AD DNS Scavenging: Safe Aging Setup with PowerShell
Set up DNS aging and scavenging on AD-integrated zones safely: timers explained, a three-phase rollout with PowerShell, protecting static records, and events 2501/2502.
October 6, 2026
AD Health Check Report: dcdiag and repadmin PowerShell Script
Free PowerShell script that runs dcdiag, repadmin /replsummary, w32tm and SYSVOL DFSR checks on every DC and saves a colour-coded HTML report.
October 6, 2026
Locked Out AD Users Report: PowerShell Script with Lockout Source
Free PowerShell script that lists locked-out AD users, reads event 4740 on the PDC emulator for the caller computer, and can unlock safely with -WhatIf.
October 6, 2026
AD Nested Group Membership: PowerShell Tree with Loop Detection
Free PowerShell script that shows the full nested group membership tree of an AD user or group, with paths, primary group and loop detection.
October 6, 2026
AD Privileged Group Report: Domain Admins and adminCount Audit
Free PowerShell script that reports every direct and nested member of Domain Admins and other privileged AD groups, plus adminCount=1 orphans.
October 6, 2026
BadSuccessor dMSA on Server 2025: Audit OU Rights and Patch
BadSuccessor (CVE-2025-53779) let anyone who could create a dMSA on Windows Server 2025 take over the domain. Check DC builds, audit OU rights and dMSA links, and monitor.
October 6, 2026
Export AD Users to CSV: PowerShell Script with Last Logon
Free PowerShell script that exports Active Directory users to CSV or HTML with last logon, password age, manager, department and OU.
October 6, 2026
Windows LAPS with Intune and Entra ID: Setup and Retrieval
Back up Windows LAPS passwords to Microsoft Entra ID with Intune: tenant setting, policy, event 10029, retrieval with Get-LapsAADPassword or Graph, and legacy LAPS migration.
October 6, 2026
File Share Auditing: Find Who Deleted a File in 5 Steps
Turn on file share auditing on a Windows Server 2025 file server so you can answer "who deleted this file?": audit policy, SACLs in the GUI and PowerShell, events 4663 with the DELETE access mask, 4660 and 5145, a search script, log sizing and restoring from Previous Versions.
September 30, 2026
NTFS Permissions and Share Permissions: 7 Secure File Server Rules
Set up a Windows Server 2025 file share the maintainable way: simple share permissions, NTFS permissions granted to domain local groups (AGDLP), icacls and PowerShell commands, controlled inheritance, access-based enumeration and effective access checks.
September 30, 2026
RDP Connection Logs: 14 Event IDs to Track Who Connected and From Where
Find out who connected over Remote Desktop, from which IP address and for how long, using the RemoteConnectionManager, LocalSessionManager and Security event logs, with the audit policies they need, a PowerShell report and brute-force detection.
September 30, 2026
RDS Licensing Server: Activate, Install CALs and Set the Mode in 6 Steps
Install and activate an RD Licensing server, install per-user or per-device RDS CALs, point Session Hosts at it through deployment properties, Group Policy or WMI, and clear the "licensing mode is not configured" warning before the 120-day grace period ends.
September 30, 2026