Field notes
Writing
Practical, reusable material for people who run lean IT operations. Newest first.
Triggering Cloudflare deployments with a Cron Worker
A 20-line Cloudflare Worker can trigger one daily static-site rebuild, keep its deploy hook secret, and make publication failures observable in its logs.
Scheduling Astro posts without GitHub Actions
When my free GitHub Actions allowance ran out, I moved Astro scheduling to a 20-line Cloudflare Worker that triggers one daily rebuild without CI at all.
Deploying Flask on IIS when Linux is not an option
How I run production Flask apps on Windows Server with IIS and wfastcgi: the web.config, the two 500 errors that cost me a day, and the deploy script that recycles the pool.
Reconciling group membership without lockouts
Safe Active Directory reconciliation separates adds from removals, protects critical groups, previews every change, and requires exact approval before changes.
Designing an access matrix PowerShell can enforce
A useful PowerShell access matrix needs 8 required fields, stable role IDs, synthetic test fixtures, and preflight validation before directory changes.
Role-based access without an IGA platform
A 7-stage request, approval, mapping, enforcement, and reconciliation loop gave my small IT shop consistent role access without claiming full IGA coverage.
Account provisioning in systems never built for you
The badge system, the time clock, the vendor portals: a 3-tier approach to account provisioning beyond AD, and why I only automate the top two systems.
HR-driven provisioning: hires and exits as data, not email
IT is always the last to know. How I wired hires and departures to the HR system with a 20-line export diff, and why the trigger beats any script.
Microsoft 365 onboarding: licenses, mailbox timing, Teams
Directory sync runs every 30 minutes and a new mailbox is not instant. How I sequence sync, licensing, and mailbox checks so day-one access actually works.
When to delete a former employee's account (and how)
A disabled account should not sit forever. My 90-day grace period, the pre-delete checklist, and the retention questions to answer before anything is gone.
The onboarding intake form that ended the email tag
The manager-facing form and 5-second approval gate that replaced my new-hire email threads: the fields, the validation that matters, and what it caught.
Revoke access everywhere: the offboarding ghost hunt
Disabling the account is step one. Here are the 7 places a user's access hides, the inventory that finds them, and the stale-login report that catches misses.
Automating offboarding in a one-person IT shop
Onboarding gets the attention. The account you forget to disable is the real risk. Here's my one-person-shop offboarding flow, and the 3 steps I keep manual.
Automating new-hire onboarding in a one-person IT shop
How I replaced a manual, error-prone new-hire checklist with a web form and a PowerShell provisioning script, plus the gotchas that made me keep a human in the loop.