Endpoint systems

The shape of it

Every environment is somebody's whole company, and each one arrives with its own history — a domain nobody has audited since 2019, a mix of Entra-joined laptops and machines that have never left the office, a compliance regime that showed up after the network did.

The work is making all of that behave the same way. Deployment and configuration run through Intune, Autopilot, Group Policy, and RMM-driven software distribution, with Jamf and Intune covering the macOS side. Software gets packaged silently, MSI or EXE, with detection that is idempotent against Add/Remove inventory so a re-run is never a re-install.

Doing it once, not two hundred times

The lever is PowerShell in SYSTEM context, pushed through RMM. One engineering test lab needed instrumentation and lab software across every workstation; the alternative was a technician walking to each machine. A deployment script replaced that, and the detection logic meant it could be run again safely on anything that drifted.

The same instinct applies to reporting. Tenant data comes out of Microsoft Graph through open-source Python servers rather than screenshots of a portal, because a number you can re-derive next month is worth more than a number you wrote down.

Rollouts that don't detonate

Endpoint DLP across a 130-endpoint environment is the example I reach for. Ten Intune and Entra-joined devices onboarded by policy; a hundred and twenty AD domain-joined devices by GPO. Two delivery mechanisms, one policy intent.

It shipped in three phases: audit-only, then block-with-override, then full block. Audit tells you what people actually do — which is never what the policy author assumed. Block-with-override tells you who screams and whether they had a point. Only then does the door close. Skipping straight to the third phase is how you teach an entire company that security is the thing that stops them working.

Baselines and evidence

Hardening and audit work maps to CMMC L2, HIPAA, PCI DSS, and ISO 27001, with DISA STIGs and NIST publications as the control baseline underneath. The frameworks differ in vocabulary more than in substance; the underlying question is always the same one — what is configured, how do you know, and can you show me.

So every environment change gets a runbook. Not for the auditor. For the version of me who has to touch this in eight months, or for whoever inherits it.

The bad days

Most of this is quiet. Occasionally it isn't, and that's when EDR escalates — Huntress or Microsoft Defender putting something in front of me that a human has to decide about.

A SYSTEM-level web shell on a production Windows Server 2019 host, contained on an isolated network. Adversary-in-the-middle identity compromises driven to closure. The pattern in both: contain before you investigate, because scope grows while you read. Then figure out what it touched, then write down how it got in, then fix that class of thing rather than that instance of it.

Incident response is not heroics. It's having already decided, on a boring day, what you would do.

Why I like it

Endpoint work is unfashionable. It's also the layer where security stops being a diagram and becomes whether a specific laptop in a specific person's bag is encrypted, patched, and reporting in.

Twenty fleets teaches you that reliability is mostly the absence of exceptions. Every one-off is a future outage with a delay fuse. So the job is to keep removing the special cases until the system is boring — and then to automate the parts that still aren't.