...horse?
PowerShell, Active Directory, Public Key Infrastructure, Security, Development, Pixel Art, Systems Administration, Career Stuff and whatever else pops into my brain.
2026
-
Battling Zombie Certificates: The Persistent Risk Lurking in AD CS
Do you feel that chill in the air? Have you seen the darkness descending upon the land? Are you already tired of ham-fisted attempts to make cybersecurity spookier than it really is?
-
Sysadmin Saturday
Good morning, y’all!
-
PowerShell Conference Europe 2026
Storm diversions, first-time hallway meetings, and two talks: a summary from my first PowerShell Conference Europe in Wiesbaden. -
Exploring ESC5: Abusing The certificateTemplates Attribute
One misplaced ACE on a CA's certificateTemplates property can hand over your forest. How ESC5-style abuse of that attribute works, and how to spot it. -
A Tiny Privilege Escalation by Abusing Dangling Templates
Delete an enabled certificate template and its name can stick around on the CA; recreate the template and it's silently enabled. A tiny privilege escalation hiding in AD CS. -
Avoid Death by PowerPoint
Notes from 8 CodeMash sessions on giving talks that don't kill anyone: structure, demos, and slides that support you instead of replacing you.
2025
-
Stepper: A Lightweight PowerShell Utility Module for Creating Resumable Scripts
Long-running automation is fragile, so I built Stepper: a small PowerShell module that breaks scripts into resumable steps that remember where they were. -
macOS Screen Sharing.app Considered Harmful
My first macOS security dig: why Screen Sharing.app deserves suspicion. -
Host Your Own Web Analytics!
Thing I said I'd never care about: blog views. Thing I spent the last hour doing: setting up Matomo. -
A Dive into AutomatedLab - Infrastructure as Code for PowerShellers
Infrastructure as code for PowerShell people: building lab environments with AutomatedLab. -
PowerShell Module Scaffolding with PSStucco
A remix of Gilbert Sanchez's Stucco article, updated for PSStucco: scaffolding new PowerShell modules fast. -
Using Crescendo to Tame certutil.exe
certutil.exe is good enough, but Crescendo can wrap it into something actually PowerShell-friendly. -
My macOS Non-Negotiables
I'm a macOS-first user. The apps and settings I can't live without. -
Mocking Up Locksmith 2 with PwshSpectreConsole
Prototyping the Locksmith 2 console UI with PwshSpectreConsole while getting over the flu. -
New Job! New MVP?
Two whirlwind months: a new job and an MVP award. A short journey through the FUD. -
You Need An Active Directory Auditing Group!
After assessing 6-10 AD forests a year, one constant: every org needs a dedicated AD auditing group. Here's why and how.
2024
-
Cannot Select "Enterprise CA" When Installing a New AD CS CA
Forty hours before a presentation and the Enterprise CA option is greyed out. Fixing the AD CS install under demo-god pressure. -
Restoring a Mistakenly-Deleted Branch in GitHub
I deleted the wrong branch mid-ESC8-detection work. Here's how to get it back. -
Virtualizing Windows Server 2025 on Apple Silicon
Hi, I'm Jake, and I'm a Mac user. Getting Windows Server 2025 virtualized on Apple Silicon for AD security work. -
Using the Clipboard in PowerShell
Set-Clipboard's -AsOSC52 parameter pipes remote output to your local clipboard over any terminal that supports OSC52. Neat. -
Using the Protected Users Group - Credential Caching (Part 2 of…
Part 2: how Protected Users membership kills credential caching, and why that matters in an AD environment full of cached creds. -
Using the Protected Users Group - Intro (Part 1 of ?)
The Protected Users group enforces a stack of non-configurable protections on its members. Part 1 of a series on actually using it. -
A Function… in an Object?
You can store a PowerShell function inside an object and transmit it over a PSSession. You do now. -
LLMs Aren’t There Yet… But They’re Still Useful
Second round with the LLMs: stop asking them to do what I already know, start asking what I don't. More useful. -
LLMs Aren’t There Yet
I spent too many hours asking local LLMs to write a basic PowerShell function. They are not there yet. -
Locksmith (AD CS Remediation Tool) is now available!
Locksmith Mode 4 now fixes ownership issues automatically. Short notes this month; happy birthday to my wife. -
BlueTuxedo v2024.1 is Now Available
BlueTuxedo gets its first official release and a more-or-less monthly cadence. New year, new release.
2023
-
Locksmith v2023.12 is now available!
People are using Mode 4 auto-remediation in the wild, which terrified us into finally giving it some love. -
Back to freecodecamp!
Blazor was fun, but I need actual C# fundamentals before I can do anything real. Back to freecodecamp. -
BLAZOR!
It's just fun to say. I built my first Blazor app in about ten minutes by following the tutorial. -
Upgrading Mattermost on Docker
The Mattermost server went out of support. A reluctant sysadmin's notes on upgrading it under Docker. -
Locksmith v2023.9
Locksmith 2023.9 adds full ESC3 detection. Enrollment agent templates and client-auth templates now get flagged. -
Blue Team Con 2023
Third year at Blue Team Con in Chicago. Why a defense-focused con is exactly my scene. -
Personal Branding
I hate to admit it, but personal branding is a thing and I'm trying to build mine. Reluctantly. -
Jupyter Notebook vs. Power BI
Should Locksmith's remediation guide be a Jupyter Notebook? Thinking through JN vs Power BI for findings reports. -
Locksmith v2023.08
Locksmith 2023.08: Przemyslaw Klys helps modernize the build with his module tooling. Build scripts, modules, and testing, oh my. -
Building a Release Playbook
Do good code, test code, review code. Drafting the repeatable release process for the tools. -
Out-ConsoleGridView
WHY DID NO ONE TELL ME PowerShell 7 has a cross-platform grid view in the console? Out-ConsoleGridView is delightful. -
Let's Talk About Nested Groups
Almost every AD environment I assess has a nested-group mess. On why they're invisible, dangerous, and worth untangling. -
Presenting Tactical Speed Square
Couch-bound after hernia surgery, so obviously I built the thing the Locksmith team needed: a standardized test harness. Aka The UnLocksmith. -
Note to Self About System.DirectoryServices.ActiveDirectoryAccessRule
Hey dummy: you have to use the proper .NET types for every argument of ActiveDirectoryAccessRule. A note-to-self so I stop re-learning this. -
Self-Hosting Pains
The Mattermost server's TLS cert is expiring and I don't want to be a sysadmin anymore. The eternal self-hosting tradeoff. -
Thank you, Universe!
Lost my earbuds somewhere between appointments and mowing the septic mound. A very short gratitude post. -
Enabling MFA on Oracle Cloud
Oracle Cloud wants MFA on admin accounts now. Setting it up on the free-tier box that runs the Locksmith Mattermost server. -
Writing Documentation for Fun and (No) Profit
I actually enjoy writing process docs. On breaking complex work down into repeatable steps that don't make people cry. -
Locksmith Rework, Day 1
6:16am on a Saturday, rebuilding Locksmith with Przemyslaw Klys's module tooling... and hitting every dependency problem on the way. -
What Happens When a Real Developer Takes an Interest in Your Open…
Przemyslaw Klys submitted a Locksmith PR and suddenly my scrappy script had to grow up into a real module. -
Restarting my PNPT journey
Picking the PNPT certification back up after a year and a half, starting with Windows Privilege Escalation. -
The first official release of Locksmith!
Locksmith settles into a monthly release cadence; new versions land the first weekend of each month. -
Locksmith Lab Setup
The home lab I use to write and review Locksmith code: a Mid-2014 MacBook Pro plus a pile of remote-access tooling. -
Pulling Cable To My Office (Finally)
Months of Discord audio skipping finally pushed me to run a permanent ethernet cable to the office. A homelab rite of passage. -
Creating a Release Schedule
Working out a monthly release cadence for Locksmith and BlueTuxedo that fits the actual humans doing the work.