Endpoint engineer · Slovakia
I make company devices secure by default.
I build Microsoft Intune setups end to end: enrolment, apps, CIS-hardened baselines, compliance and Conditional Access, for Windows 11, iOS and Android.
01 · Endpoint management
10 projects, each building on the last: enrolment, apps, updates, hardening and compliance. Every card opens the full write-up on GitHub.
Field note · from production
Intune reported the LAPS policy as succeeded, yet a few brand-new devices never created the managed account. An Autopatch report gave it away: they had shipped on Windows 11 21H2, and automatic account management needs 24H2 or later.
| 21H2 | 25H2 | |
|---|---|---|
| Backup to Entra ID | ✓ yes | ✓ yes |
| Automatic account | ✗ ignored | ✓ created |
| Account in Entra | Administrator | Custom account |
6 projects
Built in order on one lab tenant: provision the device, deliver apps, keep it patched, then lock it down.
Zero-touch Windows 11 provisioning with no on-premises AD, a Group Tag driven dynamic group and an Enrollment Status Page that holds the desktop until setup finishes.
The three ways to ship software through Intune: a Store app, the Enterprise App Catalog, and a custom Win32 package with its own detection and requirement rules.
A user-driven device preparation policy with no hardware hashes, up to 10 apps and scripts before sign-in, compared step by step with traditional Autopilot.
Quality, feature, driver, Microsoft 365 Apps and Edge updates rolled out through five rings, with every device moved to Windows 11 26H2 and no hand-built update policies.
A compliance policy requiring BitLocker and Secure Boot, a security baseline, XTS-AES 256 BitLocker with recovery keys in Entra ID, and the full CIS Windows 11 Level 2 policy set.
Configuration profiles matching the CIS Windows 11 v3.0.1 Level 1 benchmark, exported so another tenant can import them in one step.
1 project
Personal iPhones enrolled through Company Portal, protected with CIS hardening, compliance and App Protection.
A personal iPhone enrolled through Company Portal, hardened with the CIS iOS End User profile, with an Apple push certificate, a compliance policy and App Protection for Microsoft 365 apps.
1 project
Company-owned phones, fully managed from the first boot.
Samsung phones enrolled by QR code, hardened to CIS Android v1.5.0, set up with work apps and blocked from Microsoft 365 when they fall out of compliance.
1 project
Getting endpoint and identity logs into a SIEM, ready for detections.
An Active Directory domain and a Windows 11 workstation on Hyper-V, sending Security, System and Sysmon logs to Splunk Enterprise as the base for detections and attack simulation.
02 · Toolkit
Every item here is used in at least one of the projects on this page.
Getting devices enrolled and ready without touching them.
Baselines that turn a benchmark into enforced settings.
Only healthy devices reach company data.
Keeping a fleet current and seeing what happens on it.
03 · Lab
A small server that holds my storage, runs the network controller and home automation, and gives me somewhere safe to break things.
A four-bay server with a Noctua fan and thermal pads for sustained load, running Unraid with a parity drive and an SSD cache.
04 · Research · wireless and embedded
Across my bachelor's and master's theses I built a model of a car's remote locking system at 433 MHz, attacked it with hardware I made, then redesigned it to detect those attacks.
Two Arduinos acting as a car remote and a door lock, talking over 433 MHz.
A Raspberry Pi and RTL-SDR in a waterproof case that records a remote and plays it back.
A cheap jammer for the band most European car remotes use.
A rolling counter in every command, so a replayed signal is spotted and refused.
05 · About
I studied security technologies at Tomas Bata University in Zlín and work on endpoint and infrastructure security, mostly with Microsoft Intune and Microsoft 365.
My interests also cover security monitoring, mobile app analysis and vulnerability research, plus radio: SDR tools, RF signals, wireless systems and embedded devices. Knowing how a system gets attacked is what makes the defence worth trusting.
Education