Menu / Category

Tools

to go · 6 items

Barista: One Exe to Install Doppio and RistrettoOct 16, 2026The 2FA series ends with two LSA components, an unsigned DLL in lsass and a dozen steps that have to happen in the right order. Barista is a wizard that does them one reboot at a time, from a single exe with every binary embedded and hash-checked.9 min · Cappuccino#windows#lsa#2fa#credential-provider Build Your Own 2FA for the Windows Logon, Part 3: Gating Network LogonsOct 11, 2026Part 2 refuses every network logon for an enrolled account, which makes the account safe and useless. Part 3 adds a gate you open once with a one-time code, so SMB, RPC and WinRM work again for a short window. In C++, with the full source.Doppio · 3-part series35 min · French Press#windows#lsa#ntlm#smb ADHardenKit: Hardening AD Without Breaking ItOct 7, 2026LDAP signing, SMB signing, NTLM, Kerberos with AES only. Every hardening checklist has them. I wrote a tool that turns them on in an order that doesn't break the domain.5 min · Cappuccino#active-directory#windows-server#powershell#hardening NTLM-Analyzer: Find Out Who Still Uses NTLMOct 3, 2026Windows logs a lot of NTLM activity, but you have to piece it together yourself. I built a tool that shows which users and programs still use NTLMv1 or NTLMv2, and what already runs over Kerberos.6 min · Cappuccino#active-directory#ntlm#kerberos#auditing Build Your Own 2FA for the Windows LogonSep 30, 2026How a Credential Provider works and how to build a working TOTP 2FA for local Windows accounts in C++. With rate limiting, replay protection and logging.Doppio · 3-part series60 min · French Press#windows#credential-provider#2fa#totp ADTierKit: Automatic AD-TieringAug 6, 2026I got tired of building tier models by hand, so I wrote a tool for it. One PowerShell script, one JSON file.3 min · Espresso#active-directory#windows-server#powershell#tiering