Runs enterprise networks and security for a living, and writes Shore Up to turn two decades of hands-on Linux, Windows and mail-server work into guides you can actually use.
fw monitor is Check Point's kernel packet-capture tool: it shows you a packet at four fixed points as the gateway inspects it, so you can tell where a flow is being dropped. cpview is a live, top-style performance dashboard for CPU, memory, connections, and throughput. Both are diagnostic and read-only — neither changes your policy or configuration.
This guide sets up a PowerShell script that backs up every Group Policy Object in your domain to a dated folder and, optionally, exports a human-readable HTML report of each one. Backing up GPOs is a read-only operation — Backup-GPO does not change, delete, or unlink anything in Active Directory. It copies the policy settings, security filtering, and WMI filter links into files on disk. The risky part is not the backup; it's the restore , which I cover at the end and which you should treat with real care.
This sets up a background service that watches a directory and, whenever a new JPEG or PNG lands there, produces a resized, stripped, and re-compressed copy in a separate output directory. Its purpose is to keep uploaded or generated images small and consistent without anyone running a command by hand.
Ubuntu and Debian both shipped a Samba fix on 28 July 2026 — USN-8621-1 on the Ubuntu side, DSA-6401-1 on Debian's. It's a fat advisory: eight CVEs in one go. But counting CVEs is the wrong way to read it. Seven of the eight are denial-of-service, and exactly one of them is the reason you should stop reading and go patch.
This guide builds a ClusterXL High Availability (Active/Standby) pair from two Check Point gateways: two physical or virtual firewalls share one set of virtual IPs, and if the active member fails, the standby takes over the traffic and the connections. Its purpose is redundancy, not more throughput — HA mode passes traffic through one member at a time.
Stuck print jobs are one of those recurring, low-glamour tickets: a queue jams, one document sits in "Error" or "Deleting" forever, and everything behind it stalls. This guide gives you two standard tools — a graceful per-job cleanup and the classic spooler reset — and shows how to run them safely on a schedule.
Check Point gives you three different ways to save the state of a Gaia machine, and admins mix them up constantly. They are not interchangeable. This guide walks all three on Gaia R81.20 (standalone Security Management Server or gateway, not a Multi-Domain Server), driven from Gaia clish with a bit of expert mode. If you run MDS the paths and tools differ — stop and read the Multi-Domain guide instead.
This guide reads a CSV of users and writes two attributes back to Active Directory for each one: Title and Department . Nothing is created or deleted — existing user objects have those two fields overwritten with the values in your file. That overwrite is a real change: if the CSV has a wrong value in a row, that user's title or department is now wrong until you fix it. There is no built-in "undo," so the safety step below is to export the current values first so you can put them back.
This guide configures systemd to automatically restart a service when it fails, with an increasing delay between attempts (backoff), and to fire an alert when it exhausts its retries and stays down. Nothing here touches your application's data — it only changes how systemd supervises the unit — but a badly tuned restart loop can hammer CPU, disk, or an upstream database by relaunching a broken process over and over, so treat the values as production settings, not guesses.
Two things landed on the same day, 28 July 2026, and it's worth being clear about which one you can act on.
This guide turns on Check Point Remote Access VPN so staff can connect from outside with the Check Point Endpoint Security VPN / Check Point Mobile client and reach internal networks over an encrypted IPsec tunnel. You do it in SmartConsole , not on the gateway shell — enabling the IPsec VPN blade, putting the gateway in the RemoteAccess community, assigning client IPs with Office Mode, adding an access rule, and installing policy.
This guide builds a read-only report: it collects the BitLocker encryption status of every fixed volume on a set of domain computers and writes it to a CSV. It does not enable, disable, or change BitLocker on anything. The only thing it creates on your side is the output file.
This guide builds a site-to-site IPsec VPN community in Check Point SmartConsole so traffic between two sites' encryption domains is tunnelled and encrypted. The main path assumes both peers are Check Point gateways managed by the same Management Server (SMS) on R81.20 ; I note where a third-party peer (an Interoperable Device ) differs.
