About

In two lines

My name is Alessio Rosati and I work as a systems administrator. This site is where I write down the things I had to work out on the job, usually because the official documentation stopped one step short of where I was stuck.

It is not a company blog and it sells nothing. No advertising, no sponsorships, no affiliate links.

What you will find

Guides on Intune, Entra ID, Microsoft 365, Windows Server, Cisco and Linux. They are written in the order you actually do things, with the errors placed where they happen rather than collected in a "known issues" list at the end.

A vulnerability tracker, which is the less usual part and the one I care most about.

How the tracker works, and why it is not just another list

It cross-references three public sources: NIST's NVD for the records and CVSS scores, the CISA KEV catalogue for confirmed exploitation in the wild, and FIRST's EPSS for the probability that a vulnerability gets exploited within the next thirty days. It refreshes itself every two hours.

The ten vendors it follows are selected by CPE identifier, not by keyword. That distinction is tedious to explain and enormous in its results: searching descriptions for the word "Linux" returns every vulnerability that merely mentions Linux, and the previous version of this tracker had accumulated thousands of wrong entries that way. Now a vendor is the value declared in the CPE, and it is either there or it is not.

The default ordering puts what is being exploited right now first, not what scores highest. A 7.5 that ransomware crews are using today deserves your attention before a theoretical 9.8 nobody has touched.

What I do not do

I do not publish a page per CVE just because it exists. Tracker entries are useful to consult, but until one carries analysis of my own it ships with noindex: it is already on NVD, and filling a search engine with copies helps nobody. That rule lives in the database, not in a template's good intentions.

I do not rewrite Microsoft documentation. If something is explained well elsewhere, I link it and move on.

I do not publish daily. In this field one guide answering an error message nobody has documented is worth more than seven repeating what you already know.

On being straight about sources

Three of the guides currently published are adaptations of articles by Aymen EL JAZIRI (Microsoft MVP, cloudsecop.com), and they say so at the foot of the page with a link to the original. I am rebuilding them from my own lab: once rewritten, the attribution will go because nothing derived will remain. While it is derived, the credit stays.

Where you see "verified on", it means that on that day I walked the steps through on a real system. Portal screens change quickly: if something no longer matches, write to me — it is the most useful message I can get.

Contact

alessio.rosati@impicciando.it — corrections, reports, or a guide you wish existed and cannot find anywhere.

The site has no comments and collects nothing about you: see the privacy and cookie policy.