Public log
Corrections
When a published KBY Technologies page turns out to be wrong or unsafe, it is corrected or taken down, and the change is listed here, newest first, with the date (UTC), what was wrong and what changed.
Where a sweep corrected many pages at once, the entry gives the count and names only the pages the change record names. Withdrawn pages are not linked because they no longer load.
Found something wrong? Use Report a problem at the end of any article. Reports go to the site owner and are used to correct pages.
A check used Get-MgDeviceManagementManagedDevice with a -DeviceId parameter, which does not exist; it now passes the managed device ID with -ManagedDeviceId.
A step ran Get-DnsServerConditionalForwarderZone, which does not exist; conditional forwarders are listed with Get-DnsServerZone filtered on zone type Forwarder, as the next line already did.
Four references to Update-MgIdentityGovernanceAccessReviewDefinition, which does not exist, now use Set-MgIdentityGovernanceAccessReviewDefinition, which replaces the access review definition.
Two links pointed at an old macOS category path and now go to the current one, an empty "Next safe decision" heading was removed, and the step that used fdesetup changerecovery to look for a recovery key now says that running the command generates a new key.
- Post 5394
A link to a retired Config Trap now goes to the trap that replaced it, and the phrase "on-premises-style shared component" was reworded.
- Post 5454
A sentence about how DNS zone transfer settings replicate was wrong and was corrected.
- Post 2445
Four articles linked to category pages that never existed and returned 404. Three now link to /software-architecture and one to /security-operations.
- Post 958
- Post 2732
- Post 130
- Post 572
Windows paths had been saved without their backslashes (for example C:Tempgpreport.html). The backslashes were restored, and a scan of every published article found no others.
- Post 3472
- Post 3289
- Post 945
The page summaries and search descriptions of 66 corrected articles still repeated errors already corrected in the body. All 423 corrected articles were checked, and only the summaries that contradicted the correction were rewritten.
The change record gives a count only, so no page is named here.
Third review round of articles the sweep had never checked: 109 published articles corrected with 451 exact text edits, each finding judged against vendor documentation; 53 more were checked and needed no change. Titles corrected on four of them.
- Post 1519
- Post 5012
- Post 3405
- Post 4349
Two Config Traps could not be corrected and were retired: one had no symptom, cause or fix, and the other misstated how IAM policy evaluation works. Each now redirects to the nearest correct trap.
- Post 2867
- Post 4190
First two review rounds of articles the sweep had never checked, highest traffic first: 164 published articles corrected, each finding judged against vendor documentation; 47 more were checked and needed no change. Titles corrected on five of them.
- Post 2077
- Post 2725
- Post 4543
- Post 4002
- Post 1195
40 Config Traps repeated another page's problem and fix. They were unpublished, and each now redirects to the page it repeated.
The change record gives a count only, so no page is named here.
The title was wrong and was corrected. It now reads "AdminSDHolder Also Resets ACLs on Groups Nested Below Domain Admins".
- AdminSDHolder Also Resets ACLs on Groups Nested Below Domain Adminspost 4263
473 exact text edits to 58 published articles the fact-check sweep had flagged. Typical fixes: paths and line continuations that had lost backslashes, cmdlets, CLI flags and API fields that do not exist, wrong defaults and condition keys, and irreversible steps given without a backup or rollback.
The change record gives a count only, so no page is named here.
A saving bug stripped backslashes (Windows paths, escape sequences, shell line continuations) from seven articles during the sweep. Each was restored to its text from before the sweep, with the backslashes intact; post 1023 was then corrected again, and the other six were left on that earlier text.
7 pages named in the change record (WordPress post IDs)
- Post 2430
- Post 2452
- Post 2068
- Post 1149
- Post 2372
- Post 2671
- Post 1023
Article sweep, batches 3 to 7: 220 published articles fact-checked by AI in order of search impressions. 99 were corrected, by exact edits or a rewrite of the article, and the corrected text passed the fact check again; 70 passed unchanged.
99 pages named in the change record (WordPress post IDs)
- Post 3661
- Post 2079
- Post 3583
- Post 875
- Post 410
- Post 2478
- Post 2452
- Post 2406
- Post 2384
- Post 291
- Post 2522
- Post 339
- Post 395
- Post 1851
- Post 3550
- Post 2451
- Post 1197
- Post 4531
- Post 841
- Post 3697
- Post 3388
- Post 3535
- Post 196
- Post 278
- Post 2371
- Post 4035
- Post 2985
- Post 254
- Post 3804
- Post 2665
- Post 253
- Post 249
- Post 2342
- Post 2061
- Post 2387
- Post 799
- Post 4002
- Post 870
- Post 3747
- Post 3425
- Post 2472
- Post 1112
- Post 939
- Post 821
- Post 920
- Post 3172
- Post 3232
- Post 641
- Post 619
- Post 935
- Post 546
- Post 726
- Post 125
- Post 2063
- Post 958
- Post 4199
- Post 2491
- Post 2445
- Post 662
- Post 4543
- Post 3472
- Post 286
- Post 248
- Post 4171
- Post 3616
- Post 3268
- Post 3052
- Post 2552
- Post 685
- Post 347
- Post 266
- Post 4157
- Post 3119
- Post 2363
- Post 2261
- Post 2249
- Post 1211
- Post 633
- Post 548
- Post 476
- Post 462
- Post 384
- Post 345
- Post 5129
- Post 4718
- Post 3783
- Post 120
- Post 2464
- Post 2284
- Post 1190
- Post 671
- Post 5225
- Post 2579
- Post 2378
- Post 1023
- Post 826
- Post 737
- Post 41
- Post 3686
Article sweep, batches 1 and 2: 46 published articles fact-checked by AI, most-searched first. 15 were corrected, by exact edits or a rewrite of the article, and the corrected text passed the fact check again; 24 passed unchanged.
15 pages named in the change record (WordPress post IDs)
- Post 3289
- Post 734
- Post 2352
- Post 3880
- Post 1058
- Post 874
- Post 2107
- Post 945
- Post 1223
- Post 463
- Post 2446
- Post 2732
- Post 2430
- Post 2414
- Post 967
Six fixes: a warning that the fio job destroys data on the target drive, backup and device-identity checks before the secure erase, a corrected fio command, and corrected statements about nvme-cli and smartctl output and the warning_temp_time reading.
Paths containing spaces are now quoted, an unsupported claim about "error 10002" was removed, a System Settings path that could not be confirmed was made general, and a stray "nn" was removed.
- Platform SSO Configuration Failurepost 4158
Withdrawn. Its remediation script reassigned every stalled device to a different MDM server with no person approving it and no limit per run, which could move devices away from another team's or tenant's server. It may return once that step needs a person's approval.
- Fixing Stalled Automated Device Enrollment Loops for Goodpost 2269/ops-playbook/macos-device-management/fixing-stalled-automated-device-enrollment-loops-for-good
Step 3 now says to back up the BitLocker recovery key and local administrator credentials before a Retire, because a Retire removes the Entra ID record of an Entra-joined device that is not registered in Autopilot. Step 4 now deletes the device from Intune before deregistering it from Autopilot.
Vendor documentation the correction relied on
Steps 4 and 6 gained the same note about what a Retire does to an Entra-joined device, and the hybrid Remove-ADComputer step now says to back up any BitLocker recovery information held in Active Directory first. That step is marked untested.
Vendor documentation the correction relied on
The rollback section offered Retire for lost or compromised devices. It now names Wipe for them, says what a Retire does to an Entra-joined device, and says to back up the BitLocker recovery key and local administrator credentials first.
Vendor documentation the correction relied on
An undefined pilot drill, "revoke and reissue a device from the console", was removed. Step 3 now warns against using device-record deletion in Kandji or certificate revocation in Jamf as drills.
The "Apple ID ownership loss" failure mode treated every lost account as needing a new push certificate and a full re-enrolment. It now separates an account that can be recovered (recover it, then renew) from one that is gone.
Withdrawn. Its Stage 3 runbook deleted every managed device idle for 60 days, on every platform, with no scoping.
- Automating Stale Device Cleanup and Alerts in Intunepost 2277/graduate/automation-and-service-operations/automating-stale-device-cleanup-and-alerts-in-intune
Withdrawn. Its rollback deleted a batch of Entra ID device objects, which cannot be undone and deletes their BitLocker recovery keys.
- Deploying Windows Autopilot Device Preparation for New Hirespost 2536/graduate/endpoint-and-device-management/deploying-windows-autopilot-device-preparation-for-new-hires
Vendor documentation the correction relied on
Withdrawn. Step 7 ran profiles renew -type enrollment across a whole Smart Group as a routine check-in.
- Ending macOS Password Lockout Tickets With Bootstrap Token Auditspost 2056/ops-playbook/macos-automation-scripting/ending-macos-password-lockout-tickets-with-bootstrap-token-audits
Withdrawn. Stage 6 decommissioned AD FS on a time gate alone, without first checking that no relying party still had traffic, and Stage 1 removed "orphaned SIDs" with no definition and no backup.
- Zero-Downtime Cloud Identity Migration from ADpost 364/tech-fundamentals/zero-downtime-cloud-identity-migration-from-ad
A failure-table row told readers to remove the device's Entra ID record, with no exception for Autopilot devices and no warning that deleting a device also deletes its BitLocker keys and cannot be undone. The row now covers both. (The page was withdrawn the same day; see the entry above.)
- Automating Stale Device Cleanup and Alerts in Intunepost 2277/graduate/automation-and-service-operations/automating-stale-device-cleanup-and-alerts-in-intune
Vendor documentation the correction relied on
Step 5 deleted the device's Entra ID object with Remove-MgDevice, and the rollback said it could be restored. Deleted devices cannot be recovered, so the deletion step was removed and the rollback corrected.
Vendor documentation the correction relied on
The earlier correction told readers never to delete any device's Entra ID object by hand. That advice is now limited to devices registered in Windows Autopilot, which is what Microsoft's guidance covers.
Vendor documentation the correction relied on
The guide told readers to delete the device's Entra ID object by hand, to deregister it from Autopilot without first deleting it from Intune, and to Retire a lost or stolen device. It now deletes the device from Intune first, names Wipe for lost or stolen devices, and no longer deletes the Entra ID object by hand.
Vendor documentation the correction relied on