About Jeremy
I bring a background in industrial operations, enterprise IT support, and independently validated Microsoft administration.
Career foundation
Before moving into information technology, I worked in oil and gas roles involving technical operations, instrumentation, diagnostics, supervision, and operational responsibility.
That experience shaped a disciplined approach to troubleshooting: understand the environment, establish the facts, communicate clearly, and verify the result.
I returned to formal education in 2019, completing an associate degree in Computer Science with a Database Administration focus, followed by Information Security and Administration studies. Professional support roles and hands-on infrastructure work have continued that transition.
Professional experience
User support, account administration within role scope, incident ownership, documentation, and escalation. My experience also includes an initial Windows and Microsoft 365 buildout at Completeful Technologies.
Read the employment record ↗Validated lab work
Identity, endpoint management, virtualization, Microsoft 365, networking, and automation, documented with actual implementation and validation records.
Explore the projects ↗Working principle
Dates provide context. A retained result remains useful after a temporary lab changes, but the scope of the result always matters.
Inspect the evidence ↗Professional employment
Employment responsibilities are presented separately from personal laboratory projects. Dates and role descriptions follow the current repository resume.
Active Directory account management, password resets, new-user setup, permissions, Windows and application troubleshooting, connectivity support, KB documentation, and Tier 2/3 escalation. Primary healthcare support includes Ivanti, Epic, MyChart, and Vocera.
Technical troubleshooting, customer communication, ticket ownership, escalation support, and team coordination.
Joined during the launch of a new drop-shipping company and served as the primary internal IT resource. Built and configured the initial on-premises Windows environment, including Windows Server and Active Directory Domain Services, user and group administration, authentication, policy, and workstation integration. Also configured Cloudflare DNS and the company’s Microsoft 365 environment, then handled day-to-day IT support and administration after rollout.
Customer-facing network and technical support.
Help desk support while completing an A.S. in Computer Science – Database Administration.
Capability map
Explore documented capabilities by domain. No proficiency percentages or implied production ownership.
01 / capability
Windows Server, AD DS, DNS, DHCP, Group Policy, Windows LAPS, NTFS, Windows Admin Center, and PowerShell.
02 / capability
Microsoft 365, Entra ID, Exchange Online, Microsoft Graph, Conditional Access, MFA, Defender, Cloud Sync, and Azure Arc.
03 / capability
Intune, Windows Autopilot, compliance, BitLocker, Defender, and macOS management policies. Apple enrollment remains explicitly simulated.
04 / capability
Hyper-V, Proxmox, SCVMM, virtual storage, logical networking, and bounded backup/restore validation.
05 / capability
TCP/IP, DNS, DHCP, VLANs, routing, OpenVPN, pfSense, and management-path testing.
06 / capability
PowerShell, Microsoft Graph SDK and REST API, CSV reporting, permissions review, and validation scripts. Bash/shell use is supporting cross-platform practice.
07 / capability
ServiceNow request fulfillment, catalog tasks, approval, assignment controls, and escalation. The separate administration lab has unfinished phases.
08 / capability
Windows, Linux SSSD/Kerberos, macOS AD integration, and SaaS support. Platform and endpoint limitations remain visible.
Education & credentials
Education and certification names are corroborated by the current repository resume. Credential IDs, badge links, and current expiration states were not supplied.
Remington College
Computer Science — Database Administration
August 2019 – May 2021
GPA 3.84 · Honors / Dean’s List
MyComputerCareer
June 2021 – January 2022
GPA 4.00 · WCITP
Credentials on record
Microsoft
Listed in verified source resume
CompTIA
Listed in verified source resume
CompTIA
Listed in verified source resume
CompTIA
Listed in verified source resume
Microsoft
Listed in verified source resume
Microsoft
Listed in verified source resume
Microsoft
Listed in verified source resume
Linux Professional Institute
Listed in verified source resume
Listed in verified source resume
Cisco
Listed in verified source resume
freeCodeCamp
Listed in verified source resume
The typographic marks above are navigation labels, not issuer badges. Independent credential verification and current renewal status remain unverified.
Infrastructure architecture
This diagram combines the retained core platform inventory with documented subsystem relationships. It does not claim that every component was running simultaneously or remains online today.
Retained platform inventory: Proxmox VE 9.2.3
VM 100
vmbr0 + vmbr1
VM 200 · Windows Server
AD DS / DNS / DHCP
VM 300
Domain workstation
VM 400 · Ubuntu
SSSD / VLAN 30
Documented nested Hyper-V subsystem, managed through SCVMM on VMM01.
Administrative-laptop management over controlled remoting paths.
Published hybrid evidence for HVHOST01 and VMM01; one SQL Developer instance.
Additional documented components · placement varies
These documented components complement the four-guest Proxmox inventory above. They are not necessarily separate Proxmox guests, co-located on the same server, or simultaneously powered on.
Windows Server Hyper-V host with documented APP01 nested workload. HVHOST01 platform placement is not asserted here.
System Center Virtual Machine Manager management server; the recorded management role does not establish guest placement.
Identity synchronization environment from a documented Cloud Sync configuration; distinct from later DC01-based configurations.
Cross-platform client and administration lab; physical versus virtual placement is not established in this diagram.
Management interface documented on an administrative laptop; it is not a separate Proxmox VM claim.
Cloud identity, productivity administration and hybrid management; these are cloud services or integrations, not additional local virtual machines.
Hybrid identity snapshot
Dedicated Cloud Sync OU; AD remains authoritative for tested objects.
The retained project architecture names SYNC01 as the agent host.
Selected users, groups, attributes, and password hashes synchronized.
Personal nonproduction infrastructure
A Dell PowerEdge R710 lab supports hands-on Windows administration, virtualization, networking, Linux integration, and hybrid management. Retained snapshots establish what was observed.
Retained platform inventory: Proxmox VE 9.2.3
VM 100
vmbr0 + vmbr1
VM 200 · Windows Server
AD DS / DNS / DHCP
VM 300
Domain workstation
VM 400 · Ubuntu
SSSD / VLAN 30
Documented nested Hyper-V subsystem, managed through SCVMM on VMM01.
Administrative-laptop management over controlled remoting paths.
Published hybrid evidence for HVHOST01 and VMM01; one SQL Developer instance.
Additional documented components · placement varies
These documented components complement the four-guest Proxmox inventory above. They are not necessarily separate Proxmox guests, co-located on the same server, or simultaneously powered on.
Windows Server Hyper-V host with documented APP01 nested workload. HVHOST01 platform placement is not asserted here.
System Center Virtual Machine Manager management server; the recorded management role does not establish guest placement.
Identity synchronization environment from a documented Cloud Sync configuration; distinct from later DC01-based configurations.
Cross-platform client and administration lab; physical versus virtual placement is not established in this diagram.
Management interface documented on an administrative laptop; it is not a separate Proxmox VM claim.
Cloud identity, productivity administration and hybrid management; these are cloud services or integrations, not additional local virtual machines.
Core retained inventory
| System | Role | Retained allocation | Placement |
|---|---|---|---|
| pfSense / VM 100 | Routing & firewall | 2 vCPU · 4 GB RAM · 32 GB disk | vmbr0 + vmbr1 |
| DC01 / VM 200 | Windows Server 2022 · AD DS, DNS, DHCP | 2 vCPU · 4 GB RAM · 80 GB disk | vmbr1 |
| WS01 / VM 300 | Windows domain workstation | 2 vCPU · 4 GB RAM · 80 GB disk | vmbr1 |
| Linux01 / VM 400 | Ubuntu 26.04 · SSSD/Kerberos | 2 vCPU · 2 GB RAM · 40 GB disk | vmbr1 · VLAN 30 |
Administration & security
AD DS, DNS, DHCP, Group Policy, delegated LAPS retrieval, scoped remoting, Windows Admin Center, SCVMM, pfSense, and Azure Arc connect the documented administration tasks.
Explore architecture →Backup & recovery
Backup configuration and retained inventory are documented separately from restore validation. The isolated four-system cycle records narrow PASS results for Linux01 and pfSense, with WS01 and DC01 INCONCLUSIVE. A separate retained Linux01 restore drill is also documented.
No clustering, HA, RTO/RPO, recurring recovery assurance, or production DR readiness is claimed.
Inspect the records
A Microsoft-centered infrastructure lab with documented directory services, virtualization, networking, and bounded recovery tests.
Centralized Windows administration backed by connectivity, authentication, and remote-management validation.
A managed nested Hyper-V host, VMM logical networking, and validated APP01 lifecycle operations.
Two Arc-connected Windows Server lab machines, agent validation, and one SQL Server Developer instance.
A scoped virtual-disk change with checkpoint handling, guest storage inspection, and final NTFS validation.
A repeatable support method across Windows, Linux, macOS, identity, and infrastructure.
Evidence library
1,268 public artifact references indexed from the repository tree and retained catalogs. Each source link points to a file present in the inspected commit. Catalog descriptions retain original scope and limitations.
Original screenshots
These explicitly public-sanitized Azure Arc images are retained unchanged from the inspected repository commit. Select an image to enlarge it; the original source remains linked.
PowerShell source / read-only remote queries
Inspect documented Azure Arc connected-machine and Windows service state.
A suitable PowerShell environment, the modules/cmdlets named in the source, and authorized access to the target lab systems.
Authorized access to the target systems and documented read/delegation rights. Review the source before execution.
Console validation output and selected configuration metadata; see source for exact fields.
Review against your environment before execution. Reports may contain personal or tenant identifiers. Do not publish live exports. This page does not run commands.
[CmdletBinding()]\nparam(\n [string[]]$ComputerName = @(\n 'HVHOST01.ad.jeremyfontenot.online',\n 'VMM01.ad.jeremyfontenot.online'\n )\n)\n\n$ErrorActionPreference = 'Stop'\n\nforeach ($computer in $ComputerName) {\n Write-Output "=== $computer ==="\n\n try {\n Test-WSMan -ComputerName $computer -ErrorAction Stop | Out-Null\n Write-Output 'WinRM: reachable'\n\n Invoke-Command -ComputerName $computer -ScriptBlock {\n $agentPath = "$env:ProgramW6432\\AzureConnectedMachineAgent\\azcmagent.exe"\n if (Test-Path -LiteralPath $agentPath) {\n $agent = & $agentPath show --json | ConvertFrom-Json\n [pscustomobject]@{\n ComputerName = $env:COMPUTERNAME\n ResourceName = $agent.resourceName\n ResourceGroup = $agent.resourceGroup\n Location = $agent.location\n AgentVersion = $agent.agentVersion\n AgentStatus = $agent.status\n LastHeartbeat = $agent.lastHeartbeat\n AgentAutoUpgrade = ($agent.agentAutoUpgradeTaskStatus -split ',')[0].Trim()\n }\n }\n\n Get-Service himds, ExtensionService, GCArcService, SqlServerExtension `\n -ErrorAction SilentlyContinue |\n Select-Object Name, Status, StartType\n\n Get-Service -Name 'MSSQL*', 'SQLAgent*' -ErrorAction SilentlyContinue |\n Select-Object Name, DisplayName, Status, StartType\n\n $instanceNames = Get-ItemProperty `\n 'HKLM:\\SOFTWARE\\Microsoft\\Microsoft SQL Server\\Instance Names\\SQL' `\n -ErrorAction SilentlyContinue\n\n if ($instanceNames.PSObject.Properties.Name -contains 'MSSQLSERVER') {\n $instanceId = $instanceNames.MSSQLSERVER\n Get-ItemProperty `\n "HKLM:\\SOFTWARE\\Microsoft\\Microsoft SQL Server\\$instanceId\\Setup" |\n Select-Object Edition, Version\n }\n\n Test-NetConnection gbl.his.arc.azure.com -Port 443 |\n Select-Object ComputerName, RemotePort, TcpTestSucceeded\n } | Select-Object * -ExcludeProperty PSComputerName, RunspaceId, PSShowComputerName\n }\n catch {\n Write-Output "Direct validation unavailable: $($_.Exception.Message)"\n }\n}\n\nPowerShell source / read-only remote queries
[string]$User = "cloudsync.test01",
A suitable PowerShell environment, the modules/cmdlets named in the source, and authorized access to the target lab systems.
Authorized access to the target systems and documented read/delegation rights. Review the source before execution.
Console validation output and selected configuration metadata; see source for exact fields.
Review against your environment before execution. Reports may contain personal or tenant identifiers. Do not publish live exports. This page does not run commands.
param(\n [string]$User = "cloudsync.test01",\n [string]$Group = "GG-CloudSync-Test",\n [string]$CloudSyncOU = "OU=Cloud Sync,OU=JFAD,DC=ad,DC=jeremyfontenot,DC=online"\n)\n\nWrite-Host "=== Cloud Sync AD Validation ==="\n\nWrite-Host "`n[User]"\nGet-ADUser -Identity $User `\n -Properties UserPrincipalName,Enabled,Department,PasswordLastSet,PasswordNeverExpires,ObjectGUID,DistinguishedName |\n Select-Object Name,SamAccountName,UserPrincipalName,Enabled,Department,PasswordLastSet,PasswordNeverExpires,ObjectGUID,DistinguishedName\n\nWrite-Host "`n[Group]"\nGet-ADGroup -Identity $Group `\n -Properties GroupScope,GroupCategory,DistinguishedName,ObjectGUID |\n Select-Object Name,SamAccountName,GroupScope,GroupCategory,ObjectGUID,DistinguishedName\n\nWrite-Host "`n[Group Members]"\nGet-ADGroupMember -Identity $Group |\n Select-Object Name,SamAccountName,ObjectClass\n\nWrite-Host "`n[Cloud Sync OU Contents]"\nGet-ADObject -SearchBase $CloudSyncOU -SearchScope OneLevel -Filter * |\n Select-Object Name,ObjectClass,DistinguishedName\nPowerShell source / read-only remote queries
Report activated directory roles and their members.
Microsoft.Graph.Authentication; delegated sign-in with required consent; appropriate tenant service availability.
Directory.Read.All, User.Read.All
Local CSV reports and console inventory. Tenant reads are read-only; creating report directories and files writes to the local filesystem.
Review against your environment before execution. Reports may contain personal or tenant identifiers. Do not publish live exports. This page does not run commands.
<#\n.SYNOPSIS\n Reports activated Microsoft Entra directory roles and their members.\n#>\n\n$ErrorActionPreference = "Stop"\n$ProjectRoot = Split-Path $PSScriptRoot -Parent\n$ReportsPath = Join-Path $ProjectRoot "reports"\nif (-not (Test-Path $ReportsPath)) { New-Item -ItemType Directory -Path $ReportsPath -Force | Out-Null }\n\nImport-Module Microsoft.Graph.Authentication -ErrorAction Stop\n$RequiredScopes = @("Directory.Read.All","User.Read.All")\n$Context = Get-MgContext\nif (-not $Context) {\n Connect-MgGraph -Scopes $RequiredScopes -UseDeviceCode -NoWelcome\n $Context = Get-MgContext\n}\nif (-not $Context) { throw "Microsoft Graph authentication could not be established." }\n\nfunction Get-GraphCollection {\n param([Parameter(Mandatory=$true)][string]$Uri)\n $Results=@(); $NextUri=$Uri\n while($NextUri){\n $Response=Invoke-MgGraphRequest -Method GET -Uri $NextUri\n if($Response["value"]){$Results+=@($Response["value"])}\n $NextUri=$Response["@odata.nextLink"]\n }\n return $Results\n}\n\n$Roles = @(Get-GraphCollection -Uri "https://graph.microsoft.com/v1.0/directoryRoles?`$select=id,displayName,description,roleTemplateId")\n$RoleInventory=@()\n$FailedRoleQueries=@()\n\nforeach($Role in $Roles){\n $RoleId=$Role["id"]\n try{\n # The directoryRoles/{id}/members endpoint was validated without $top.\n $Members=@(Get-GraphCollection -Uri "https://graph.microsoft.com/v1.0/directoryRoles/$RoleId/members")\n\n if($Members.Count -eq 0){\n $RoleInventory += [PSCustomObject]@{\n RoleDisplayName=$Role["displayName"]; RoleDescription=$Role["description"]\n RoleTemplateId=$Role["roleTemplateId"]; RoleId=$RoleId\n MemberDisplayName=""; MemberUPN=""; MemberMail=""; MemberType=""; MemberId=""\n }\n continue\n }\n\n foreach($Member in $Members){\n $RoleInventory += [PSCustomObject]@{\n RoleDisplayName=$Role["displayName"]; RoleDescription=$Role["description"]\n RoleTemplateId=$Role["roleTemplateId"]; RoleId=$RoleId\n MemberDisplayName=$Member["displayName"]; MemberUPN=$Member["userPrincipalName"]\n MemberMail=$Member["mail"]; MemberType=$Member["@odata.type"]; MemberId=$Member["id"]\n }\n }\n } catch {\n $FailedRoleQueries += [PSCustomObject]@{RoleDisplayName=$Role["displayName"];RoleId=$RoleId;Error=$_.Exception.Message}\n }\n}\n\nif($FailedRoleQueries.Count -gt 0){ throw "$($FailedRoleQueries.Count) role member query or queries failed." }\n\n$ReportPath=Join-Path $ReportsPath "Entra-Role-Inventory.csv"\n$RoleInventory | Sort-Object RoleDisplayName,MemberDisplayName | Export-Csv -Path $ReportPath -NoTypeInformation -Encoding UTF8\n\nWrite-Host "Activated Roles: $($Roles.Count)"\nWrite-Host "Roles With Members: $(@($RoleInventory | Where-Object MemberId -ne '' | Select-Object -ExpandProperty RoleId -Unique).Count)"\nWrite-Host "Roles Without Members: $(@($RoleInventory | Where-Object MemberId -eq '' | Select-Object -ExpandProperty RoleId -Unique).Count)"\nWrite-Host "Role Membership Rows: $(@($RoleInventory | Where-Object MemberId -ne '').Count)"\nWrite-Host "Report exported to: $ReportPath" -ForegroundColor Green\nPowerShell source / read-only remote queries
Identify potentially stale accounts from sign-in activity; this is review input, not automatic deletion.
Microsoft.Graph.Authentication; delegated sign-in with required consent; appropriate tenant service availability.
User.Read.All, AuditLog.Read.All
Local CSV reports and console inventory. Tenant reads are read-only; creating report directories and files writes to the local filesystem.
Review against your environment before execution. Reports may contain personal or tenant identifiers. Do not publish live exports. This page does not run commands.
<#\n.SYNOPSIS\n Reports potentially stale Microsoft Entra user accounts.\n#>\n\n$ErrorActionPreference = "Stop"\n$ProjectRoot = Split-Path $PSScriptRoot -Parent\n$ReportsPath = Join-Path $ProjectRoot "reports"\nif (-not (Test-Path $ReportsPath)) { New-Item -ItemType Directory -Path $ReportsPath -Force | Out-Null }\n\nImport-Module Microsoft.Graph.Authentication -ErrorAction Stop\n$RequiredScopes = @("User.Read.All","AuditLog.Read.All")\n\n$Context=Get-MgContext\n$ReconnectRequired=$false\nif(-not $Context){$ReconnectRequired=$true}\nelse{\n $CurrentScopes=@($Context.Scopes)\n $MissingScopes=@($RequiredScopes | Where-Object {$_ -notin $CurrentScopes})\n if($MissingScopes.Count -gt 0){$ReconnectRequired=$true}\n}\n\nif($ReconnectRequired){\n if($Context){ try{Disconnect-MgGraph | Out-Null}catch{} }\n Connect-MgGraph -Scopes $RequiredScopes -UseDeviceCode -NoWelcome\n $Context=Get-MgContext\n}\nif(-not $Context){throw "Microsoft Graph authentication could not be established."}\n\n$MissingScopes=@($RequiredScopes | Where-Object {$_ -notin @($Context.Scopes)})\nif($MissingScopes.Count -gt 0){throw "Required scopes are missing: $($MissingScopes -join ', ')"}\n\nfunction Get-GraphCollection {\n param([Parameter(Mandatory=$true)][string]$Uri)\n $Results=@();$NextUri=$Uri\n while($NextUri){\n $Response=Invoke-MgGraphRequest -Method GET -Uri $NextUri\n if($Response["value"]){$Results+=@($Response["value"])}\n $NextUri=$Response["@odata.nextLink"]\n }\n return $Results\n}\n\n$UserUri="https://graph.microsoft.com/v1.0/users?`$select=id,displayName,userPrincipalName,accountEnabled,userType,createdDateTime,onPremisesSyncEnabled,signInActivity&`$top=999"\n$Users=@(Get-GraphCollection -Uri $UserUri)\n\n$Now=Get-Date\n$StaleThresholdDays=90\n\n$AccountInventory=@(\n foreach($User in $Users){\n $CreatedDate=$null;$LastSignIn=$null;$DaysSinceLastSignIn=$null;$AccountAgeDays=$null\n\n if($User["createdDateTime"]){\n $CreatedDate=[datetime]$User["createdDateTime"]\n $AccountAgeDays=[int](New-TimeSpan -Start $CreatedDate -End $Now).TotalDays\n }\n\n if($User["signInActivity"] -and $User["signInActivity"]["lastSignInDateTime"]){\n $LastSignIn=[datetime]$User["signInActivity"]["lastSignInDateTime"]\n $DaysSinceLastSignIn=[int](New-TimeSpan -Start $LastSignIn -End $Now).TotalDays\n }\n\n $StaleReason=@()\n if($User["accountEnabled"] -eq $false){$StaleReason+="Account disabled"}\n if($null -ne $DaysSinceLastSignIn -and $DaysSinceLastSignIn -ge $StaleThresholdDays){\n $StaleReason+="No sign-in for $DaysSinceLastSignIn days"\n }\n if($null -eq $LastSignIn -and $null -ne $AccountAgeDays -and $AccountAgeDays -ge $StaleThresholdDays){\n $StaleReason+="No recorded sign-in and account older than $StaleThresholdDays days"\n }\n\n [PSCustomObject]@{\n DisplayName=$User["displayName"];UserPrincipalName=$User["userPrincipalName"]\n AccountEnabled=$User["accountEnabled"];UserType=$User["userType"]\n CreatedDateTime=$CreatedDate;AccountAgeDays=$AccountAgeDays\n LastSignInDateTime=$LastSignIn;DaysSinceLastSignIn=$DaysSinceLastSignIn\n OnPremisesSyncEnabled=$User["onPremisesSyncEnabled"]\n PotentiallyStale=($StaleReason.Count -gt 0);StaleReason=($StaleReason -join "; ")\n UserId=$User["id"]\n }\n }\n)\n\n$ReportPath=Join-Path $ReportsPath "Entra-Stale-Accounts.csv"\n$AccountInventory | Sort-Object DisplayName | Export-Csv -Path $ReportPath -NoTypeInformation -Encoding UTF8\n\nWrite-Host "Total Users: $($AccountInventory.Count)"\nWrite-Host "Potentially Stale: $(@($AccountInventory | Where-Object PotentiallyStale -eq $true).Count)"\nWrite-Host "Disabled Accounts: $(@($AccountInventory | Where-Object AccountEnabled -eq $false).Count)"\nWrite-Host "No Recorded Sign-In: $(@($AccountInventory | Where-Object {$null -eq $_.LastSignInDateTime}).Count)"\nWrite-Host "Stale Threshold (Days): $StaleThresholdDays"\nWrite-Host "Report exported to: $ReportPath" -ForegroundColor Green\nPowerShell source / read-only remote queries
Inventory Intune-managed devices and management attributes.
Microsoft.Graph.Authentication; delegated sign-in with required consent; appropriate tenant service availability.
DeviceManagementManagedDevices.Read.All
Local CSV reports and console inventory. Tenant reads are read-only; creating report directories and files writes to the local filesystem.
Review against your environment before execution. Reports may contain personal or tenant identifiers. Do not publish live exports. This page does not run commands.
<#\n.SYNOPSIS\n Reports Microsoft Intune managed devices using Microsoft Graph.\n#>\n\n$ErrorActionPreference = "Stop"\n$ProjectRoot=Split-Path $PSScriptRoot -Parent\n$ReportsPath=Join-Path $ProjectRoot "reports"\nif(-not(Test-Path $ReportsPath)){New-Item -ItemType Directory -Path $ReportsPath -Force|Out-Null}\n\nImport-Module Microsoft.Graph.Authentication -ErrorAction Stop\n$RequiredScopes=@("DeviceManagementManagedDevices.Read.All")\n\n$Context=Get-MgContext\n$ReconnectRequired=$false\nif(-not $Context){$ReconnectRequired=$true}\nelse{\n $MissingScopes=@($RequiredScopes | Where-Object {$_ -notin @($Context.Scopes)})\n if($MissingScopes.Count -gt 0){$ReconnectRequired=$true}\n}\n\nif($ReconnectRequired){\n if($Context){try{Disconnect-MgGraph|Out-Null}catch{}}\n Connect-MgGraph -Scopes $RequiredScopes -UseDeviceCode -NoWelcome\n $Context=Get-MgContext\n}\nif(-not $Context){throw "Microsoft Graph authentication could not be established."}\n\n$MissingScopes=@($RequiredScopes | Where-Object {$_ -notin @($Context.Scopes)})\nif($MissingScopes.Count -gt 0){throw "Required scopes are still missing: $($MissingScopes -join ', ')"}\n\nfunction Get-GraphCollection {\n param([Parameter(Mandatory=$true)][string]$Uri)\n $Results=@();$NextUri=$Uri\n while($NextUri){\n $Response=Invoke-MgGraphRequest -Method GET -Uri $NextUri\n if($Response["value"]){$Results+=@($Response["value"])}\n $NextUri=$Response["@odata.nextLink"]\n }\n return $Results\n}\n\n$GraphDevices=@(Get-GraphCollection -Uri "https://graph.microsoft.com/v1.0/deviceManagement/managedDevices?`$top=999")\n\n$Devices=@(\n foreach($Device in $GraphDevices){\n [PSCustomObject]@{\n DeviceName=$Device["deviceName"];ManagedDeviceId=$Device["id"];AzureAdDeviceId=$Device["azureADDeviceId"]\n UserPrincipalName=$Device["userPrincipalName"];OperatingSystem=$Device["operatingSystem"]\n OSVersion=$Device["osVersion"];Manufacturer=$Device["manufacturer"];Model=$Device["model"]\n SerialNumber=$Device["serialNumber"];ComplianceState=$Device["complianceState"]\n ManagementAgent=$Device["managementAgent"];EnrollmentType=$Device["deviceEnrollmentType"]\n LastSyncDateTime=$Device["lastSyncDateTime"];EnrolledDateTime=$Device["enrolledDateTime"]\n IsEncrypted=$Device["isEncrypted"];DeviceRegistrationState=$Device["deviceRegistrationState"]\n ManagedDeviceOwnerType=$Device["managedDeviceOwnerType"]\n }\n }\n)\n\n$ReportPath=Join-Path $ReportsPath "Intune-Managed-Device-Inventory.csv"\n$Devices|Sort-Object DeviceName|Export-Csv -Path $ReportPath -NoTypeInformation -Encoding UTF8\n\nWrite-Host "Total Managed Devices: $($Devices.Count)"\nWrite-Host "Compliant: $(@($Devices|Where-Object ComplianceState -eq 'compliant').Count)"\nWrite-Host "Noncompliant: $(@($Devices|Where-Object ComplianceState -eq 'noncompliant').Count)"\nWrite-Host "Encrypted: $(@($Devices|Where-Object IsEncrypted -eq $true).Count)"\nWrite-Host "Report exported to: $ReportPath" -ForegroundColor Green\nPowerShell source / read-only remote queries
Report groups and direct group membership.
Microsoft.Graph.Authentication; delegated sign-in with required consent; appropriate tenant service availability.
Group.Read.All, User.Read.All, Directory.Read.All
Local CSV reports and console inventory. Tenant reads are read-only; creating report directories and files writes to the local filesystem.
Review against your environment before execution. Reports may contain personal or tenant identifiers. Do not publish live exports. This page does not run commands.
<#\n.SYNOPSIS\n Collects Microsoft 365 and Entra group membership information.\n#>\n\n$ErrorActionPreference = "Stop"\n$ProjectRoot = Split-Path $PSScriptRoot -Parent\n$ReportsPath = Join-Path $ProjectRoot "reports"\nif (-not (Test-Path $ReportsPath)) { New-Item -ItemType Directory -Path $ReportsPath -Force | Out-Null }\n\nImport-Module Microsoft.Graph.Authentication -ErrorAction Stop\n\n$RequiredScopes = @("Group.Read.All","User.Read.All","Directory.Read.All")\n$Context = Get-MgContext\nif (-not $Context) {\n Connect-MgGraph -Scopes $RequiredScopes -UseDeviceCode -NoWelcome\n $Context = Get-MgContext\n}\nif (-not $Context) { throw "Microsoft Graph authentication could not be established." }\n\nfunction Get-GraphCollection {\n param([Parameter(Mandatory=$true)][string]$Uri)\n $Results = @(); $NextUri = $Uri\n while ($NextUri) {\n $Response = Invoke-MgGraphRequest -Method GET -Uri $NextUri\n if ($Response["value"]) { $Results += @($Response["value"]) }\n $NextUri = $Response["@odata.nextLink"]\n }\n return $Results\n}\n\n$Groups = @(Get-GraphCollection -Uri "https://graph.microsoft.com/v1.0/groups?`$select=id,displayName,mail,mailEnabled,securityEnabled,groupTypes&`$top=999")\n$MembershipReport = @()\n\nforeach ($Group in $Groups) {\n $GroupId = $Group["id"]\n $Members = @(Get-GraphCollection -Uri "https://graph.microsoft.com/v1.0/groups/$GroupId/members?`$select=id,displayName,userPrincipalName,mail&`$top=999")\n\n if ($Members.Count -eq 0) {\n $MembershipReport += [PSCustomObject]@{\n GroupDisplayName=$Group["displayName"]; GroupId=$GroupId; GroupMail=$Group["mail"]\n MailEnabled=$Group["mailEnabled"]; SecurityEnabled=$Group["securityEnabled"]\n GroupTypes=(@($Group["groupTypes"]) -join "; "); MemberDisplayName=""; MemberUPN=""\n MemberMail=""; MemberId=""; MemberType=""\n }\n continue\n }\n\n foreach ($Member in $Members) {\n $MembershipReport += [PSCustomObject]@{\n GroupDisplayName=$Group["displayName"]; GroupId=$GroupId; GroupMail=$Group["mail"]\n MailEnabled=$Group["mailEnabled"]; SecurityEnabled=$Group["securityEnabled"]\n GroupTypes=(@($Group["groupTypes"]) -join "; "); MemberDisplayName=$Member["displayName"]\n MemberUPN=$Member["userPrincipalName"]; MemberMail=$Member["mail"]; MemberId=$Member["id"]\n MemberType=$Member["@odata.type"]\n }\n }\n}\n\n$ReportPath = Join-Path $ReportsPath "M365-Group-Membership.csv"\n$MembershipReport | Sort-Object GroupDisplayName,MemberDisplayName | Export-Csv -Path $ReportPath -NoTypeInformation -Encoding UTF8\n\nWrite-Host "Total Groups: $($Groups.Count)"\nWrite-Host "Groups With Members: $(@($MembershipReport | Where-Object MemberId -ne '' | Select-Object -ExpandProperty GroupId -Unique).Count)"\nWrite-Host "Groups Without Members: $(@($MembershipReport | Where-Object MemberId -eq '' | Select-Object -ExpandProperty GroupId -Unique).Count)"\nWrite-Host "Membership Rows: $(@($MembershipReport | Where-Object MemberId -ne '').Count)"\nWrite-Host "Report exported to: $ReportPath" -ForegroundColor Green\nPowerShell source / read-only remote queries
Report license capacity and user assignment.
Microsoft.Graph.Authentication; delegated sign-in with required consent; appropriate tenant service availability.
User.Read.All, Organization.Read.All
Local CSV reports and console inventory. Tenant reads are read-only; creating report directories and files writes to the local filesystem.
Review against your environment before execution. Reports may contain personal or tenant identifiers. Do not publish live exports. This page does not run commands.
<#\n.SYNOPSIS\n Reports Microsoft 365 license capacity and user license assignments.\n#>\n\n$ErrorActionPreference = "Stop"\n$ProjectRoot = Split-Path $PSScriptRoot -Parent\n$ReportsPath = Join-Path $ProjectRoot "reports"\nif (-not (Test-Path $ReportsPath)) { New-Item -ItemType Directory -Path $ReportsPath -Force | Out-Null }\n\nImport-Module Microsoft.Graph.Authentication -ErrorAction Stop\n\n$RequiredScopes = @("User.Read.All","Organization.Read.All")\n$Context = Get-MgContext\nif (-not $Context) {\n Connect-MgGraph -Scopes $RequiredScopes -UseDeviceCode -NoWelcome\n $Context = Get-MgContext\n}\nif (-not $Context) { throw "Microsoft Graph authentication could not be established." }\n\nfunction Get-GraphCollection {\n param([Parameter(Mandatory=$true)][string]$Uri)\n $Results=@(); $NextUri=$Uri\n while($NextUri){\n $Response=Invoke-MgGraphRequest -Method GET -Uri $NextUri\n if($Response["value"]){$Results+=@($Response["value"])}\n $NextUri=$Response["@odata.nextLink"]\n }\n return $Results\n}\n\n$SkuResponse = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/subscribedSkus"\n$Skus = @($SkuResponse["value"])\n$SkuLookup = @{}\n\n$LicenseCapacity = @(\n foreach($Sku in $Skus){\n $SkuId=$Sku["skuId"].ToString()\n $SkuLookup[$SkuId]=$Sku["skuPartNumber"]\n [PSCustomObject]@{\n SkuPartNumber=$Sku["skuPartNumber"]; SkuId=$SkuId\n Enabled=[int]$Sku["prepaidUnits"]["enabled"]; Consumed=[int]$Sku["consumedUnits"]\n Available=([int]$Sku["prepaidUnits"]["enabled"]-[int]$Sku["consumedUnits"])\n }\n }\n)\n\n$Users = @(Get-GraphCollection -Uri "https://graph.microsoft.com/v1.0/users?`$select=id,displayName,userPrincipalName,accountEnabled,userType,onPremisesSyncEnabled,assignedLicenses&`$top=999")\n\n$LicenseAssignments = @()\nforeach($User in $Users){\n $AssignedLicenses=@($User["assignedLicenses"])\n if($AssignedLicenses.Count -eq 0){\n $LicenseAssignments += [PSCustomObject]@{\n DisplayName=$User["displayName"]; UserPrincipalName=$User["userPrincipalName"]\n AccountEnabled=$User["accountEnabled"]; UserType=$User["userType"]\n OnPremisesSyncEnabled=$User["onPremisesSyncEnabled"]; Licensed=$false\n SkuPartNumber=""; SkuId=""; UserId=$User["id"]\n }\n continue\n }\n foreach($AssignedLicense in $AssignedLicenses){\n $SkuId=$AssignedLicense["skuId"].ToString()\n $LicenseAssignments += [PSCustomObject]@{\n DisplayName=$User["displayName"]; UserPrincipalName=$User["userPrincipalName"]\n AccountEnabled=$User["accountEnabled"]; UserType=$User["userType"]\n OnPremisesSyncEnabled=$User["onPremisesSyncEnabled"]; Licensed=$true\n SkuPartNumber=$(if($SkuLookup.ContainsKey($SkuId)){$SkuLookup[$SkuId]}else{"Unknown"})\n SkuId=$SkuId; UserId=$User["id"]\n }\n }\n}\n\n$LicenseCapacity | Export-Csv (Join-Path $ReportsPath "M365-License-Capacity.csv") -NoTypeInformation -Encoding UTF8\n$LicenseAssignments | Sort-Object DisplayName,SkuPartNumber | Export-Csv (Join-Path $ReportsPath "M365-License-Assignments.csv") -NoTypeInformation -Encoding UTF8\n\nWrite-Host "Subscribed SKUs: $($LicenseCapacity.Count)"\nWrite-Host "Total Users: $($Users.Count)"\nWrite-Host "Licensed Users: $(@($Users | Where-Object { @($_["assignedLicenses"]).Count -gt 0 }).Count)"\nWrite-Host "Unlicensed Users: $(@($Users | Where-Object { @($_["assignedLicenses"]).Count -eq 0 }).Count)"\nPowerShell source / read-only remote queries
Inventory the organization, verified domains, users, groups, SKUs, roles, and Entra devices.
Microsoft.Graph.Authentication; delegated sign-in with required consent; appropriate tenant service availability.
Organization.Read.All, User.Read.All, Group.Read.All, Directory.Read.All
Local CSV reports and console inventory. Tenant reads are read-only; creating report directories and files writes to the local filesystem.
Review against your environment before execution. Reports may contain personal or tenant identifiers. Do not publish live exports. This page does not run commands.
<#\n.SYNOPSIS\n Collects a read-only Microsoft 365 tenant inventory using Microsoft Graph.\n#>\n\n$ErrorActionPreference = "Stop"\n\n$ProjectRoot = Split-Path $PSScriptRoot -Parent\n$ReportsPath = Join-Path $ProjectRoot "reports"\nif (-not (Test-Path $ReportsPath)) {\n New-Item -ItemType Directory -Path $ReportsPath -Force | Out-Null\n}\n\nImport-Module Microsoft.Graph.Authentication -ErrorAction Stop\n\n$RequiredScopes = @(\n "Organization.Read.All"\n "User.Read.All"\n "Group.Read.All"\n "Directory.Read.All"\n)\n\n$Context = Get-MgContext\nif (-not $Context) {\n Connect-MgGraph -Scopes $RequiredScopes -UseDeviceCode -NoWelcome\n $Context = Get-MgContext\n}\nif (-not $Context) { throw "Microsoft Graph authentication could not be established." }\n\n$OrgResponse = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/organization"\n$Org = $OrgResponse["value"][0]\n\n$OrganizationSummary = [PSCustomObject]@{\n DisplayName = $Org["displayName"]\n TenantId = $Org["id"]\n TenantType = $Org["tenantType"]\n CountryCode = $Org["countryLetterCode"]\n OnPremisesSyncEnabled = $Org["onPremisesSyncEnabled"]\n OnPremisesLastSync = $Org["onPremisesLastSyncDateTime"]\n}\n\n$VerifiedDomains = @(\n $Org["verifiedDomains"] | ForEach-Object {\n [PSCustomObject]@{\n Name = $_["name"]\n IsDefault = $_["isDefault"]\n IsInitial = $_["isInitial"]\n }\n }\n)\n\n$UserResponse = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/users?`$select=displayName,userPrincipalName,accountEnabled,userType,onPremisesSyncEnabled&`$top=999"\n$Users = @($UserResponse["value"])\n\n$GroupResponse = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/groups?`$select=displayName,mailEnabled,securityEnabled,groupTypes&`$top=999"\n$Groups = @($GroupResponse["value"])\n\n$SkuResponse = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/subscribedSkus"\n$SubscribedSkus = @($SkuResponse["value"])\n\n$RoleResponse = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/directoryRoles?`$select=id,displayName"\n$DirectoryRoles = @($RoleResponse["value"])\n\n$DeviceResponse = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/devices?`$select=id,displayName,operatingSystem,operatingSystemVersion,accountEnabled,trustType,approximateLastSignInDateTime&`$top=999"\n$Devices = @($DeviceResponse["value"])\n\n$TenantSummary = [PSCustomObject]@{\n GeneratedDate = Get-Date\n TenantDisplayName = $OrganizationSummary.DisplayName\n TenantId = $OrganizationSummary.TenantId\n TenantType = $OrganizationSummary.TenantType\n CountryCode = $OrganizationSummary.CountryCode\n OnPremisesSync = $OrganizationSummary.OnPremisesSyncEnabled\n VerifiedDomains = $VerifiedDomains.Count\n Users = $Users.Count\n Groups = $Groups.Count\n SubscribedSkus = $SubscribedSkus.Count\n DirectoryRoles = $DirectoryRoles.Count\n EntraDevices = $Devices.Count\n}\n\n$ReportPath = Join-Path $ReportsPath "M365-Tenant-Summary.csv"\n$TenantSummary | Export-Csv -Path $ReportPath -NoTypeInformation -Encoding UTF8\n\n$TenantSummary | Format-List\nWrite-Host "Report exported successfully: $ReportPath" -ForegroundColor Green\nPowerShell source / read-only remote queries
Report Entra/Microsoft 365 users and their licensing attributes.
Microsoft.Graph.Authentication; delegated sign-in with required consent; appropriate tenant service availability.
User.Read.All, Organization.Read.All
Local CSV reports and console inventory. Tenant reads are read-only; creating report directories and files writes to the local filesystem.
Review against your environment before execution. Reports may contain personal or tenant identifiers. Do not publish live exports. This page does not run commands.
<#\n.SYNOPSIS\n Collects a detailed Microsoft 365 / Entra user inventory.\n#>\n\n$ErrorActionPreference = "Stop"\n$ProjectRoot = Split-Path $PSScriptRoot -Parent\n$ReportsPath = Join-Path $ProjectRoot "reports"\nif (-not (Test-Path $ReportsPath)) { New-Item -ItemType Directory -Path $ReportsPath -Force | Out-Null }\n\nImport-Module Microsoft.Graph.Authentication -ErrorAction Stop\n\n$RequiredScopes = @("User.Read.All","Organization.Read.All")\n$Context = Get-MgContext\nif (-not $Context) {\n Connect-MgGraph -Scopes $RequiredScopes -UseDeviceCode -NoWelcome\n $Context = Get-MgContext\n}\nif (-not $Context) { throw "Microsoft Graph authentication could not be established." }\n\nfunction Get-GraphCollection {\n param([Parameter(Mandatory=$true)][string]$Uri)\n $Results = @()\n $NextUri = $Uri\n while ($NextUri) {\n $Response = Invoke-MgGraphRequest -Method GET -Uri $NextUri\n if ($Response["value"]) { $Results += @($Response["value"]) }\n $NextUri = $Response["@odata.nextLink"]\n }\n return $Results\n}\n\n$SkuResponse = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/subscribedSkus"\n$SkuLookup = @{}\nforeach ($Sku in @($SkuResponse["value"])) {\n $SkuLookup[$Sku["skuId"].ToString()] = $Sku["skuPartNumber"]\n}\n\n$UserUri = "https://graph.microsoft.com/v1.0/users?`$select=id,displayName,userPrincipalName,mail,accountEnabled,userType,createdDateTime,onPremisesSyncEnabled,usageLocation,assignedLicenses&`$top=999"\n$GraphUsers = @(Get-GraphCollection -Uri $UserUri)\n\n$Users = @(\n $GraphUsers | ForEach-Object {\n $AssignedSkuNames = @()\n foreach ($AssignedLicense in @($_["assignedLicenses"])) {\n $SkuId = $AssignedLicense["skuId"].ToString()\n if ($SkuLookup.ContainsKey($SkuId)) { $AssignedSkuNames += $SkuLookup[$SkuId] }\n else { $AssignedSkuNames += $SkuId }\n }\n\n [PSCustomObject]@{\n DisplayName = $_["displayName"]\n UserPrincipalName = $_["userPrincipalName"]\n Mail = $_["mail"]\n AccountEnabled = $_["accountEnabled"]\n UserType = $_["userType"]\n CreatedDateTime = $_["createdDateTime"]\n OnPremisesSyncEnabled = $_["onPremisesSyncEnabled"]\n UsageLocation = $_["usageLocation"]\n LicenseCount = @($_["assignedLicenses"]).Count\n AssignedLicenses = ($AssignedSkuNames -join "; ")\n UserId = $_["id"]\n }\n }\n)\n\n$ReportPath = Join-Path $ReportsPath "M365-User-Inventory.csv"\n$Users | Sort-Object DisplayName | Export-Csv -Path $ReportPath -NoTypeInformation -Encoding UTF8\n\nWrite-Host "Total Users: $($Users.Count)"\nWrite-Host "Enabled Users: $(@($Users | Where-Object AccountEnabled -eq $true).Count)"\nWrite-Host "Disabled Users: $(@($Users | Where-Object AccountEnabled -eq $false).Count)"\nWrite-Host "Synced Users: $(@($Users | Where-Object OnPremisesSyncEnabled -eq $true).Count)"\nWrite-Host "Licensed Users: $(@($Users | Where-Object LicenseCount -gt 0).Count)"\nWrite-Host "Unlicensed Users: $(@($Users | Where-Object LicenseCount -eq 0).Count)"\nWrite-Host "Report exported to: $ReportPath" -ForegroundColor Green\nPowerShell source / read-only remote queries
Inspect AD LAPS attributes, safe password metadata, and delegated OU rights without displaying the managed password.
A suitable PowerShell environment, the modules/cmdlets named in the source, and authorized access to the target lab systems.
Authorized access to the target systems and documented read/delegation rights. Review the source before execution.
Console validation output and selected configuration metadata; see source for exact fields.
Review against your environment before execution. Reports may contain personal or tenant identifiers. Do not publish live exports. This page does not run commands.
# Portfolio-safe Windows LAPS validation script\n# Does not display the managed password.\n\nparam(\n [string]$ComputerName = "WS01"\n)\n\nWrite-Host "=== Windows LAPS Validation: $ComputerName ==="\n\nWrite-Host "`n[1] AD computer and LAPS attribute presence"\nGet-ADComputer $ComputerName `\n -Properties msLAPS-PasswordExpirationTime,msLAPS-EncryptedPassword |\nSelect-Object Name,\n msLAPS-PasswordExpirationTime,\n @{N='EncryptedPasswordPresent';E={[bool]$_.'msLAPS-EncryptedPassword'}}\n\nWrite-Host "`n[2] LAPS password metadata"\nGet-LapsADPassword -Identity $ComputerName |\nSelect-Object ComputerName,\n Account,\n PasswordUpdateTime,\n ExpirationTimestamp,\n Source,\n DecryptionStatus,\n AuthorizedDecryptor\n\nWrite-Host "`n[3] LAPS OU extended rights"\nFind-LapsADExtendedRights `\n -Identity "OU=LAPS-Test,OU=Workstations,OU=JFAD,DC=ad,DC=jeremyfontenot,DC=online"\nAutomation & administration
Existing repository scripts are presented with their purpose, permissions, requirements, safety considerations, and original source. The seven Graph scripts demonstrate read-only delegated reporting.
Read-only remote queries
evidence-library/projects/on-prem-home-lab/azure-arc-hybrid-management/evidence/azure-arc-validation.ps1
Review script and requirements ↗Read-only remote queries
projects/entra-cloud-sync/scripts/Test-CloudSyncADState.ps1
Review script and requirements ↗Read-only remote queries
projects/m365-graph-administration-lab/scripts/Get-EntraRoleInventory.ps1
Review script and requirements ↗Read-only remote queries
projects/m365-graph-administration-lab/scripts/Get-EntraStaleAccounts.ps1
Review script and requirements ↗Read-only remote queries
projects/m365-graph-administration-lab/scripts/Get-IntuneManagedDeviceInventory.ps1
Review script and requirements ↗Read-only remote queries
projects/m365-graph-administration-lab/scripts/Get-M365GroupMembership.ps1
Review script and requirements ↗Read-only remote queries
projects/m365-graph-administration-lab/scripts/Get-M365LicenseAssignment.ps1
Review script and requirements ↗Read-only remote queries
projects/m365-graph-administration-lab/scripts/Get-M365TenantInventory.ps1
Review script and requirements ↗Read-only remote queries
projects/m365-graph-administration-lab/scripts/Get-M365UserInventory.ps1
Review script and requirements ↗Read-only remote queries
projects/windows-laps-gpo/scripts/Validate-WindowsLAPS.ps1
Review script and requirements ↗Troubleshooting case study
RSOP failed with RPC error 0x800706BA because WS01 WMI firewall rules were disabled. Enabling the required Domain-profile rules restored WMI and Group Policy Results. Event 10067 also led to targeting the existing LocalAdmin account instead of the disabled built-in Administrator.
Personal AD lab: DC01 and the WS01 endpoint in a dedicated LAPS-Test OU; an enabled LocalAdmin account and a delegated reader group.
RSOP failed with RPC error 0x800706BA because WS01 WMI firewall rules were disabled. Enabling the required Domain-profile rules restored WMI and Group Policy Results. Event 10067 also led to targeting the existing LocalAdmin account instead of the disabled built-in Administrator.
Encrypted attribute presence, delegated retrieval, unauthorized-access denial, effective policy, and forced-rotation events support the completed Windows LAPS scope.
Personal Active Directory lab. Evidence supports modern Windows LAPS schema extension, OU scoping, GPO configuration, encrypted AD password storage, least-privilege retrieval, negative access testing, RSOP/event validation, and forced rotation. Actual passwords are excluded.
The evidence supports the specific scenario. Unestablished root causes are not presented as confirmed.
Troubleshooting case study
Sign-in error 53003 traced to an external-identity security-information policy scoped to all users. Restricting scope to guest/external users restored the internal test sign-in while MFA remained effective. A Graph licensing-metadata discrepancy remains documented.
Personal Microsoft 365 E5 Developer tenant with Exchange Online, Defender, Conditional Access, and test identities.
Sign-in error 53003 traced to an external-identity security-information policy scoped to all users. Restricting scope to guest/external users restored the internal test sign-in while MFA remained effective. A Graph licensing-metadata discrepancy remains documented.
Delivery traces, Defender Explorer, audit logs, successful MFA sign-in evaluation, and effective E5 licensing support the completed lab scope.
Personal Microsoft 365 Developer tenant. The evidence README is synchronized with the current COMPLETE project status. Group-license UI evidence and Graph metadata were not fully reconciled; the discrepancy remains part of the claim boundary and is not represented as resolved.
The evidence supports the specific scenario. Unestablished root causes are not presented as confirmed.
Troubleshooting case study
A directory-role membership request returned 400 because it used an unsupported $top parameter. A signInActivity query returned 403 until the missing AuditLog.Read.All delegated scope was addressed.
Microsoft 365 E5 Developer tenant; Microsoft.Graph.Authentication, delegated Device Code authentication, Graph v1.0 GET requests, and local CSV reports.
A directory-role membership request returned 400 because it used an unsupported $top parameter. A signInActivity query returned 403 until the missing AuditLog.Read.All delegated scope was addressed.
Seven read-only scripts and CSV reporting are documented as validated. Live exports are deliberately excluded from the public repository.
Read-only delegated administration/reporting is currently proven. Live CSV exports are intentionally not public because they may contain UPNs, object IDs, device identifiers, and tenant-specific data. Do not imply write automation or broader Graph coverage that has not been validated.
The evidence supports the specific scenario. Unestablished root causes are not presented as confirmed.
Troubleshooting case study
Group membership did not make a Procurement user selectable. The Task assigned_to reference qualifier required the itil role. Granting that lab role resolved the invalid reference while retaining the qualifier.
Personal ServiceNow Developer Instance with separate Procurement and Field Services lab identities and role-qualified task assignment.
Group membership did not make a Procurement user selectable. The Task assigned_to reference qualifier required the itil role. Granting that lab role resolved the invalid reference while retaining the qualifier.
Closing the Field Services task automatically completed the RITM and parent REQ. Procurement, delivery, installation, and handoff remained simulations.
Personal ServiceNow PDI. Physical laptop procurement, vendor delivery, software installation, and user handoff were simulated. The project demonstrates ServiceNow workflow understanding and hands-on lab administration, not employer production ownership.
The evidence supports the specific scenario. Unestablished root causes are not presented as confirmed.
Troubleshooting case study
The original physical-device validation includes Secure Boot remediation followed by Confirm-SecureBootUEFI returning True and an Intune Compliant state. Later endpoint reuse does not invalidate that retained result.
Personal physical Windows device, Microsoft 365 developer tenant, assigned Autopilot profile, pilot groups, and Intune policy.
The original physical-device validation includes Secure Boot remediation followed by Confirm-SecureBootUEFI returning True and an Intune Compliant state. Later endpoint reuse does not invalidate that retained result.
Entra join, MDM enrollment, ESP, required apps, BitLocker, Defender, firewall, VBS, Secure Boot, standard-user posture, and compliance were validated.
Live physical-device personal-lab validation. Secrets and unique hardware/directory identifiers are excluded or redacted. Later reconfiguration of the endpoint does not invalidate the documented completed Autopilot project.
The evidence supports the specific scenario. Unestablished root causes are not presented as confirmed.
Troubleshooting case study
Provisioning logs, source-anchor correlation, OU scope, and agent traces were inspected before resets. The retained implementation distinguishes the 20-minute user/group interval from the separate Password Hash Sync process.
Retained project architecture: DC01 supplies AD DS; SYNC01 hosts the provisioning agent. The tested dedicated OU limits synchronization to selected users and groups.
Provisioning logs, source-anchor correlation, OU scope, and agent traces were inspected before resets. The retained implementation distinguishes the 20-minute user/group interval from the separate Password Hash Sync process.
User and group synchronization, Password Hash Sync, source authority, provisioning logs, and agent health are documented as validated.
Personal hybrid-identity lab. On-premises AD remains the source of authority for the tested synchronized objects. Scope is intentionally limited to the documented Cloud Sync OU.
The evidence supports the specific scenario. Unestablished root causes are not presented as confirmed.
Troubleshooting case study
Direct tests separated WinRM reachability, authentication overhead, and actual host resources when the WAC experience felt slow. The source does not establish a broader server-performance root cause.
Administrative laptop running Windows Admin Center, connecting to Windows servers and endpoints through controlled management paths.
Direct tests separated WinRM reachability, authentication overhead, and actual host resources when the WAC experience felt slow. The source does not establish a broader server-performance root cause.
Windows management and connectivity/remoting validation are documented. The registry does not identify a fully separate WAC evidence directory.
Personal lab management. Does not imply production WAC administration or enterprise-scale fleet management.
The evidence supports the specific scenario. Unestablished root causes are not presented as confirmed.
Troubleshooting case study
The evidence preserves a direct-remoting limitation for VMM01. Portal and agent observations are reported within their actual scope; local service state is not inferred where it was not read.
HVHOST01 and VMM01 in a personal hybrid Windows lab; the published evidence also covers one SQL Server 2022 Developer instance.
The evidence preserves a direct-remoting limitation for VMM01. Portal and agent observations are reported within their actual scope; local service state is not inferred where it was not read.
Two connected Windows lab servers and one SQL Developer instance are supported by sanitized retained records, with remoting and administrative boundaries intact.
Supports two Arc-connected Windows Server lab machines and one SQL Server 2022 Developer instance. Does not prove production Azure administration, broad RBAC ownership, HA/DR, SLA performance, or enablement of Azure services not explicitly shown.
The evidence supports the specific scenario. Unestablished root causes are not presented as confirmed.
Troubleshooting case study
The documented workflow accounts for checkpoints and the active VHDX before modifying storage. Final host and guest observations are retained as separate evidence.
APP01 on nested Hyper-V, with host-side virtual disk state and guest-side partition/filesystem validation.
The documented workflow accounts for checkpoints and the active VHDX before modifying storage. Final host and guest observations are retained as separate evidence.
Before/after host and guest evidence supports the scoped virtual-disk and NTFS storage administration work.
Personal nested Hyper-V lab storage administration. Claims are limited to the documented VM/disk/guest changes and validation.
The evidence supports the specific scenario. Unestablished root causes are not presented as confirmed.
Troubleshooting case study
Linux01 domain integration and SSSD remediation are documented separately from macOS AD binding and reachability. A test passing on one platform is not generalized to the entire environment.
Windows Server and Windows endpoints, Linux01 using SSSD/Kerberos, and a separate macOS lab VM. Individual claims follow the underlying records.
Linux01 domain integration and SSSD remediation are documented separately from macOS AD binding and reachability. A test passing on one platform is not generalized to the entire environment.
Windows, Linux, and macOS administration evidence supports a cross-platform method with platform-specific limitations.
Supporting portfolio project, not a claim of enterprise fleet ownership. Individual platform claims remain bounded by their underlying evidence.
The evidence supports the specific scenario. Unestablished root causes are not presented as confirmed.
Troubleshooting
Review the actual diagnostic reasoning, scoped corrections, retained outcomes, and unresolved limits.
Identity & security
RSOP failed with RPC error 0x800706BA because WS01 WMI firewall rules were disabled. Enabling the required Domain-profile rules restored WMI and Group Policy Results. Event 10067 also led to targeting the existing LocalAdmin account instead of the disabled built-in Administrator.
Read diagnostic record ↗Cloud administration
Sign-in error 53003 traced to an external-identity security-information policy scoped to all users. Restricting scope to guest/external users restored the internal test sign-in while MFA remained effective. A Graph licensing-metadata discrepancy remains documented.
Read diagnostic record ↗Automation
A directory-role membership request returned 400 because it used an unsupported $top parameter. A signInActivity query returned 403 until the missing AuditLog.Read.All delegated scope was addressed.
Read diagnostic record ↗ITSM
Group membership did not make a Procurement user selectable. The Task assigned_to reference qualifier required the itil role. Granting that lab role resolved the invalid reference while retaining the qualifier.
Read diagnostic record ↗Endpoint management
The original physical-device validation includes Secure Boot remediation followed by Confirm-SecureBootUEFI returning True and an Intune Compliant state. Later endpoint reuse does not invalidate that retained result.
Read diagnostic record ↗Identity & security
Provisioning logs, source-anchor correlation, OU scope, and agent traces were inspected before resets. The retained implementation distinguishes the 20-minute user/group interval from the separate Password Hash Sync process.
Read diagnostic record ↗Infrastructure
Direct tests separated WinRM reachability, authentication overhead, and actual host resources when the WAC experience felt slow. The source does not establish a broader server-performance root cause.
Read diagnostic record ↗Cloud administration
The evidence preserves a direct-remoting limitation for VMM01. Portal and agent observations are reported within their actual scope; local service state is not inferred where it was not read.
Read diagnostic record ↗Virtualization
The documented workflow accounts for checkpoints and the active VHDX before modifying storage. Final host and guest observations are retained as separate evidence.
Read diagnostic record ↗Infrastructure
Linux01 domain integration and SSSD remediation are documented separately from macOS AD binding and reachability. A test passing on one platform is not generalized to the entire environment.
Read diagnostic record ↗Supporting technical work
These records are separate from the 13 completed published projects. Unfinished phases and evidence consolidation remain visible.
Repository checkpoint: Phases 1–4 are validated. Phases 5–10 are not started in that checkpoint. Scope includes users, groups, roles, incident intake, SLA behavior, and notifications.
Next milestone: Phase 05 — Flow Designer Automation, followed by the remaining administration phases and final evidence consolidation.
Read complete administration checkpoint →The master registry records substantially complete operational work associated with the existing site: DNSSEC, DDoS protection, WAF, Browser Integrity Check, rate limiting, and related controls. A consolidated authoritative evidence package and repository path remain unconfirmed.
These are registry-recorded claims, not a fresh Cloudflare configuration audit or comprehensive security assurance. No Cloudflare configuration was accessed or changed for this preview.
Review registry scope ↗Preserved portfolio context
Active Directory, DNS, DHCP, Group Policy, and identity-services lab overview.
Active Directory
The domain ad.jeremyfontenot.online provides AD DS, DNS, DHCP, Kerberos, Group Policy, and identity services for lab systems.
OUs separate users, workstations, servers, service accounts, groups, Cloud Sync scope, and dedicated test scopes such as LAPS-Test.
Group Policy, delegated groups, least privilege, and RSOP validation are central to the Windows administration work.
Preserved portfolio context
pfSense, OpenVPN, firewall scoping, and management-path validation.
Network segmentation
pfSense separates lab networks and remote-access paths. Connectivity tests are used to prove which layer is failing before configuration changes are made.
Microsoft infrastructure uses the core lab network while OpenVPN provides administrative access from the non-domain-joined laptop.
WinRM, RDP, WMI, and other management paths are opened only where needed and validated with direct tests.
Preserved portfolio context
Evidence-backed macOS lab case study covering Proxmox placement, Active Directory binding, DNS, SSH, VNC, system identity, and time configuration.
MACVM01 · validated lab case study
MACVM01 is a personal-lab macOS Monterey VM used to validate virtualization, network placement, AD binding, DNS, remote-access reachability, system identity, and time configuration. Apple Business Manager and Intune workflows remain separate simulated or license-dependent work.
Public-safe evidence records the Proxmox VM configuration, macOS 12.7.6 system identity, hostname, resolved directory identity, and the Active Directory binding to ad.jeremyfontenot.online.
Evidence records the lab IP, gateway, AD DNS server, forward and reverse DNS records, and successful TCP reachability from DC01 to SSH on port 22 and VNC on port 5900.
The current public record shows the America/Chicago timezone with network time enabled and time.apple.com configured.
This case study supports a personal nonproduction macOS VM integrated with the lab domain. It does not claim enterprise Apple fleet administration, Apple Business Manager enrollment, production MDM ownership, or Intune-managed macOS deployment.
Preserved portfolio context
Evidence index for the Jeremy Fontenot technical portfolio.
Evidence library
Evidence links open the evidence itself or a dedicated evidence catalog. Case studies remain separate so reviewers always know whether they are reading a narrative or inspecting proof.
Windows LAPS, Group Policy, Active Directory, and hybrid identity validation.
Exchange Online, Defender message investigation, Conditional Access remediation, sign-in validation, and licensing administration.
AD DS, virtualization, hybrid management, networking, backup, and restore validation.
Production-facing support experience stays on the resume and is not mixed with personal-lab evidence.
Preserved portfolio context
Claim-to-evidence map for portfolio validation.
Claim map
Technical claims map directly to evidence. Case-study links are provided separately for readers who want implementation context.
| Claim | Validation | Primary evidence | Context |
|---|---|---|---|
| Windows LAPS administration | Schema, GPO, encryption, delegation, retrieval, rotation | Evidence | Case study |
| Hybrid identity | Cloud Sync, PHS, source authority, scoped provisioning | Evidence | Case study |
| Microsoft 365 messaging and security administration | Shared mailbox delegation, distribution-group delivery, external-sender rule, Defender review, Conditional Access remediation, MFA sign-in evaluation, and effective E5 licensing | Evidence | Case study |
| Microsoft infrastructure administration | AD DS, DNS, DHCP, virtualization, management, recovery | Evidence | Case study |
| Professional end-user support | Employment history | Resume | Production experience |
Preserved portfolio context
Evidence map tying systems skills to validated projects.
Claim map
Technical claims map directly to evidence. Case-study links are provided separately for readers who want implementation context.
| Claim | Validation | Primary evidence | Context |
|---|---|---|---|
| Windows LAPS administration | Schema, GPO, encryption, delegation, retrieval, rotation | Evidence | Case study |
| Hybrid identity | Cloud Sync, PHS, source authority, scoped provisioning | Evidence | Case study |
| Microsoft 365 messaging and security administration | Shared mailbox delegation, distribution-group delivery, external-sender rule, Defender review, Conditional Access remediation, MFA sign-in evaluation, and effective E5 licensing | Evidence | Case study |
| Microsoft infrastructure administration | AD DS, DNS, DHCP, virtualization, management, recovery | Evidence | Case study |
| Professional end-user support | Employment history | Resume | Production experience |
Preserved portfolio context
Curated evidence catalog for home-lab infrastructure.
Home-lab evidence
Direct records support system state, virtualization, backup, restore, Linux integration, and related infrastructure claims.
Supported public claims, source boundaries, and direct evidence links for the current Home Lab state.
Open the individual records rather than relying only on the case-study narrative.
Configuration, retained backup inventory, and the bounded restore-validation record.
Use the case study for architecture and implementation context, or the proof page for the recruiter summary.
Preserved portfolio context
Microsoft 365 and Entra evidence with clear licensing boundaries.
Microsoft 365 & Entra
The verified domain and developer tenant support hands-on Entra, Exchange Online, Defender, Conditional Access, and licensing administration. The portfolio keeps personal-lab validation separate from production ownership.
Verified domain, Entra tenant inventory, Cloud Sync, Password Hash Sync, shared-mailbox delegation, distribution-group delivery, an enforced external-sender transport rule, and message tracing.
Defender mail-protection review, Conditional Access troubleshooting and scope remediation, successful MFA sign-in evaluation, audit validation, and effective Developer E5 licensing are documented. Captured Intune service-plan states remain explicitly non-final.
Preserved portfolio context
Evidence catalog for Entra, Exchange Online, Defender, Conditional Access, and licensing work.
Microsoft 365 & Entra
The verified domain and developer tenant support hands-on Entra, Exchange Online, Defender, Conditional Access, and licensing administration. The portfolio keeps personal-lab validation separate from production ownership.
Verified domain, Entra tenant inventory, Cloud Sync, Password Hash Sync, shared-mailbox delegation, distribution-group delivery, an enforced external-sender transport rule, and message tracing.
Defender mail-protection review, Conditional Access troubleshooting and scope remediation, successful MFA sign-in evaluation, audit validation, and effective Developer E5 licensing are documented. Captured Intune service-plan states remain explicitly non-final.
Provisioning, source authority, Password Hash Sync, agent health, scope, and troubleshooting validation.
Exchange Online configuration, Defender investigation, Conditional Access remediation, sign-in evaluation, audit validation, and licensing evidence.
Concise claim summaries keep hybrid identity and messaging/security validation tied to direct evidence.