Around forty posts live here, and the archive is not much help if you have just arrived. This page groups everything by what you are actually trying to do.
If you only read one thing, make it the Entra and Proxmox SSO walkthrough — it is far and away the most-read post on the site, and it is the pattern most of the homelab material builds on.
Single sign-on for the things you self-host
This is what most people arrive for. If you run services at home and want to stop maintaining a second set of passwords, these walk through pointing them at Entra ID instead.
- Setting up SSO with Entra and Proxmox (OIDC) — the most-read post on this site: Proxmox VE against Entra over OIDC, including realm setup and permission mapping
- Setting up SSO with Entra and Portainer (OAuth) — the same idea for Portainer, using OAuth and team mapping
- Using Entra to log into an application without SAML/OAUTH/OIDC — what to do when the app supports no modern auth protocol at all
- Tailscale for Pi-hole — split DNS, certificates, and reverse proxy access on Tailscale’s free tier
Building out a homelab
Hardware, containers, and the unglamorous maintenance nobody writes about.
- Portainer for your Homelab — Docker and Portainer from scratch, reachable over Tailscale rather than the open internet
- Homepage for your Homelab — the Homepage container as a single dashboard for everything you run
- Upgrading My Home Lab: From Dying Synology to NetApp JBOD with Proxmox 9 — replacing a dead Synology with a 24-bay NetApp JBOD on Proxmox 9, ZFS layout and all
- Renewing a Cert From Behind a Residential ISP — certbot on DNS-01 when your ISP blocks port 80, and alerting so it fails loudly
- RSS feeds to Discord channel using FeedCord — FeedCord in Docker, pushing RSS headlines into a Discord channel
PowerShell
Modules and patterns from real work, most of them over-engineered on purpose.
- PowerShell AST or "How I Stopped Looking for that Curly Brace" — using the AST to analyse scripts instead of reading them
- Beyond Basic Secrets: Building a Universal PowerShell Secret Management Module — one module across SecretStore, Key Vault, AWS Secrets Manager, Bitwarden and CredMan
- Rolling my own ssh-copy-id for Windows — the utility Windows OpenSSH forgot to ship
- Blue/Green Deployment for Patch Management — PowerShell classes applied to zero-downtime patching
- Transforming PowerShell Development with GitHub Copilot: Enterprise Standards and Custom Instructions — encoding your team’s standards as Copilot custom instructions
- Keeping Copilot Instructions in Sync Across Repositories — a GitHub Actions workflow that stops those instructions drifting
- Raising the Copilot Standards to Pester 6.1 — checking those same standards against an actual Pester install rather than the release notes
- Testing Security Functions with Pester: A Real-World Example — Pester coverage for a path traversal validator
Active Directory
On-prem AD is not dead, it is just quietly accumulating problems.
- Understanding Orphaned SIDs in Active Directory — deleted accounts leave SID references behind in ACLs; finding them at scale
- Modernizing Your Active Directory: A PowerShell Solution for Kerberos Encryption Migration — inventorying encryption types and moving RC4 to AES without breaking authentication
- Active Directory Test Data That Doesn't Suck — a thousand realistic objects in a lab domain in about a minute
- From Plain Text Passwords to PowerShell SecretStore: Securing Your AD Test Environment — getting the service account passwords in that lab out of plain text
Entra ID and Microsoft 365 administration
Tenant work: policy, licensing, and finding out what is actually configured.
- Conditional Access: Outcomes, Not Verdicts — testing who a Conditional Access policy will block before you enable it
- Using an MCP agent to query Entra with natural language. — asking Microsoft Graph questions in plain English from VS Code
- Information for Microsoft Licenses in tenant — every license in the tenant and who holds it, direct or inherited
- Why Every IT Administrator Needs This Intune Browser Extension Policy Analyzer — pulling browser extension policy out of Intune and reporting what applies
- Getting latest Windows updates in Autopilot devices — patching during Autopilot enrollment while Microsoft’s built-in option is delayed
- What You Should Know About Managing OneDrive in 2025 — OneDrive admin settings worth knowing about
- Remove OneDrive sites in bulk — and how to remove OneDrive entirely when a client insists
- Migrating to Microsoft 365 — migration assistance available to smaller organisations
Windows Server on AWS: CIS benchmarks with DSC
A series on eliminating configuration drift across Windows fleets in AWS. Read them in order.
- Part 1: Getting Started with PowerShell DSC and CIS Benchmarks in AWS — the setup and prerequisites
- Part 2: Making Sure Systems Manager Actually Works and Logs Are Sent to CloudWatch — the troubleshooting detour, because your instances will not show up in Systems Manager
- Part 3: Deploying CIS Benchmarks at Scale with Systems Manager — deploying to hundreds of servers, with dashboards and maintenance windows
Everything else
Hardware, identity providers that are not Microsoft, and Windows features of varying usefulness.
- Seeding an Okta Test Tenant When You Only Get Ten Users — building a useful Okta lab inside a ten-user trial cap
- 24H2 and Recall — what the DISM output actually tells you about whether Recall is installed
- PowerToys new Workspaces feature — saving and relaunching whole application layouts
- Framework Laptop Setup Thoughts — notes from setting one up
Browse by topic
Every post also sits under one of ten topic hubs: PowerShell, Homelab, Entra ID, Active Directory, Microsoft 365, Windows, Security, DevOps, AWS and AI.