Automation & Applied AI
Repeatable workflows and AI integrations for operations, documentation, and knowledge management, with permissions, validation, and human review.
Building practical systems in Brazil
Infrastructure · Security · Automation · Applied AI
I design reliable systems for infrastructure, security, and applied artificial intelligence.
I'm Diogo Wermann, an IT Infrastructure & Security Analyst focused on Windows automation, Microsoft Intune, hybrid identity, and the safe integration of AI into operations, documentation, and internal systems.
CURRENT FOCUS
dw://portfolio
Operational and AI-assisted systems that remain safe under uncertainty.
Automation and agents should be observable, reversible, and explicit about the decisions they refuse to make.
Identity
AD → Entra ID
Correlated
Endpoints
Intune → Windows
Managed
Automation & AI
Code + agents
Governed
Fail closedLeast privilegeRecovery first
WHAT I WORK ON
Infrastructure, security, and AI applied to real operational problems.
I operate across the layers where identity, endpoints, automation, knowledge, and business continuity meet.
Endpoint Management
Microsoft Intune packaging, deployment, detection, policy validation, and reliable device-side execution.
Hybrid Identity
Active Directory, Microsoft Entra ID, synchronization, device identity correlation, and access-aware operations.
Resilience & Observability
Backups, logs, dashboards, service health, recovery procedures, and evidence for operational decisions.
SELECTED PROJECTS
Public tools built from production problems.
Each project starts with an operational constraint and is designed around safety, maintainability, and clear documentation.
Flagship
Active
DeviceLifecycle
A safety-first lifecycle engine for inactive hybrid Windows devices across Active Directory, Entra ID, and Intune.
PowerShellMicrosoft GraphActive Directory
Open source
Active
DeviceLifecycle-API
A read-only FastAPI extension that exposes lifecycle reports and logs without extending the privileged control plane.
PythonFastAPIAPI Security
Open source
Active
WallpaperAgent
A Windows agent for validated, versioned wallpaper delivery with privilege separation and safe content promotion.
PowerShellIntuneSHA-256
Open source
Active
RustDeskIntuneDeployment
A complete Win32 deployment package for installing, configuring, detecting, and removing RustDesk through Intune.
PowerShellIntuneEndpoint Management
Open source
Active
Windows Unattended Provisioning
A security-conscious PowerShell pipeline for deployment-specific Windows answer files, delegated domain join, Hybrid Microsoft Entra join, cleanup, state, and validation.
PowerShellWindows SetupHybrid Identity
FEATURED CASE STUDY
An enterprise operations portal built around real internal workflows.
A private modular platform for support, assets, dashboards, scheduling, integrations, and an AI-ready knowledge base. The source remains private; its architecture and decisions can still be documented responsibly.
Multiple operational modules in one controlled interface
Role-aware access and network-aware exposure
Migrations, integrations, AI-assisted knowledge, and operational evidence
Private system · Sanitized engineering case study
Multi-module
operational platform
Private
source and business data
Public
engineering lessons
TECHNICAL WRITING
Detailed implementation notes, not generic tutorials.
Long-form articles explain the constraints, architecture, safeguards, and tradeoffs behind the systems I build.
12 min read
Endpoint Security
Scheduled
Building a Secure Wallpaper Distribution Agent for Windows
How a PowerShell agent uses Intune, privilege separation, SHA-256 validation, atomic promotion, and per-user application to manage Windows wallpapers safely.
Microsoft IntunePowerShellWindowsEndpoint Security
9 min read
Projects
Engineering case study
From Autounattend.xml to a Security-Conscious Windows Provisioning Pipeline
An engineering case study on converting a working Windows unattended installation into a reusable PowerShell provisioning pipeline without publishing operational secrets.
windows provisioningautounattendpowershellactive directory
8 min read
Endpoint Management
Published
Deploying RustDesk with Microsoft Intune
How a RustDesk MSI became a configured and verifiable Microsoft Intune Win32 application with multi-context configuration, logs, service checks, and custom detection.
Microsoft IntuneRustDeskPowerShellEndpoint Management
ABOUT
Infrastructure, security, and applied AI with engineering discipline.
I work across infrastructure, support, automation, endpoints, observability, security, and applied AI. I turn operational knowledge into systems that are easier to understand, audit, and maintain.
Production-minded automation
Microsoft hybrid environments
Governed documentation and AI
CONTACT
Let's discuss infrastructure, security, automation, or applied AI.
For professional conversations, technical collaboration, or questions about my public projects, use the channels below.