Knowledgebase

  1. Portal Home
  2. Knowledgebase
  3. IT Guides
  4. Active Directory & Windows Server

  Categories

Help Center
13
IT Guides
107

  Categories

  Tag Cloud

3-2-1 Backup Rule Active Directory AD DS AD LDS AD Objects AD Security AD Snapshots AdExplorer AES-256 AI in auditing AKS Alerts Ansible App Service Application Delivery Controller application packaging AsJob audit policy authentication policies Automation Autoruns autostart locations availability zones AWS AWS billing alerts AWS budgets AWS Cost Explorer AWS KMS AWS S3 AWS Security Hub Azure Azure CDN Azure fundamentals Azure Key Vault Azure Security Center Azure SQL Database Background Jobs backup automation backup encryption bash bash scripting BitLocker boot sector bulk import Business Continuity BYOK Certificate Management chain of custody Change Management CI/CD CI/CD security CIM CimSession Citrix NetScaler Cloud Backup cloud compliance Cloud Computing cloud cost optimization cloud database cloud encryption cloud infrastructure cloud migration cloud performance cloud security cloud storage security Cluster Management Community Engagement Compliance compliance policies conditional access configuration management Container Orchestration container security content delivery Credential Guard Credential Security CredSSP cron jobs crontab cryptography CSPM Cybersecurity cybersecurity frameworks Cybersecurity Investigation daemon.json hardening data migration Data Protection data-at-rest encryption database security DBaaS dependencies detection engineering detection rules DevOps DevOps Automation DevSecOps DFIR DHCP digital forensics Disaster Recovery Disk Monitoring DNS docker security Domain Controllers DPAPI DS Access DSC DSN Management Dynamic Parameters EC2 right-sizing edge caching EDR elastic pools Elasticity encryption encryption at rest encryption hardening endpoint management endpoint protection endpoint security Enterprise Scripting ESXi etcd ETW event logs evidence collection evidence preservation fastcgi cache Fault Tolerance Firewall Management For loop ForEach forensic triage Forest Functional Level FQDN functions GCP GCP KMS GDPR Get-NetAdapterRsc GitHub GitHub Actions GitHub Discussions GPO backup GPO management Group Policy Group Policy troubleshooting hardening high availability hybrid security Hyper-V Hyper-V containers IAM identity security ike hardening immutable backups Import-Module incident post-mortem Incident Response infrastructure automation Install-Module Intune IntuneWinAppUtil Invoke-Command Invoke-RestMethod IoT security IP analysis IP hash ipsec IT Administration IT Audit IT auditing IT Automation IT Collaboration IT Infrastructure IT Management IT Operations IT security standards JEA Just Enough Administration KAPE kerberos Kerberos Hardening key management key rotation KMS KQL Kubernetes least connections Least Privilege linux linux automation linux backup Load Balancing loops malware analysis managed database MDM memory leak microsegmentation Microsoft 365 Microsoft Defender Microsoft Defender for Cloud Microsoft Endpoint Manager Microsoft Intune Microsoft Sentinel Microsoft Teams misconfigurations MITRE ATT&CK Module Management module manifest multi-cloud multipartite virus naming conventions NetAdapter NetBIOS NetEventPacketCapture NetIPsec netsecurity netsecurity module Network Adapters Network Automation network capture network diagnostics Network Management Network Operations Network Optimization Network Performance Network Security network troubleshooting Networking Nginx NIC Configuration NTFS Forensics NTLM ODBC Office 365 Offsite Backup OutBuffer OWASP packet capture Parameters patch management penetration testing performance Performance Tuning persistence detection Pester php-fpm Pipeline pipeline as code pipeline security PKI PolicyStore Post-Mortem PowerShell PowerShell Gallery PowerShell Modules PowerShellGet prepared statements Prisma Cloud Privileged Access Management Process Explorer process management procmon PSD1 ransomware ransomware defense Ransomware Protection RBAC RDM RDMA Receive Segment Coalescing red team Region Selection Registry Analysis Remote Administration Remote Management Replication REST API reverse proxy round robin RSAT Scalability Script Testing Scripting secrets management secure coding Secure Score SecureString Security Security as a Service security audit security baselines security monitoring security posture security testing Select-Object server management serverless Service Management SharePoint 2016 SharePoint administration SharePoint Governance SharePoint lists shell scripting SIEM SIEM detection Site Collection Administrators SMB SMB Direct SOC SQL injection SQL Server sre SSL Offloading Start-NetEventSession StarWind Stop-NetEventSession Storage Spaces Direct supply chain Sysadmin Sysinternals System Administration systemctl tabletop exercises tar backup Teams Administration threat detection threat hunting threat intelligence ThrottleLimit tier 0 troubleshooting Tutorials UAC USB forensics Validation variables Veeam Veeam Cloud Connect versioning VFP Virtual Tape Library virtualization VM Scale Sets VMDK VMMap VMware VMware vSphere vSphere 6.7 vSphere administration vulnerability scanning WAF web application security web performance Web Server Win32_Service Windows Admin Center Windows administration Windows Autopilot windows boot Windows Digital Forensics Windows forensics Windows Group Policy Windows performance Windows Registry Windows Security Windows Server Windows Server 2025 Windows Services WinRM WMI wordpress XaaS yaml Zero Trust

  Support

My Support Tickets
News
Knowledgebase
Downloads
Network Status
Open Ticket

Articles

Process Explorer: Private Bytes vs Working Set Explained The ticket said the Citrix session host was sluggish around 4 PM every weekday. Twenty minutes with Process Explorer running and a baseline export from the day before… 7 min read Creating Enforced Authentication Policies in Active Directory It was 03:14 when the SOC at one of our financial services clients flagged a Tier 0 admin credential authenticating from a workstation in the call center VLAN. The acc… 5 min read Tracing Windows Boot and Service Init with Sysinternals After the third “slow login” ticket in a week from one of our managed customers, I went back to Sysinternals boot logging because nothing else was going to give me wha… 8 min read AD Server Parameter: FQDN vs NetBIOS Name Explained While scripting a bulk user migration for a client last quarter, I hit one of those issues that wastes an hour before you realize what happened. Half the Get-ADUser ca… 13 min read Using Autoruns to Audit Every Windows Autostart Location During a quarterly security review for a client running a 200-seat Windows environment, we found a DLL registered under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersi… 7 min read AdExplorer: Browsing and Snapshotting Active Directory Offline Three service accounts disabled in production. No change ticket. No record of who did it or when. The helpdesk was fielding calls for forty minutes before we traced th… 6 min read Windows Admin Center: Browser-Based Server Management Done Right Last year, a logistics client with fourteen Windows Server instances across two sites called us in a panic — their lone sysadmin had left, and nobody else knew how to… 5 min read Windows Server Hardening: Stop Guessing, Start Baselining We inherited an environment last year where the client had been running Windows Server 2019 domain controllers with NTLMv1 still enabled, SMBv1 wide open, and zero Gro… 11 min read Windows Group Policy Incident: A Real Post-Mortem It was a Tuesday. 4:47 PM. My phone started ringing before I even got up from my desk. Help desk on line one, my manager on line two, and a Slack flood that would take… 7 min read Active Directory Security: Harden Your AD Environment In March 2023, Cl0p operators compromised a regional financial services company and reached their domain controllers in 87 minutes. The initial vector was a spearphish… 8 min read Managing Active Directory Objects: A Complete Guide Managing Active Directory objects is the core administrative task for any Windows domain environment. AD objects – including users, computers, groups, and contacts – f… 10 min read How to Raise the Active Directory Forest Functional Level Raising the Active Directory forest functional level is one of those tasks that many administrators either delay indefinitely or rush through without adequate preparat… 8 min read
Back

  Tag Cloud

3-2-1 Backup Rule Active Directory AD DS AD LDS AD Objects AD Security AD Snapshots AdExplorer AES-256 AI in auditing AKS Alerts Ansible App Service Application Delivery Controller application packaging AsJob audit policy authentication policies Automation Autoruns autostart locations availability zones AWS AWS billing alerts AWS budgets AWS Cost Explorer AWS KMS AWS S3 AWS Security Hub Azure Azure CDN Azure fundamentals Azure Key Vault Azure Security Center Azure SQL Database Background Jobs backup automation backup encryption bash bash scripting BitLocker boot sector bulk import Business Continuity BYOK Certificate Management chain of custody Change Management CI/CD CI/CD security CIM CimSession Citrix NetScaler Cloud Backup cloud compliance Cloud Computing cloud cost optimization cloud database cloud encryption cloud infrastructure cloud migration cloud performance cloud security cloud storage security Cluster Management Community Engagement Compliance compliance policies conditional access configuration management Container Orchestration container security content delivery Credential Guard Credential Security CredSSP cron jobs crontab cryptography CSPM Cybersecurity cybersecurity frameworks Cybersecurity Investigation daemon.json hardening data migration Data Protection data-at-rest encryption database security DBaaS dependencies detection engineering detection rules DevOps DevOps Automation DevSecOps DFIR DHCP digital forensics Disaster Recovery Disk Monitoring DNS docker security Domain Controllers DPAPI DS Access DSC DSN Management Dynamic Parameters EC2 right-sizing edge caching EDR elastic pools Elasticity encryption encryption at rest encryption hardening endpoint management endpoint protection endpoint security Enterprise Scripting ESXi etcd ETW event logs evidence collection evidence preservation fastcgi cache Fault Tolerance Firewall Management For loop ForEach forensic triage Forest Functional Level FQDN functions GCP GCP KMS GDPR Get-NetAdapterRsc GitHub GitHub Actions GitHub Discussions GPO backup GPO management Group Policy Group Policy troubleshooting hardening high availability hybrid security Hyper-V Hyper-V containers IAM identity security ike hardening immutable backups Import-Module incident post-mortem Incident Response infrastructure automation Install-Module Intune IntuneWinAppUtil Invoke-Command Invoke-RestMethod IoT security IP analysis IP hash ipsec IT Administration IT Audit IT auditing IT Automation IT Collaboration IT Infrastructure IT Management IT Operations IT security standards JEA Just Enough Administration KAPE kerberos Kerberos Hardening key management key rotation KMS KQL Kubernetes least connections Least Privilege linux linux automation linux backup Load Balancing loops malware analysis managed database MDM memory leak microsegmentation Microsoft 365 Microsoft Defender Microsoft Defender for Cloud Microsoft Endpoint Manager Microsoft Intune Microsoft Sentinel Microsoft Teams misconfigurations MITRE ATT&CK Module Management module manifest multi-cloud multipartite virus naming conventions NetAdapter NetBIOS NetEventPacketCapture NetIPsec netsecurity netsecurity module Network Adapters Network Automation network capture network diagnostics Network Management Network Operations Network Optimization Network Performance Network Security network troubleshooting Networking Nginx NIC Configuration NTFS Forensics NTLM ODBC Office 365 Offsite Backup OutBuffer OWASP packet capture Parameters patch management penetration testing performance Performance Tuning persistence detection Pester php-fpm Pipeline pipeline as code pipeline security PKI PolicyStore Post-Mortem PowerShell PowerShell Gallery PowerShell Modules PowerShellGet prepared statements Prisma Cloud Privileged Access Management Process Explorer process management procmon PSD1 ransomware ransomware defense Ransomware Protection RBAC RDM RDMA Receive Segment Coalescing red team Region Selection Registry Analysis Remote Administration Remote Management Replication REST API reverse proxy round robin RSAT Scalability Script Testing Scripting secrets management secure coding Secure Score SecureString Security Security as a Service security audit security baselines security monitoring security posture security testing Select-Object server management serverless Service Management SharePoint 2016 SharePoint administration SharePoint Governance SharePoint lists shell scripting SIEM SIEM detection Site Collection Administrators SMB SMB Direct SOC SQL injection SQL Server sre SSL Offloading Start-NetEventSession StarWind Stop-NetEventSession Storage Spaces Direct supply chain Sysadmin Sysinternals System Administration systemctl tabletop exercises tar backup Teams Administration threat detection threat hunting threat intelligence ThrottleLimit tier 0 troubleshooting Tutorials UAC USB forensics Validation variables Veeam Veeam Cloud Connect versioning VFP Virtual Tape Library virtualization VM Scale Sets VMDK VMMap VMware VMware vSphere vSphere 6.7 vSphere administration vulnerability scanning WAF web application security web performance Web Server Win32_Service Windows Admin Center Windows administration Windows Autopilot windows boot Windows Digital Forensics Windows forensics Windows Group Policy Windows performance Windows Registry Windows Security Windows Server Windows Server 2025 Windows Services WinRM WMI wordpress XaaS yaml Zero Trust

  Support

My Support Tickets
News
Knowledgebase
Downloads
Network Status
Open Ticket