BadSuccessor dMSA on Server 2025: Audit OU Rights and Patch
BadSuccessor (CVE-2025-53779) let anyone who could create a dMSA on Windows Server 2025 take over the domain. Check DC builds, audit OU rights and dMSA links, and monitor.
October 6, 2026
Block RDP Brute Force on Windows Server: Detect and Stop It
Stop RDP brute force on Windows Server: read event 4625 (logon types 3 and 10), close or scope port 3389, require NLA, set account lockout, and auto-block attacking IPs.
October 6, 2026
NTFS Permissions Report to CSV: PowerShell Folder ACL Script
Free PowerShell script that exports NTFS folder permissions to CSV: identity, rights, allow/deny, inherited or explicit, scope, with errors logged.
October 6, 2026
Block RDP Brute Force on Windows Server: PowerShell Script
Free PowerShell script that reads failed RDP logons (event 4625), counts them per source IP and blocks repeat offenders with Windows Firewall rules, with allow-list and -WhatIf.
October 6, 2026
Reset krbtgt Password Safely: Two Resets, Replication and RODCs
Reset the krbtgt password safely: why it takes two resets, how long to wait, replication checks, Microsoft's New-KrbtgtKeys.ps1 modes, and RODC krbtgt accounts.
October 6, 2026
How to Audit Active Directory Changes: Track Who Changed What and From Which Computer
Turn on the right audit policy and SACLs, then find who changed which Active Directory user, group or setting, the old and new value, and the computer it came from. Tested on Windows Server 2025.
October 6, 2026
Secure Boot 2023 Certificate Check: PowerShell Script for Many PCs
Free read-only PowerShell script that checks Secure Boot, the 2023 Microsoft certificates in DB and KEK, UEFICA2023Status and events 1801/1808 on many Windows computers.
October 6, 2026
AD Change Audit Reporter: Find Who Changed Active Directory (PowerShell)
Read-only PowerShell report of Active Directory changes: who changed which user, group or computer, old and new values, and the source workstation when the logs allow it.
October 6, 2026
Secure Boot Certificate Expiry 2026: Check and Update to 2023 CAs
Microsoft Secure Boot 2011 certificates expire in 2026. Check UEFICA2023Status and events 1801/1808, trigger the 2023 CA update with AvailableUpdates 0x5944, and fix common errors.
October 6, 2026
“Cannot Manage PHP Versions When CageFS Is Disabled”: PHP Selector Fix
Fix "Cannot manage PHP versions when CageFS is disabled" and related CloudLinux PHP Selector errors on cPanel and DirectAdmin.
October 6, 2026
Clean a Hacked WordPress Site on cPanel: Step-by-Step
Clean a hacked WordPress site on a cPanel server: isolate, scan with Imunify360 or ClamAV, verify checksums, find backdoors and rogue admins, rotate secrets and harden.
October 6, 2026
WordPress CVE-2026-64638 Patch: Find and Update Every Vulnerable Site
WordPress CVE-2026-64638 (XSS2Shell): what is affected, which versions fix it per branch, and how hosts find and update every vulnerable site.
October 6, 2026