ToolEvergreenActive Directory and Identity
AD stale computer cleanup report
A read-only Active Directory stale computer report for last logon, OU, operating system, enabled state, and cleanup planning.
Read-onlyPublished
Recent
Newest guidance, labs, and tools in one place.
Review what changed across the public operator library without learning three different section names or jumping between landing pages.
Total114
Learn25
Labs42
Tools47
Current Feed
28 items
ToolEvergreenActive Directory and Identity
All-DC lastLogon collector and stale-user evidence report
Collect non-replicated lastLogon values from every writable domain controller, calculate the newest observed logon per account, and export evidence suitable for stale-user or stale-computer cleanup decisions without relying on replicated lastLogonTimestamp alone.
Read-onlyPublished
ToolEvergreenSecurity and Exposure Checks
Authenticated Users drive ACL scanner
PowerShell scanner that checks fixed local drives on Windows servers for root ACL entries where Authenticated Users have broad access. Produces console and CSV evidence so admins can review exposure before any ACL changes.
Read-onlyPublished
ToolEvergreenHybrid Cloud Operations
Azure Arc bulk onboarding CSV and logging starter
Reusable starter for Azure Arc onboarding waves using a host CSV, dry-run expectations, per-host logging, and repeatable result tracking suitable for tickets, change records, and post-wave reporting.
Read-onlyPublished
ToolEvergreenHybrid Cloud Operations
Azure Arc onboarding preflight checklist
Preflight checklist for onboarding Windows servers to Azure Arc. Confirms supported OS state, outbound connectivity, proxy/TLS behavior, local admin rights, target Azure placement, tagging, pilot scope, and rollback notes before any agent install.
Read-onlyPublished
ToolEvergreenReporting and Evidence Packs
Azure Update Manager compliance workbook starter
Starter template for an Azure Workbook plus Resource Graph evidence pack that shows patch compliance, pending updates, unsupported coverage, and patch-group drift across Azure and Arc-enabled machines.
Read-onlyPublished
ToolEvergreenHybrid Cloud Operations
Azure Update Manager patch wave planning template
Operator-ready planning template for Azure Update Manager patch waves covering scope, maintenance windows, reboot tolerance, exclusions, soak periods, rollback contacts, and stop-go criteria before scheduled patching.
Read-onlyPublished
ToolEvergreenSecurity and Exposure Checks
Certificate expiration scanner
A read-only certificate inventory that finds local-machine store certificates nearing expiration and captures certificates presented by known TLS endpoints for review.
Read-onlyPublished
ToolEvergreenConnectivity and Network Triage
DHCP scope utilization report
A read-only DHCP scope report that surfaces high utilization, exhausted ranges, and cleanup candidates.
Read-onlyPublished
ToolEvergreenWindows Server Health
Disk space cleanup candidate report
A read-only disk-pressure report that captures low-space context and returns targeted cleanup candidates from known folders without deleting, compressing, or moving anything.
Read-onlyPublished
ToolEvergreenDNS and DHCP
DNS and DHCP Health Check
A read-only two-client DNS failure workflow that collects the same evidence on the affected and known-good Windows clients, compares suffix, resolver, cache, and query paths side by side, and narrows the first actual delta before any reset.
Read-onlyPublished
ToolEvergreenConnectivity and Network Triage
DNS resolution and reverse lookup audit
A read-only DNS audit that compares forward and reverse lookup results across host lists and expected DNS servers.
Read-onlyPublished
ToolEvergreenFile, Backup, and Storage Operations
File share permission audit
A read-only file share audit that records SMB share permissions, NTFS access, and ownership evidence for review.
Read-onlyPublished
ToolEvergreenWindows Server Health
IIS site and binding inventory
A read-only IIS inventory that correlates sites, bindings, ports, host headers, app-pool identities, content paths, and certificate thumbprints for migration or renewal work.
Read-onlyPublished
ToolEvergreenInventory
Installed Application Inventory for Windows Endpoints
A read-only PowerShell inventory starter for collecting installed applications from local or remote Windows endpoints.
Read-onlyPublished
ToolEvergreenApplication Hosting
Internal IIS site rollout checklist
Operator checklist for launching an internal IIS-hosted site with evidence capture for IIS role presence, site folder layout, bindings, app pool identity, DNS readiness, browser validation, and rollback notes.
Read-onlyPublished
ToolEvergreenActive Directory and Identity
Local administrator group audit across Windows endpoints
A read-only local administrator audit that records privileged group membership across Windows endpoints for review.
Read-onlyPublished
ToolEvergreenPatch and Reboot Readiness
Pending reboot detection across Windows servers
A read-only pending reboot check for Windows servers before patching, application installs, or maintenance-window closure.
Read-onlyPublished
ToolEvergreenConnectivity and Network Triage
PowerShell server connectivity quick check
A concise read-only connectivity triage script that separates DNS, ICMP reachability, and expected TCP-port failures before escalation.
Read-onlyPublished
ToolEvergreenInventory
RADIUS and NPS server detection report
Read-only PowerShell reporting script pattern to identify likely Microsoft NPS or other RADIUS-capable Windows servers using multiple evidence sources: NPS service presence, NPAS role/feature state, IAS/NPS event log activity, UDP 1812/1813 listener evidence, and registry indicators. Designed for migration discovery, audit support, and authentication troubleshooting.
Read-onlyPublished
ToolEvergreenRemote Access
RDP Connectivity Checklist
A structured check for RDP failures before changing firewall rules, user rights, or server policy.
Read-onlyPublished
ToolEvergreenConnectivity and Network Triage
RDP failure triage script
A read-only RDP triage script pattern for DNS, TCP 3389, listener state, firewall evidence, sessions, and event logs.
Read-onlyPublished
ToolEvergreenWindows Server Health
Scheduled task inventory and failure report
A read-only scheduled task inventory that highlights failed runs, missed runs, disabled tasks, and ownership gaps.
Read-onlyPublished
ToolEvergreenActive Directory and Identity
Service account usage finder
A read-only configuration-discovery pass for service-account assignments in Windows services, scheduled tasks, and IIS application pools, designed as the first step of—not a substitute for—the full retirement evidence workflow.
Read-onlyPublished
ToolEvergreenActive Directory and Identity
SMB working-user vs failing-user access comparison
Compare a working and failing user's identity, token, Kerberos, share ACL, NTFS ACL, inheritance, and effective-access path to identify the first authorization delta before changing permissions.
Read-onlyPublished
ToolEvergreenFreeware Utilities Worth Keeping
Sysinternals first-response kit guide
A practical Sysinternals first-response map for process, file handle, startup, network, login, and registry symptoms.
Read-onlyPublished
ToolEvergreenSecurity and Exposure Checks
Windows firewall rule audit
A read-only Windows Firewall audit that records enabled allow rules, ports, profiles, and address scopes.
Read-onlyPublished
ToolEvergreenWindows Server Health
Windows server health snapshot
A read-only Windows Server health snapshot that returns one compact row per host for uptime, disk pressure, memory headroom, stopped automatic services, and recent system errors.
Read-onlyPublished