Runs enterprise networks and security for a living, and writes Shore Up to turn two decades of hands-on Linux, Windows and mail-server work into guides you can actually use.
An expired TLS certificate is the kind of outage that is entirely preventable and still catches everyone. This guide builds a small PowerShell script that reads the certificates in a server's own store, flags any that expire soon, and then schedules it to run daily so you hear about it weeks in advance instead of from a monitoring alert at 2 a.m.
This guide builds a small PowerShell script that walks every address in a /24 subnet, sends one ICMP echo (a ping) to each, and — for the hosts that answer — tests a short list of TCP ports and does a reverse-DNS lookup. The output is a CSV inventory: IP, up/down, resolved name, and which ports were open. It is read-only. It does not log into, change, or write anything on the machines it probes.
This guide reads a CSV file and, for each row, creates a shared mailbox in Exchange Online and grants the people you list Full Access and Send As on it. The purpose is to onboard many shared mailboxes (team@, support@, invoices@) in one pass instead of clicking through the admin center dozens of times.
This guide gives you a PowerShell script that connects to a list of Windows machines over WinRM and sets a brand-new random password on the built-in local Administrator account of each one , then writes the results to a CSV so you have the new credentials. Its purpose is to kill shared, static, "same password everywhere" local admin accounts.
This guide uses the community PSWindowsUpdate module to check for, install, and log Windows updates on the machine it runs on. The end result is a scheduled job that patches a box unattended and drops a CSV report so you can see what happened.
This guide exports the members of one or more Active Directory groups to a CSV file so you can hand it to a manager or an auditor for a periodic access review. It only reads from AD and writes a file to disk — it does not add, remove, or change a single group membership.
This guide sets up a .bat logon script that runs net use to attach network shares to fixed drive letters (for example S: and H: ) every time a user signs in on a domain-joined Windows machine. Its purpose is consistent, hands-off drive mapping so users don't set them up manually.
This guide builds a small watchdog: a PowerShell script that checks one named Windows service, and if it is not running, tries to start it and writes the outcome to a log file and the Windows event log. You then schedule it with Task Scheduler so it runs every few minutes. The script starts a stopped service — that is its whole point — so run it only against a service you actually want kept running. It does not delete or reconfigure anything, and starting a service is reversible (you can stop it again), so there is no destructive, one-way step here.
This guide resets the passwords of a list of Active Directory user accounts, clears any lockout on them, and flags each account to require a new password at the next sign-in. The usual reason is a batch of expired or compromised accounts, or a group of seasonal staff coming back online.
This guide builds a Windows batch file that deletes old log files from a folder you name and temporary files from a temp folder, based on how many days ago each file was last modified. Its purpose is to reclaim disk space on a schedule without you having to remember to do it.
This guide builds a small PowerShell script that reads the last 24 hours of Critical and Error events from the System and Application logs, writes them to an HTML file, and emails that file to you. It's a read-only report: it does not clear, modify, or delete any event log. The only things it creates on the system are the HTML report files in a folder you choose and — in the last section — a scheduled task.
This guide sets up a nightly copy of one folder to a backup location using robocopy driven by a script, then schedules that script to run unattended with Windows Task Scheduler. The point is a low-fuss, repeatable file copy — not a full backup product with versioning or bare-metal restore.
This procedure finds enabled user accounts that have not logged on for a set number of days , disables them, stamps a note in the account's description, and moves them into a dedicated "archive" OU so they are out of your working OUs but not deleted. Its purpose is routine account hygiene: a disabled, quarantined account can't be used for a logon, which shrinks your attack surface, but nothing is destroyed and everything is reversible.
