Engineering notes
Infrastructure, systems administration, and lessons from the day job.
My brand-new blog got an F on a security header scan. Here's why, what actually matters for a static site, and the fixes that work on DigitalOcean App Platform.
Building this notebook · Note 4 ↗The short list of WP-CLI commands worth knowing by heart, the few that bite, and what I fixed in my own old notes after checking them against the current docs.
The WordPress toolbox · Note 1 ↗A dry run that quietly lies to you. Why ForEach-Object's property shorthand returns nothing under -WhatIf, and the one-line fix.
PowerShell craft · Note 1 ↗How RADIUS VSAs work, how to add one in Windows NPS or FreeRADIUS to hand out DNS servers, and how to prove your VPN or NAS is actually using it.
Troubleshooting notes · Note 1 ↗A plain-spoken tour of what Intune actually handles, where it stops, and the identity decisions you want settled before the first device shows up.
Getting devices into Intune · Note 1 ↗The Settings app route into Intune, which of its three options to pick, and why the device might show up as personal when you didn't want it to.
Getting devices into Intune · Note 2 ↗A practical checklist for taking a device that gets its security policy through Defender for Endpoint and enrolling it in Intune without leaving a gap.
Getting devices into Intune · Note 7 ↗How I think about patch risk now. Sort updates by blast radius, roll them out in rings, decide what "bad" looks like up front, and know your way back before you need it.
Windows Update, untangled · Note 1 ↗What ClientOtherError really counts in Azure Files metrics, how to find which calls cause it, and what to look for in the client library code making them.
Troubleshooting notes · Note 2 ↗How to build a configuration profile in Intune, roll it out to machines that are already in people's hands, and confirm it actually landed.
Getting devices into Intune · Note 5 ↗Onboarding to Defender for Endpoint and enrolling in Intune are two different things, and you almost never have to offboard one to get the other.
Getting devices into Intune · Note 6 ↗The hardware hash script behind Windows Autopilot, explained. Upload straight to Intune with -Online, or export a CSV when the device can't reach the tenant.
Getting devices into Intune · Note 4 ↗
