The record
we build on.

One client build, and the founder’s infrastructure record that Codex Systems is built on: identity, endpoint fleets, networks and security posture at enterprise scale. Every entry is labelled for what it is.

Client builds
One
Founder’s record
11 projects
Vendor bias
$0 independent
Practice areas
IT · Cloud · AI
Illustration of a cloud infrastructure architecture

One client build. The record behind it.

Open any card for the full account. The founder’s record is the experience Codex Systems is built on, not work Codex Systems has delivered.

Client work

Know Your Catch

An educational browser game: fish a British Columbia lake against the clock, then name each catch native or invasive.

Built for the Invasive Species Council of British Columbia to sit inside their WordPress site. A round opens with a pledge, then gives you five minutes on a lake: land a fish, say whether it is native or invasive, and the game tells you what to do with it. A Species at Risk goes straight back into the water, and every catch is written into a log book. The species are data, built to be generated from the council’s own spreadsheet. Responsive and touch-first so it works on a phone at a public event, with audio and a tutorial that does not lecture. Finished and passing its quality gate; not published yet.

Role
Design and build
Year
2026
Built with
TypeScript, Vite, Canvas, WordPress embed
Status
Built, not yet published

Founder’s record

Secure Score, 52 to 90

Raised a fleet of 1,000+ nodes from a Secure Score of 52 to 90, cutting ransomware exposure by around 40%.

Secure Score is a blunt number, but it is the one an executive reads. Getting it from 52 to 90 meant enforcing Attack Surface Reduction rules and rolling Defender for Endpoint EDR across more than a thousand nodes without breaking the line-of-business software those nodes exist to run. The endpoint estate was aligned to ISO 27001 baselines at the same time: BitLocker, Secure Boot, and compliance policies that actually block rather than warn.

Role
Sr. Cloud Architect
Year
2026
Built with
Defender for Endpoint, ASR rules, Intune, Entra ID

Founder’s record

Zero-touch provisioning

Rebuilt device setup for 1,000+ Windows endpoints, taking provisioning from four hours to under 30 minutes.

Imaging a laptop by hand is four hours somebody is not doing their job. This replaced it with a user-driven Autopilot flow and an Enrollment Status Page profile, so a machine can be drop-shipped to a person and be ready in under half an hour. Behind it sits a five-ring Autopatch strategy holding 98% compliance on quality updates within seven days, and PowerShell that recovered 200+ endpoints which had fallen out of management entirely.

Role
Sr. Cloud Architect
Year
2026
Built with
Windows Autopilot, Intune, Windows Autopatch, PowerShell

Founder’s record

Retiring the print servers

Moved 100+ print queues into Azure Universal Print and retired the legacy print server estate.

Print is the least glamorous thing in an IT estate and one of the most expensive to keep limping. Migrating more than a hundred queues to Azure Universal Print through Azure connectors removed the dependency on the legacy print servers and their proprietary licensing, worth about $25,000 a year in operating cost, and moved queue management to the same console everything else is managed from.

Role
Sr. Cloud Architect
Year
2026
Built with
Azure Universal Print, Azure connectors, Intune

Founder’s record

Hub and spoke network

Architected a hub-and-spoke topology joining on-premises appliances to Azure over IKEv2 IPSec.

A hub-and-spoke topology integrating on-premises Cisco Meraki appliances with Azure VPN Gateways over IKEv2 IPSec tunnels, with routing tuned for under 20ms access to cross-tenant SQL instances. The same programme launched a new site end to end: Meraki MX84 firewalls and Ubiquiti CloudKeys, full layer two and three configuration in-house, 99.9% uptime, and roughly $15,000 of managed-service labour avoided.

Role
Sr. Cloud Architect
Year
2026
Built with
Azure VPN Gateway, Cisco Meraki, IKEv2 IPSec, Azure Monitor

Founder’s record

Identity lifecycle automation

Automated the joiner, mover and leaver lifecycle so a new hire has the right access on day one and a leaver has none.

Joiner, mover and leaver done by hand is where access quietly accumulates: people keep permissions from roles they left years ago, and nobody notices until an audit. Automated JML workflows in PowerShell and Power Automate now provision and de-provision across Entra ID, Active Directory and Okta, cutting manual intervention by 40% while giving new staff day-one access. A centralised identity store governs the accounts, dormant ones are decommissioned rather than left, and group ownership has clear boundaries.

Role
Manager, IT
Year
2025
Built with
Entra ID, PowerShell, Power Automate, Conditional Access

Founder’s record

SCCM to co-management

Moved 1,000+ endpoints from standalone SCCM into Intune co-management, in waves, with no reimage.

Standalone SCCM works until the fleet stops being in one building. Moving more than a thousand endpoints into Intune co-management was done in waves, with workloads shifted one at a time so a rollback was always a switch rather than a rebuild, and without reimaging a single machine. Alongside it, a PowerShell packaging factory automated wrapping and detection logic for more than fifty complex applications.

Role
Sr. Cloud / Systems Engineer
Year
2024
Built with
SCCM, Intune, Entra ID, PowerShell

Founder’s record

Enterprise Windows 11 rollout

Planned and ran an enterprise-wide Windows 11 deployment on one standardised image.

An operating system upgrade is only partly a technical problem. The build was one standardised image driven by SCCM task sequences, with driver and application packaging automated through the PSAppDeploy Toolkit so that the thousandth machine came out the same as the first. Doing the packaging properly is what makes the rollout boring, and boring is the goal: nobody should be able to tell which wave they were in.

Role
Sr. Cloud / Systems Engineer
Year
2024
Built with
SCCM Task Sequences, PSAppDeploy Toolkit, Intune, PowerShell

Founder’s record

Active Directory modernisation

Upgraded the domain controllers to Server 2022 and audited over 500 Group Policy Objects down to a consolidated set.

On-premises directories accumulate. Domain controllers were brought from Windows Server 2016 to 2022, and more than five hundred Group Policy Objects were audited and consolidated, which is mostly the unglamorous work of finding out what each one was for and who still needs it. The Entra Connect sync topology was strengthened at the same time, because a directory that is current on one side and stale on the other is worse than either.

Role
Sr. Cloud Architect
Year
2026
Built with
Windows Server 2022, Group Policy, Entra Connect, PowerShell

Founder’s record

Multi-site forest consolidation

Consolidated several separately managed Active Directory domains into a single unified forest.

Several domains, each managed by different people to different standards, is several sets of assumptions about who should have access to what. Consolidating them into one forest meant a migration plan written before anything moved, trust relationships configured deliberately rather than inherited, and role-based access controls applied on the way in so the new forest did not start life carrying the old one’s exceptions.

Role
Systems Analyst
Year
2018
Built with
Active Directory, Domain trusts, RBAC, Windows Server

Founder’s record

Cross-platform patch automation

One patching framework across Windows and macOS, reaching 100% compliance within 30 days.

Two operating systems patched by two different processes means two different answers to the question of whether the fleet is current, and the honest answer is usually neither. A single centralised framework across SCCM and Intune covers Windows and macOS together, reaching full compliance within thirty days. The number that matters is not the peak but the fact that it is measured the same way on both platforms.

Role
Sr. Cloud Architect
Year
2026
Built with
SCCM, Intune, Windows, macOS

Founder’s record

Identity disaster recovery

Disaster recovery for the identity estate itself, with a recovery time objective under four hours for Tier-0 assets.

Most disaster recovery plans assume the directory is there to authenticate against. If the domain controllers and the Entra Connect servers are the thing that is gone, everything downstream is unreachable no matter how well it was backed up. This planned for that case specifically: a recovery time objective of under four hours for Tier-0 assets, automated backup, and rehearsed rapid-restore procedures so the global identity store survives ransomware or a catastrophic failure rather than being restored from a document nobody has tested.

Role
Sr. Cloud Architect
Year
2026
Built with
Entra Connect, Domain Controllers, Azure Backup, PowerShell

Let's scope your environment.

Book a 30-minute discovery call. No sales pitch, just a direct conversation about your environment and whether Systems is the right fit.

Book a discovery call View pricing

systems.codexcorp.ca, a Codex Corp Company, Canada