Production-minded guidance for endpoints, servers, updates, cloud services, administration, and supportable operations.
Production-minded guidance for endpoints, servers, updates, cloud services, administration, and supportable operations.
Microsoft has fixed CVE-2026-70329, an Outlook integer-overflow vulnerability rated CVSS 8.8. Exploitation requires a user to open a malicious Office file. Review the exact affected editions, deploy the August 11 security release, and verify the installed build by servicing channel.
Read the briefing
Microsoft reports active exploitation of CVE-2026-68820, a Windows privilege-escalation flaw that can grant SYSTEM access. Inventory affected systems, deploy the applicable August update, and verify the result with evidence.
Read the briefing
A Universal Print connector is a live bridge between Microsoft 365 and existing printer queues. Give every connector a supported host, named owner, current software, controlled drivers, monitored capacity, and a tested replacement procedure.
Read the playbook
Azure Arc management depends on software installed on every connected server. Inventory the Connected Machine agent, establish an upgrade path for each operating system, pilot releases, verify reconnection, and resolve version exceptions before support expires.
Read the checklist
Hyper-V Replica provides test, planned, and unplanned failover paths with different prerequisites and consequences. Exercise all three, including network isolation, application validation, reverse replication, failback, and the decision to complete a failover.
Read the playbook
A quorum witness is a deciding vote, not a decorative cluster setting. Select cloud, disk, or file share from the topology; isolate its dependencies from the failures it must resolve; validate access from every node; and retest after cluster or site changes.
Read the guide
Windows DNS aging can identify stale dynamic records, and scavenging can delete them. Inventory timestamps and registration owners, align intervals with DHCP and client behavior, restrict scavenging servers, pilot one zone, and prove recovery before enabling automation.
Read the checklist
Windows devices can keep booting after the 2011 Secure Boot certificates expire yet miss future early-boot protections. Inventory status, update OEM firmware, pilot by hardware family, and verify the 2023 trust chain with evidence.
Read the playbook
Microsoft now plans to disable SMTP AUTH Basic authentication by default for existing Exchange Online tenants at the end of December 2026. Find every sender, choose a supported replacement, pilot it, and prove the legacy path is quiet.
Read the playbook
SMB over QUIC protects Windows file access with TLS 1.3 over UDP 443, but Windows clients can still prefer TCP and external authentication can fall back to NTLM. Prove transport, identity, certificates, and renewal before production.
Read the checklist