Windows Server, Active Directory, and PowerShell guides
WinRM is enabled on every modern Windows Server, and almost every breach report mentions it. Here is how to harden PowerShell Remoting properly in 2026 — TLS, auth, scoping, and audit....
PrintNightmare is closed by patches but the configuration that enabled it lives on. Audit spooler state, Point and Print and unsigned drivers from PowerShell....
NTFS ACL drift is the silent finding on every file server. Hunt Everyone-FullControl, broken inheritance and orphaned SIDs from PowerShell....
Unconstrained delegation, AS-REP roasting, duplicate SPNs — Kerberos posture in AD is a long-running risk surface. Audit it from PowerShell....
WSUS rots quietly. Audit client compliance, declined updates and the database state from PowerShell....
IIS will happily serve TLS 1.0 in 2026 if SChannel was never hardened. Audit bindings, protocols and app pool identities from PowerShell....
A modern Hyper-V VM should have Secure Boot on, vTPM attached and old checkpoints cleaned up. Audit them all from PowerShell....
A clean DHCP audit catches scope exhaustion before users notice. Inventory scopes, check failover, find duplicate reservations from PowerShell....
A neglected Windows DNS server is a silent compliance and reliability gap. Audit zones, scavenging, recursion and DNSSEC from PowerShell....