Letting Caddy Own the Certificates
Certbot on a timer, a deploy hook, and a Discord webhook whose only job was to tell me when the other two broke. Caddy does that work itself, so I moved the front door and deleted the rest.
Security
Standing Up authentik on a Thin Client
Nine self-hosted services, nine login forms, nine passwords in my manager under slightly different names. I put an identity provider in front of all of them on a thin client, and published it to every interface on the box without noticing.
Knowing What Breaks Before You Turn Off RC4
Flipping msDS-SupportedEncryptionTypes is one line. I have never once been nervous about the line. I am nervous about the call two days later: a nightly job stopped, and nobody can say why. The attribute is trivial. The blast radius is not.
Renewing a Cert From Behind a Residential ISP
A service’s cert I don’t use much had expired. Turns out certbot had been failing twice a day for months and nothing said a word. Port 80 is blocked on my home line, so HTTP-01 was never an option. Wrote up the fix, and hand rolled some alerting.
Seeding an Okta Test Tenant When You Only Get Ten Users
A fresh Okta trial org is empty. The licence caps you at ten active users, so I built a lab where 8 awkward users plus everything Okta doesn’t cap does the work. Seeds in 2 min, tears down safely.
Why Every IT Administrator Needs This Intune Browser Extension Policy Analyzer
Browser extension policy in Intune is spread across blocklists, allowlists and forced installs, and nothing shows you the combined result. So I wrote an analyzer that does.
Beyond Basic Secrets: Building a Universal PowerShell Secret Management Module
One PowerShell module that talks to SecretStore, Azure Key Vault, AWS Secrets Manager, Bitwarden and CredMan through the same commands, so hybrid environments stop needing five different scripts.
From Plain Text Passwords to PowerShell SecretStore: Securing Your AD Test Environment
My AD test environment module still had service account passwords sitting in plain text. This adds PowerShell SecretStore for setup, storage and retrieval, without making the lab harder to spin up.
Testing Security Functions with Pester: A Real-World Example
A real path traversal validator, tested end to end with Pester. The test patterns, the edge cases that actually matter, and coverage that holds up once the function ships.
Understanding Orphaned SIDs in Active Directory
Deleting an AD account does not remove the security references pointing at it; they sit in ACLs as orphaned SIDs. An over-engineered PowerShell solution to find them at scale, with batching, logging and full test coverage.