The registry, NTFS, the security model, and the enterprise tooling behind Microsoft's OS.
A bounded explanation of Windows ALPC ports, connection and communication channels, messages, shared views, security context, RPC use, and observability.
A driver-engineering guide to Windows minifilter registration, operations, instances, altitudes, pre/post callbacks, contexts, communication, and testing.
A recovery-first Active Directory secure-channel workflow covering time and DNS, machine passwords, evidence, supported repair, rejoin fallback, and proof.
A layer-by-layer Schannel diagnosis covering role, protocol and cipher overlap, certificate chain and name, private-key access, events, traces, and retest.
A production WEF workflow covering collector-initiated and source-initiated subscriptions, WinRM, event sizing, SDDL, filtering, buffering, and proof.
A secure PowerShell logging rollout covering script blocks, modules, transcripts, protected event forwarding, sensitive data, capacity, tests, and tamper signals.
A staged Microsoft baseline workflow covering version pinning, GPO and MDM comparison, exceptions, pilot rings, conflicts, rollback, evidence, and drift control.
A practical map of Windows kernel objects, per-process handles, the Object Manager namespace, symbolic links, sessions, access checks, and inspection tools.
A version-aware ReFS guide covering checksummed metadata and data, Storage Spaces repair, scrubbing, block cloning, sparse VDL, workloads, and support limits.
How Windows Hello provisions device-bound credentials, how passkeys use WebAuthn, what biometrics unlock, how attestation and recovery work, and key limits.