Engineering products, not side projects. Everything here started as a real business problem — most of it at ~384,000-endpoint scale. Public tools link to live sites and source on GitHub; internal platforms are presented as case studies.
Flagship Case Study
Rescuing ~10,000 endpoints from an unrecoverable state
~10,000
Devices saved from becoming unrecoverable
$18M–$24M
Estimated hardware replacement avoided
~384K
Endpoint fleet the fix was validated against
The problem. Roughly 10,000 enterprise Windows devices were trending toward an unrecoverable state. A failed Trellix DLP uninstall left an orphaned device-filter driver still registered in Windows, so on reboot the OS tried to load a driver that no longer existed — taking the machine's network (Wi-Fi and Ethernet) and USB down with it. With no network, the affected devices couldn't be reached by Intune or any remote-management tool: the kind of failure that ends in re-imaging or physically replacing hardware in the field.
Why it mattered. At fleet scale, a silent failure mode isn't a 10,000-ticket inconvenience — it's an estimated $18M–$24M capital hit in hardware replacement (~10,000 devices at $1,800–$2,400/device), plus the operational cost of touching thousands of machines spread across stores and facilities.
What I built. Trellix-Cleanup — a PowerShell remediation deployed as an Intune Proactive Remediation (detect, then fix) that confirms the product is genuinely gone by cross-checking both installed programs and running services, then surgically removes only the orphaned driver entries while preserving every other filter driver. It backs up each affected registry key to a timestamped export before touching anything, aborts if that backup fails, supports a WhatIf preview, and can undo everything it does — so it reliably fixes broken machines and provably leaves healthy ones alone. The same fix runs as a local rescue script for devices already offline.
The engineering lesson. A remediation that touches hundreds of thousands of endpoints is only as good as its blast-radius controls: detect precisely, correct safely, and validate against the fleet before you scale. The number that matters most here isn't the money saved — it's zero devices made worse.
AI Platform · Internal
AI Story-Intake Platform
Problem: Engineering requests arrive as unstructured plain English. Turning them into well-formed, sprint-ready Jira stories is slow, and quality varies by author.
Built: An AI-powered web application that converts plain-English requests into INVEST-compliant Jira stories, routes every story through human approval, and files approved work via direct Jira integration — secured with Microsoft Entra ID single sign-on (SSO).
Stack: Generative AI with Jira integration; internal platform.
Impact: Standardizes story quality at the point of intake, cutting recurring backlog-grooming overhead and giving the team back planning time.
Lesson: AI output ships only behind a human-in-the-loop approval gate — the model drafts, an engineer decides.
PowerShell Framework · Internal
Unified Engineering Toolkit
Problem: Engineering knowledge lived in individual engineers' one-off scripts and habits, producing inconsistent, unrepeatable procedures across the org.
Built: A menu-driven PowerShell platform that consolidates 30+ ad-hoc tools into one supported, documented, versioned product.
Stack: PowerShell (modular framework).
Impact: Standardized engineering procedures and cut MTTR by making the right tool the easy, consistent default.
Engineering Education
Problem: Moving an operations-heritage team onto real version control and peer review takes more than a wiki page.
Built: A self-paced training platform with in-browser Git staging and workflow simulators, a commit-message builder, a .gitignore builder, a security scanner, and a certification exam.
Stack: Vanilla JavaScript PWA — every simulation runs fully client-side.
Impact: The training layer behind the team's Git/GitHub standardization.
Kiosk Configuration
Problem: Windows Assigned Access means hand-crafting multi-namespace XML, obscure Edge kiosk arguments, and manual Start-menu shortcuts — and Intune's Settings Catalog only covers part of it.
Built: A browser-based visual builder: three kiosk modes, 40+ app presets, drag-and-drop pin management, and real-time validation — exporting deployment-ready AssignedAccess XML, PowerShell installers, and .intunewin/.ppkg packages.
Stack: Vanilla JavaScript, fully client-side — configurations never leave the browser.
Impact: Turns a specialist XML task into a guided workflow anyone on a team can run — recognized in the Microsoft Intune practitioner community.
Diagnostics
Problem: Full device workups — OS, hardware, network, software, drivers, event logs — are collected manually and inconsistently.
Built: A PowerShell module that collects complete system diagnostics into a standalone, interactive HTML report with tabbed navigation and search; remote-deployable with a modular template system.
Stack: PowerShell 5.1+, HTML/JavaScript report engine.
Impact: A 30–60 second full-system report replacing manual data collection for troubleshooting and audits.
Diagnostics
Problem: "My computer is slow" tickets burn hours of manual Task Manager and event-log triage.
Built: The Performance Utilization & Latency Sampling Engine — 60 seconds of live sampling scored against Microsoft thresholds, flagging CPU/memory/disk bottlenecks, correlating recent installs, and auto-generating ServiceNow-ready work notes plus an HTML report.
Stack: Pure PowerShell, zero external dependencies.
Impact: Slowness triage in about 60 seconds instead of hours.
Live Diagnostics · Internal
Device Config Inspector
Problem: When one device misbehaves, what it's actually configured with is scattered across Group Policy, Intune, and SCCM — with no single live view.
Built: A PowerShell collector that assembles a single device's complete configuration inheritance into an interactive HTML report — a real-time snapshot for troubleshooting.
Stack: PowerShell, HTML report engine.
Impact: Answers "what is this device actually configured with, right now?" in one report.
Windows Servicing · Internal
Internal WUfB Ring Manager
Problem: The Intune environment holds ~155 Windows Update for Business ring policies spanning multiple domains and deployment rings. Routine servicing — pausing a feature update, resuming quality updates, adjusting a ring — meant hand-navigating hundreds of policies in the portal: slow, repetitive, and operationally risky at fleet scale.
Built: A PowerShell application that performs enterprise-wide WUfB operations from a single command line — updating ring configuration and pausing or resuming feature and quality updates across one policy, one domain, a set of rings, or every domain at once. Every run authenticates with least-privilege Microsoft Graph, previews in WhatIf mode, takes an automatic backup before it writes, and confirms before touching production — with one-command rollback if anything needs undoing.
Stack: PowerShell, Microsoft Graph API, Microsoft Entra ID authentication.
Impact: Turns hours of manual, change-risky portal work into safe, repeatable, change-management-friendly servicing — with a backup and a rollback path behind every production change.
Lesson: Enterprise-scale change needs guardrails, not just reach — preview it, back it up, and make rollback a single command.
Profile Lifecycle
Problem: Windows' native "last logon" signals lie — antivirus scans, indexing, and GPO refresh touch profile folders without real user activity. Cleanup based on them deletes the wrong profiles or misses the bloat that breaks feature updates.
Built: Two decoupled components: a Tracker (Intune Win32 app) that writes a tamper-resistant registry timestamp at genuine sign-in, and a Cleanup proactive remediation that acts only on that registry contract.
Stack: PowerShell, Microsoft Intune (Win32 + Proactive Remediation).
Impact: Reclaims disk on shared devices and heads off the profile bloat that silently breaks Windows feature updates.
Lesson: Never trust folder timestamps — decouple detection from action with an explicit contract.
Config Governance · Internal
Config Governance & Audit Trail
Problem: The whole tenant's Intune configuration lives in a portal — impossible to version, audit, or diff across time to see what changed and when.
Built: PowerShell + Microsoft Graph exporters that snapshot every configuration profile, compliance policy, app, baseline, and Group Policy into dated, indexed Markdown and JSON — a versioned history of the estate.
Stack: PowerShell, Microsoft Graph API.
Impact: Point-in-time, diffable configuration history for governance, audit, and change tracking across the tenant.
Deployment Tooling
Problem: Branded landing pages for kiosks and managed devices meant hand-coding HTML for every request.
Built: A no-code visual editor with live preview — 20 WCAG-compliant themes, drag-and-drop link groups, and protocol-handler registration so portal tiles launch native Windows apps — exporting a standalone HTML portal plus a PowerShell installer packaged for Intune Win32 or SCCM.
Stack: Vanilla JavaScript, fully client-side.
Impact: Portal pages become a self-service task instead of an engineering request.
Off the clock, I keep shipping — full-stack web and native apps that scratch my own itches. They're here as evidence of range and range only; the endpoint-platform work above is the main event.
Web App
Astrophotography planning with live ISS tracking, a 700+ celestial object catalog, Bortle-scale sky-quality assessment, 41+ telescope models, and a red night-vision mode. Built on real NASA, US Naval Observatory, and Open-Meteo data.
Stack: React 19 PWA, fully client-side.
Web App
The true cost of an FDM print — filament, electricity, printer depreciation, consumables, labor, and failure rate — with profit/loss calculation, 50+ regional electricity rates, and print-history analytics. WCAG 2.1 AA compliant.
Stack: Vanilla JavaScript with Chart.js, all data in browser localStorage.
Web App · Data
Interactive US state-data explorer: 28 metrics across all 50 states — 1,400+ data points from Census, BEA, BLS, and CDC sources — with side-by-side comparison of up to five states and a complete government officials database.
Stack: React with Recharts and Plotly; Python data-collection and validation pipeline.
Web App · Data
Public records, mapped — see the whole neighborhood, not just one listing. Free, no-login interactive maps of property valuations, full deed histories, owner and building details, and taxes.
Data: County GIS & assessor records, recorded deeds, FEMA flood data, US Census, and OpenStreetMap.
Web App · Hardware
Bridges physical 3D-printed VHS tapes with digital playback: an NFC tag embedded in each tape triggers instant movie playback on a Jellyfin media server. A retro-styled scan page and admin panel manage the tape-to-movie mappings, with poster, rating, cast, and plot metadata pulled from OMDB.
Stack: Node.js / Express, SQLite, and the Jellyfin and OMDB APIs; Docker, nginx, and PM2 for deployment.
Web App · Music
A mobile-first web app for learning and practicing guitar chords: searchable chord lookup filtered by type and difficulty, visual fingering diagrams rendered on canvas with audio playback, and a practice mode with a built-in metronome.
Stack: Vanilla JavaScript PWA — Web Audio API for playback, Canvas API for chord diagrams, localStorage for progress; installable and offline-capable.
Web App · AI Learning
A gamified, project-based platform for learning responsible AI usage, prompt engineering, and AI-assisted development — four progressive phases with XP, achievements, and retro password-style progress codes so learners never lose progress, no accounts required.
Stack: React on Cloudflare Pages.
Web + Native App
A mobile-first dating app built around enforced honesty: profiles read like a nutrition label, dating intentions show as a plain "serving suggestion," and you browse people by personality and lifestyle "departments" instead of endless looks-first swiping. Anti-catfish photo checks with AI moderation, real-time chat, and privacy-by-design throughout.
Stack: React 19 + Vite on Cloudflare Workers — Hono API, Better Auth on D1, R2 photo storage, Workers AI (Llama 3.2 Vision) moderation, and Durable Objects real-time chat; native iOS and Android via Capacitor.
