Writing
Field notes from production work, rewritten so the lesson travels and the client detail does not. Commands and configuration are from lab builds unless stated.
MigrationWiz "Mailbox Size" is not your source size
Why MigrationWiz showed some Gmail mailboxes at nearly twice the size Google reported, how to measure the label multiplier and what it changes for limits and pass times.
AADSTS50079 on a migration account: replacing Security Defaults with Conditional Access
Why a migration service account failed destination authentication under Entra Security Defaults, and how a five-policy Conditional Access baseline replaced them without weakening the tenant.
Wazuh all-in-one on Ubuntu 24.04: the decisions that matter
A condensed build guide for a single-node Wazuh SIEM covering about 80 Windows endpoints, from memory sizing and disk layout to agent rollout through RMM and the first custom rules.
KAPE and THOR Lite: a two-tool triage workflow
A repeatable Windows triage workflow practised on a lab machine. Collect with KAPE, preserve, parse with Eric Zimmerman's tools, scan with THOR Lite, then correlate before calling anything a finding.
Building a Windows hardening tool that can always be undone
Design notes from Win11-Security-Optimizer: read-only scans, before-state backups, a rollback script that standard users cannot tamper with, risk tiers and opt-in DFIR tools checked against pinned hashes.