MECM (formerly SCCM) 2012 R2 — PKI Certificate Enrollment Issues
When MECM (formerly SCCM) clients aren't picking up their PKI certificates after deployment, the fix is usually in the certificate template or AD enrollment.
Hello, I'm
Technology Professional
Consultant • Systems Engineering • Cloud Architecture • Cybersecurity
Technology professional based in Pittsburgh with nearly two decades of experience spanning systems engineering, cloud architecture, and cybersecurity.
My journey into tech started in an unexpected place — the arts. I studied ceramics, painting, sculpture, and digital media before discovering my passion at the intersection of creativity and technology. That background taught me to approach complex technical challenges with a creative mindset.
I hold industry-leading certifications in security and cloud platforms, and I'm driven by a simple philosophy: Learn, Acquire, then Apply.
When I'm not working, you'll find me playing volleyball, softball, exploring new languages, or tinkering with code.
Industry-recognized credentials in security, cloud, and identity management. Click any card to learn more.
The gold standard in cybersecurity certification. Validates expertise across 8 security domains including risk management, asset security, network security, and software development security. Recognized globally by enterprises and government agencies.
Proves proficiency in managing Azure cloud services including compute, storage, networking, and security. Covers identity management, governance, monitoring, and implementing virtual networks.
Validates expertise in designing and implementing identity and access management using Azure AD. Covers authentication methods, conditional access, identity governance, and privileged access management.
Demonstrates understanding of Microsoft Power Platform capabilities including Power Apps, Power Automate, Power BI, and Power Virtual Agents. Covers business value and platform components.
Tap to flip backValidates foundational knowledge of machine learning and AI concepts on Azure. Covers computer vision, natural language processing, conversational AI, and responsible AI principles.
Tap to flip backDemonstrates understanding of security, compliance, and identity concepts across Microsoft cloud services. Covers Zero Trust, shared responsibility, encryption, and compliance frameworks.
Tap to flip backValidates knowledge of Microsoft 365 cloud productivity services including collaboration tools, endpoint management, security, and licensing. Covers Teams, SharePoint, Exchange, and Intune.
Tap to flip backDemonstrates foundational knowledge of core data concepts and Azure data services. Covers relational and non-relational data, analytics workloads, Cosmos DB, and Azure SQL.
Tap to flip backThe entry-level Azure certification covering cloud concepts, core Azure services, security, privacy, compliance, and pricing. Foundation for all other Azure certifications.
Tap to flip backA globally recognized baseline cybersecurity certification. Validates skills in threat assessment, risk management, incident response, network security, cryptography, and identity management.
Recognizes contributions to nonprofit technology initiatives through Microsoft Change Agent program. Demonstrates commitment to using technology for social good.
Tap to flip backNotes, guides, and insights from two decades in IT — security-focused and field-tested.
When MECM (formerly SCCM) clients aren't picking up their PKI certificates after deployment, the fix is usually in the certificate template or AD enrollment.
When you need to capture an image from an OS that was upgraded (not clean-installed), Sysprep requires special handling.
Adding .NET Framework 4.0 as a step in a Configuration Manager (MECM/SCCM) task sequence for OS deployment.
Silencing the Autodesk CIP popup across an enterprise deployment.
Windows limits Sysprep to 3 runs by default. Here's how to reset the counter when you need to update your golden image.
When a machine won't pull its PXE boot advertisement in MECM (formerly SCCM), the fix is usually in the deployment settings, not the network.
Understanding how Outlook resolves names against the Global Address List and when it uses cached versus online lookups.
A quick fix for the blinking message light on Toshiba Strata handsets when there's no voicemail waiting.
The mysterious 'unexpected error occurred (error code -50)' on macOS usually isn't about file names at all.
When clicking links in Outlook opens nothing (or the wrong browser), the registry URL handler is usually the culprit.
Resolving the 'Error 25007 — could not load fusion with LoadLibraryShim' during .NET Framework installation.
How to update the registered owner and organization on a Windows machine via the registry.
First impressions of Windows Server 2008 R2 and the features that made it a landmark release.
Using DNS to provide automatic failover between geographically distributed servers.
When every switch in a building starts flashing in unison, you've probably got a switching loop. Here's what happened and how to prevent it.
How a power outage corrupted our Exchange public folder database and the recovery process that followed.
Active Directory is the central nervous system of most organizations. Understanding it is non-negotiable for any IT professional.
DNS is one of the most critical and least understood services in IT. Here's why every admin needs to understand it deeply.
How switching from ISP DNS to OpenDNS dramatically improved speed and security for our organization.
A look back at Microsoft's pivotal shift to 64-bit-only server platforms with Server 2008 R2.
A collection of scripts from over the years — refactored, modernized, and shared for posterity.
Detects any missing Remote Server Administration Tools (RSAT) capabilities on Windows 10/11 and installs them automatically. Enumerates all RSAT* Windows capabilities and adds any that are not present, then verifies the final state.
Checks when Group Policy was last applied by reading the machine extension timestamps from the registry and the Registry.pol last-write time. Returns true if either value exceeds a configurable threshold (default 30 days). Useful for compliance checks and monitoring.
Enterprise deployment script for Visual Studio Code with automatic updates disabled. Handles silent uninstall of previous versions, clean install with configuration, and replaces the product.json to strip the update URL. Designed for Configuration Manager or other deployment tools.
Performs a clean removal and fresh Installation of the Configuration Manager client. Copies ccmsetup binaries from a local cache or UNC path, uninstalls the existing client, reinstalls with specified site code and management point, then triggers all policy and inventory cycles.
Silent registry-based software uninstaller. Searches both 64-bit and WOW6432Node registry paths, auto-detects MSI vs EXE installers, and applies the correct silent switches. Designed for Configuration Manager deployment scripts and automation.
Decommissions Windows 7 systems from Active Directory and Configuration Manager. Searches AD for Win7 computer objects, disables and moves them to a decommission OU, then removes the device records from CM. Full lifecycle cleanup for legacy OS decommissioning.
Captures and restores the active Windows power scheme during OS upgrades. Run with -Capture before the upgrade to export the current scheme, then -Restore after to import it back. Designed for Configuration Manager task sequences.
Detects the primary disk number during a Configuration Manager task sequence and writes it to a TS variable. Most hardware defaults to disk 0, but edge cases exist. This ensures the Format Disk step always targets the correct drive.
Temporarily suspends BitLocker protection on the C: drive for a specified number of reboots. Useful before BIOS updates, firmware upgrades, or OS upgrades that would otherwise trigger BitLocker recovery mode. Protection resumes automatically after the reboot count expires.
Detects whether a VPN connection is currently active by querying CIM for network adapters matching common VPN client names. Works in environments where Get-VpnConnection isn't available. Returns true/false for easy use in conditional logic.
Reads a list of system names from a text file and adds each one as a direct membership rule to the specified MECM (formerly SCCM) device collection. Validates each device exists before adding and logs the results. Useful for bulk onboarding machines into deployment or patching collections.
Comprehensive Configuration Manager client repair script — completely removes the existing client, cleans up residual files and registry keys, then performs a fresh installation with full logging. Triggers all major policy and inventory cycles after install.
Registers the classic Windows Photo Viewer as an available application in Windows 10/11. Microsoft hid it in favor of the Photos app, but the DLL still exists. This script creates the necessary registry keys and file associations for common image types including .webp.
Prevents Remote Desktop sessions from disconnecting when Group Policy refreshes. When gpupdate runs it briefly resets the Terminal Server registry setting, dropping RDP sessions. This script enforces fDenyTSConnections to 0 so sessions survive the policy refresh.
Fully disables IPv6 on a Windows system by removing the adapter binding and setting the DisabledComponents registry key to 0xFF. Simply unchecking the binding in the adapter properties is not enough — this script handles both layers. A reboot is required afterward.
Resolves the Windows Installer error "The profile for the user is a temporary profile" introduced by security update MS14-049. Sets the SecureRepairPolicy registry value so installations proceed normally.
Launches a new elevated (Administrator) PowerShell session from the command line. Checks if the current session is already running elevated and only launches a new window if needed. Quick utility for those who don't want to right-click > Run as Administrator.
Retrieves the BIOS serial number and model name from a local or remote machine using CIM. The original version used WMIC, which Microsoft has deprecated — this version uses Get-CimInstance for the same result with better reliability.
Checks the Configuration Manager client cache size and corrects it if it was reset to the default 5 GB after a client repair. Queries the CIM namespace for the cache configuration and updates it if needed. Ideal as a scheduled task or GPO startup script.
Clears, initializes, partitions, and formats a disk using native PowerShell storage cmdlets. Replaces the manual DiskPart workflow with a safer, scriptable approach. Requires explicit confirmation because this operation destroys all data on the target disk.
Finds and removes disconnected mailboxes from an Exchange server. Can target a specific mailbox database and remove all or list them for review. Originally written for Exchange 2007, but the same pattern works on Exchange 2010 through 2019.
Fixes the "Outlook Web Access did not initialize properly" error on Exchange by removing and recreating the OWA virtual directory. Common after CAS role patches or IIS resets. Originally for Exchange 2007 but the same cmdlets apply to 2010 through 2019.
Converts Roman numeral strings to integers using a reverse iteration approach. The trick: walk the string backwards — if the current value is less than the previous, subtract it. Handles all standard subtraction pairs (IV, IX, XL, XC, CD, CM).
Grabs the current BTC/USD price from CoinGecko's free API and compares it against a target value. Uses requests with timeouts and proper error handling. Originally used the CoinDesk API, which has since been deprecated.
Checks if an integer reads the same forwards and backwards. Classic LeetCode problem (#9) — uses the string reversal approach for clean, readable code. Handles edge cases like negative numbers and single digits.
Reads volcano data from a CSV and plots them on an interactive Folium world map. Markers are color-coded by elevation — green under 1500m, orange 1500–2500m, red above. Uses the CartoDB dark theme for contrast. Output is a standalone HTML file.
Models my cats' reactions to various stimuli — show them something and they'll respond based on category: food, play, love, or startle. Originally part of a Flask web app, pulled into a standalone module with an interactive demo mode.
Interactive PowerShell greeting with timestamp. Demonstrates Read-Host, Get-Date formatting, and string interpolation. Accepts a -Name parameter to skip the interactive prompt for automation or piping.
Registry-based application uninstaller for Windows. Reads from both 64-bit and WOW6432Node registry paths instead of the slow Win32_Product WMI class. Supports -ListOnly to browse installed apps and -WhatIf to preview the uninstall safely.
Validates console color names against the System.ConsoleColor .NET enum. Uses PowerShell's type system for automatic validation — pass an invalid color and it throws an error before the script runs. Shows each color's name, integer value, and a sample block.
Validates IPv4 and IPv6 addresses using .NET's System.Net.IPAddress.Parse() instead of regex. Returns a structured object with the input, validity, address family, and normalized form. Using .NET's built-in parser avoids the pitfalls of IP address regex patterns.
Featured in industry publications and academic press.
Co-authored technical publication on mitigating enterprise security risks from remote work endpoints, covering endpoint management, security baselines, and zero-trust architecture.
Alumni feature profiling career path from IT education to Senior Systems Engineer at Carnegie Mellon University.