sysop@hub:~/glossary$

glossary

Plain-language definitions of IT security and Microsoft admin terms.

A

Attack Surface Reduction

A set of rules in Microsoft Defender for Endpoint that block behaviors commonly used by malware, such as Office macros calling Win32 APIs or executables spawned from email attachments. Controlled by Defender or Group Policy.

AADSTS

Prefix of error codes returned by Microsoft Entra ID when a sign-in or token request fails. It stands for Azure Active Directory Security Token Service. Look up an AADSTS code

Active Directory

Microsoft's directory service for Windows domains. It stores users, computers and groups and handles authentication and policies in on-premises networks.

Adversary-in-the-middle (AiTM)

A phishing technique where a proxy sits between the victim and the real sign-in page and captures the password and the session cookie. It can bypass MFA methods that are not phishing-resistant. Interactive explainer

Attack surface

All the points where an attacker could try to get in, such as exposed services, accounts, apps and people.

Azure AD

Former name of Microsoft Entra ID. Older tools, commands and documents still use it.

AS-REP roasting

An attack on accounts that have Kerberos pre-authentication switched off. Anyone can request a ticket for such an account and crack its password offline. No account should have that setting. Find affected accounts

Authentication strength

A Conditional Access setting that says which sign-in methods count, for example only phishing-resistant ones. It replaces the plain "require MFA" control when you need to be specific.

Access token

A short-lived proof, usually valid for about an hour, that an app presents to a service such as Exchange or Graph. It states who the user is and what the app may do. Anyone who holds it can use it until it expires.

App protection policy

Intune rules that apply to a work app instead of the whole device: a PIN for Outlook, no copying into private apps, a selective wipe of company data. The way to protect company data on private phones without enrolling them.

App registration

The definition of an application in Entra ID: its ID, its secrets and certificates, its redirect addresses and the permissions it asks for. It lives in the tenant of whoever built the app. Audit yours

Application permission

A permission an app uses on its own, without a signed-in user, for example reading every mailbox. It is not limited to one person and is not subject to MFA, which is why these deserve the closest look.

ACL (file)

An access control list on a file or folder: permissions for additional users and groups beyond the owner, the group and everyone else. On Linux set with setfacl, on Windows it is how NTFS permissions work.

AllowedIPs

The WireGuard setting that confuses everybody. For outgoing packets it is a routing table (send these addresses to this peer), for incoming ones a filter (accept only these source addresses from this peer). WireGuard cheat sheet

APIPA

The 169.254.x.x address a device gives itself when it asked for an address by DHCP and nobody answered. It is a symptom, not a configuration: the problem sits between the device and the DHCP server.

ARP

Address Resolution Protocol. How a device finds the hardware (MAC) address that belongs to an IP address in its own network. The ARP table on a router is where you look up which MAC has which address.

ACID

The four promises of a database transaction: atomic (all of it or none), consistent (the rules still hold afterwards), isolated (others do not see it half done) and durable (once committed, it survives a crash).

Alignment (DMARC)

The check that makes DMARC more than SPF plus DKIM: the domain that passed SPF or DKIM must match the domain in the From line the reader sees. A newsletter service that signs with its own domain authenticates, and still fails DMARC for yours. DMARC report reader

Aggregate report (DMARC)

The XML file a mail receiver sends once a day to the address in your DMARC record's rua tag. It lists every server that sent mail with your domain in the From line, how many messages, and whether they passed. DMARC report reader

Access-based enumeration

A file share setting that hides folders and files a user has no right to open, instead of showing them and answering "access denied".

Activation lock

The link between a phone and its owner's Apple or Google account that survives a factory reset. A company phone wiped while still tied to an employee's personal account cannot be set up again without that person. Mobile device checklist

ACME

Automatic Certificate Management Environment: the protocol with which a server proves that it controls a domain and receives a TLS certificate without a human, as used by Let's Encrypt. certbot, acme.sh, Caddy and win-acme are ACME clients. Let's Encrypt cheat sheet

Asset tag

A unique number on a sticker that identifies one device in the inventory, independent of its serial number or its current user. It is what a user reads out on the phone. Asset inventory

Authentication-Results

A header that the receiving mail server adds, with the outcome of its SPF, DKIM and DMARC checks for this message. It is the first place to look when a message was rejected or landed in junk. Mail header reader

B

BitLocker

Windows full-disk encryption feature. Protects data when a device is lost or stolen. Recovery keys should be stored in Entra ID. BitLocker status

Break-glass account

An emergency admin account for cases where normal admin access fails, for example after a Conditional Access mistake. It is excluded from most policies, stored securely and monitored. Microsoft 365 security checklist

Brute force attack

Trying many passwords or keys against one account or target until one works.

Business email compromise (BEC)

Fraud carried out from a real or imitated mailbox, usually to redirect a payment. Typical signs are a new inbox rule, a changed bank detail and pressure to act today. Practise one

3-2-1 rule

Three copies of the data, on two different systems, one of them outside the building. The current form adds one copy that cannot be changed and zero errors when restoring. Check a plan against it

Bug check

The proper name of a Windows blue screen: the kernel found a condition it cannot safely continue from and stopped. The stop code says which. Look up a stop code

BMC

Baseboard management controller. The small independent computer inside a server that stays on whenever the power cords are in: it shows the screen remotely, switches the server on and off and keeps the hardware log. Vendors call theirs iDRAC, iLO or XClarity. Server hardware guide

Beep code

A pattern of beeps a computer gives when its self-test fails before the screen works. The pattern names the part. Beep code lookup

C

CIDR

Classless Inter-Domain Routing. Notation such as 192.168.1.0/24 that describes an IP range by network address and prefix length. CIDR calculator

Conditional Access

Entra ID feature that decides at sign-in whether to allow, block or require extra steps such as MFA, based on user, device, location and risk. Entra ID hardening checklist Interactive explainer Try the simulator

Credential stuffing

Logging in with username and password pairs leaked in other breaches, hoping people reused them.

CVE

Common Vulnerabilities and Exposures. A public identifier such as CVE-2024-12345 for a specific known vulnerability.

CVSS

Common Vulnerability Scoring System. A score from 0 to 10 that rates the technical severity of a vulnerability.

Command and control (C2)

The channel an attacker uses to steer malware inside your network, usually ordinary-looking HTTPS traffic to a server they own. Cutting it is a priority during containment.

Compliance policy

Intune rules a device must meet, such as encryption on and a minimum OS version. Conditional Access can block devices that fail them.

Continuous access evaluation (CAE)

Lets Entra ID tell an app to drop a session within minutes when the user is disabled, the password changes or the location leaves the allowed range, instead of waiting for the token to expire.

Client secret

A password for an application. It ends up in config files and pipelines, cannot do MFA and is valid until it expires. A certificate or a managed identity is the safer choice. Find expiring secrets

Checkpoint

Hyper-V's word for a snapshot of a virtual machine. Useful right before a change, a liability when forgotten. See Snapshot.

Cron

The classic Unix scheduler. A line of five time fields and a command. Jobs run with almost no environment, which is why scripts that work by hand fail in cron.

CSR

Certificate signing request. The file you send to a certificate authority: your public key and the names you want in the certificate, signed with your private key. The private key stays with you. Decode one

Connection pool

A fixed set of open database connections that an application shares, instead of opening a new one for every request. Opening is slow, and every connection costs the server memory, so a pool is both faster and safer. The database is slow

CMOS battery

The coin cell on a mainboard, usually a CR2032, that keeps the clock running and on older boards the BIOS settings alive. When it is empty, the PC forgets the time and the boot order each time it is unplugged.

CSM

Compatibility Support Module. A firmware mode that lets a current PC start operating systems installed the old BIOS way. It has to be off for Secure Boot. BIOS settings explained

Channel width

How much spectrum a Wi-Fi network occupies: 20, 40, 80 or 160 MHz. Wider is faster for one device and leaves fewer channels for the neighbours and for your other access points. Wi-Fi channel planner

Connection string

The line of text that tells a program how to reach a database: server, port, database name, user, and options such as encryption. Each driver has its own format. Connection string builder

Crypto erase

Wiping a self-encrypting drive by destroying its internal key. The data stays on the chips and can never be read again. Takes seconds. Disk wiping cheat sheet

Cloning

Copying a whole drive, with all partitions and the boot information, onto another one, so that the computer starts from the copy as before. Storage upgrade planner

D

DomainKeys Identified Mail

Another name for DKIM. A cryptographic signature on outgoing email that lets receivers verify the sender.

DNS over TLS / DNS over HTTPS

Protocols that encrypt DNS queries to prevent eavesdropping and tampering. Supported in modern Windows, macOS and Android.

DKIM

DomainKeys Identified Mail. A cryptographic signature on outgoing email that lets receivers check the message came from the domain and was not altered.

DLP

Data loss prevention. Rules and tools that detect and block sensitive data, such as card numbers, from leaving the organization.

DMARC

Domain-based Message Authentication, Reporting and Conformance. A DNS policy that tells receivers what to do with mail that fails SPF and DKIM alignment and where to send reports.

DCSync

An attack in which an account with replication rights asks a domain controller for password hashes, including krbtgt. Only domain controllers should hold those rights. See it on the attack map

Device code phishing

The attacker starts a device sign-in and gets the victim to enter the code on the real Microsoft page. The victim completes MFA and the attacker receives the tokens. Block the device code flow with Conditional Access where it is not needed.

Delegated permission

A permission an app uses on behalf of the signed-in user. The app can do at most what that user can do. Compare application permission.

Device code flow

A sign-in method for devices without a browser or keyboard: the device shows a code and the user enters it on another device. Convenient for meeting room systems, and abused for phishing. Interactive explainer

DHCP relay

A setting on the gateway of a network that forwards address requests to a DHCP server in another network. Without it, only devices in the same segment as the server get an address. On Cisco it is called ip helper-address.

DMZ

A network zone for systems that must be reachable from the internet, separated from the internal network by the firewall so that a break-in there does not lead straight inside.

Deadlock (database)

Two transactions each hold a lock the other one needs. Neither can go on, so the database ends one of them with an error. The fix is in the application: touch tables in the same order and keep transactions short.

Dual channel

Two memory modules working side by side so that the processor reads from both at once. Needs the modules in the right pair of slots, usually the second and fourth. Which slots

DKIM selector

The name that tells a receiver which of your DKIM keys signed a message. It is part of the DNS name where the public key lives: selector._domainkey.yourdomain. Each sending service gets its own.

DFS (Wi-Fi)

Dynamic Frequency Selection. Most 5 GHz channels are shared with radar, so an access point must listen before it uses them and leave when it hears radar. Wi-Fi channel planner

DisplayLink

A way to drive monitors over plain USB by compressing the picture in a driver. It works on almost any port and needs that driver installed: without it, a DisplayLink dock shows nothing.

Drum (printer)

The light-sensitive cylinder in a laser printer onto which the image is drawn before toner sticks to it. Scratches and wear on it show on every page as lines, dots or a grey background.

DHCP snooping

A switch feature that lets DHCP answers through only from ports marked as trusted. It stops a home router plugged into a wall socket from handing out addresses to the office. DHCP walkthrough

E

Entra Connect

Microsoft's tool that synchronises identities between on-premises Active Directory and Entra ID. A tier-0 asset because compromise gives full control of both.

EDR

Endpoint detection and response. Software on devices that records activity, detects suspicious behavior and helps respond, for example by isolating a machine.

Entra ID

Microsoft's cloud identity and access service, previously called Azure AD. It handles sign-in, MFA, Conditional Access and app access for Microsoft 365 and other apps.

Exploit

Code or a technique that takes advantage of a vulnerability.

Enterprise application

The local copy of an app inside your tenant, technically its service principal. It carries what your tenant granted the app: consents, role assignments and who may use it. An outside vendor's app has its registration in their tenant and an enterprise application in yours.

err-disabled

A switch port the switch shut down by itself because a protection was triggered: a loop, too many MAC addresses, a rogue DHCP server. The port stays off until someone fixes the cause and re-enables it.

Exit code

The number a program returns when it ends. Zero means success, anything else an error, by convention. Scripts and schedulers judge a job by this number alone. Robocopy is the famous exception: its codes below 8 are successes.

Execution plan

The way a database decided to run a query: which table it reads first, with which index, and how it joins. EXPLAIN shows it, and it is the first thing to look at for a slow query. The database is slow

ECC memory

Memory with extra bits that let it correct a single flipped bit and detect two. Standard in servers. Corrected errors appear in the hardware log and are the early warning that a module is failing.

EPS connector

The 8-pin (or 4+4-pin) plug that feeds the processor on a mainboard. It looks like the 8-pin plug for graphics cards and is keyed differently: never force one into the other socket. PC build checker

Emergency access account

A cloud-only administrator account kept for the day when normal sign-in is broken: excluded from Conditional Access, with a long password in a safe, and an alert on every use. Also called a break-glass account. Tenant audit in one hour

F

FIDO2

An open standard for passwordless and phishing-resistant sign-in with security keys or passkeys.

FILETIME

Windows timestamp counting 100-nanosecond intervals since 1 January 1601 UTC. Active Directory uses it for attributes such as lastLogon. Time converter

FSMO roles

Five tasks in Active Directory that only one domain controller performs at a time, such as the PDC emulator and the RID master. Show the role holders

Foreign key

A column that holds the key of a row in another table, such as user_id in a tickets table. Declared as a constraint, the database refuses values that point at nothing.

Force push

Overwriting a branch on the server with your version. On a shared branch it deletes other people's commits. The safer form is --force-with-lease. Git fix-it

Fuser

The pair of hot rollers in a laser printer that melts the toner powder into the paper, at about 200 °C. A worn fuser shows as print that rubs off, wrinkled paper and jams at the exit. Printer hardware guide

Forwarder (DNS)

The resolver a DNS server passes questions to when it does not know the answer itself. A dead forwarder shows as internal names that work and internet names that do not.

Form factor

The standard size and hole pattern of a part, so that parts of different makers fit together: ATX, Micro-ATX and Mini-ITX for boards, ATX and SFX for power supplies, 2.5 and 3.5 inch for drives. PC build checker

G

GUID

Globally Unique Identifier. A 128-bit identifier shown as 32 hex digits in groups, for example 550e8400-e29b-41d4-a716-446655440000. Used throughout Azure and Entra ID to identify resources, apps and tenants. GUID generator

gMSA

Group Managed Service Account. An Active Directory account whose password is automatically managed and rotated by the domain, with no human-readable secret. Recommended for service accounts to protect against Kerberoasting. Glossary: Kerberoasting

Golden ticket

A Kerberos attack where the attacker forges ticket-granting tickets with the password hash of the krbtgt account, gaining long-lasting domain access.

Group Policy

Windows feature for centrally managing settings and security configuration of computers and users in an Active Directory domain.

Group-based licensing

Licences are assigned to a group and every member gets them. A leaver who is removed from the group loses the licence automatically. Licences assigned by hand are the ones that get forgotten. Find wasted licences

GFS (grandfather-father-son)

A retention scheme for backups: keep daily copies for a short time, weekly ones for longer, monthly ones for longer still. It reaches far back without keeping every day.

Greylisting

A spam defence where the server refuses the first delivery attempt from an unknown sender with a temporary error. Real mail servers try again some minutes later, most spam senders do not. The cost is a delay on first contact. Mail header reader

Greedy

A quantifier in a regular expression that takes as much text as it can. .* runs to the end of the line and then gives back. Its lazy form, .*?, takes as little as possible. Regex tester

H

Hybrid identity

A setup where identities exist in both on-premises Active Directory and Entra ID, synchronised by Entra Connect. Glossary: Entra Connect

HTTPS Strict Transport Security

An HTTP header that tells browsers to always use HTTPS for a domain for a set period, preventing protocol downgrade attacks.

Hash

A fixed-length value calculated from data by a one-way function. Used for integrity checks and for storing passwords. Hash generator

Hybrid join

A Windows device that is joined to on-premises Active Directory and also registered in Entra ID. It lets Conditional Access trust domain machines. Check the join state

Hot spare

A disk that sits unused in an array and takes over automatically when another disk fails, so the rebuild starts at once instead of when someone arrives with a replacement.

Hypervisor

The software that runs virtual machines and shares the hardware between them: Hyper-V, VMware ESXi, Proxmox VE with KVM, and others.

Hot swap

Replacing a part while the machine keeps running: disks in carriers, power supplies, fans. The part must be built for it, and for a disk the array must be told or must notice.

I

Incident

In security, an event or chain of events that has a real or potential negative impact on the confidentiality, integrity or availability of data or systems. Requires a formal response. Response checklist

Intune

Microsoft's cloud service for managing devices and apps, including compliance and configuration policies.

Immutable backup

A backup that cannot be changed or deleted for a set time, even by an administrator. It is what survives when ransomware reaches the backup server. Interactive explainer

ImmutableID

The value that ties an on-premises AD account to its cloud account, normally the Base64 form of objectGUID. A mismatch produces duplicate users after a sync. Calculate it

Indicator of compromise (IOC)

A piece of evidence that points to an intrusion, such as a file hash, an IP address, a domain or a mail subject. You search your logs for it to find out who else is affected.

Inode

The record a Linux file system keeps for every file. A file system has a fixed number of them, so millions of tiny files can make a disk "full" while gigabytes are free. Check with df -i.

Intermediate certificate

The certificate between a server's own certificate and the root that clients trust. The server has to send it along, otherwise clients that have never seen it reject the connection. Check a chain

iowait

The share of time a processor sat idle because it was waiting for a disk. High iowait with low CPU use means the storage is the bottleneck. Walkthrough

Index (database)

A sorted side structure on one or more columns that lets the database find rows without reading the whole table, like the index of a book. Every index speeds up reads on those columns and slows down every write.

Idempotent

An operation that leaves the same result whether it runs once or ten times. Configuration tools such as Ansible are built on it: a playbook describes a state, and running it again changes nothing. Ansible cheat sheet

Inheritance (permissions)

Folders and files take over the permissions of the folder above them unless someone breaks the chain. Every broken chain is a place where access differs from what the top level suggests. NTFS and share permissions cheat sheet

J

JWT

JSON Web Token. A signed token made of a header, claims and a signature, widely used in OAuth and OpenID Connect. JWT decoder

Journal (systemd)

The log that systemd keeps for all services and the kernel, read with journalctl. It replaces or supplements the text files in /var/log on current Linux systems. Cheat sheet

JOIN

The SQL operation that puts rows from two tables side by side where a condition holds, usually key equals foreign key. LEFT JOIN also keeps the rows of the first table that have no partner. Try it

Jitter

The variation in how long packets take to arrive. Voice and video need packets at even intervals; high jitter sounds choppy even when nothing is lost. Call quality walkthrough

K

Kerberoasting

An attack where an authenticated user requests service tickets for accounts with service principal names and cracks them offline to recover the service account password. Interactive explainer

Kerberos

Ticket-based authentication protocol used in Active Directory domains. Interactive explainer

KQL

Kusto Query Language. The query language of Microsoft Sentinel, Log Analytics and Defender advanced hunting. KQL cheat sheet

L

Log Analytics

Microsoft's cloud service for collecting, querying and analysing log data. The data store behind Microsoft Sentinel and Defender. KQL cheat sheet

LAPS

Local Administrator Password Solution. Manages a unique, regularly changed local administrator password for each device. Windows LAPS is built into supported Windows versions.

Lateral movement

Moving from one compromised system or account to others inside a network.

Legacy authentication

Older protocols such as IMAP, POP and basic SMTP AUTH that do not support MFA. Blocking them closes a common attack path.

Litigation hold

A setting that keeps everything in a mailbox, including deleted items, for as long as it is on. Used to preserve evidence. A mailbox on hold needs a licence that includes it.

Load average

Three numbers from uptime: how many processes were running or waiting, averaged over 1, 5 and 15 minutes. It only means something compared with the number of processor cores.

LVM

Logical Volume Manager. A layer between disks and file systems on Linux that lets you grow volumes, add disks to a pool and take snapshots without repartitioning. Cheat sheet

Lingering object

An object that was deleted in Active Directory but still exists on a domain controller that missed the deletion, because it was offline for longer than the tombstone lifetime.

Loopback processing

A Group Policy mode in which the user settings depend on the computer someone signs in to instead of on the user's own OU. Used for terminal servers and kiosks. Group Policy walkthrough

Lease

The loan of an IP address from a DHCP server to a device, for a set time. The device asks to extend it at half time. Short leases free addresses quickly, long ones survive a server outage. DNS and DHCP cheat sheet

logrotate

The Linux tool that renames, compresses and deletes log files on a schedule so that they do not fill the disk. Each application needs a rule in /etc/logrotate.d. Disk full walkthrough

LLDP

Link Layer Discovery Protocol: switches, phones and access points announce who they are to the device on the other end of the cable. It answers "which switch port is this socket on". Cisco's own version is CDP. Switch port finder

M

MX record

Mail Exchange record. A DNS record that tells senders which servers receive email for a domain. DMARC explainer

MDM

Mobile Device Management. A service that manages configuration, compliance and apps on mobile devices and PCs. Microsoft Intune is the MDM service for Microsoft 365. Glossary: Intune

Managed identity

Azure feature that gives a resource an identity managed by the platform, so apps can access other services without stored secrets.

MFA

Multi-factor authentication. Signing in with more than one kind of proof, such as a password plus an app approval or a security key.

MITRE ATT&CK

A public knowledge base of attacker tactics and techniques, used to describe attacks and plan detections.

MTA-STS

A policy published over HTTPS that tells sending mail servers to deliver to your domain only over verified TLS. It stops downgrade attacks on mail in transit. Check a domain

MAC address

The hardware address of a network interface, six bytes written in hex. Switches forward by it. The first half identifies the manufacturer.

MTU

Maximum transmission unit: the largest packet a link carries, 1500 bytes on Ethernet. When a tunnel or a DSL line makes it smaller and something blocks the messages that would say so, small transfers work and large ones hang.

M.2

The small card format for SSDs and Wi-Fi cards that plugs flat onto the board. The notches (keys) say which slot a card fits, a four-digit number such as 2280 gives width and length in millimetres. Connector identifier

MST

Multi-Stream Transport. The DisplayPort feature that sends several monitor pictures through one cable, for daisy chains and docks. macOS does not support it over DisplayPort.

MAC address table

The list in which a switch remembers on which port it last saw each hardware address. It is how a frame reaches one port instead of all of them, and how an admin finds a device. Switch port finder

N

Network Segmentation

Dividing a network into segments so that a compromised device or system cannot reach everything else. Limits the blast radius of an attack.

NTLM

Older Windows challenge-response authentication protocol, still present for compatibility and often targeted by attacks such as pass-the-hash.

NDR (non-delivery report)

The bounce message a sender gets when a mail cannot be delivered. The status code in it, such as 5.1.1 or 5.7.1, names the reason. Look up a code

NAT

Network address translation. A router rewrites addresses so that many devices with private addresses share one public one, or so that a port on the public address leads to an internal machine (a port forward).

N+1 queries

An application loads a list with one query and then runs one more query per line for the details. Each is fast, but a page with 200 lines makes 201 round trips. Shows up in statistics as a small statement with a huge number of calls.

NULL

The marker for a missing or unknown value in a database. It is not zero and not empty text, and nothing equals it, not even another NULL: ask with IS NULL. Try it

NXDOMAIN

The DNS answer "this name does not exist". It is cached like any other answer, which is why a record you just created can stay invisible for a while. DNS walkthrough

O

OAuth 2.0

Authorization framework that lets an app access resources on a user's behalf using tokens instead of passwords. Interactive explainer

OpenID Connect

Identity layer on top of OAuth 2.0 that lets apps verify who signed in.

OOM killer

The part of the Linux kernel that ends a process when memory has run out completely. It picks what frees the most, which is not always what caused the problem. It leaves a line in the kernel log.

OID

Object identifier. The numeric address of one value in SNMP, such as 1.3.6.1.2.1.1.3.0 for the uptime of a device. A MIB file translates the numbers into names. SNMP cheat sheet

P

Phishing Resistant MFA

Authentication methods that cannot be relayed or intercepted by an adversary in the middle, such as FIDO2 security keys, passkeys and Windows Hello for Business. The strongest protection against AiTM phishing. AiTM phishing explained

Pass-the-hash

Using a captured password hash to authenticate without knowing the password itself.

Passkey

A passwordless credential based on public-key cryptography, bound to a device or synced by a platform, and resistant to phishing.

Password spraying

Trying a few common passwords against many accounts to avoid lockouts. KQL query for spray detection

Penetration test

An authorized simulated attack used to find weaknesses before real attackers do.

Phishing

Fraudulent messages that trick people into giving up credentials, running malware or approving requests. Email header analyzer

PIM

Privileged Identity Management. Entra feature for just-in-time, time-limited and approved admin roles.

Primary Refresh Token (PRT)

A token issued to Entra-joined or registered devices that enables single sign-on across apps. Stealing it is a known attacker goal.

Principle of least privilege

Give users, apps and systems only the access they need for their task and no more.

Privilege escalation

Gaining higher permissions than originally granted, for example from a normal user to an administrator.

PKCE

An addition to the OAuth authorization code flow in which the app proves that it is the same app that started the sign-in. It stops an intercepted code from being used by someone else. Pronounced "pixy". Interactive explainer

Pending sector

A sector a disk could not read and is waiting to retry or replace. Counted in SMART attribute 197. Above zero, files in those sectors may already be damaged. Read SMART output

PoE

Power over Ethernet. The switch powers a device through the network cable: access points, phones, cameras. Every switch has a total budget in watts that all ports share.

Point-in-time recovery

Restoring a database to a chosen moment, such as one minute before a wrong DELETE, by replaying the logged changes on top of an older full backup. Needs the log (WAL, binary log, transaction log) to be archived. Backup and restore cheat sheet

Primary key

The column, or columns, whose value identifies exactly one row of a table: unique and never empty. Usually a number called id.

PDU

Power distribution unit: the power strip of a rack. Managed ones measure the load per outlet and can switch outlets remotely.

POST

Power-on self-test. The checks a computer runs on its own hardware before it starts the operating system. A failure shows as beeps, a lit LED on the board or a code. Troubleshooting wizard

PWM (fan)

Pulse-width modulation. The fourth wire of a fan plug carries a signal with which the board sets the speed precisely. Three-wire fans can only be slowed by lowering the voltage.

PoE budget

The total power a switch can deliver to devices over the network cable. When phones, access points and cameras together need more, the switch leaves the last ports unpowered. PoE budget calculator

Pipeline

Sending the output of one command into the next with the | sign. In Linux shells it carries text, in PowerShell it carries objects with properties. PowerShell playground, Linux playground

Q

Quorum

The majority a cluster needs before it may act. It stops the two halves of a split cluster from both changing the same data. A two-node cluster needs a third vote from somewhere.

R

Ransomware

Malware that encrypts data and demands payment for its release, often combined with data theft.

Red team and blue team

The red team simulates attackers, the blue team defends and detects. Working together is sometimes called purple teaming.

RPO and RTO

Recovery point objective is how much data you can afford to lose, measured in time since the last backup. Recovery time objective is how long the restore may take. Both should be agreed before an incident, not during one.

Redirect URI

The address Entra ID sends the result of a sign-in to. It must match one registered for the app exactly. A wildcard or an unencrypted address here lets someone else receive the token.

Refresh token

A long-lived token an app uses to get new access tokens without asking the user again. It is what keeps an attacker in after a phish, and why revoking sessions matters more than resetting the password.

RAID

Several disks combined so that one or more can fail without losing data or stopping the system. It protects against a dead disk and against nothing else. RAID calculator

Reallocated sector

A damaged sector that a disk has replaced with a spare one. Counted in SMART attribute 5. A few that do not grow can be lived with, a rising number means the disk is failing.

Resilver

What ZFS calls rebuilding: copying data onto a new disk after a replacement so the pool is redundant again.

Reverse proxy

A web server that takes requests from the internet and passes them to an application behind it. It terminates HTTPS, can serve several applications under one address, and is why a 502 means "the thing behind me did not answer".

Recovery model

The SQL Server setting that decides what happens to the transaction log. SIMPLE reuses it on its own and allows restores only to the last backup. FULL keeps everything until a log backup is taken, which allows point-in-time recovery and, without log backups, fills the disk. SQL Server cheat sheet

Replication (database)

A second server that receives every change from the first and stays a copy of it. Used for failover and for moving read load. It is not a backup: a wrong DELETE is replicated within a second.

Rack unit

The height unit of rack equipment, written U: 44.45 mm, or three holes of the rail. A 2U server is two of them high. How to count them

RDIMM

Registered memory module, the kind servers use: a buffer chip on the module lets a board drive many of them. Does not work in desktop boards, and desktop modules do not work in servers.

RTP

Real-time Transport Protocol. Carries the voice or video of a call, on other ports than the signalling and directly between the two ends. No sound on a connected call means RTP is blocked.

Reflog

Git's private diary of where each branch pointed. It is how commits lost to a reset or a deleted branch are found again, for about 90 days. Git fix-it

Received header

One line that every mail server adds on top of a message when it takes it over: from whom, by whom, when. Read from the bottom up, the Received lines are the route of the message. Mail header reader

Return-Path

The envelope sender of a message: the address that bounces go to and that SPF checks. The reader normally never sees it, and it may differ from the From address. Mail header reader

robocopy

The command-line copy tool built into Windows, made for whole folder trees: it copies permissions and timestamps, resumes, mirrors and writes a log. The standard tool for file server migrations. File server migration checklist

Regular expression

A pattern that describes text: "three digits, a dot, three digits". Used to search logs, check input and rewrite text, in nearly every tool with slightly different rules. Regex tester

S

SAML

Security Assertion Markup Language. XML-based standard for single sign-on between an identity provider and an app.

Secure Score

Microsoft's numeric rating of a tenant's security posture, with recommended improvement actions.

Service principal

The identity of an application in an Entra tenant, used to grant it permissions.

SIEM

Security information and event management. Collects and analyzes logs from many sources to detect threats. Microsoft Sentinel is an example.

Smart lockout

Entra ID feature that blocks sign-in attempts after repeated failures while trying to keep the real user able to sign in.

SPF

Sender Policy Framework. A DNS record listing the servers allowed to send mail for a domain.

SSO

Single sign-on. Signing in once to access multiple applications.

Safe Links

A Defender for Office 365 feature that rewrites links in mail and checks them at the moment of the click. It is also what records who clicked. Hunt for clicks

Safeguard hold

Microsoft holds back a Windows feature update on devices with a known incompatibility, such as a driver or an application. The device simply is not offered the update until the hold is lifted. Check a device

Shared mailbox

A mailbox several people open with their own accounts, such as info@ or invoices@. It needs no licence while it stays under 50 GB and has no archive or hold, and nobody should sign in to it directly.

Staging mode

An Entra Connect server in staging mode imports and calculates everything but writes nothing to Entra ID or Active Directory. Used to prepare a replacement server and compare its results before switching. Upgrade checklist

Supervised device

An iPhone or iPad enrolled in a way that gives the organisation deeper control: silent app installs, forced updates, more restrictions. Supervision is set at enrolment through Apple Business Manager and cannot be added afterwards.

SAN (certificate)

Subject alternative name. The list of host names and addresses a certificate is valid for. Browsers look only here and ignore the older common name field.

Scrub

A background pass in which a storage system reads every block and compares it with its checksum, repairing from redundancy what does not match. How silent corruption gets found before it matters.

setgid

A permission bit. On a folder it makes new files inherit the folder's group, which is what makes shared folders work on Linux. On a program it runs the program with its group's rights.

Shebang

The first line of a script, starting with #!, that names the interpreter to run it with. #!/usr/bin/env bash finds Bash wherever it is installed.

SMART

The health record every disk keeps about itself: counters for errors, wear, temperature and running time, and the results of its self-tests. Read with smartctl. SMART reader

Snapshot

A frozen view of a disk or virtual machine at one moment, made by keeping the old blocks when something changes. Instant and cheap, and stored in the same place as the original, which is why it is not a backup. Why not

Spanning tree

The protocol that lets switches detect loops in the cabling and block the redundant link, so that one misplaced patch cable does not take the network down.

Spooler

The Windows service that takes print jobs from applications and feeds them to the printer. When printing hangs for everyone on a machine, restarting it is the first step.

Steal time

Processor time a virtual machine wanted and the hypervisor gave to someone else. High values mean the host is overbooked, and nothing inside the VM can fix it.

Stop code

The number on a Windows blue screen that says why the system stopped, such as 0x0000007E. Stop code lookup

Swap

Disk space used as overflow when memory runs out. A little is harmless. A server that actively swaps in and out is slow in every way at once.

systemd unit

A file that tells systemd how to run something: a service, a timer, a mount. Changes belong in an override created with systemctl edit, which survives package updates.

SQL injection

An attack where text typed by a user ends up inside an SQL statement and changes what it does. The cause is building statements by gluing strings together, and the cure is passing values as parameters.

SO-DIMM

The short memory module used in notebooks and mini PCs, about half the length of a desktop module.

Split pair

A wiring fault where all eight wires reach the right pins but two of them are twisted with the wrong partner. A simple tester passes the cable, and it then loses packets at speed.

SIP ALG

A router function that rewrites SIP packets to help phone calls through NAT, and often breaks them instead: lost registrations, one-way audio, dropped calls. Switching it off is the first step in VoIP troubleshooting. VoIP cheat sheet

SLA

Service level agreement. The promise of how available a service is, usually as a percentage: 99.9% allows about 44 minutes of downtime a month. Uptime calculator

Security filtering

The list of users, computers or groups a Group Policy object applies to. They need both the Read and the Apply permission, and the computer account needs Read even for user settings. Group Policy walkthrough

systemd timer

The newer way to schedule jobs on Linux: a timer unit starts a service unit. Unlike cron it can catch up on runs that were missed while the machine was off, and its output lands in the journal. Cron and timer builder

Scavenging

The clean-up job of a Windows DNS server that removes dynamically registered records which were not refreshed for a set time. Off by default, and when it is misconfigured, records of running machines disappear.

Split DNS

Answering the same name differently inside and outside the company network. Useful, and a common source of "it works at home but not in the office".

Secure erase

A command built into SSDs and hard disks that makes the drive erase all of itself, including areas the operating system cannot reach. The right way to wipe an SSD. Disk wiping cheat sheet

T

TLS

Transport Layer Security. The cryptographic protocol that secures data in transit, for example HTTPS, SMTPS and LDAPS. TLS 1.3 is current; TLS 1.0 and 1.1 are deprecated. Cryptography quick reference

Tenant

A dedicated instance of Entra ID and Microsoft 365 that belongs to one organization.

Tier 0

The most sensitive assets in the enterprise access model, such as domain controllers and identity systems. Compromising tier 0 means compromising everything.

Token theft

Stealing an access, refresh or session token to impersonate a user without needing their password or MFA.

TPM

Trusted Platform Module. A hardware chip that stores keys securely and supports features such as BitLocker.

Temporary Access Pass

A time-limited passcode an admin issues so a user can sign in and register a passkey or other strong method without ever having a password.

Token protection

A Conditional Access control that binds a sign-in token to the device it was issued to, so a stolen token is useless elsewhere. Coverage depends on the app and platform.

Thin provisioning

Giving a virtual disk or a LUN more space on paper than physically exists, filling it only as data arrives. Saves space until the real storage runs full, at which point everything on it stops.

Trunk port

A switch port that carries several VLANs at once, each frame tagged with its VLAN number. Used between switches and towards access points and hypervisors.

Transaction

A group of changes that a database applies as a whole: after BEGIN nothing is final until COMMIT, and ROLLBACK undoes all of it. Try it

Thermal throttling

A processor that slows itself down because it has reached its temperature limit. The machine stays on and gets slow: the usual causes are dust, a dead fan or dried-out thermal paste.

Thunderbolt

The fastest connection that uses the USB-C plug: 40 Gbit/s and more, several monitors and fast storage through one cable. Marked with a small bolt next to the port. Connector identifier

T568B

The more common of the two colour orders for wiring an eight-pin network plug. T568A swaps the orange and green pairs. Both work, as long as both ends of a cable use the same one. The colours

Tombstone lifetime

How long Active Directory remembers that an object was deleted, 180 days by default. A domain controller that was offline for longer may not replicate again and has to be rebuilt. dcdiag reader

Topology

The way the devices of a network are connected: which switch hangs on which, where the firewall sits, which links are doubled. A diagram of it is the first thing the next admin needs. Network diagram builder

Three-way handshake

The three packets that open every TCP connection: SYN, SYN-ACK, ACK. A firewall that drops the first one causes a timeout; a server with no program on the port answers with a reset and the connection is refused at once. Packet journey

U

Unified Audit Log

The central audit log in Microsoft 365 that records user and admin activity across Exchange, SharePoint, Teams, Entra ID and other services. Essential for investigations. KQL cheat sheet

UPN

User principal name. The sign-in name of a user in email-like form, such as name@contoso.com.

Update ring

An Intune or Group Policy setting that says how long a group of devices waits before installing Windows updates. A few rings with rising delays let a small pilot group find problems first. Rollout cadence

UPS

Uninterruptible power supply. A battery that carries equipment through short power cuts and gives servers time to shut down cleanly during long ones. The battery lasts three to four years.

URE

Unrecoverable read error: a sector the disk cannot read back. During a RAID 5 rebuild there is no redundancy left to correct one, which is the argument for RAID 6 with large disks.

USB Power Delivery

The standard by which a USB-C charger and a device agree on voltage and current, up to 240 W. Charger, cable and device must all support the wattage, and the weakest of the three decides.

Unit file

A text file that tells systemd what to run and how: which program, as which user, when to restart, what must be up before. Service units end in .service, schedules in .timer. systemd unit builder

V

Vulnerability

A weakness in software, configuration or process that can be abused.

Verified publisher

A blue badge on an app's consent screen showing that the publisher has proven its identity to Microsoft. Its absence on an app that asks for mail access is a warning sign. User consent can be limited to verified publishers.

Virtual host

One web server answering for several sites, choosing by the host name in the request. Called a server block in nginx.

VLAN

A virtual LAN: one physical network split into separate logical ones on the switches. Devices in different VLANs can only talk through a router or firewall, which is where the rules go. Plan VLANs and subnets

VLSM

Variable length subnet masking: cutting an address range into subnets of different sizes, each as large as its segment needs, instead of equal blocks.

Vacuum

The PostgreSQL housekeeping that removes old row versions left behind by updates and deletes. Autovacuum does it in the background, and when it cannot keep up, tables grow and queries slow down. PostgreSQL cheat sheet

VA (volt-ampere)

The unit on a UPS box. It is not watts: multiply by the power factor of the UPS, between 0.6 and 1, to get the watts it can really deliver. UPS runtime calculator

W

WireGuard

A modern VPN protocol with very little configuration: a key pair per device and a list of allowed addresses per peer. It is silent when something is wrong, which makes troubleshooting its own skill. Cheat sheet

WAL

Write-ahead log. PostgreSQL writes every change to this log before it touches the data files, which is what makes a crash survivable. Archived WAL is also the raw material for replication and point-in-time recovery.

Web shell

A small script that an attacker uploads to a web server and then calls through the browser to run commands. Often a single line in a folder meant for pictures. Finding one is an incident, not a clean-up job. Linux playground, mission 11

Window function

An SQL function that calculates over a group of related rows and still returns every row, for example a running total or a rank per team. Recognised by the word OVER. Window functions cheat sheet

Wildcard mask

The inverse of a subnet mask, used in access lists and OSPF on Cisco devices: 0.0.0.255 instead of 255.255.255.0. Subnet and VLAN poster

X

XDR

Extended detection and response. Correlates signals across endpoints, identities, email and cloud.

Z

Zero Trust

A security model built on never trusting by default: verify each request explicitly, use least privilege and assume breach.

Zero-day

A vulnerability that is exploited or public before a fix exists.

ZFS

A file system and volume manager in one, with checksums on all data, snapshots, built-in RAID and replication. The basis of TrueNAS and an option on Proxmox and Ubuntu. Cheat sheet

ZIF connector

Zero insertion force: the latched connector that holds a flat ribbon cable in notebooks and phones. The latch is opened first, then the cable slides out without force. The two kinds

Zero-touch enrolment

A device registers itself with the company's device management at first start, because its serial number was assigned to the company at purchase. Apple calls it Automated Device Enrolment, Microsoft Autopilot. Device management explained