Learn / Build / Use

Windows and Identity

Windows administration, Active Directory, identity, access, protocols, patching, and server operations.

6 learn3 build15 use2 capability mapsBrowse all topic paths

Capability Maps

How this path becomes useful work

Windows Patch Readiness and Maintenance Evidence

Know whether Windows servers are ready for patching and prove what changed after maintenance.

Free boundary: Read-only readiness checks, reboot detection, servicing evidence, and local reports for one environment.
Paid value later: Pre/post comparison, multi-host reporting, exception tracking, maintenance summaries, and reusable evidence packs.

01UnderstandChoose repair and maintenance paths with evidenceTeach why patch readiness starts with state capture, not immediate repair commands.02BuildBuild a patch compliance workflowPractice scheduled scans, CSV evidence, rollback notes, and maintenance documentation in a build path.03UseCheck pending reboots before patchingUse a read-only reboot state check before maintenance, installs, or troubleshooting.04ExtendAdd servicing health and update repair evidenceInclude Windows Update state, servicing health, approved repair actions, and validation criteria.05AutomateRun pre and post checks as a maintenance routineSchedule repeatable before/after checks, export results, and track exceptions that need follow-up.06IntegrateSend maintenance evidence to stakeholdersTurn readiness and post-check findings into HTML summaries, tickets, or change-record attachments.07Upgrade / plannedSell patch readiness report packsPaid packs can add compare mode, fleet grouping, exception handling, and maintenance-window reporting.

Endpoint Management and SCCM-Style Reporting

Give endpoint and server owners useful compliance, inventory, deployment, and client-health reports without drowning them in raw console exports.

Free boundary: Read-only inventory and compliance starters, report design guidance, and small CSV/HTML outputs.
Paid value later: High-end report packs, query libraries, dashboards, deployment health summaries, and packaged documentation.

01Understand / plannedDefine what endpoint reports must proveTeach report purpose, audience, source data, stale-client risk, deployment state, and compliance interpretation.

02BuildBuild reusable inventory reporting habitsPractice collecting endpoint software inventory and shaping evidence into useful reports.03UseStart with installed application inventoryUse a read-only inventory starter to capture software evidence from Windows endpoints.04ExtendAdd stale clients, patch state, and deployment healthGrow into client health, collection targeting, missing updates, failed deployments, and ownership gaps.

05Automate / plannedRefresh reports and preserve point-in-time evidenceSchedule exports, normalize rows, track trend changes, and identify devices that need manual follow-up.

06IntegratePublish report packs for operational reviewConnect endpoint evidence to HTML reports, internal dashboards, or review-ready exported bundles.07Upgrade / plannedSell high-end endpoint report packsPaid products can compete through polish: report design, interpretation, query packs, deployment health, and client-ready documentation.

Learn

Understand Windows and Identity

Academy guides that explain the concepts, architecture, decisions, and durable operator patterns.

Comparing Identity Validation Paths Across DNS, LDAP, Kerberos, and SMBUse this supporting Insight to decide whether an identity or Windows access failure should be validated from DNS, LDAP, Kerberos, or SMB first.Academyactive directory and windows protocols Comparing Windows Repair Paths: SFC, DISM, Restore, Rollback, and ReinstallUse this supporting Insight to compare Windows repair paths before reaching for SFC, DISM, restore workflows, update rollback, or full rebuilds.Academywindows Identity Evidence-First Comparison Between Good and Broken PathsUse this supporting Insight to compare a working identity or protocol path against the failing one before you change AD, DNS, trust, or service settings.Academyactive directory and windows protocols Planning Identity and Windows Protocol Troubleshooting Without GuessingUse this parent Insight to isolate identity and Windows protocol failures by mapping the failing boundary before changing DNS, AD, SMB, or auth settings.Academyactive directory and windows protocols Planning Windows Recovery and Repair Without Making the Outage WorseUse this parent Insight to plan Windows recovery around evidence, repair-path choice, validation, and rollback before you change system state.Academywindows Windows Evidence-First Recovery Workflow Before Repair CommandsUse this supporting Insight to gather Windows evidence before SFC, DISM, uninstalls, Safe Mode, or other repair commands change the system.Academywindows

Build

Practice Windows and Identity

DIY projects that turn the concepts into working systems, labs, and repeatable environments.

Build a Raspberry Pi Travel Gateway with WireGuard for Safe Remote Access to Your Home LabA Raspberry Pi travel gateway pattern for secure WireGuard access back to a home lab while away from the trusted network.Admin AccessIntermediate2-3 hours Build a Secure Remote Admin Toolkit with Tailscale, RDP Hardening, and Access ControlsA practical build for a secure remote administration toolkit using Tailscale for secure networking, along with RDP hardening techniques and access control measures to ensure a safe remote management experience.Admin AccessIntermediate2-3 hours Build a Small Identity Lab with Authentik and KeycloakBuild a small identity lab with Authentik and Keycloak so you can test SSO flows, admin access, and recovery steps safely.Identity and SecretsIntermediate2-3 hours

Use

Operate Windows and Identity

Free Toolchest assets for checks, scripts, evidence, reporting, and practical operator work.

AD stale computer cleanup reportA read-only Active Directory stale computer report for last logon, OU, operating system, enabled state, and cleanup planning.ScriptActive Directory and IdentityRead-only All-DC lastLogon collector and stale-user evidence reportCollect non-replicated lastLogon values from every writable domain controller, calculate the newest observed logon per account, and export evidence suitable for stale-user or stale-computer cleanup decisions without relying on replicated lastLogonTimestamp alone.ScriptActive Directory and IdentityRead-only Authenticated Users drive ACL scannerPowerShell scanner that checks fixed local drives on Windows servers for root ACL entries where Authenticated Users have broad access. Produces console and CSV evidence so admins can review exposure before any ACL changes.ScriptSecurity and Exposure ChecksRead-only Certificate expiration scannerA read-only certificate inventory that finds local-machine store certificates nearing expiration and captures certificates presented by known TLS endpoints for review.ScriptSecurity and Exposure ChecksRead-only Disk space cleanup candidate reportA read-only disk-pressure report that captures low-space context and returns targeted cleanup candidates from known folders without deleting, compressing, or moving anything.ScriptWindows Server HealthRead-only IIS site and binding inventoryA read-only IIS inventory that correlates sites, bindings, ports, host headers, app-pool identities, content paths, and certificate thumbprints for migration or renewal work.ScriptWindows Server HealthRead-only Inactive AD user disable review workflowTwo-phase review checklist for identifying inactive AD user accounts, validating inactivity evidence, applying exclusions, capturing approval, and preparing rollback details before any disable action.ChecklistActive Directory and IdentityChanges system state Local administrator group audit across Windows endpointsA read-only local administrator audit that records privileged group membership across Windows endpoints for review.ScriptActive Directory and IdentityRead-only Pending reboot detection across Windows serversA read-only pending reboot check for Windows servers before patching, application installs, or maintenance-window closure.ScriptPatch and Reboot ReadinessRead-only Scheduled task inventory and failure reportA read-only scheduled task inventory that highlights failed runs, missed runs, disabled tasks, and ownership gaps.ScriptWindows Server HealthRead-only Service account usage finderA read-only service account discovery pass for Windows services, scheduled tasks, and IIS application pools.ScriptActive Directory and IdentityRead-only Windows firewall rule auditA read-only Windows Firewall audit that records enabled allow rules, ports, profiles, and address scopes.ScriptSecurity and Exposure ChecksRead-only Windows server health snapshotA read-only Windows Server health snapshot that returns one compact row per host for uptime, disk pressure, memory headroom, stopped automatic services, and recent system errors.ScriptWindows Server HealthRead-only Windows Update readiness and repair evidence packA patch readiness and repair evidence pack for reboot state, servicing health, update logs, and approved repair actions.ChecklistPatch and Reboot ReadinessChanges system state Windows Update Repair ChecksA staged Windows Update troubleshooting path that starts read-only and escalates only when needed.ChecklistPatchingChanges system state