica when the only spare host runs Ubuntu.

  1. Standing Up FreeIPA When Everything in the Lab Is Linux 8 Sep 2026
  2. Hardening FreeIPA Before the First Client Joins 9 Sep 2026
  3. Adding a FreeIPA Replica When the Only Spare Host Runs Ubuntu 10 Sep 2026

Homelab Identity Stack 7

A thin client running authentik, Caddy in front of it with real certificates for names that resolve nowhere public, forward auth for the applications that can’t do better, Cloudflare Access on the way in, and then the two applications that proved awkward. A follow-on moves Proxmox onto OIDC, which it can do itself.

  1. Standing Up authentik on a Thin Client 1 Sep 2026
  2. Letting Caddy Own the Certificates 2 Sep 2026
  3. Forward Auth in One Snippet, and the Hop I Had Wrong 3 Sep 2026
  4. An Identity Provider Is Supposed to Be Reachable 3 Sep 2026
  5. Turning Off Tautulli's Login on Purpose 5 Sep 2026
  6. Why OpenMediaVault Keeps Its Own Login 6 Sep 2026
  7. Proxmox Can Do This Itself 7 Sep 2026

CIS Benchmarks with PowerShell DSC in AWS 3

Windows security configuration drifts, constantly. Eliminating it across a Windows fleet in AWS: PowerShell DSC and the CIS benchmarks, the Systems Manager troubleshooting detour most people hit on the way, and deploying to hundreds of servers with maintenance windows and dashboards.

  1. Part 1: Getting Started with PowerShell DSC and CIS Benchmarks in AWS 23 May 2025
  2. Part 2: Making Sure Systems Manager Actually Works and Logs Are Sent to CloudWatch 24 May 2025
  3. Part 3: Deploying CIS Benchmarks at Scale with Systems Manager 27 May 2025