Runs enterprise networks and security for a living, and writes Shore Up to turn two decades of hands-on Linux, Windows and mail-server work into guides you can actually use.
This guide sets up a read-only pull of the firewall's config.xml to a separate Linux host, scheduled nightly with cron, so you have off-box, dated copies of every configuration. The backup script itself never writes to the firewall — it only copies one file off it over SSH.
Before I start, one honesty note that shapes this whole guide: Active Directory has no merge operation . There is no Merge-ADUser cmdlet, and there never was. When people say "merge duplicate accounts," what they actually need is a repeatable process to find the duplicates, decide which one survives , copy the things that matter (mainly group memberships) onto the survivor , and then retire the other . That is what this guide automates. The detection half is safe and read-only. The consolidation half changes and can delete accounts, so it is gated hard.
The script below reads an X.509 certificate and prints a TLSA record . That is all it does: it computes a SHA-256 hash of the certificate's public key and formats it as a DNS TLSA resource record you can paste into your zone. It changes nothing on the machine, and it needs no elevated privileges — except that if your certificate file is only readable by root you will need sudo to read it.
If you run an on-premises Microsoft stack, SharePoint usually isn't the box you think about first — it sits next to Exchange, shares the same Active Directory, and gets patched on whatever cadence the Windows team keeps. This one is worth pulling forward, and not for the reason the headline gives.
This guide configures a Cisco AnyConnect (Secure Client) SSL remote-access VPN on an ASA so remote users can dial in, receive an internal IP from a pool, and reach inside subnets over an encrypted tunnel. It creates address pools, a group policy, a connection profile (tunnel-group), a split-tunnel ACL, a NAT exemption, and at least one VPN user.
On a busy Remote Desktop Session Host, local profiles pile up fast — every user who ever logged in leaves a folder under C:\Users , and a system drive fills quietly until logons start failing. This guide sets up an unattended, standard-supported cleanup of profiles that haven't been used in N days.
This sets up a weekly, unattended package upgrade on each server, then emails you a plain-text report of what was upgraded and whether a reboot is now pending. The upgrade step runs apt-get upgrade non-interactively, so it changes installed software on the host. Package upgrades are not cleanly reversible: apt has no "undo the last upgrade" button, so treat this with the same caution as any change to a running server.
This guide builds a policy-based site-to-site IPsec VPN between two Cisco ASAs using IKEv2 , so hosts on your local LAN can reach hosts on a remote LAN over an encrypted tunnel across the public internet. It defines the crypto policy, a pre-shared key, the interesting-traffic ACL, the NAT exemption, and applies a crypto map to the outside interface.
This procedure reads a CSV of user accounts and their destination OUs, then moves each account to its target OU with PowerShell's Move-ADObject . Moving a user changes its distinguished name (DN). That matters because anything scoped by DN or OU — Group Policy links, delegated permissions, and OU-based filters — will start or stop applying to the account the moment it moves. The move itself does not delete the account or its group memberships, and it is reversible if you know where the account came from — which is why the script below records the original OU of every user before it touches anything.
This is a small bash wrapper that reads a list of hostnames from a file and runs the same command on all of them over SSH, several at a time in parallel , tagging every line of output with the host it came from. The purpose is to save you from looping through servers by hand when you want to check a value, restart a service, or gather a fact fleet-wide.
Arctic Wolf Labs, via The Hacker News , has tied a run of June 2026 intrusions to CVE-2026-0257 , an authentication bypass (CVSS 7.8) in the portal and gateway components of PAN-OS. The affiliates behind Qilin (also called Agenda) used it as their way in, then deployed ransomware. BleepingComputer reported the same activity.
This guide sets the security level on each ASA interface (its trust ranking, 0–100) and applies extended access lists to control which traffic is allowed into an interface. On an ASA, traffic from a higher-security interface to a lower one is permitted by default, but the moment you apply an inbound access-group to an interface, the ASA enforces that ACL and drops everything the ACL doesn't explicitly permit — there is an implicit deny ip any any at the end of every ACL. A single applied ACL can therefore cut production traffic and lock you out of management in one command.
This script is a read-only audit . It reports PASS/FAIL for a small set of well-known hardening settings — SMBv1 status, firewall profiles, Defender real-time protection, RDP Network Level Authentication, and the local Guest account — and writes the results to the screen and a CSV. It changes nothing. There is nothing to roll back, which is exactly why an audit script is the safe place to start before you touch any actual configuration.
