Reset a Windows Password with the Sticky Keys Trick (sethc.exe)

Alternative to the Utilman trick — replace sethc.exe to get SYSTEM-level cmd at the Windows lockscreen. When to use it, how to harden against it.

bpftrace One-Liners I Actually Use on Production Linux

Eight bpftrace one-liners that replace half of strace, iotop, and tcpdump without the perf hit. Real tracing for sysadmins on modern kernels.

Proxmox Backup Server — Why Snapshots Alone Aren't Enough

PBS gives you dedup + incremental + verify on top of Proxmox VE. Install, wire it as storage, first backup + restore, prune policy. The why and the how.

Headscale — Self-Hosted Tailscale Control Plane on Ubuntu

Run your own Tailscale control plane with Headscale. Docker compose setup, preauth keys, MagicDNS, point clients with --login-server. No vendor lock-in.

Caddy vs Nginx — When 5 Lines Beats certbot + Cron

Honest take on Caddy vs Nginx for small servers. Auto-HTTPS Caddyfile in 5 lines vs nginx + certbot. Where each one actually wins.

Pelican Panel — the Pterodactyl Successor I Switched To

Pterodactyl is in maintenance mode. Pelican Panel is the fork that's actually moving. Install on Ubuntu 24.04 + first gameserver in 20 min.

Tailscale for Gameservers — Friends-Only Without Port Forwards

Run a Minecraft, Valheim or Palworld server only your friends can reach. Tailscale mesh, MagicDNS, no DDoS surface, no router config.

RDP Hardening on Windows Server — NLA, IP Allowlist, and Audit

Lock down RDP on Windows Server — enforce NLA, restrict the firewall to specific IPs, audit failed logons, kill the bot brute-force traffic. The settings I run on every internet-exposed server.

Windows Server Hardening — Kill SMBv1, LLMNR, and NTLMv1

Three legacy protocols still enabled by default on Windows Server that no modern network needs. PowerShell one-liners to disable each, the rare exceptions, and how to verify.

BitLocker on Windows Server — Encrypting the OS Volume Without Locking Yourself Out

Enable BitLocker on a Windows Server OS volume via PowerShell — TPM unlock, recovery key handling, the boot quirks specific to Server, and how to unlock from WinPE.

Satisfactory Dedicated Server on Linux — Native, Lightweight, and Boring (in the Best Way)

Set up a Satisfactory dedicated server on Ubuntu via SteamCMD. Native Linux build (no Wine), small RAM footprint, ports, claim flow, save backups.

ARK Survival Ascended Dedicated Server on Linux — Wine, 16 GB RAM, and Patience

How to run an ARK Survival Ascended dedicated server on Ubuntu via SteamCMD and Wine. Real RAM requirements, ports, mods via CurseForge, weekly restart strategy.

Migrating from BungeeCord/Waterfall to Velocity — A Practical Walkthrough

How to migrate a Minecraft proxy network from BungeeCord or Waterfall to Velocity — config translation, plugin replacements, modern IP forwarding, and the gotchas.

Hosting a Forge / NeoForge Modpack Server on Linux — The Pragmatic Guide

Run a CurseForge or Modrinth modpack server (Forge / NeoForge) on Ubuntu. Server-pack download, JVM tuning for modded RAM appetite, systemd unit, update workflow.

LuckPerms on BungeeCord and Velocity — Permissions That Actually Scale

Install LuckPerms on a Minecraft proxy network, sync permissions across backends, define groups and inheritance, avoid the per-server-permission trap.

Waterfall vs BungeeCord — Which Minecraft Proxy Should You Run?

BungeeCord vs Waterfall in 2026: Waterfall is end-of-life, so what to run instead, what still works, and when Velocity is the real answer.

BungeeCord config.yml — Every Option Explained

Full breakdown of BungeeCord's config.yml — listeners, servers, IP forwarding, priorities, the options nobody documents and the ones that bite you.

Velocity Minecraft Proxy — Setup From Scratch in 10 Minutes

Stand up a Velocity proxy on Linux from zero — install, velocity.toml, modern IP forwarding to Paper backends, systemd unit, firewall. The clean install, no BungeeCord baggage.

Restic Backups to S3 / MinIO — Encrypted, Deduplicated, Restore-Tested

Real backup setup with Restic — encrypted offsite to S3 or self-hosted MinIO, dedup, retention, and the restore-drill that proves your backups actually work.

Active Directory Part 3 — GPO Hardening for the Whole Domain

The GPOs every domain should have — password policy, account lockout, audit, RDP restrictions, SMBv1 / LLMNR / NTLMv1 kill, BitLocker enforcement. The defaults are not enough.

Active Directory Part 2 — OUs, Users, and GPO Basics

Build a sane AD structure — OU layout, user and group provisioning via PowerShell, first GPO. The patterns that scale from 10 users to 1000.