Runs enterprise networks and security for a living, and writes Shore Up to turn two decades of hands-on Linux, Windows and mail-server work into guides you can actually use.
This guide sets up a nightly copy of one folder to a backup location using robocopy driven by a script, then schedules that script to run unattended with Windows Task Scheduler. The point is a low-fuss, repeatable file copy — not a full backup product with versioning or bare-metal restore.
This procedure finds enabled user accounts that have not logged on for a set number of days , disables them, stamps a note in the account's description, and moves them into a dedicated "archive" OU so they are out of your working OUs but not deleted. Its purpose is routine account hygiene: a disabled, quarantined account can't be used for a logon, which shrinks your attack surface, but nothing is destroyed and everything is reversible.
This guide gives you a PowerShell script that reads Active Directory and produces a report (on screen and as a CSV) of user accounts that have never authenticated against any domain controller. It changes nothing — it does not disable, delete, or edit a single account. Its purpose is to hand you a clean list of candidates for review before you decide what to do with them.
This guide builds a PowerShell script that reads a CSV file of people and creates a matching Active Directory user account for each row — name, logon name, OU placement, and an initial password. Its purpose is to save you from clicking through Active Directory Users and Computers a hundred times when you onboard a class, a department, or a new office.
This guide uses the Unlock-ADAccount cmdlet to clear the locked-out state on an Active Directory user account — the state a user lands in after too many bad password attempts trip your domain lockout policy. Unlocking lets them log in again immediately; it does not change or reset their password.
This guide walks the standard three-stage offboarding of a single Active Directory user account: disable it (so nobody can log in), move it to a holding OU, and — only after a retention period — delete it. That order is deliberate. Disabling is instant and fully reversible; deletion is not.
This guide gives you a PowerShell script that reads a CSV file of new employees and creates one Active Directory user account per row, with a per-row try/catch so that one bad line doesn't halt the whole batch. Its purpose is bulk onboarding — creating dozens or hundreds of accounts without clicking through the console each time.
This guide changes existing Active Directory user objects: it sets the email address, job title, and department on one account or a batch of accounts. It does not create or delete anything. But it overwrites whatever those attributes held before, and Active Directory keeps no built-in undo — if you set the wrong department on 200 people, the only way back is to set it again with the correct value. So treat the write as permanent unless you record the old values first (I show how below).
This script creates one LDAP user entry (an inetOrgPerson / posixAccount ) under your people container and adds that user's uid as a memberUid to one or more existing groups. Its purpose is to make user provisioning repeatable instead of hand-crafting LDIF every time.
These commands add a user account to an Active Directory security or distribution group, or remove it from one, using the ActiveDirectory PowerShell module. Group membership is how most access is granted in AD, so getting it right matters: adding a user to the wrong group can hand out access it should not have, and removing a user from a group can cut off access to file shares, mailboxes, or applications immediately at their next logon or token refresh.
This guide builds a small read-only status page. A bash script checks whether a list of systemd services are active and whether a few HTTP endpoints answer, then writes a plain HTML file that your web server already serves. Cron re-runs it every few minutes so the page stays current. Nothing here restarts, reconfigures, or stops any service — it only reads state and writes one HTML file.
I keep ending up with directories that are one flat dumping ground — exported reports, scans, camera dumps — hundreds of files with no order. This guide builds a small bash script that reads each file's modification date, renames it with a YYYY-MM-DD_ prefix, and moves it into DEST/YYYY/MM/ folders. It is safe by default: it prints what it would do and moves nothing until you explicitly tell it to.
This guide configures rsyslog on your Linux hosts to forward their system logs over the network to one central collector, and configures that collector to receive them and file each sender's logs into its own directory. The point is to have every machine's logs in one place so you can search, retain, and back them up centrally.
