50 explainers · Curated and written by practitioners
More 154
Windows Event ID 1074 (User32): System Restart or Shutdown Initiated
Windows Event ID 1074 from User32 records who or what cleanly initiated a restart or shutdown: the process, account, reason code, and shutdown type. Learn what it means, how to read the reason code, and how it differs from crash events.
Event ID 5719: Why Netlogon Can't Reach a Domain Controller
Event ID 5719 is a Netlogon warning logged when a domain-joined Windows computer fails to establish a secure session with a domain controller. Common causes include network timing at boot, DNS misconfiguration, and broken secure channel trust.
What Is IPv8? Definition, How It Works, and Use Cases
IPv8 is a P2P networking library from TU Delft for decentralized identity and communication. Covers overlay networks, attestation-based trust, Tribler integration, and differences from IPv4/IPv6.
What Is Windows Event ID 4625? Failed Logon Monitoring and Attack Detection Explained
Windows Event ID 4625 logs every failed logon attempt. This explainer covers Sub Status codes, Logon Types, brute-force detection patterns, audit policy setup, and PowerShell analysis techniques.
What Is LDAP? Lightweight Directory Access Protocol Explained
LDAP is the standard protocol for querying and modifying directory services like Active Directory. It runs on port 389 (plaintext) or 636 (TLS). This explainer covers LDAP operations, Active Directory integration, LDAPS, and security best practices.
Azure AD vs Active Directory (Entra ID): Key Differences Explained
Active Directory and Microsoft Entra ID (formerly Azure AD) both handle identity, but they were built for different eras. This explainer breaks down their trust models, authentication protocols, and when to use each.
What is SLA? Definition, How It Works & Use Cases
An SLA (Service Level Agreement) is a contract defining the service level a provider commits to - with metrics, remedies, and exclusions. Learn how SLAs work, the availability 'nines', and how they differ from SLOs and SLIs.
What Is mshta.exe? Windows LOLBin Security Explainer
mshta.exe is a Windows binary for running HTA files. Per MITRE ATT&CK T1218.005, attackers abuse it as a LOLBin to execute malicious VBScript/JScript, bypass AppLocker, and proxy payload execution. Covers detection, blocking, and defense strategies.
What is Bandwidth? Definition, How It Works & Use Cases
Bandwidth is the maximum data capacity of a connection, measured in bits per second - not its speed. Learn how it works, how it differs from throughput and latency, and the bits-vs-bytes trap.
Windows Monthly Updates Explained: B Releases, Preview Updates, Hotpatch, and OOB Fixes
A complete guide to the Windows servicing model: Patch Tuesday (B release), optional preview updates (C/D release), hotpatch, out-of-band fixes, and how they fit together for IT admins.
What Is a SAN (Storage Area Network)? Definition, How It Works, and Use Cases
A Storage Area Network (SAN) is a dedicated high-speed network that gives servers block-level access to consolidated, shared storage. This explainer covers how a SAN works, its architecture, Fibre Channel vs iSCSI vs NVMe over Fabrics, use cases, limits, and how it differs from NAS and DAS.
What Is Windows Event ID 4768? Kerberos TGT Request Auditing Explained
Windows Event ID 4768 logs every Kerberos TGT request on domain controllers. This explainer covers what it means, how the Kerberos AS-REQ flow works, key result codes, and how to use 4768 for security monitoring.
What Is SCADA? Definition, How It Works & Key Use Cases
SCADA (Supervisory Control and Data Acquisition) is the architecture that lets operators monitor and control industrial equipment: pumps, valves, breakers, and sensors, from a central location. Here's how it works, where it's used, and the main security risks.
What Is Git? How It Works, Key Concepts and Use Cases
Git is a distributed version control system that tracks changes in files and coordinates work among multiple developers. This guide explains what Git is, how its snapshot-based model works, what it is used for, and how it compares to SVN and Mercurial.
What Is Hyper-V? Microsoft's Hypervisor Explained
Hyper-V is Microsoft's native Type 1 (bare-metal) hypervisor for creating and running virtual machines on x64 Windows systems. Learn how it works, its architecture, how it's licensed today, and where it fits.
What Is a Cluster? Definition, How It Works, and Use Cases
A cluster is a group of interconnected computers (nodes) that work together as a single system for higher availability, performance, and scalability than one machine. This explainer covers how clusters work, the main types (high-availability, load-balancing, HPC, storage), quorum and fencing, use cases, and limits.
Windows 11 Memory Integrity: Microsoft Enables HVCI by Default in October 2026
Starting in October 2026, Microsoft will use monthly Windows updates to turn on Memory Integrity (HVCI) by default on eligible Windows 11 PCs, closing a gap left by devices upgraded from Windows 10.
What Is Hashing? Cryptographic Hash Functions Explained
Hashing converts data into a fixed-length fingerprint using a one-way function. It's used for password storage, file integrity, digital signatures, and deduplication. This guide covers SHA-256, bcrypt, Argon2, and common attacks like rainbow tables.
Event ID 5061: Cryptographic Operation Explained
Event ID 5061 is a Windows security audit event that logs cryptographic operations performed through a Key Storage Provider. This explainer covers what triggers it, how to read its fields, the common 0x80090016 failure, and when it signals a real security concern.