Made by Arden

Small software I build and share. Moor Linux puts a Linux desktop in your browser. ABetterStartBar, a better dock for Windows 11, is coming soon.

[Made by Arden @madebyarden]

SFC & DISM explained (visually) ↓

SFC fixes Windows system files from cached copies. DISM repairs those copies.

Help desk tip: run DISM /RestoreHealth first, then sfc /scannow, both as admin.

#SysAdmin

[Made by Arden @madebyarden]

Robocopy explained (visually) ↓

Copies only what changed, retries, restarts big files, and logs it all. /MIR also deletes what isn't in the source.

Help desk tip: exit code 1 means everything copied. Only 8 or higher is a failure.

#SysAdmin

[Made by Arden @madebyarden]

Share vs NTFS permissions explained (visually) ↓

A shared folder has two locks. Over the network, the stricter one wins. Signed in on the server, only NTFS counts.

Help desk tip: user can open but not save? Check both. Either one set to Read means Read.

#WindowsServer

[Made by Arden @madebyarden]

Entra device join explained (visually) ↓

Registered: your own device, work account added. Joined: company device, Entra sign-in. Hybrid: on-prem AD plus Entra.

Help desk tip: not sure which? Run dsregcmd /status and read AzureAdJoined and DomainJoined.

#MicrosoftEntra

[Made by Arden @madebyarden]

Mailbox permissions explained (visually) ↓

Full Access opens a mailbox. Send As sends as it. Send on Behalf sends as you, "on behalf of" it.

Help desk tip: "I can open the shared mailbox but can't send"? Full Access alone can't send. Add Send As.

#Microsoft365

[Made by Arden @madebyarden]

Azure RBAC explained (visually) ↓

Every Azure grant is a role assignment: who, which role, and at what scope. Access flows down and adds up.

Help desk tip: "I'm Owner but can't read the blobs"? Owner has no DataActions. Add Storage Blob Data Reader.

#Azure

[Made by Arden @madebyarden]

Event Viewer explained (visually) ↓

Every Windows event has a log, a source, an ID, and a level. Read the source and ID together.

Help desk tip: PC restarted on its own? Filter the System log for 41, 1074 and 6008. A 1074 names who asked.

#HelpDesk

[Made by Arden @madebyarden]

Ping & tracert explained (visually) ↓

ping sends ICMP Echo Requests and times the replies. tracert raises TTL 1, 2, 3… so each router on the path reveals itself.

Help desk tip: the IP pings but the name doesn't? That's DNS, not the network.

#HelpDesk

[Made by Arden @madebyarden]

Remote Desktop explained (visually) ↓

RDP is a remote Windows desktop. Pro/Enterprise/Education host; Home is client-only. Default port TCP 3389. Keep NLA on.

Help desk tip: works on LAN, fails over VPN? Check routing and the Remote Desktop firewall group.

#HelpDesk

[Made by Arden @madebyarden]

Windows Firewall explained (visually) ↓

Inbound is blocked unless a rule allows it. Outbound is allowed. Rules go by profile: Domain, Private or Public.

Help desk tip: works at home, fails on café Wi-Fi? Run Get-NetConnectionProfile. The rule may be Private-only.

#HelpDesk

[Made by Arden @madebyarden]

Network ports explained (visually) ↓

The IP address finds the machine. The port finds the program: 443 for HTTPS, 3389 for RDP, 445 for file shares.

Help desk tip: app won't connect? Run Test-NetConnection server -Port 443 and check TcpTestSucceeded.

#Networking

[Made by Arden @madebyarden]

Windows LAPS explained (visually) ↓

Every PC gets its own local admin password. Windows rotates it and backs it up to Entra ID or AD, never both.

Help desk tip: need local admin on a PC? Look up its LAPS password in Intune, Entra, or AD. Never reuse a shared one.

#Windows

[Made by Arden @madebyarden]

BitLocker explained (visually) ↓

It encrypts the whole Windows drive. The TPM unlocks it at boot only if the boot chain is unchanged.

Help desk tip: manual BIOS update? Run Suspend-BitLocker -MountPoint C: first, or the next boot may want the 48-digit recovery key.

#Windows

[Made by Arden @madebyarden]

Subnetting explained (visually) ↓

The /24 says how many of 32 bits are network. The rest are hosts.

Help desk tip: right IP but can't reach the printer? Compare the subnet mask in ipconfig with a working PC on the same network.

#Networking

[Made by Arden @madebyarden]

Execution Policy explained (visually) ↓

PowerShell checks 5 scopes; the first one that's set wins. Windows PCs start at Restricted.

Help desk tip: "running scripts is disabled"? Run Get-ExecutionPolicy -List, then set RemoteSigned for CurrentUser. No admin needed.

#PowerShell

[Made by Arden @madebyarden]

Conditional Access explained (visually) ↓

Entra ID's if-then engine: who, which app, where, what device. Then block, or grant with MFA or a compliant device.

Help desk tip: user blocked? Check the Conditional Access tab on their sign-in log before resetting anything.

#EntraID

[Made by Arden @madebyarden]

Group Policy explained (visually) ↓

Local, Site, Domain, then OU: the GPO applied last wins, unless a link is Enforced.

Help desk tip: GPO not applying? Run gpresult /r and read the filtered-out list. "Denied (Security)" means the filter, not the GPO.

[Made by Arden @madebyarden]

NAT explained (visually) ↓

Many private devices share one public IP. Outbound creates the mapping, so unsolicited inbound has nowhere to go.

Help desk tip: can't reach a home PC from outside? You need a port forward, 1:1 NAT, or a VPN. Behind CGNAT, port forwards won't work.

[Made by Arden @madebyarden]

DHCP explained (visually) ↓

How a PC gets its IP, gateway and DNS: Discover, Offer, Request, Ack, then it renews at half the lease.

Help desk tip: a 169.254.x.x address means no DHCP server ever answered. Check the link, VLAN, relay, then whether the scope is full.

[Made by Arden @madebyarden]

DNS explained (visually) ↓

How a typed name becomes an IP: your PC's cache → recursive resolver → root → .com → authoritative, then cached for the TTL.

Help desk tip: "propagation" is just caches expiring. ipconfig /flushdns clears the PC, not the resolver.