Microsoft infrastructure engineering.

PKI rebuild and Exchange Server SE

Rebuilt the lab certificate hierarchy with a root CA and issuing CA on Windows Server 2025, using RSA 4096 and SHA-256 for the subordinate CA request. Published certificate and revocation files through IIS and used the internal PKI for service HTTPS.

• Installed Exchange Server Subscription Edition on Windows Server Core.
• Moved the user mailbox into a new mailbox database.
• Troubleshot ECP authentication and certificate configuration; sign-in was restored and HTTPS used the internal PKI certificate.
• Extended certificate-trust work to Kubernetes services and the infrastructure dashboard.

The demonstrated outcome is working internal mail administration and PKI-backed HTTPS. Internet mail hosting is a separate planned project.

Identity and isolated security practice

Transferred Active Directory FSMO roles to the replacement domain controller and documented identity recovery procedures. Built a segmented Kali and Windows 11 learning lab, resolving VLAN/DHCP and enhanced-session issues and inspecting SMB protocol support on the lab target.

A FIDO-only security key was evaluated for Windows sign-in. Its lack of PIV was identified; domain smart-card sign-in was not claimed as implemented.

SharePoint Server Subscription Edition

Built an on-premises SharePoint environment on Windows Server 2025 to provide an internal collaboration and OneDrive-style experience.

• Designed SQL data and log placement and configured server memory boundaries.
• Created dedicated farm and service identities following separation-of-duties principles.
• Configured portal and MySites web applications, content databases, managed metadata, user profiles, and supporting service applications.
• Implemented internal PKI certificates, HTTPS bindings, and integrated authentication.
• Tuned search services and system resources to improve page performance.

Configuration Manager deployment engineering

Developed SCCM operating-system deployment workflows for virtual servers, including PXE boot, task sequences, driver support, and in-place upgrade planning.

• Resolved VMXNET3 PXE compatibility and driver-import issues.
• Tuned TFTP block size to improve boot-image transfer performance.
• Built PowerShell task-sequence steps that run safely as Local System.
• Worked through site-upgrade prerequisite failures and client boundary configuration.
• Planned Software Center-initiated in-place upgrades for Windows Server virtual machines.

Active Directory and Windows operations

• Created Group Policy designs for RDP, Windows Update behavior, firewall configuration, and enterprise client settings.
• Automated account, group membership, server inventory, reboot history, and domain-migration tasks with PowerShell.
• Troubleshot failover clustering, NTFS corruption, SQL-hosted applications, authentication, DNS, and Windows Server lifecycle issues.
• Built prerequisite automation for System Center Operations Manager and Orchestrator.

Approach

The common design principle is repeatability. GUI configuration is documented, then moved into PowerShell, Group Policy, task sequences, or version-controlled deployment files wherever practical. That reduces one-off knowledge and turns troubleshooting discoveries into reusable operating procedures.