Windows Server: 15 PowerShell commands to diagnose without rebooting
Check services, events, CPU, memory, disks, DNS, and ports with 15 diagnostic recipes, permission guidance, and interpretation limits, without automatic fixes.
Read article→
Marc-Antoine LambertTechnology consultingTechnical blog · Field notes · Practical guides
IT guidance
built for the real world.
Cybersecurity, Microsoft infrastructure, networking, backup, AI and residential technology explained with a practical approach.
Latest articles
Understand. Prioritize.
Take action.
Articles designed to help IT teams, decision makers and homeowners make better technical decisions.
Azure Resource Graph: 10 queries for Azure inventory and monitoring
Inventory VMs, unattached disks, public IPs, tags, and Arc servers with ten read-only queries, interpretation guidance, and paginated collection.
Read article→Microsoft Graph PowerShell: 12 commands for users and licenses
Inventory users, distinguish direct and inherited licenses, investigate assignment errors, and prepare two pilot changes with permissions and rollback.
Read article→Exchange Online: 10 PowerShell commands to troubleshoot email
Follow messages with Message Trace V2, inspect connectors, rules, quotas, and SMTP AUTH, then validate a targeted correction with a pilot and rollback.
Read article→Microsoft 365: 15 PowerShell commands to check security
Check Entra roles, Conditional Access, OAuth grants, and Exchange settings with 15 read-only PowerShell commands, required permissions, and interpretation limits.
Read article→Unraid: monitor disk health and plan replacement
Interpret SMART, errors, and self-tests, then plan Unraid drive replacement according to disk role, parity, pool topology, and independent backups.
Read article→Connect AI to VMware with MCP: start with read-only access
Build a vCenter MCP pilot with verified tool scope, limited vSphere identity, validated TLS, protected secrets, and tests against unauthorized actions.
Read article→Enterprise DNS: troubleshoot intermittent name resolution
Isolate intermittent DNS failures across clients, caches, resolvers, zones, and forwarders, then validate a pilot correction with rollback.
Read article→TLS certificates: detect expiry before an outage
Monitor certificates actually served with OpenSSL and PowerShell, check SNI and chains, then renew with actionable alerts, a pilot, and rollback.
Read article→Microsoft 365: backup, retention, and legal hold explained
Separate recovery, Purview retention, and eDiscovery holds, then build a tested strategy for Exchange, SharePoint, OneDrive, and Teams.
Read article→Microsoft Purview DLP: start with useful policies without blocking work
Deploy useful DLP policies in simulation, measure false positives, pilot tips and exceptions, then enforce proportionate controls without disrupting work.
Read article→Microsoft Defender: investigate an alert without unnecessary device isolation
Triage a Defender alert with incident context, timelines, evidence, and KQL, then choose proportionate containment instead of reflexive device isolation.
Read article→Microsoft Entra Token Protection: reduce stolen token replay
Pilot Token Protection with compatible clients, Windows and Apple devices, web limitations, sign-in logs, KQL queries, and Conditional Access rollback.
Read article→Microsoft 365: detect and remove suspicious email forwarding
Inventory hidden inbox rules, mailbox forwarding and transport rules, preserve evidence, and stop suspicious forwarding with controlled business exceptions.
Read article→Home Assistant and MCP: build with Claude, Codex, and ChatGPT
Connect Home Assistant to Claude, Codex, or ChatGPT with minimal entity exposure, then build local, validated, and reversible automations and dashboards.
Read article→Microsoft Defender: manage antivirus exclusions without weakening security
Separate antivirus exclusions, ASR rules, EDR, and indicators, then validate every exception with minimal scope, an owner, and an expiry date.
Read article→Slow file server: diagnose SMB, DNS, antivirus, and storage
Isolate slow file-server performance with SMB, DNS, network, antivirus, and storage evidence—without disabling protection or applying random tuning.
Read article→Secure vendor remote access with MFA, Conditional Access, and Cisco
Secure maintenance access with named identities, MFA, Conditional Access, SAML groups, Cisco policies, least-privilege ACLs, and tested revocation.
Read article→Employee offboarding: secure Microsoft 365 without losing data
Block access and sessions, manage shared mailboxes, licenses and OneDrive, then transfer ownership with verified retention and clear exit checks.
Read article→Microsoft 365 email going to junk: how to find the cause
Diagnose inbound or outbound mail sent to junk using message trace, headers, SPF, DKIM, DMARC, policies, connectors, and sender reputation.
Read article→Compromised Microsoft 365 account: a first-response guide
Contain a compromised account, revoke sessions, inspect MFA, rules, forwarding and OAuth consent, then preserve evidence and restore access safely.
Read article→Slow SQL Server: diagnose blocking, waits and expensive queries
Isolate a SQL Server slowdown with read-only T-SQL, blocking chains, wait statistics, Query Store, execution plans, and deadlock evidence.
Read article→Microsoft Secure Score: which recommendations should you fix first?
Prioritize Secure Score actions by risk, reach, licensing, and operational impact instead of simply chasing the most points.
Read article→Microsoft 365 OAuth apps: audit consent and Microsoft Graph permissions
Inventory OAuth apps, delegated and application permissions, owners, credentials and logs, then remove access through a controlled process.
Read article→Migrate a Windows Server 2016 domain controller to 2025
Replace a 2016 DC with Windows Server 2025 using health checks, backup, promotion, DNS, replication, FSMO transfer, demotion, and rollback.
Read article→Before Copilot: audit SharePoint, Teams and OneDrive permissions
Find oversharing, links, guests, and oversized groups before Copilot, then remediate access in controlled stages based on your Microsoft 365 licenses.
Read article→LDAP signing and channel binding: secure Active Directory without outages
Inventory LDAP clients, analyze events 2889 and 3074/3075, then enforce signing and CBT through Group Policy with pilots, validation, and rollback.
Read article→SQL Server health assessment: T-SQL queries and PowerShell scripts
Assess SQL Server backups, integrity, jobs, storage, waits, blocking, Query Store and security with read-only collection and a prioritized action plan.
Read article→Azure Update Manager and the future of WSUS: transition with Azure Arc
Modernize Windows and Linux patching with Azure Arc: WSUS and GPO coexistence, maintenance windows, costs, permissions and a phased transition.
Read article→Secure Active Directory service accounts: gMSA, SPNs and delegation
Reduce AD service account privileges with gMSAs, controlled password retrieval, SPNs, Kerberos delegation, secret rotation and a tested migration rollback.
Read article→Conditional Access: move from report-only to enforced without locking out users
Analyze sign-in logs, protect emergency access and enforce Conditional Access in rings with pilots, exit criteria and a tested rollback path.
Read article→Restore Active Directory after a cyberattack: build a forest recovery plan
Build an executable AD forest recovery plan covering trusted backups, isolation, the first DC, SYSVOL, DNS, FSMO, krbtgt, validation and recovery drills.
Read article→Windows Hello for Business and Cloud Kerberos Trust: hybrid deployment guide
Deploy passwordless sign-in across Microsoft Entra ID and Active Directory with Cloud Kerberos Trust: prerequisites, Intune or GPO setup, validation and limitations.
Read article→Protect Veeam from ransomware: hardened Linux repository and immutable backups
Deploy a hardened Linux repository, separate identities, size immutability and test recovery without a false sense of security.
Read article→Exchange Server SE: migrate from 2016 or 2019 without breaking hybrid
Choose a supported path to Exchange SE, inventory dependencies, and validate mail flow, SMTP relay, certificates and Microsoft 365 coexistence.
Read article→Azure Virtual Desktop vs Citrix: architecture, performance and costs
Compare AVD, Citrix DaaS and CVAD: HDX, RDP Shortpath, FSLogix, images, autoscaling, licensing and a transparent budget model.
Read article→Secure Microsoft 365 admin workstations with Conditional Access and PIM
Build dedicated admin workstations, require compliance and strong authentication, limit privileges with PIM, and validate access and recovery.
Read article→Microsoft Intune: replace Group Policy through a controlled migration
Inventory your GPOs, assess MDM compatibility, and migrate to Intune in rings with validation, conflict management and a tested rollback path.
Read article→Home Assistant, Matter and Thread: which architecture should you choose?
Understand Matter, Thread and border-router roles, then build a reliable local smart home with IPv6, multi-admin, backups and practical validation.
Read article→Secure a UniFi small-business network: VLANs, firewall, guests and IoT
Segment employees, guests, cameras and IoT with UniFi: VLAN plan, zone-based policies, mDNS, PowerShell tests and a phased rollout.
Read article→Azure Arc for on-premises servers: inventory, patching and governance without migration
Connect Windows and Linux to Azure Arc in stages, structure inventory, delegate access, and manage compliance and updates without moving workloads.
Read article→Configure DMARC with SPF and DKIM in Microsoft 365 without blocking legitimate mail
Inventory every sending source, align SPF and DKIM, analyze DMARC reports, and move safely from p=none to p=reject.
Read article→Replace AzureAD and MSOnline with Microsoft Graph PowerShell without breaking scripts
Inventory commands, map permissions and objects, secure authentication, and migrate in stages with parity testing and a rollback path.
Read article→Microsoft Entra emergency access accounts: create, protect and monitor break-glass access
Build resilient emergency accounts, protect their FIDO2 keys, control Conditional Access exclusions and alert on every use.
Read article→Deploy Windows LAPS in a hybrid Active Directory and Microsoft Entra ID environment
Choose where to back up local passwords, delegate retrieval, configure GPO or Intune and migrate from legacy LAPS without losing recovery capability.
Read article→Windows Server 2016 is nearing end of support: build a realistic migration plan
Inventory roles and dependencies, choose a migration strategy and plan the Windows Server 2016 exit before January 12, 2027.
Read article→Microsoft 365 token theft: why MFA is not enough against AiTM attacks
Learn how AiTM attacks steal an already authenticated session, then combine passkeys, compliant devices, Token Protection, detection and revocation.
Read article→Secure Active Directory Certificate Services: detect ESC1, ESC4, ESC6 and ESC8
Audit AD CS templates, ACLs, CA settings and IIS enrolment endpoints, then remediate ESC1, ESC4, ESC6 and ESC8 without disrupting critical certificates.
Read article→SMTP AUTH Basic retirement in Microsoft 365: migrate printers, apps and alerts to OAuth
Inventory SMTP dependencies, choose OAuth, Microsoft Graph or a controlled relay, then remove Basic authentication without interrupting critical email.
Read article→Cloudflare Tunnel with Docker on Unraid: publish services without opening ports
Run cloudflared in Docker on Unraid, publish a service over HTTPS without port forwarding and protect it with Cloudflare Access.
Read article→Home Assistant and UniFi Protect: build secure local home surveillance
Connect Home Assistant to UniFi Protect without exposing cameras: VLANs, local accounts, API access, notifications, retention, backups and secure remote access.
Read article→Microsoft 365: why OneDrive and SharePoint are not a backup
Recycle bins, versions and retention reduce risk but have finite windows. Build a tested Microsoft 365 backup and restore strategy.
Read article→Modern Wi-Fi and legacy IoT devices: avoid 2.4 GHz connectivity problems
SSID, channels, WPA2/WPA3, PMF, mDNS and VLANs: connect legacy IoT devices to modern Wi-Fi without weakening the network.
Read article→Stale MDE devices: cleanup with PowerShell and the API
Find stale MDE devices with PowerShell and Active Directory. Separate inactivity, exclusion and offboarding, with review before any changes.
Read article→Migrate Microsoft Defender for Identity to v3.x sensors: a practical guide
Plan your MDI v2-to-v3 migration: MDE prerequisites, patches, GPOs, action accounts, KQL validation and phased sensor cleanup.
Read article→VMware alternatives: hypervisor comparison for 2026
Compare Hyper-V, Proxmox, Nutanix, Azure Local and HPE Morpheus: costs, SAN storage, Veeam backup and VMware migration for your infrastructure.
Read article→Deploy passkeys with Microsoft Entra ID without locking out users
A phased method to choose FIDO2 profiles, bootstrap with Temporary Access Pass, measure adoption and enforce phishing-resistant authentication without locking out accounts.
Read article→SMB hardening with Windows 11 24H2 and Windows Server 2025: a deployment guide
Audit signing, encryption, NTLM and guest access, then harden SMB in stages without disrupting legacy NAS devices and applications.
Read article→Securing Copilot agents and MCP servers in the enterprise: a practical guide
A Zero Trust architecture for controlling identities, tools, data, OAuth authorization, sensitive actions and audit trails for AI agents.
Read article→Microsoft Defender Advanced Hunting: 10 useful KQL queries for IT administrators
Ten practical KQL queries to monitor MDE sensors, ASR rules, logons, PowerShell, vulnerabilities and ransomware warning signs.
Read article→Kerberos and RC4 in 2026: audit Active Directory and migrate to AES without outages
A practical method to detect RC4 dependencies, remediate service accounts and phase in AES after the 2026 Kerberos hardening changes.
Read article→Microsoft Defender ASR rules: moving from Audit to Block without disrupting production
A phased method to assess, deploy and monitor ASR rules with Intune or Group Policy before enabling Block mode.
Read article→Active Directory security: 10 checks to prioritize
Ten technical checks to identify important Active Directory risks and build a realistic remediation plan.
Read article→UniFi Protect: 8 things to plan before installing cameras
Storage, cabling, PoE, privacy and remote access: the decisions to make before selecting and positioning cameras.
Read article→3-2-1 backup: protecting a NAS or Veeam environment
How to turn the 3-2-1 rule into a practical, testable strategy that withstands human error and ransomware.
Read article→