tag
41 posts
A bounded explanation of Windows ALPC ports, connection and communication channels, messages, shared views, security context, RPC use, and observability.
A driver-engineering guide to Windows minifilter registration, operations, instances, altitudes, pre/post callbacks, contexts, communication, and testing.
A recovery-first Active Directory secure-channel workflow covering time and DNS, machine passwords, evidence, supported repair, rejoin fallback, and proof.
A layer-by-layer Schannel diagnosis covering role, protocol and cipher overlap, certificate chain and name, private-key access, events, traces, and retest.
A production WEF workflow covering collector-initiated and source-initiated subscriptions, WinRM, event sizing, SDDL, filtering, buffering, and proof.
A secure PowerShell logging rollout covering script blocks, modules, transcripts, protected event forwarding, sensitive data, capacity, tests, and tamper signals.
A staged Microsoft baseline workflow covering version pinning, GPO and MDM comparison, exceptions, pilot rings, conflicts, rollback, evidence, and drift control.
A practical map of Windows kernel objects, per-process handles, the Object Manager namespace, symbolic links, sessions, access checks, and inspection tools.
A version-aware ReFS guide covering checksummed metadata and data, Storage Spaces repair, scrubbing, block cloning, sparse VDL, workloads, and support limits.
How Windows Hello provisions device-bound credentials, how passkeys use WebAuthn, what biometrics unlock, how attestation and recovery work, and key limits.
A precise model of WSL 2 NAT and mirrored networking, localhost proxying, listener addresses, IPv4 and IPv6, firewalls, remote LAN access, and diagnosis.
Why Boot Camp stayed Intel-only on Apple Silicon, what native Windows would require, and how Microsoft now supports licensed Windows 11 Arm virtual machines.
WSL's path from a cancelled Android-compatibility project through syscall translation to a genuine, Microsoft-maintained Linux kernel in a lightweight VM.
Getting WSL2 and a Linux distro running from a clean Windows install using the single-command path, plus what to check if it doesn't work the first time.
Microsoft shelved its Android-app bridge for Windows 10 Mobile in February 2016, consolidating on a single iOS-focused bridge just weeks before WSL's own reveal.
Eighteen months after its reveal, WSL gained full Microsoft support, multi-distro Store installs, and Windows Server compatibility, ending its beta status.
The wsl --install command, shipped via KB5004296 in mid-2021, collapsed WSL's previously multi-step manual setup process into a single line.
At Build 2019, Microsoft revealed WSL2, an entirely different architecture running a genuine Linux kernel inside a purpose-built lightweight virtual machine.
Announced at Build 2020 and previewed to Insiders in spring 2021, WSLg let a Linux GUI application's window appear on the Windows desktop like any native app.
Released as a public beta on April 5, 2006, Boot Camp let Intel Macs dual-boot Windows XP just months after Apple's architecture transition began.
How a modern Windows machine goes from firmware to a running kernel, and where each stage's configuration actually lives.
How discretionary ACLs, mandatory integrity levels, and UAC's token-splitting combine to form Windows' layered access control model.
A blue screen flashes by too fast to read. Here's how to pull the crash dump it left behind and find out which driver actually caused it.
Task Manager shows disk usage pinned at 100% with no obvious cause. Windows Search's indexer is a frequent culprit — here's how to confirm it and fix it properly.
Windows Update hangs at a percentage forever, or fails and rolls back every time — a systematic order of fixes, from least to most invasive.
How Group Policy Objects, ADMX templates, and the client-side refresh cycle turn Active Directory structure into enforced machine configuration.
How Microsoft's 1975 founding led, eighteen years later, to hiring a DEC operating-system veteran to build Windows NT from scratch.
A complete BitLocker setup covering TPM requirements, the recovery key you must save externally, and how to verify encryption actually completed.
A complete walkthrough using the official Media Creation Tool, plus how to verify the resulting USB actually boots before you need it in an emergency.
Creating specific, scoped inbound and outbound Windows Firewall rules with PowerShell, rather than the common mistake of disabling it entirely.
A complete guide to enabling System Restore, creating restore points at the right moments, and actually rolling back correctly when something breaks.
Released July 27, 1993, Windows NT 3.1 was the first shipping version of the from-scratch, Dave Cutler-led OS underlying every Windows release since.
Announced June 24, 2021 by Panos Panay and released October 5, 2021, Windows 11 brought a redesigned interface and stricter hardware requirements.
First revealed via Windows 10 Insider Preview Build 14316 on April 6, 2016, WSL let Windows run real Linux binaries for the first time.
How NTFS's Master File Table, transaction journal, and lesser-known features like alternate data streams and the USN journal actually work.
How WinRM and PowerShell Remoting turn scattered single-machine administration into fleet-wide scripted management across hundreds of servers.
How the Windows kernel represents processes as containers of handles and a security token, and the tools to inspect both live.
How the registry's hive files, keys, and value types work under the hood, and the tools to inspect and edit them safely.
How the Service Control Manager starts, stops, and supervises background processes, and how to configure and debug a service directly.
How Task Scheduler's triggers, actions, and conditions work together, and how to build and inspect scheduled tasks from the command line.
How WSL2 differs fundamentally from WSL1's syscall translation, running an actual Linux kernel in a lightweight, tightly-integrated VM.