Infrastructure Automation
Repeatable PowerShell and Python workflows for Windows, servers, inventories, reporting, and operational maintenance.
Building practical systems in Brazil
Infrastructure · Endpoint Management · Identity Security
I design reliable infrastructure and security automation for real environments.
I'm Diogo Wermann, an IT Infrastructure & Security Analyst focused on Windows automation, Microsoft Intune, hybrid identity, observability, and operational resilience.
CURRENT FOCUS
dw://portfolio
Operational systems that remain safe under uncertainty.
Automation should be observable, reversible, and explicit about the decisions it refuses to make.
Identity
AD → Entra ID
Correlated
Endpoints
Intune → Windows
Managed
Automation
PowerShell + Python
Auditable
Fail closedLeast privilegeRecovery first
WHAT I WORK ON
Infrastructure work with a security engineering mindset.
I operate across the layers where identity, endpoints, automation, and business continuity meet.
Endpoint Management
Microsoft Intune packaging, deployment, detection, policy validation, and reliable device-side execution.
Hybrid Identity
Active Directory, Microsoft Entra ID, synchronization, device identity correlation, and access-aware operations.
Resilience & Observability
Backups, logs, dashboards, service health, recovery procedures, and evidence for operational decisions.
SELECTED PROJECTS
Public tools built from production problems.
Each project starts with an operational constraint and is designed around safety, maintainability, and clear documentation.
Flagship
Active
DeviceLifecycle
A safety-first lifecycle engine for inactive hybrid Windows devices across Active Directory, Entra ID, and Intune.
PowerShellMicrosoft GraphActive Directory
Open source
Active
DeviceLifecycle-API
A read-only FastAPI extension that exposes lifecycle reports and logs without extending the privileged control plane.
PythonFastAPIAPI Security
Open source
Active
WallpaperAgent
A Windows agent for validated, versioned wallpaper delivery with privilege separation and safe content promotion.
PowerShellIntuneSHA-256
Open source
Active
RustDeskIntuneDeployment
A complete Win32 deployment package for installing, configuring, detecting, and removing RustDesk through Intune.
PowerShellIntuneEndpoint Management
Open source
Active
Windows Unattended Provisioning
A security-conscious PowerShell pipeline for deployment-specific Windows answer files, delegated domain join, Hybrid Microsoft Entra join, cleanup, state, and validation.
PowerShellWindows SetupHybrid Identity
FEATURED CASE STUDY
An enterprise operations portal built around real internal workflows.
A private, modular platform for support, assets, operational dashboards, scheduling, access control, and service integrations. The source remains private; the architecture and engineering decisions can still be documented responsibly.
Multiple operational modules in one controlled interface
Role-aware access and network-aware exposure
Database migrations, integrations, logs, and reporting
Private system · Sanitized engineering case study
Multi-module
operational platform
Private
source and business data
Public
engineering lessons
TECHNICAL WRITING
Detailed implementation notes, not generic tutorials.
Long-form articles explain the constraints, architecture, safeguards, and tradeoffs behind the systems I build.
12 min read
Endpoint Security
Scheduled
Building a Secure Wallpaper Distribution Agent for Windows
How a PowerShell agent uses Intune, privilege separation, SHA-256 validation, atomic promotion, and per-user application to manage Windows wallpapers safely.
Microsoft IntunePowerShellWindowsEndpoint Security
9 min read
Projects
Engineering case study
From Autounattend.xml to a Security-Conscious Windows Provisioning Pipeline
An engineering case study on converting a working Windows unattended installation into a reusable PowerShell provisioning pipeline without publishing operational secrets.
windows provisioningautounattendpowershellactive directory
8 min read
Endpoint Management
Published
Deploying RustDesk with Microsoft Intune
How a RustDesk MSI became a configured and verifiable Microsoft Intune Win32 application with multi-context configuration, logs, service checks, and custom detection.
Microsoft IntuneRustDeskPowerShellEndpoint Management
ABOUT
Hands-on infrastructure experience, documented with engineering discipline.
I work across infrastructure, user support, automation, endpoint management, backups, monitoring, and security. My focus is turning operational knowledge into systems that are easier to understand, audit, and maintain.
Production-minded automation
Microsoft hybrid environments
Clear technical documentation
CONTACT
Let's discuss infrastructure, automation, or security engineering.
For professional conversations, technical collaboration, or questions about my public projects, use the channels below.