gMSA: Kill Your Service Account Passwords
Reading Time: 4 minutesGroup Managed Service Accounts (gMSA) kill service account passwords for good. AD rotates a 240-byte password every 30 days so kerberoasting cant crack it.
The AD CS Backdoor
Reading Time: 5 minutesAD CS attacks like ESC1 through ESC8 turn a certificate server into full domain takeover. Here’s what each misconfiguration is and how to audit for it.
Intune Zero Touch Deployment
Reading Time: 4 minutesHow Intune zero touch deployment actually works, how Dell registers the hardware hash before shipping, and how to authorize drop shipping straight to a new hire.
Microsoft Entra Connect: A Simple Setup and Hardening Guide
Reading Time: 5 minutesA step-by-step setup guide for Microsoft Entra Connect, covering server hardening, directory user permissions, and writeback configuration.
Where to Find BitLocker Keys
Reading Time: 6 minutesA guide on how to find BitLocker keys in Active Directory, Microsoft Entra ID, and Intune, followed by step-by-step instructions to configure automated backups.
Check Which Intune Policies Are Applied
Reading Time: 5 minutesHow to check which Intune policies are applied to a specific device, and how to go the other way and see which devices have a specific policy.
Is Intune a MAM or MDM? It’s Both, Here’s What Each One Does
Reading Time: 5 minutesIs Intune a MAM or MDM? It’s both. Here’s what the MDM side actually manages, what the MAM side actually protects, and when to use each.
Who’s in Domain Admins?
Reading Time: 5 minutesHow to audit Domain Admins and the other privileged AD groups, catch nested members and adminCount orphans, and cut membership down to what you actually need.
Intune: How to Enroll Android Devices
Reading Time: 5 minutesHow to enroll Android devices in Intune, covering work profile BYOD, fully managed, corporate owned work profile, dedicated kiosk devices, and device enrollment managers.