Battle-tested IT field notes, production checklists, and client-sanitized scripts.
A production-verified hardening runbook stripping unnecessary attack surfaces, configuring SMB signing, auditing LSASS protections, and locking down NTLM without breaking legacy clients.
A blueprint of essential Conditional Access policies that immediately block legacy authentication, enforce phishing-resistant MFA for admins, and isolate risky sign-ins without locking yourself out.
A 3 AM outage investigation: how standard 802.1X re-authentication timers and DHCP option delays caused hundred-node server fleets to get stuck at BitLocker PIN prompts during reboots.
How to automate daily tenant hygiene checks across Exchange Online, Entra ID, and on-premises domain controllers using certificate-based authentication and secure app registrations.