sysop@hub:~/cheat-sheets$

cheat-sheets

Commands, queries and lookup tables you can copy. Each sheet has its own filter, and every snippet is in the site search.

microsoft 365 9

Exchange, Teams, SharePoint, compliance and licences.

exchange-onlineMailbox delegation, mail flow rules, message trace and audit.19 snippets mail-flowMessage trace, quarantine, spam verdict headers, forwarding, connectors and DKIM.22 snippets email-error-codesExchange Online and Microsoft 365 bounce codes with the usual fix.14 codes sharepoint-teamsPnP PowerShell for SharePoint sites and Teams policies.16 snippets teams-phoneAssign numbers, voice routing, dial plans, Direct Routing, auto attendants and queues.19 snippets purview-complianceAudit log search, retention, DLP, labels, eDiscovery.12 snippets license-comparisonMicrosoft 365 and Entra ID plans side by side: what is really included in each.25 features defender-office-365Read the mail protection policies, find risky allows, quarantine, block lists, purge a phish, hunting queries.27 snippets sharepoint-sharingTenant and site sharing levels, Anyone links, guest expiry, who may invite, guests in groups, sharing audit.27 snippets

identity 6

Entra ID, hybrid identity, roles and permissions.

graphMicrosoft Graph PowerShell for users, licences, sign-in logs and Conditional Access.11 snippets entra-pimEligible and standing role assignments, activation, role settings, access reviews.18 snippets entra-connectSync cycles, staging mode, ImmutableID matching, password hash sync and dsregcmd.22 snippets entra-id-rolesWhat common Entra ID directory roles can actually do.21 roles graph-permissionsDelegated vs application permissions and what each one allows.23 permissions certificate-authenticationCertificate stores, PFX export/import, smart card readers, Windows Hello for Business.10 snippets

hunting and logs 5

Queries and the places to look when something is wrong.

kqlKQL queries for Entra ID sign-ins, Sentinel and Defender hunting.19 snippets defender-xdr-huntingAdvanced hunting: who got the mail, who clicked, where is the hash, ransomware precursors.21 snippets event-idWindows event IDs for logons, accounts and services.37 event IDs log-file-locationsWhere to find logs on Windows, Linux and Microsoft 365.18 entries exploited-nowThe newest entries of the CISA catalog of vulnerabilities that are being exploited. Updated automatically.live

devices 8

Intune, Autopilot, encryption and updates.

intune-defenderJoin state, MDM sync, diagnostics, Defender status, scans and attack surface reduction.13 snippets intune-app-deploymentWin32 packaging, silent installs, detection scripts, return codes, logs and retries.22 snippets autopilot-deploymentHardware hash export, device registration, group tags, ESP diagnostics.10 snippets bitlockerStatus, recovery keys from device, AD and Entra ID, suspend before firmware updates.19 snippets windows-lapsRead and rotate local admin passwords, set permissions, check the active policy.18 snippets windows-updateWhich policy applies, WSUS leftovers, safeguard holds, logs and the classic repairs.21 snippets macos-adminSystem info, updates, users, FileVault, Gatekeeper, MDM, network and DNS, logs, disks, launchd.33 snippets printer-troubleshootingStuck queue, spooler, add and remove printers and drivers, the print log, 0x0000011b and friends.24 snippets

windows and active directory 6

On-premises servers, the domain and the classic tools.

powershellEveryday PowerShell for Exchange Online, Active Directory and Windows security checks.14 snippets active-directoryLockouts, stale accounts, replication, DC health and the checks an attacker runs first.25 snippets group-policyList, report, back up and find links for Group Policy objects.7 snippets windows-troubleshootingsfc, DISM, gpresult, services, processes and network resets.19 snippets windows-server-rolesAD DS, AD CS, DNS, DHCP, IIS, Hyper-V, WSUS and more explained.13 roles ntfs-share-permissionsRead and fix permissions with icacls and PowerShell, find who has access, copy with permissions intact.22 snippets

network and crypto 14

Connectivity, DNS, certificates and what is still safe to use.

networkingnmap, dig, curl, openssl, tcpdump and Wireshark filters.16 snippets wifi-networkWi-Fi status, saved profiles and connectivity tests on Windows.6 snippets dns-record-typesA, AAAA, MX, TXT, SPF, DKIM, DMARC, CAA, SRV and DNSSEC explained.15 record types sshKeys, port forwarding, jump hosts, copying files and hardening sshd.18 snippets opensslInspect and convert certificates, build a CSR, check a chain, test a TLS endpoint.17 snippets cryptoHashes, encryption, keys and TLS rated recommended to broken.24 entries http-status-codesHTTP response codes with common causes and what to check.37 codes wireguardKeys, server and client config, site-to-site, routing and NAT, and why there is no handshake.24 snippets openvpnRead the log, the usual errors, certificates and revocation, routes and DNS, testing by hand.23 snippets switching-vlanFind a device by MAC, VLANs and trunks, why a port is down, spanning tree, PoE, LLDP.26 snippets dns-dhcpNo address or 169.254, leases and reservations, rogue DHCP servers, name resolution step by step.27 snippets snmp-monitoringsnmpwalk and snmpget for v2c and v3, the OIDs worth knowing, counters into bandwidth, quick checks.18 snippets voip-sip-troubleshootingHow a call is set up, one-way audio and NAT, codecs, QoS, SIP response codes, capturing a call.18 snippets lets-encryptcertbot for nginx and Apache, DNS challenge for wildcards, renewal, hooks, staging, fixing a failed renewal.13 snippets

cloud and devops 14

Azure, infrastructure as code, containers and Linux.

azure-cliAzure CLI commands for subscriptions, resource groups, VMs, roles, networking and storage checks.16 snippets azure-limitsDefault Azure subscription and service limits.23 limits bicep-armDeployments, what-if, modules, loops and Key Vault references.12 snippets terraformAzure resources, variables, remote state, count, for_each, core workflow.14 snippets dockerDocker and Compose commands for containers, images, logs, cleanup and safer runs.17 snippets docker-composeVolumes, networks, health checks, overrides and resource limits.10 snippets linuxLinux commands for admins and security checks.14 snippets gitEveryday Git: branches, undo, stash, rebase and finding who changed what.15 snippets azure-networkingSubnets, NSG rules open to the internet, effective routes, Network Watcher checks, private endpoints, DNS, VPN.25 snippets systemd-journalctlWhy a service failed, logs by unit and time, overrides, timers, writing a unit, journal size.28 snippets linux-users-permissionsAccounts, groups, sudo rules, chmod and chown, shared folders, ACLs, and why access is denied.29 snippets linux-disks-lvmWhat fills the disk, add and mount a disk, grow a volume with LVM, snapshots, SMART, swap, repair.27 snippets nginx-apacheTest and reload, virtual hosts, reverse proxy, HTTPS, Let's Encrypt, log analysis, 502 and 504.28 snippets ansibleInventory, ad-hoc commands, playbooks, check mode, vault, roles, limiting a run.20 snippets

virtualisation and storage 4

Hypervisors, virtual machines, ZFS and the disks underneath.

proxmoxVMs and containers, snapshots, vzdump backup and restore, storage, cluster and quorum, migration.29 snippets hyper-vVMs, checkpoints and leftover AVHDX files, virtual disks, switches and VLANs, export, migration, replication.27 snippets vmware-esxiList and control VMs, end a stuck VM, forgotten snapshots, datastores, networking, esxtop, logs.27 snippets zfs-nasPool health and scrubs, replacing a disk, datasets, snapshots, replication, SMART tests, testing shares.29 snippets

databases 6

SQL itself, and keeping PostgreSQL, MySQL and SQL Server alive.

sql-basicsSelect, filter, join, group, change data safely, and the patterns that answer most questions.26 snippets postgresql-adminLook around, users and rights, running queries and locks, sizes, vacuum, backup and restore.29 snippets mysql-mariadb-adminUsers and grants, process list and locks, sizes, slow query log, InnoDB, backup and restore.28 snippets sql-server-adminRunning queries and blocking, backup and restore, the full log file, sizes, indexes, integrity checks.27 snippets database-backup-restoreNightly dumps, point-in-time recovery, restore tests, and what makes a backup worthless.23 snippets sql-window-functionsROW_NUMBER, RANK, running totals, LAG and LEAD, top N per group, percent of total, gaps, duplicates.15 snippets

scripting 3

Bash, PowerShell and Python for people who automate on the side.

bash-scriptingA safe skeleton, arguments, tests, loops over odd file names, trap, locking, logging, retries.27 snippets powershell-scriptingParameters, error handling, objects and the pipeline, CSV and JSON, REST, remoting, credentials, scheduled tasks.26 snippets python-for-adminsFiles, CSV and JSON, running commands, HTTP, regex, arguments, logging, ports, many hosts at once.28 snippets

toolbox 3

Patterns and bookmarks.

regex-patternsCopy-paste patterns for email, IPv4, UUID, passwords and more, with their limits.15 patterns admin-linksPortals, diagnostics, CVE sources and checkers an admin bookmarks.36 links disk-wipingSecure erase for SSDs and NVMe, overwriting for hard disks, crypto erase, Windows and macOS, checking the result.18 snippets