PowerShell for real administration

Windows 11 includes useful security controls, but a hardening checklist can cause lockouts or break older devices if it is applied as a single blind script. The right settings depend on whether the PC is standalone, managed by an organization, used for Remote Desktop, or still needs legacy network equipment. Run administrative commands from an elevated PowerShell window and keep a tested recovery administrator account available. Quick answer Start with a current backup, Windows Update, standard user accounts for daily work, Microsoft Defender Firewall enabled, and Windows Security protections enabled. Disable unused Guest access and SMBv1, turn off LLMNR where your network supports it, require NLA if RDP is enabled, and audit Defender ASR rules before enforcing them. Hiding an account tile is cosmetic, and setting PowerShell’s language mode from a script is not a security boundary. ...

Microsoft Edit is installed on the Windows host, PowerShell finds edit.exe, and New-Item successfully creates myTest.txt. Yet running edit .\myTest.txt inside Enter-PSSession returns Error 0x80070006: The handle is invalid. This is confusing because the executable and file are both present. The failure is caused by the session type: a WinRM PowerShell remoting session does not provide the normal interactive console handles that a full-screen terminal editor expects. Quick answer Nothing in the screenshots indicates a broken Edit installation or a file permission problem. Edit does not work in the shown WinRM Enter-PSSession because PSRP does not provide the console handles its TUI needs. There is no setting, permission change, or reinstall that fixes this within that session type. Use a direct interactive SSH terminal with a PTY instead; the fifth screenshot confirms Edit works there. Enter-PSSession -HostName is still a PowerShell remoting session, not the direct SSH shell shown in the screenshot. ...

Running wsl --update in an administrative PowerShell terminal is the standard way to update the Windows Subsystem for Linux kernel and user-mode packages. However, on machines running active background updates, scheduled software deployments, or incomplete reboots, the update process can terminate immediately with exit code 1618 and error code Wsl/UpdatePackage/0x80070652. This error occurs because the modern decoupled WSL package installs via the Windows Installer engine (msiexec.exe). Windows Installer allows only one active installation transaction across the entire operating system. When another process holds the global installer mutex, WSL cannot start its transaction and exits with a Win32 installation conflict. ...

When I am connected to a Windows host through Enter-PSSession, I sometimes need to make a quick change to a configuration file. Starting Notepad is not the answer: a graphical window belongs to an interactive desktop, and PowerShell remoting does not forward that desktop to the machine where I am sitting. Other GUI editors have the same basic limitation. A terminal editor is the right shape for a remote shell, but the transport matters: SSH gives a conventional terminal, while a WinRM PowerShell session is a remoting host, not a complete remote console. ...

A second Windows account can be allowed to sign in over Remote Desktop without making it an administrator. The account needs permission on the host, a usable password, and a Windows edition that can accept incoming RDP connections. Adding it does not provide a second simultaneous desktop: Windows 11 client editions are designed for one interactive session at a time. Quick answer On the Windows 11 PC that will receive the connection, open Settings > System > Remote Desktop > Remote Desktop users, select Add, enter the second account, and confirm it. Or run Add-LocalGroupMember -Group “Remote Desktop Users” -Member “$env:COMPUTERNAME\rdpuser” in an elevated PowerShell window, replacing rdpuser with the local account name. The account must have a password. This grants that account permission to use the existing RDP session; it does not enable two users to work in separate sessions at once. ...

For many system administrators, version control began as a folder full of scripts named backup-script-v1.ps1, backup-script-v2-final.ps1, and backup-script-v2-final-REALLYFINAL.ps1. Moving to Git solved local versioning, but modern IT operations require central collaboration, peer review, backup, and automated deployment. This is where GitHub becomes indispensable. GitHub transforms isolated scripts on administrator laptops into structured, collaborative infrastructure. Whether you manage PowerShell modules, Terraform definitions, Docker containers, or static documentation sites, understanding how GitHub works—and how to interact with it securely—is essential. ...

Setting up a robust developer or systems administration workstation often requires working across both native Windows (PowerShell) and a Linux subsystem (WSL). Because version control coordinates configurations, automation scripts, and application source code, having Git installed and configured correctly in both environments is a fundamental prerequisite. Without deliberate setup, administrators frequently encounter annoying friction: entering GitHub or GitLab personal access tokens repeatedly inside WSL, running into permission errors on cross-mounted drives (/mnt/c/), or corrupting shell scripts because Windows inserted carriage return (CRLF) line endings into bash scripts. ...

When an IT department transitions from individual administrators writing scripts on isolated workstations to a collaborative engineering team, managing access on a per-person basis quickly becomes unmaintainable. An administrator leaves the company, and their individual account must be manually unlinked from dozens of repositories; a new engineer joins, and someone spends hours granting them access one repository at a time. GitHub solves this organizational sprawl through GitHub Organizations and Teams. Teams allow leads to implement role-based access control (RBAC), enforce security boundaries, automate code reviews, and maintain a clear audit trail across shared infrastructure code, PowerShell modules, and deployment templates. ...

While public cloud platforms like GitHub and GitLab are ubiquitous, many enterprise environments, air-gapped networks, and privacy-conscious organizations require keeping their source code and automation scripts entirely on-premises. Storing internal credentials, proprietary PowerShell modules, and infrastructure configurations within your local LAN ensures compliance, eliminates third-party cloud outages, and gives administrators complete sovereignty over their data. However, setting up a bare Git server with plain SSH shared folders lacks the collaborative features teams expect: interactive code browsing, visual diff comparisons, issue tracking, organization teams, branch protection, and Pull Request reviews. ...

Running git status in a repository that was working perfectly fine yesterday and getting hit with this: fatal: bad object HEAD fatal: 'git status --porcelain=2' failed in submodule web/hugo/hugoweb/h2 The error appears as two fatal lines: the first on the main repository and the second propagating into a submodule. This is one of those errors that feels worse than it is. The repository is not gone. The commits are almost certainly intact. What has failed is Git’s ability to resolve the name HEAD to a valid commit object, which breaks nearly every Git command that needs to know what the current state of the repository is. ...