Secure Active Directory Certificate Services: detect ESC1, ESC4, ESC6 and ESC8
Audit AD CS templates, ACLs, CA settings and IIS enrolment endpoints, then remediate ESC1, ESC4, ESC6 and ESC8 without disrupting critical certificates.
Read article→
Marc-Antoine LambertTechnology consultingTechnical blog · Field notes · Practical guides
IT guidance
built for the real world.
Cybersecurity, Microsoft infrastructure, networking, backup, AI and residential technology explained with a practical approach.
Latest articles
Understand. Prioritize.
Take action.
Articles designed to help IT teams, decision makers and homeowners make better technical decisions.
SMTP AUTH Basic retirement in Microsoft 365: migrate printers, apps and alerts to OAuth
Inventory SMTP dependencies, choose OAuth, Microsoft Graph or a controlled relay, then remove Basic authentication without interrupting critical email.
Read article→Cloudflare Tunnel with Docker on Unraid: publish services without opening ports
Run cloudflared in Docker on Unraid, publish a service over HTTPS without port forwarding and protect it with Cloudflare Access.
Read article→Home Assistant and UniFi Protect: build secure local home surveillance
Connect Home Assistant to UniFi Protect without exposing cameras: VLANs, local accounts, API access, notifications, retention, backups and secure remote access.
Read article→Microsoft 365: why OneDrive and SharePoint are not a backup
Recycle bins, versions and retention reduce risk but have finite windows. Build a tested Microsoft 365 backup and restore strategy.
Read article→Modern Wi-Fi and legacy IoT devices: avoid 2.4 GHz connectivity problems
SSID, channels, WPA2/WPA3, PMF, mDNS and VLANs: connect legacy IoT devices to modern Wi-Fi without weakening the network.
Read article→Stale MDE devices: cleanup with PowerShell and the API
Find stale MDE devices with PowerShell and Active Directory. Separate inactivity, exclusion and offboarding, with review before any changes.
Read article→Migrate Microsoft Defender for Identity to v3.x sensors: a practical guide
Plan your MDI v2-to-v3 migration: MDE prerequisites, patches, GPOs, action accounts, KQL validation and phased sensor cleanup.
Read article→Leaving VMware in 2026: Hyper-V, Azure Local, Nutanix, Proxmox or HPE Morpheus?
A practical comparison of architectures, licensing, costs and trade-offs for choosing a replacement platform without weakening backup, storage or application operations.
Read article→Deploy passkeys with Microsoft Entra ID without locking out users
A phased method to choose FIDO2 profiles, bootstrap with Temporary Access Pass, measure adoption and enforce phishing-resistant authentication without locking out accounts.
Read article→SMB hardening with Windows 11 24H2 and Windows Server 2025: a deployment guide
Audit signing, encryption, NTLM and guest access, then harden SMB in stages without disrupting legacy NAS devices and applications.
Read article→Securing Copilot agents and MCP servers in the enterprise: a practical guide
A Zero Trust architecture for controlling identities, tools, data, OAuth authorization, sensitive actions and audit trails for AI agents.
Read article→Microsoft Defender Advanced Hunting: 10 useful KQL queries for IT administrators
Ten practical KQL queries to monitor MDE sensors, ASR rules, logons, PowerShell, vulnerabilities and ransomware warning signs.
Read article→Kerberos and RC4 in 2026: audit Active Directory and migrate to AES without outages
A practical method to detect RC4 dependencies, remediate service accounts and phase in AES after the 2026 Kerberos hardening changes.
Read article→Microsoft Defender ASR rules: moving from Audit to Block without disrupting production
A phased method to assess, deploy and monitor ASR rules with Intune or Group Policy before enabling Block mode.
Read article→Active Directory security assessment: 10 checks to prioritize
A practical method to identify the most important Active Directory risks and build a realistic remediation plan.
Read article→UniFi Protect: 8 things to plan before installing cameras
Storage, cabling, PoE, privacy and remote access: the decisions to make before selecting and positioning cameras.
Read article→3-2-1 backup: protecting a NAS or Veeam environment
How to turn the 3-2-1 rule into a practical, testable strategy that withstands human error and ransomware.
Read article→