Soar Systems Blog

Azure App Secret Expiry Alerts

TLDR * Built a Python monitoring tool that checks Azure App Registration secrets and certificates for upcoming expiration. * Authenticates via service principal or managed identity and queries Microsoft Graph API. * Sends alerts through Slack and email with configurable thresholds at 90, 60, 30, 14, and 7 days. * Single-file script, no framework

Manage AD Accounts - Part 2

TLDR * Ran the AD Account Manager (covered in Post 1) through an AI code review using Claude Opus before publishing to GitHub. * 21 issues found: 5 critical, 4 high, 6 medium, 3 performance, 3 best-practice. * This post documents every finding. The next post covers the fixes — the cleaned-up version is

Manage AD Accounts - Part 1

TLDR * Built a PowerShell Windows Forms GUI for managing Active Directory contractor accounts. * Three roles — SuperAdmin, HelpDesk, ContractorManager — each with different permissions enforced at every action. * Searches across multiple OUs, updates expiry dates, disables accounts, and logs everything. * Designed for Intune deployment: drop a .ps1 and a config.json, runs

NirvanaLink

TL;DR * Built a serverless astrology, numerology, and feng shui app on AWS to test Lambda + CloudFormation after a coworker wouldn’t stop recommending it. * The standout feature: BaZi Travel — recommends vacation destinations based on your Kua compass lucky directions, so each city tells you what TYPE of luck it

AD Automated Access Management

TLDR * HR exported employee data from Paylocity every two weeks. Syncing it to Active Directory was manual and error-prone. * Built a PowerShell script to automate the full lifecycle: onboarding, offboarding, rehires, attribute updates. * Went through 13 versions over 5 months as edge cases kept surfacing from real Paylocity exports. * After

The Day CrowdStrike Took Down the World: How We Responded

Incident · July 19, 2024 CrowdStrike Falcon · C-00000291*.sys · BSOD boot loop · 4,000+ workstations + servers · 200+ locations TLDR 1. CrowdStrike pushed a bad update Friday morning. 4,000+ workstations across 200+ gym locations were hit, and servers had to be recovered too. 2. At the 8 AM IT meeting, servers

RustDesk Deployment

TLDR * Needed self-hosted remote access across 100+ club locations. Commercial tools were too expensive at that scale. * Deployed RustDesk with a self-hosted relay server. No per-seat fees, all traffic through our infrastructure. * Built a PowerShell script that silently configures the client, sets the server connection, and returns the RustDesk ID.

Google Workspace GAM

TLDR * Google admin console doesn't scale for bulk operations across hundreds of users and groups. * Built a set of scripts around GAM (Google Apps Manager) for bulk group management, user archiving, and membership extraction. * PowerShell, Python, and Bash variants for Windows and macOS. BulkGroup ops AutoUser archiving CrossPlatform

Active Directory Reporting Suite

TLDR * No visibility into what was changing in Active Directory week to week. * Built a suite of reporting scripts that run on a schedule and email results to the ops team. * Covers weekly change reports, stale workstation detection, expiring account alerts to managers, and Paylocity data cross-reference. WeeklyChange reports DailyHardware

AWS IAM Automation

TLDR * IAM users spread across multiple AWS accounts. Offboarding meant logging into each console individually. * Built a Python script with boto3 that iterates across AWS profiles, disables console access, deactivates API keys, and logs everything to Excel. * One failure doesn't block the rest of the batch. MultiAWS accounts

Active Directory Automation Scripts

TLDR * 100+ club locations, each with workstations that needed correct security group assignments and OU placement in AD. * Built scripts that extract the club number from the hostname and dynamically assign groups and move workstations. * Separate script catches new workstations sitting in the default Computers container. * Also includes bulk OU

Windows Server Automation

TLDR * Windows Server backups were local only. No offsite copy. * Built an 8-line batch file that syncs the backup drive to S3 daily, organized by date. * aws s3 sync only transfers the delta, keeping costs and transfer time low. * S3 lifecycle policies handle retention automatically. DailyS3 sync DeltaTransfers only 8Lines

PowerShell Endpoint Management

TLDR * 100+ club locations, each with multiple printers that needed to be set up silently on every new or reimaged workstation. * Built per-club scripts (one per location) and per-model scripts for common printer models. * Also includes network reset utilities, Windows Update checks, and a barcode scanner reboot tool for club