Two firewall changes in one maintenance window. By morning one box pings the gateway, cannot reach the Plex VM, and looks perfectly healthy in UniFi. Routing is fine. It is working from a cache written before I moved the network underneath it.
Flipping msDS-SupportedEncryptionTypes is one line. I have never once been nervous about the line. I am nervous about the call two days later: a nightly job stopped, and nobody can say why. The attribute is trivial. The blast radius is not.
A utility script died on a fresh Windows 11 box. wmic bios get serialnumber, gone, and the DISM command that puts it back stops working this month. The one-liners map onto Get-CimInstance cleanly. The for /f blocks wrapped around them do not.
A report-only CA policy, and one question: if I enable it, who stops being able to work? What If gave me thirteen rows and no answer. So I wrote a PowerShell module that folds them into one.
A service’s cert I don’t use much had expired. Turns out certbot had been failing twice a day for months and nothing said a word. Port 80 is blocked on my home line, so HTTP-01 was never an option. Wrote up the fix, and hand rolled some alerting.
Pester 6.1 shipped, so I checked my Copilot standards against an install instead of the release notes. Four claims no longer held. Two aren’t in the announcement at all, and one example from the release notes doesn’t actually run.
Windows OpenSSH ships everything except ssh-copy-id. VS Code Remote-SSH kept asking for my password, and the documented fix is macOS/Linux only. So I built one: platform detection, idempotent installs, real verification.
A fresh Okta trial org is empty. The licence caps you at ten active users, so I built a lab where 8 awkward users plus everything Okta doesn’t cap does the work. Seeds in 2 min, tears down safely.
Updated my PowerShell Copilot Standards repo and realized every other project was still on the old instruction copies. So I built a GitHub Actions workflow that mirrors them weekly and opens a PR when they drift.
Browser extension policy in Intune is spread across blocklists, allowlists and forced installs, and nothing shows you the combined result. So I wrote an analyzer that does.