Flipping msDS-SupportedEncryptionTypes is one line. I have never once been nervous about the line. I am nervous about the call two days later: a nightly job stopped, and nobody can say why. The attribute is trivial. The blast radius is not.
A service’s cert I don’t use much had expired. Turns out certbot had been failing twice a day for months and nothing said a word. Port 80 is blocked on my home line, so HTTP-01 was never an option. Wrote up the fix, and hand rolled some alerting.
A fresh Okta trial org is empty. The license caps you at ten active users, so I built a lab where 8 awkward users plus everything Okta doesn’t cap does the work. Seeds in 2 min, tears down safely.
Browser extension policy in Intune is spread across blocklists, allowlists and forced installs, and nothing shows you the combined result. So I wrote an analyzer that does.
One PowerShell module that talks to SecretStore, Azure Key Vault, AWS Secrets Manager, Bitwarden and CredMan through the same commands, so hybrid environments stop needing five different scripts.
My AD test environment module still had service account passwords sitting in plain text. This adds PowerShell SecretStore for setup, storage and retrieval, without making the lab harder to spin up.
A real path traversal validator, tested end to end with Pester. The test patterns, the edge cases that actually matter, and coverage that holds up once the function ships.
Deleting an AD account does not remove the security references pointing at it; they sit in ACLs as orphaned SIDs. An over-engineered PowerShell solution to find them at scale, with batching, logging and full test coverage.
Kerberoasting depends on RC4 still being available. How to inventory encryption types across the domain and automate the move to AES without locking anyone out.
Windows security configuration drifts, constantly. This starts a step-by-step series on automating CIS benchmarks with PowerShell DSC and AWS Systems Manager.