Page 144 of the DSE IT knowledge center, with source-backed guidance and practical next steps.
Production-minded guidance for endpoints, servers, updates, cloud services, administration, and supportable operations.
Azure Arc management depends on software installed on every connected server. Inventory the Connected Machine agent, establish an upgrade path for each operating system, pilot releases, verify reconnection, and resolve version exceptions before support expires.
Read the checklist
Hyper-V Replica provides test, planned, and unplanned failover paths with different prerequisites and consequences. Exercise all three, including network isolation, application validation, reverse replication, failback, and the decision to complete a failover.
Read the playbook
A quorum witness is a deciding vote, not a decorative cluster setting. Select cloud, disk, or file share from the topology; isolate its dependencies from the failures it must resolve; validate access from every node; and retest after cluster or site changes.
Read the guide
Windows DNS aging can identify stale dynamic records, and scavenging can delete them. Inventory timestamps and registration owners, align intervals with DHCP and client behavior, restrict scavenging servers, pilot one zone, and prove recovery before enabling automation.
Read the checklist
Windows devices can keep booting after the 2011 Secure Boot certificates expire yet miss future early-boot protections. Inventory status, update OEM firmware, pilot by hardware family, and verify the 2023 trust chain with evidence.
Read the playbook
Microsoft now plans to disable SMTP AUTH Basic authentication by default for existing Exchange Online tenants at the end of December 2026. Find every sender, choose a supported replacement, pilot it, and prove the legacy path is quiet.
Read the playbook
SMB over QUIC protects Windows file access with TLS 1.3 over UDP 443, but Windows clients can still prefer TCP and external authentication can fall back to NTLM. Prove transport, identity, certificates, and renewal before production.
Read the checklist
Kubernetes Pod Security Admission can enforce privileged, baseline, or restricted profiles by namespace while audit and warn modes expose violations first. Govern labels, policy versions, exemptions, and controller-created Pods as one system.
Read the playbook
GitHub Actions can exchange a GitHub-issued OIDC token for a short-lived cloud credential instead of storing a long-lived key. The security gain depends on strict trust claims, least-privilege cloud roles, protected environments, and tested revocation.
Read the guide
Azure Policy exemptions preserve compliance visibility while recording a Mitigated or Waiver decision, but expiration is optional and the object remains after expiry. Treat each exemption as a governed, time-bound risk record.
Read the checklist