Other

Start here

• Capture browser network traffic: Troubleshoot awkward browser issues with the built-in NetLog capture.
• Check lookalike domains: Start a reviewed baseline for domain impersonation checks.
• Review Protected Users: Test stronger protections for privileged Active Directory accounts.

In this section

• Capture network traffic in Chrome and Edge
  Use the browser's built-in NetLog capture to troubleshoot awkward network issues.
• Check lookalike domains with dnstwist
  Find and triage domain variants that could be used to impersonate your organization.
• Collect files with OneDrive file requests
  Use an upload-only link to collect files without exposing the destination folder.
• PowerShell 7 and ForEach-Object -Parallel
  Process independent work in parallel with PowerShell 7 and a sensible throttle.
• Privileged accounts and Protected Users
  Test Protected Users for privileged Active Directory accounts to restrict NTLM and credential delegation.
• Restart Windows directly into firmware settings
  Skip the race to press a startup key with Windows' firmware restart switch.
• Review guest resharing in SharePoint and OneDrive
  Review whether guests can reshare items they don't own, alongside their site permissions.
• Use an allowlist for VS Code extensions
  Control VS Code extensions with an enforced allowlist and keep reviewing approved extensions.
• Windows has a built-in openfiles utility
  Use Windows openfiles for local file-handle troubleshooting, with the required tracking and restart.