Every runbook, one place.
Troubleshooting guides, project walkthroughs, and checklists for Microsoft 365. Each one covers what's actually happening, the order that works, and the commands to prove it.
Moving Off GoDaddy Microsoft 365: How Defederation Actually Works
GoDaddy-hosted Microsoft 365 isn't a normal tenant. Here's what's different, the two ways out, and the traps that delete mailboxes or lock everyone out.
Read the runbookMicrosoft Entra Connect Sync Errors: How to Find and Fix Them
Duplicate attributes, soft-match failures, stopped sync cycles, and version retirement. Where Entra Connect errors show up, what they mean, and the fix for each.
Autopilot Pre-Flight Checklist: Verify Before You Deploy
The tenant, licensing, enrollment, network, and device checks to run before your first Windows Autopilot deployment. Interactive checklist, and your progress is saved in your browser.
Autopilot Stuck on the Enrollment Status Page or Pre-Provisioning: Fix Guide
Autopilot hangs at "Identifying", times out on apps, or fails pre-provisioning with a red screen. How to get logs out of OOBE, read them, and fix the usual causes.
Microsoft 365 Business Premium: What You're Paying For but Not Using
Business Premium includes Intune, Conditional Access, Defender for Business, and Defender for Office 365. Here's what each one does, what it's worth, and what most small businesses leave switched off.
Conditional Access for Small Businesses: The Baseline Policy Set
The core Conditional Access policies every Business Premium tenant should have, how they fit together, the P1 vs P2 limits, and how to roll them out in cloud-only and hybrid environments.
Cyber Insurance Questionnaire Cheat Sheet for Microsoft 365
The questions cyber insurers ask about MFA, EDR, backups, email security, and admin access, what they really mean, and where each one is answered in Microsoft 365.
Onboarding Devices to Defender for Business With Intune
Connect Defender and Intune, onboard Windows devices automatically, run Defender Antivirus in the right mode, and verify each device is actually protected, not just "onboarded".
Email Migration Readiness Checklist for Microsoft 365
Everything to confirm before you move a single mailbox: access, licensing, DNS, mailbox data, devices, and communication. Interactive checklist, and your progress is saved in your browser.
Exchange Server to Microsoft 365: Choosing Cutover, Staged, or Hybrid
Exchange 2016 and 2019 are out of support. Here's how to pick a migration method, what hybrid actually requires, and what to do about the last Exchange server.
FortiGate Hardening Checklist for Small Businesses
A practical review of a small-business FortiGate. Firmware, admin access, VPN, firewall policies, logging, and backups. Interactive checklist, and your progress is saved in your browser.
Moving Off GoDaddy Microsoft 365: How Defederation Actually Works
GoDaddy-hosted Microsoft 365 isn't a normal tenant. Here's what's different, the two ways out, and the traps that delete mailboxes or lock everyone out.
Google Workspace to Microsoft 365 Migration: The Order That Works
Moving from Gmail to Exchange Online with Microsoft's built-in Google Workspace migration. Prerequisites, mail routing, the migration batch, and what doesn't come across.
Moving From Group Policy to Intune: What to Keep, Translate, or Drop
Use Group Policy analytics to see what translates to Intune, sort your GPOs into keep, translate, and drop, and replace drive maps, printers, and logon scripts with cloud-native options.
Hybrid Join Diagnostic: Reading dsregcmd /status Line by Line
A diagnostic guide for Microsoft Entra hybrid join failures. What every important field in dsregcmd /status means, the common failure states, and how to fix each one.
Intune Win32 App Deployment Failures: 8 Causes and Their Fixes
Apps stuck on "Install pending," failing with 0x87D1041C, or installing but reporting as failed. Where to find the real error, and the fixes for the eight most common causes.
Setting Up Windows Autopilot From Scratch: The Right Order
Autopilot fails when steps are done out of sequence. Licensing, enrollment, device registration, profiles, the Enrollment Status Page, and when to use Autopilot device preparation instead.
BitLocker Silent Encryption With Intune: Why Devices Won't Encrypt
Intune BitLocker policy assigned but devices stay unencrypted, prompt users, or never escrow keys. The requirements for silent encryption, how to check each one, and how to fix it.
Intune Certificates: Cloud PKI vs SCEP/NDES vs PKCS, and Fixing SCEP
Which certificate approach fits a small business for Wi-Fi and VPN, how the SCEP/NDES chain works, and how to troubleshoot SCEP profiles that never deliver a certificate.
Intune Compliance Policies Not Applying: Find the Real Cause
The device shows "Not evaluated," compliance never updates, or Conditional Access blocks a device that should pass. Six root causes, how to prove which one you have, and the fix for each.
Windows Updates With Intune: Update Rings, Feature Updates, and Leaving WSUS
How to replace WSUS or "whatever Windows does by default" with Intune update rings, feature update policies, and driver updates, and the leftover GPO settings that silently block it all.
Microsoft 365 Security Quick Check: 20 Things to Verify Today
A 30-minute self-check for small-business Microsoft 365 tenants. Admin accounts, MFA, legacy auth, mail security, Defender, devices, and data sharing. Interactive, and your progress is saved in your browser.
Rolling Out MFA in Microsoft 365 Without Locking Anyone Out
Security defaults vs Conditional Access, break-glass accounts, the Authentication methods policy, and a staged rollout that doesn't flood the help desk.
Shared Mailbox Permissions Not Working in Microsoft 365: Full Fix
Full Access granted but the mailbox won't show up, Send As fails, or sent items land in the wrong place. The permission types, how to check them, and every common fix.
SPF, DKIM, and DMARC for Microsoft 365, Set Up Correctly
The three DNS records that keep your mail out of spam folders and stop spoofing. What each one does, how to publish it for Exchange Online, and how to move DMARC to enforcement safely.
Moving From a Legacy Phone System to Teams Phone
Replacing a hosted PBX with Teams Phone. Licensing, the three PSTN options, number porting, auto attendants and call queues, emergency calling, and the devices people forget.
Kerberos pre-authentication failures — event IDs decoded
Every Kerberos pre-auth failure code decoded — 0x6, 0x12, 0x18, 0x25 and more — with the exact fix for clock skew, stale passwords, and duplicate SPNs.
Domain Controller Decommission Checklist — Every Step in Order
A printable phase-by-phase checklist for decommissioning a domain controller properly. Pre-demotion, demotion, post-demotion cleanup, and final verification — every checkbox in the right order.
Decommissioning a File Server Without Losing Anything
Shares, DFS namespaces, GPO drive maps, and open sessions — handled in the right order so nothing breaks when you pull the plug on an old file server.
How to Migrate FSMO Roles Safely
The correct transfer sequence, pre-flight health checks, NTP reconfiguration after the PDC move, and how to seize roles when the original holder is dead.
Trust Relationship Failed — Fix a Broken Domain Join Without a Reimage
The trust relationship broke but you don't need to wipe the machine. Reset the secure channel with PowerShell in under 5 minutes — no rejoin needed.
AD Replication Errors: What the Event IDs Actually Mean
Decoding the most common AD replication errors — 1864, 8606, 1722, 8524, 1753 — with the exact fix for each so replication starts working again.
DNS Resolution Failures in a Windows Domain — Step-by-Step Fix
DNS failures break logins, GPO, and Kerberos silently. A structured approach to finding and fixing the root cause fast — every command in order.
Group Policy Not Applying — Diagnose and Fix It
GPO silently failing with no error. Every diagnostic step: scope, security filtering, WMI filters, loopback processing, and event log codes decoded.
DC Decommission Companion: Cleaning Up What dcpromo Leaves Behind
Even a clean demotion leaves traces. Clean up the metadata, DNS records, and Sites and Services entries that DC demotion silently misses.
The Real-World Checklist for Decommissioning a Domain Controller Properly
Transfer FSMO roles, sync replication, run demotion, verify DNS — every step in the right order with the right commands for a clean DC decommission.
AD Artifacts Left After a Domain Controller Wasn't Properly Decommissioned
Stale DNS records, ghost objects in Sites and Services, and metadata that won't leave. Full cleanup after a DC wasn't properly decommissioned.
No runbooks match that search yet. Suggest one.