Blog
We share practical ideas for real work on website development, SEO, Google Ads management, Windows development, existing asset reuse, and bug investigation.
AI search across this site
Search queries are sent to Cloudflare AI Search to generate results. Please do not enter personal information.
-
Using WMI/CIM from C# and PowerShell — A Practical Guide to Hardware Inventory, Process Monitoring, and Remote Queries
WMI/CIM is the standard way to read a PC serial number, watch disk space, and detect process starts. Covers CIM cmdlets, Get-WmiObject migration, C# APIs, an...
-
A Practical Guide to Group Policy (GPO) — How It Works, Confirming Application, and Choosing Between GPO and Intune
This guide covers how Group Policy works, the LSDOU order, verifying with gpupdate and gpresult, GPO versus Intune, and customer GPOs that change how your ap...
-
Windows Security Audit Policy and Event Log Investigation in Practice — Becoming an IT Team That Can Read Event 4625
A practical guide for "look into the failed sign-in logs": basic versus advanced audit policy, subcategories to enable, 4624/4625/4688, Security log sizing, ...
-
A Practical Guide to Windows LAPS — Retiring the Shared Local Administrator Password Across All PCs
A shared local admin password lets one compromised PC spread to all via Pass-the-Hash. This guide covers Windows LAPS rotation, AD/Entra ID storage, and oper...
-
The Windows Certificate Store in Practice — User or Computer, Which Should You Use?
Should a client certificate go in the user or computer store? A practical guide to certmgr.msc vs certlm.msc, private key permissions, and PowerShell expiry ...
-
The Windows Firewall and Business Applications — Register Inbound Rules From the Installer
When a Windows business app cannot communicate on site, triage inbound rules, listening, profiles, and managed policy. Covers rule design, installer registra...
-
Windows Update Management After WSUS Deprecation — How to Choose Between WUfB, Autopatch, and Intune
Deprecated in September 2024, WSUS still runs but gains no new features. A decision table weighs WSUS, Windows Update for Business, Autopatch, and Intune, li...
-
BitLocker Practical Guide — How to Find the Recovery Key and Manage It Safely
Where is the BitLocker recovery key? Find it from the recovery screen, tell encryption percentage from protection status, and manage company keys, updates, a...
-
Why Passkeys Are Secure — How They Work, How They Sync, and What to Watch for If You Lose a Device
Why passkeys are secure, from registration to login: phishing resistance, synced vs. device-bound, revocation and recovery after a loss, plus WebAuthn and Wi...
-
The Depths of Windows I/O (Part 6, Final) — How Minifilters Work and Investigating Slow I/O with Procmon
Explains how minifilters monitor and control file I/O: FltMgr, altitudes, pre/post callbacks, fltmc, finding slow operations in Procmon, plus exclusion and D...
-
The Depths of Windows I/O (Part 5) — NTFS Internals: Understanding the File System Through the MFT
An illustrated Part 5 on NTFS internals for developers: the MFT, file records, data streams, hard links, 8.3 names, reparse points, journals, sparseness, and...
-
The Depths of Windows I/O (Part 4) — Cache Manager: When Does Your WriteFile Actually Reach the Disk?
Part 4 of a diagram-led Windows Cache Manager series. It covers the cache as a file mapping, read-ahead, lazy writing, FlushFileBuffers, FILE_FLAG_NO_BUFFERI...
-
The Depths of Windows I/O (Part 3) — I/O Completion Ports (IOCP) and the .NET Thread Pool: The Basement Under async/await
Part 3 of a diagram-led series on I/O completion ports (IOCP). It covers the queue plus thread-count control, the concurrency value, LIFO release, and .NET c...
-
How Long Can You Go On Using MSMQ? — The Migration Decision for a Legacy Queue That Isn't Even "Deprecated"
MSMQ is not on Microsoft's deprecated lists, yet System.Messaging is .NET Framework-only and blocks .NET migration. How to decide whether to keep it, and wha...
-
The Depths of Windows I/O (Part 2) — Synchronous and Asynchronous I/O: What OVERLAPPED Really Means
Part 2 explains Windows synchronous and asynchronous (overlapped) I/O: FILE_FLAG_OVERLAPPED, the four notification paths, synchronous completion, cancellatio...
-
Registered Information Security Specialist Examination, Autumn 2023 (Reiwa 5) Afternoon Question 1 Explained — The Stored XSS Where 16 Reviews Show Up as 2
This walkthrough of Autumn 2023 RISS exam Afternoon Question 1 shows how split posts beat the character limit, how the session ID left as an image, and what ...
-
AppLocker, App Control for Business (WDAC), and Business App Distribution — Before Application Control Blocks You
Compares AppLocker, App Control for Business (formerly WDAC), and Smart App Control, and covers how to avoid blocks on business apps and how to read the even...
-
The Depths of Windows I/O (Part 1) — Every Read and Write Becomes an IRP: The Big Picture of the I/O System
Part 1 of a series on Windows I/O from the ground up: the Object Manager namespace, the driver, device and file objects, the IRP lifecycle, and what CloseHan...
-
SMB Signing and LDAP Channel Binding — Closing the "Other Half" of NTLM Defense in Practice
SMB signing and LDAP signing/channel binding limit relay damage while you retire NTLM. We cover OS defaults, audit events, enforcement, and how to fix apps a...
-
NTLM and Kerberos Explained with Diagrams — Why Authentication Falls Back to NTLM
Diagrams compare NTLM and Kerberos: challenge/response, TGTs and service tickets, Negotiate's NTLM fallback without an SPN, relay attacks, Pass-the-Hash, and...
-
Is OpenHarmony a Viable OS for Industrial Equipment? — Compared with Windows IoT and Embedded Linux
Is OpenHarmony an option for industrial equipment? Compare maintenance, memory, tooling and sourcing with Windows IoT LTSC and embedded Linux in a decision t...
-
Will NTLM Deprecation Stop Your Business Apps? — How to Collect Audit Logs, and the Order in Which to Kill Dependencies
This article covers how to find where Windows and business apps depend on NTLM: audit policies, NTLM/Operational events 8001-8004, causes and fixes, and SMB ...
-
What Is OpenHarmony? — Sorting Out How It Differs from HarmonyOS and HarmonyOS NEXT
OpenHarmony is not HarmonyOS. From primary sources, this article maps the OpenAtom Foundation's open source OS, Huawei's commercial OS, and Android-free Harm...
-
What Is the TPM in Windows? — An Illustrated Guide to the "Safe That Never Lets Keys Out" and Measured Boot
An illustrated TPM guide. It covers keys that never leave the chip, PCRs and Measured Boot, BitLocker and Windows Hello, dTPM, fTPM and Pluton, Get-Tpm, and ...
-
Never Use a QR Code's Decoded Value As-Is — Error Correction Succeeding Does Not Guarantee the Value
QR error correction does not guarantee the decoded value. Sample images and two decoders show why dirt can yield a different value, and what a business syste...
-
How to Work with USB Devices from a Windows App — Choosing Between virtual COM, HID, WinUSB, and Vendor SDKs
A comparison of four ways to control equipment and USB devices from a Windows application: virtual COM port, HID, WinUSB, and vendor SDKs. We cover whether a...
-
Automating PC Provisioning With winget + PowerShell — Making the Runbook Executable
Make new-hire PC setup reproducible: winget installs and export/import, declarative WinGet Configuration, the settings PowerShell fills in, and unattended-ru...
-
Hardening PowerShell — Logging, AMSI, Language Modes, and JEA
Use PowerShell safely instead of banning it. This guide covers script block logging and transcription, AMSI, disabling old versions, language modes, and JEA ...
-
Investigating Event Logs in Practice with Get-WinEvent — Filtering Speed Decides How Long the Investigation Takes
How to make Windows event log investigation efficient with PowerShell. Covers why filtering with Where-Object is slow, when to use FilterHashtable versus XPa...
-
Distributing and Updating PowerShell Modules In-House — PSResourceGet and an Internal Repository
How to move on from copying and reusing ps1 files in a shared folder. Covers how to write a module manifest, versioning, building an internal repository with...