Wasaf Abbasi

I build small, boring, useful ops tools: cert expiry, patch order, log triage, runbook drills. Intune · PowerShell · PKI · SRE. All MIT ↓

[Wasaf Abbasi @WasafAbbasi]

I just open-sourced 8 small, read-only tools for the boring-but-critical parts of IT ops: endpoints, certificates, patches, runbooks, logs and AI-assisted coding. All MIT, all with an offline demo that runs in under a minute. 🧵

[Wasaf Abbasi @WasafAbbasi]

@msxfaq Wichtiger Punkt bei PHS: Entra Connect synchronisiert nicht den NT-Hash selbst, sondern einen daraus abgeleiteten, gesalzenen PBKDF2-Hash. Der Sync-Server gehört trotzdem wie ein DC behandelt, also Tier 0.

[Wasaf Abbasi @WasafAbbasi]

@copyconstruct For ops scripts the loop that pays off most for me: freeze the old behaviour first. Run old and new on the same inputs and diff the output before changing anything on purpose.

Golden files catch more in a PowerShell refactor than tests written afterwards.

[Wasaf Abbasi @WasafAbbasi]

@PatchMyPC Has anyone found a clean way to report which devices already have the 2023 Secure Boot CAs in DB and KEK? Get-SecureBootUEFI per device works, but at fleet scale the reporting is what hurts.

[Wasaf Abbasi @WasafAbbasi]

@merill The recovery path is the real design here. If TAP is the fallback, test it at volume before rollout: who may issue, how fast, is it logged.

And two registered passkeys per user beat one, wherever they live.

[Wasaf Abbasi @WasafAbbasi]

@cyb3rops For browsers, default-deny is already a policy away: ExtensionInstallBlocklist "*" plus an allowlist in Chrome and Edge, pushed via Intune. VS Code has extensions.allowed now too.

The hard part is the first inventory of what's already installed everywhere.

[Wasaf Abbasi @WasafAbbasi]

https://t.co/ClTMxVfWW0

[Wasaf Abbasi @WasafAbbasi]

Version matching is where CVE tooling quietly gets it wrong. patchorder matches locally against NVD ranges and CVE 5 version blocks, incl. OpenSSH p suffixes, OpenSSL letter releases and Windows builds like 10.0.22631.4037. Every priority score prints its arithmetic.
#CVE

[Wasaf Abbasi @WasafAbbasi]

https://t.co/lbB2OLjMNB

[Wasaf Abbasi @WasafAbbasi]

secure-app-factory packages Win32 apps for Intune from a manifest with a SHA-256 pin: download, verify hash and signer thumbprint, PSAppDeployToolkit 4.1 folder, .intunewin, CycloneDX 1.6 SBOM and provenance. Graph upload stays off unless you pass -Upload.
#Intune #SBOM

[Wasaf Abbasi @WasafAbbasi]

https://t.co/0PYs72mxjv

[Wasaf Abbasi @WasafAbbasi]

Rule Q001 in endpoint-quorum: Intune says compliant, Defender hasn't seen the device in weeks.

It ships 12 starter rules like that, e.g. Q007 Defender high risk but Intune compliant, Q012 Defender still reporting a device that is disabled in Entra. Read-only. #Intune #EntraID

[Wasaf Abbasi @WasafAbbasi]

https://t.co/rcohCD3Hwb

[Wasaf Abbasi @WasafAbbasi]

The demo runbook fails on a review 507 days old, a dead pager contact, two status URLs at 404 and a bash syntax error. #SRE

[Wasaf Abbasi @WasafAbbasi]

https://t.co/G8bBd8vFVH

[Wasaf Abbasi @WasafAbbasi]

A failed Win32 deployment leaves clues in IME, AgentExecutor and CMTrace logs and EVTX, full of hostnames and UPNs.

logsieve builds one timeline and pseudonymises hostnames, UPNs, SIDs, IPs and GUIDs before anything leaves the machine. logsieve reveal maps them back.
#Intune

[Wasaf Abbasi @WasafAbbasi]

https://t.co/V4H1bFtZOz

[Wasaf Abbasi @WasafAbbasi]

grundschutz-check runs 63 read-only checks of a Windows 11 client against BSI IT-Grundschutz. Each finding cites its requirement id from the Kompendium 2023 or Grundschutz++, and values not yet verified on Win11 are marked unverified instead of guessed.
#PowerShell #Windows11

[Wasaf Abbasi @WasafAbbasi]

https://t.co/0PYs72mxjv

[Wasaf Abbasi @WasafAbbasi]

Intune calls a laptop compliant. Defender hasn't seen it in 3 weeks. Entra keeps it enabled, so access rules still trust it.

endpoint-quorum flags this as Q001, read-only, one of 12 cross-checks.

Intune, Entra and security folks: how do you catch this today?
#Intune #MSIntune

[Wasaf Abbasi @WasafAbbasi]

@PSConfEU @chagerCOC The underrated part for PowerShell: pin Pester and PSScriptAnalyzer versions inside the container, so laptop and CI lint and test the exact same way. Will the talk cover modules that still need Windows PowerShell 5.1? That's where devcontainers usually get awkward.