Engineering across the modern enterprise.

Use events 4740 and 4625 together to move from 'the account keeps locking' to a timeline that identifies the source device, logon type and stale credential.

NO_CLIENT_SITE entries in Netlogon logs are useful evidence that client networks are not mapped cleanly to Active Directory sites. PowerShell can turn the logs into a subnet-hygiene report.

Enterprise browsers move enforcement into the user session. Network-centric Zero Trust still owns critical controls such as DNS, routing and non-browser traffic. The interesting architecture is often the combination.

Zero Trust is not resilient just because it is cloud-hosted. Identity, posture, policy, tunnels, DNS and SaaS authentication all create failure domains that need deliberate recovery paths.

A practical pattern for consuming AWS/Azure network feeds, calculating desired state and safely synchronising Cloudflare Zero Trust lists with PowerShell.

When private sites and DNS exceptions multiply, WARP device-profile configuration becomes data. Source control can become the input and PowerShell the generator.