Secure Boot Certificate Expiry 2026: Check and Update to 2023 CAs
Microsoft Secure Boot 2011 certificates expire in 2026. Check UEFICA2023Status and events 1801/1808, trigger the 2023 CA update with AvailableUpdates 0x5944, and fix common errors.
October 6, 2026
Block RDP Brute Force on Windows Server: Detect and Stop It
Stop RDP brute force on Windows Server: read event 4625 (logon types 3 and 10), close or scope port 3389, require NLA, set account lockout, and auto-block attacking IPs.
October 6, 2026
Export AD Users to CSV: PowerShell Script with Last Logon
Free PowerShell script that exports Active Directory users to CSV or HTML with last logon, password age, manager, department and OU.
October 6, 2026
Inactive AD Accounts Report: PowerShell Script with Safe Disable
Free PowerShell script that reports AD users and computers inactive for N days (lastLogonTimestamp), with never-logged-on detection and a safe -WhatIf disable.
October 6, 2026
How to Audit Active Directory Changes: Track Who Changed What and From Which Computer
Turn on the right audit policy and SACLs, then find who changed which Active Directory user, group or setting, the old and new value, and the computer it came from. Tested on Windows Server 2025.
October 6, 2026
Kerberos RC4 Audit Script: Find RC4 Accounts and Tickets
Free PowerShell script that finds AD accounts allowing or requiring Kerberos RC4 and counts RC4 tickets issued by your DCs (events 4769/4768).
October 6, 2026
AD Change Audit Reporter: Find Who Changed Active Directory (PowerShell)
Read-only PowerShell report of Active Directory changes: who changed which user, group or computer, old and new values, and the source workstation when the logs allow it.
October 6, 2026
Kerberos RC4 Removal: Find and Fix RC4 Accounts (2026)
Kerberos RC4 removal in 2026: the KB5073381 timeline, how to find RC4 users with KDCSVC events 201-209 and event 4769 type 0x17, and how to fix service accounts and keytabs.
October 6, 2026
AD DNS Scavenging: Safe Aging Setup with PowerShell
Set up DNS aging and scavenging on AD-integrated zones safely: timers explained, a three-phase rollout with PowerShell, protecting static records, and events 2501/2502.
October 6, 2026
NTFS Permissions Report to CSV: PowerShell Folder ACL Script
Free PowerShell script that exports NTFS folder permissions to CSV: identity, rights, allow/deny, inherited or explicit, scope, with errors logged.
October 6, 2026
AD Health Check Report: dcdiag and repadmin PowerShell Script
Free PowerShell script that runs dcdiag, repadmin /replsummary, w32tm and SYSVOL DFSR checks on every DC and saves a colour-coded HTML report.
October 6, 2026
Locked Out AD Users Report: PowerShell Script with Lockout Source
Free PowerShell script that lists locked-out AD users, reads event 4740 on the PDC emulator for the caller computer, and can unlock safely with -WhatIf.
October 6, 2026