The registry, NTFS, the security model, and the enterprise tooling behind Microsoft's OS.
Setting up Microsoft's free, browser-based server management console as a modern alternative to a collection of separate MMC snap-ins and RDP.
How to retire deprecated Microsoft Defender Application Guard, choose supported browser or container isolation, and validate the replacement without losing controls.
Packaging and deploying an MSI installer to multiple computers automatically via Group Policy Software Installation — no third-party deployment tool.
Enabling Hyper-V and creating a working virtual machine — Windows' own native, type-1 hypervisor, built directly into Pro and Enterprise editions.
Setting up Just Enough Administration so a support team runs specific, pre-approved remote commands without ever holding full admin rights.
Declaring a machine's desired configuration once, then letting PowerShell DSC continuously enforce it, instead of re-applying settings after drift.
Using Process Explorer and Autoruns to inspect a suspicious running process and audit every autostart location that Task Manager doesn't show.
Building a current App Control for Business policy from a reference system, deploying it in audit mode, reviewing evidence, and enforcing it in rings.
Deploying Windows Server Update Services to control which updates deploy where and when, instead of every machine pulling updates directly from Microsoft.
Microsoft retired the Internet Explorer 11 desktop application for Edge, while quietly preserving IE-dependent legacy compatibility through IE mode.