21 articles · Curated and written by practitioners
More 49
TerminalFix ClickFix Variant Deploys Reverse-Tunnel Backdoor via Fake Cloudflare CAPTCHAs
Microsoft has detailed TerminalFix, a ClickFix variant that lures victims via fake Cloudflare CAPTCHAs into running PowerShell commands in Windows Terminal, ultimately deploying a Python-based reverse-tunnel implant that gives attackers persistent network access.
Enable DNS-over-HTTPS (DoH) on Windows Server 2025 DNS Server
Learn how to enable DNS-over-HTTPS (DoH) on the Windows Server 2025 DNS Server role, covering certificates, netsh binding, the Set-DnsServerEncryptionProtocol cmdlet, and client testing.
-640x640.webp&w=3840&q=75)
How to Change Your SharePoint Domain Name in Microsoft 365
Learn how to change your SharePoint domain name (tenant rename) in Microsoft 365 using PowerShell. Covers prerequisites, the Start-SPOTenantRename cmdlet, post-rename verification, and limitations like the one-time rename restriction.
-640x640.webp&w=3840&q=75)
How to Deploy PowerShell Startup Scripts via Group Policy
Learn how to deploy PowerShell startup scripts to domain computers using Group Policy. Covers the Scripts (Startup/Shutdown) extension, the PowerShell Scripts tab, execution policy, Netlogon storage, and verifying execution with Event ID 5018.
How to Delegate Distribution List Management in Exchange Online
Learn how to delegate distribution list management in Exchange Online. Covers assigning owners via ManagedBy, enabling the MyDistributionGroups role, and configuring Send As / Send on Behalf permissions. Includes EAC and PowerShell methods.
-640x640.webp&w=3840&q=75)
How to Change the Mailbox Language in Outlook
Learn how to change the mailbox language in Outlook, both through Outlook on the web settings and with the Set-MailboxRegionalConfiguration PowerShell cmdlet. Covers renaming default folders, date/time formats, and verifying the change.
Windows Event ID 1074 (User32): System Restart or Shutdown Initiated
Windows Event ID 1074 from User32 records who or what cleanly initiated a restart or shutdown: the process, account, reason code, and shutdown type. Learn what it means, how to read the reason code, and how it differs from crash events.
How to Export BitLocker Recovery Keys from Active Directory With PowerShell
Use the ActiveDirectory PowerShell module to export BitLocker recovery keys from Active Directory into a CSV, then validate the 48-digit passwords and keep the file secure.
How to Track Email Messages in Exchange Online Microsoft 365
Track email messages in Exchange Online using the modern EAC message trace (90-day history) and PowerShell's Get-MessageTraceV2 cmdlet. Covers search setup, result analysis, reporting, and troubleshooting.
How to Enable Remote Desktop on Windows Server Using PowerShell
Enable Remote Desktop on Windows Server using PowerShell. Covers the registry change, firewall rules, NLA configuration, connectivity testing, and a reusable script for multi-server deployment.
How to Configure RDP Session Timeouts and Keep-Alive in Windows Server 2025
A step-by-step guide to controlling how long RDP sessions stay active, idle, or disconnected on Windows Server 2025 — and how to keep sessions alive across unstable networks.
How to Optimize Windows Server 2025 Performance for Maximum Efficiency
A step-by-step guide to tuning Windows Server 2025 for maximum performance: identify bottlenecks, set power plans, optimize memory, storage, drivers, networking, and monitoring.
How to Deploy FortiClient VPN with Configuration Using Microsoft Intune
Deploy and pre-configure FortiClient VPN to Windows devices with Microsoft Intune using MSI extraction, a Line-of-Business app, and a PowerShell registry script - no Fortinet EMS Premium required.
How to Disable Windows Defender on Windows Server 2019 and 2022
Step-by-step guide to disabling or uninstalling Microsoft Defender Antivirus on Windows Server 2019 and 2022 using PowerShell, Group Policy, the registry, or Server Manager - safely and with a replacement AV.
How to Delete Windows Autopilot Devices from Intune, Entra ID, and M365
Learn the correct deletion sequence to fully remove stale Windows Autopilot devices from Intune, Entra ID, and Microsoft 365 - including hybrid-joined devices, orphaned records, and BitLocker key cleanup.
How to Enable and Disable Remote Desktop Access Using Microsoft Intune
Learn how to enable and disable RDP access at scale with Microsoft Intune using custom OMA-URI policies, PowerShell remediation scripts, and the Remote Help alternative for secure enterprise remote access.
How to Uninstall Internet Explorer from Windows Server 2019-2025
Remove the end-of-support Internet Explorer 11 optional feature from Windows Server 2019, 2022, and 2025 using Settings, DISM, or PowerShell, then verify the removal and set up Edge IE mode for legacy apps.
Fix SMB Network Folder Refresh Issues on Windows 10, 11, and Windows Server
Network shares not updating in File Explorer? Disable SMB client metadata caching and Offline Files with PowerShell, the registry, or Group Policy to force instant folder refresh.
How to Fix Set-AzureADKerberosServer Connection Errors in Windows Hello for Business
Resolve the Set-AzureADKerberosServer 'Failed to connect to domain' and 'Failed to read secrets' errors when setting up Windows Hello for Business cloud Kerberos trust in a hybrid Microsoft Entra ID environment.