Guides
Tested walkthroughs for endpoint management and the parts of the job that never make it into the official docs.
Managing, securing and troubleshooting Macs across Jamf Pro and Microsoft Intune, with the encryption and MDM details that decide whether things actually work. Includes the staged Jamf-to-Intune migration series.
A staged set of standalone runbooks for moving an Apple silicon fleet off Jamf and onto Intune. Six stages, three published: audit what you enforce and watch two dozen profiles collapse into three, enrol cleanly via no-affinity ADE, and enforce FileVault so the key genuinely escrows. Apps and extensions, migrating machines already in service, and the move to user affinity and Platform SSO follow once they have been built for real. Ends with an acceptance test for proving the whole build works, including what the person receiving the machine actually sees.
Export your Jamf profiles with their values and map them to Intune. Most turn out to be Jamf tooling that dies with Jamf, or near-empty, so the genuine build list is tiny. The stage that shrinks the whole migration.
The stage-and-post enrolment model, the affinity choice you cannot undo without a wipe, scutil naming that propagates up to the console, and the group and rebuild traps that silently stop configuration applying.
Enabling FileVault by policy so the key actually escrows, the truth about why a break-glass admin is always visible at pre-boot, and the compliance password setting that silently desyncs the encryption credential.
A fleet can be fully encrypted and still have no usable recovery keys on file. How I fixed a backlog of them on a Jamf-managed fleet, using Netflix's open-source Escrow Buddy, a gated Smart Group as the worklist, and a fix-forward approach with zero user prompts.
Day-to-day commands for the jamf binary on managed Macs: triggering inventory and policies, running custom triggers, reading local state, forcing MDM sync, and the destructive recovery sequence for when the framework itself is broken (with the ordering trap that catches everyone once).
Standardising browser update behaviour across Chrome, Brave, Edge and Firefox using Jamf Pro and Microsoft Intune, with detailed deployment steps for both, a method for finding policy conflicts before they happen, and the gotchas nobody warns you about.
Turning on disk encryption is the easy half. This guide covers the half that keeps you employed: reliably capturing and escrowing the recovery key, in both Jamf Pro and Intune, plus the SecureToken and deferral gotchas that quietly decide whether it works at all.
A reusable toolkit for verifying and troubleshooting MDM-delivered configuration. Each command shown as a template with the variable part highlighted, then specific examples. Works for any managed app, not just browsers, and it is the page the other guides keep pointing back to.
↑ Back to topManaging Windows endpoints through Intune, and the cross-platform endpoint security tooling that lands mostly on Windows admins' desks.
The mdatp CLI on macOS and Linux, plus PowerShell equivalents on Windows. Templates first, examples second, and the diagnostic one-liner I reach for before anything else. Covers health, connectivity, RTP, definitions, EDR, exclusions, tamper protection, threats, performance, and common scenarios I have actually hit.
The Windows companion to the Mac browser update guide. Same goal, same end state, different machinery: registry instead of plists, ADMX instead of mobileconfig, and a single PowerShell script as the closest thing to a bundled deliverable. Two deployment paths covered.
↑ Back to topOn-premises Active Directory, hybrid identity, and Microsoft Entra: security hardening, sync, and the multi-domain operations that carry real risk.
Shutting the door on sign-ins from countries where nobody legitimately works, to cut credential-spray noise and shrink the attack surface. A two-tier named-location design, a repeatable way to let real travellers through without weakening the block, the APAC geolocation problem and its workaround, and how quickly the block takes effect.
Retiring one AD domain from a two-domain hybrid sync, turning its users and groups cloud-only while the main domain stays hybrid. The disable-and-rescope method that converts everything in place, why it beats domain filtering, what actually converts, and the modern per-object Source of Authority alternative.
The PowerShell tooling I built while working through the RC4 deprecation: a live authentication failure monitor, baseline snapshots, RC4 activity audit, and bulk changes with auto-generated rollback. Notes on where each pattern is useful far beyond Kerberos.
An honest account of working through CVE-2026-20833 across a multi-domain estate with an AWS Managed AD trust. What to audit, how to fix the accounts safely, when to actually enforce, and the things that surprised me along the way.
↑ Back to topMoving workloads into the cloud, and the practical mechanics of getting existing machines from on-premises hypervisors onto cloud infrastructure.
Taking the disks out of a VMware or Hyper-V VM and turning them into a booting EC2 instance. Both the import-snapshot and import-image paths, the bootable-versus-storage disk distinction that trips everyone up, getting disks into the right format with StarWind or native tooling, and the driver-timing decision that determines whether it boots at all.
↑ Back to top