Speaker 1: Welcome to the deep dive. We're here to pull out
Speaker 1: the really key insights from complex sources just so you
Speaker 1: can get up to speak quickly. Today we're jumping straight
Speaker 1: into well, a really crucial area, the modern desktop administrator.
Speaker 1: Our goal mission for you is to give you a
Speaker 1: focused look at the essential skills the concepts you need
Speaker 1: for managing Windows ten. And that's across all sorts of environments,
Speaker 1: from regular networks right through to the cloud. You'll get
Speaker 1: a quick, actionable grasp of how Windows ten gets deployed,
Speaker 1: how it's secured, managed, even recovered, and importantly how it
Speaker 1: works with modern cloud services. Yeah, and our source for
Speaker 1: this it's a pretty hefty study guide for Microsoft's m
Speaker 1: D one hundred and MD one to one exams, packed
Speaker 1: with practical stuff, real world insights. We've basically boiled it
Speaker 1: down to the core nuggets for you.
Speaker 2: It's such a critical topic. I mean it, administration has
Speaker 2: changed so much, hasn't it. It's really not just about
Speaker 2: fixing one computer here and there anymore. This role fundamentally
Speaker 2: it's about thinking strategically, deployment strategy, really robust security, proactive security,
Speaker 2: and just super efficient management across well everything and The
Speaker 2: big challenge, the question in organizations face now is how
Speaker 2: do you balance that user need for flexibility working from
Speaker 2: anywhere with the absolute necessity of corporate control and you know,
Speaker 2: keeping things secure.
Speaker 1: Yeah, that tightrope walk freedom versus control. Every admin knows it.
Speaker 1: So okay, let's start right at the beginning, getting Windows
Speaker 1: ten onto a machine. We all kind of know about
Speaker 1: clean installs, in place upgrades, but the real admin headache
Speaker 1: isn't setting up one machine, it's doing it efficiently across
Speaker 1: maybe hundreds even thousands. That's where automation really steps in exactly.
Speaker 2: And the source material points to some key tools for that.
Speaker 2: You've got the Microsoft Deployment Toolkit MDT. It's more than
Speaker 2: just installing Windows. It basically turns a complex, potentially error
Speaker 2: prone manual job into a smooth, repeatable process like a
Speaker 2: factory assembly line. And that's huge because it frees up
Speaker 2: all t folks from those repetitive tasks to focus on
Speaker 2: bigger picture stuffrategic work. Yeah. Then there's Windows Deployment Services
Speaker 2: WDS that works with a Windows server. Let's you do
Speaker 2: network booting for deployment, you can figure it with WDS YouTube,
Speaker 2: but for real world imaging, getting those golden images ready.
Speaker 2: SISPREP dot ex the system preparation tool that's your go to.
Speaker 2: Its main job is to generalize a Windows image. It
Speaker 2: strips out the unique stuff, crucially, the security identifier, the SIV.
Speaker 1: This ida right the computer's fingerprint basically, and.
Speaker 2: If you cloned without CISPREPP in the old days, you
Speaker 2: got identical fingerprints, major network conflicts. CISPREP solves that by
Speaker 2: resetting it and use the Windows Assessment and Deployment Kit
Speaker 2: ADK for tools to customize these images, like using Windows
Speaker 2: SIM to create those unintended answer files for automated setup.
Speaker 1: Okay, so that covers the traditional methods. What about the cloud.
Speaker 2: Approach, Ah, yes, Windows autopile. That's a big shift. Cloud
Speaker 2: based devices can be deployed pretty much straight from the vendor,
Speaker 2: sometimes zero it touch involved. You get a customizable out
Speaker 2: of box experience. Devices automatically joined groups. It streamlines everything
Speaker 2: sounds efficient.
Speaker 1: What's needed for that?
Speaker 2: You need an Azure subscription, Azure Active directory and Microsoft
Speaker 2: in Tune. And the key is capturing the device's unique
Speaker 2: hardware ID, the hardware hash beforehand for pre registration. This
Speaker 2: whole move Automated deployment, cloud integration. It shifts it from
Speaker 2: being reactive and manual to being strategic and scalable. It
Speaker 2: aligns with how businesses operate.
Speaker 1: Now that makes sense, moving from manual setup to strategic automation.
Speaker 1: It's a huge leap. But okay, you've got the machines deployed.
Speaker 1: What about the people using them? Users and groups? That's
Speaker 1: the next layer, right. We know the difference generally between
Speaker 1: local users on one machine and domain users managed centrally
Speaker 1: an active directory or azure AD. The real power of
Speaker 1: domain users is that central control, that single place for
Speaker 1: identity and access across the whole organization.
Speaker 2: Absolutely, centralization is key, and.
Speaker 1: Something that often surprises people is this SID concept, the
Speaker 1: security identifier. You know, you rename a user account, maybe
Speaker 1: Bob becomes Robert, but all's permissions, his access, it all
Speaker 1: stays the same.
Speaker 2: Because Windows doesn't actually track users by the name you see,
Speaker 2: It uses that unique, unchanging SID behind the scenes. That's
Speaker 2: the real identifier for access control. Right.
Speaker 1: The name is just a label for us humans pretty much.
Speaker 2: And when you need to manage permissions for lots of users,
Speaker 2: groups are obviously essential. You have the built in ones
Speaker 2: like administrators, users backup operators. But creating custom groups lets
Speaker 2: you apply specific rights to collections of users all at once.
Speaker 2: Much simpler.
Speaker 1: Okay, So sids, identify groups, simplify permissions. How do we
Speaker 1: enforce standards and security across all these users and machines?
Speaker 2: Policies exactly. Policy is the heart of control for domain
Speaker 2: join machines. It's group policy objects GPOs for standalone ones,
Speaker 2: local group policy objects lgpos, and the crucial thing to remember,
Speaker 2: GPOs always win if a setting is configured in both
Speaker 2: the domain. GPO takes precedence that ensures organizational standards are met.
Speaker 1: And what kind of things do these policies control?
Speaker 2: Key areas include account policies, password rules, complexity, how often
Speaker 2: you have to change it, how many times you can
Speaker 2: try logging in before getting locked out? You know, like
Speaker 2: setting it so five bad attempts in two minutes locks
Speaker 2: the account for half an hour. That directly stops basic
Speaker 2: brute force attacks makes sense.
Speaker 1: And local policies.
Speaker 2: Local policies control what users can do after they're logged in.
Speaker 2: Auditing settings who get specific rights like allow log on
Speaker 2: locally or backup files and directories. It's about defining capabilities.
Speaker 2: And then there's User Account Control UAC. That's the thing
Speaker 2: that gives you all those prompts asking for permission for
Speaker 2: admin tasks.
Speaker 1: Oh yeah, even when you are an administrator.
Speaker 2: Right, it's designed that way. UAC forces privilege elevation. It's
Speaker 2: an architectural safety net to stop malware running silently with
Speaker 2: admin rights without you explicitly okaying it. Standard users always
Speaker 2: need admin credentials. Of course, the big picture here is
Speaker 2: defense in depth. UAC GPOs, local policies. They're not separate things,
Speaker 2: they're layers. If one gets bypassed, the next one makes
Speaker 2: it harder for an attacker. It builds resilience, layers of control.
Speaker 2: Got it.
Speaker 1: Okay, so we've controlled the users and the basic system settings.
Speaker 1: Let's talk actual defenses, security paramount stuff. Windows ten bundles
Speaker 1: a lot of this into the Windows Defender Security Center, right,
Speaker 1: that's the main dashboard.
Speaker 2: That's the hub. Yeah, makes it easier to manage.
Speaker 1: So starting with the basics, Windows Defender Firewall blocks connections,
Speaker 1: we get that. But the advanced version wfas.
Speaker 2: Right, Windows Defendor Firewall with Advanced security that gives you
Speaker 2: much finer control. Granular inbound and outbound rules really lets
Speaker 2: you lock down network traffic precisely.
Speaker 1: Now, there's something called authenticated exceptions in the firewall. What's
Speaker 1: the deal there? Sounds convenient but maybe risky.
Speaker 2: It is exactly that. It allows specific trusted computers, usually
Speaker 2: domain joined and managed, to bypass certain ipsick rules. It
Speaker 2: can simplify things and managed environments, but yeah, you have
Speaker 2: to understand it inherently reduces the security boundary, so use
Speaker 2: it sparingly only where trust is extremely high. Every convenience
Speaker 2: has a security trade off.
Speaker 1: Good point. Okay, on the firewall. What other Defender components
Speaker 1: are key.
Speaker 2: Well, there's Windows Defender Application Guard that's pretty neat. It
Speaker 2: isolates untrusted websites or PDFs by opening them in a
Speaker 2: separate virtualized container like a sandbox on steroids. So if
Speaker 2: there's something malicious in there, it can't touch your actual system.
Speaker 2: You can run it and standalone or enterprise mode.
Speaker 1: Okay, sandboxing for web stuff. What about protecting credentials.
Speaker 2: That's where Windows Defendo Credential Guard comes in. Uses hardware virtualization,
Speaker 2: leveraging the actual processor features to create a super isolated
Speaker 2: secure zone. It protects things like in TLM password hashes,
Speaker 2: making those pass the hash attacks where attackers steal credentials
Speaker 2: to move laterally much much harder. It's not just software,
Speaker 2: it uses hardware isolation.
Speaker 1: Hardware based protection.
Speaker 2: Nice. What else is in the toolkit Windows Defender Exploit Guard.
Speaker 2: This focus is on reducing the attack surface. It blocks
Speaker 2: common techniques, malware and ransomware used to exploit vulnerabilities and applications.
Speaker 2: The analogy in the source is like putting plexiglass over
Speaker 2: most to a hockey net. Leaving only a tiny slot
Speaker 2: makes it way harder for attackers to score even if
Speaker 2: there's a vulnerability. I like that analogy, And for really
Speaker 2: strict control, there's Windows Defender Application Control WDAC. This basically
Speaker 2: says only applications you explicitly approve can run nothing else,
Speaker 2: very locked down.
Speaker 1: That sounds restrictive but effective. What about data encryption?
Speaker 2: BitLocker drive encryption, full disc encryption for your OS drive,
Speaker 2: other internal drives, and BitLocker to go for USB sticks
Speaker 2: and removable drives. Ideally it uses a Trusted Platform Module
Speaker 2: or TPM chip on the motherboard. That's a secure hardware
Speaker 2: ship that stores the encryption keys, much safer than just
Speaker 2: using a USB key to trade off. You get much
Speaker 2: better security for data arrest, but there might be a
Speaker 2: tiny performance hit because of the encryption. Decryption process usually
Speaker 2: negligible these.
Speaker 1: Days though okay, and authentication stronger methods.
Speaker 2: Yeah. Windows ten has better support for smart cards and
Speaker 2: multi factor authentication MFA. It makes deploying them easier, especially
Speaker 2: for domain logins, pushing towards stronger identity verification. All these
Speaker 2: things together firewall, application guard, credential guard, exploit guard, WDAC, BitLocker, MFA,
Speaker 2: they create this multi layered defense. It's moved way beyond
Speaker 2: just having anti virus. It's about proactively reducing threats and
Speaker 2: protecting identities.
Speaker 1: It definitely sounds comprehensive a lot of layers, but you know,
Speaker 1: a lockdown fortress isn't much use if it can't talk
Speaker 1: to the outside world or the rest of the network.
Speaker 1: So networking, how do these machines connect and communicate? We
Speaker 1: know the basic models where group decentralized peer to peer
Speaker 1: domain base using active directory centralized control. But the modern
Speaker 1: angle is also managing devices that join azuread directly right
Speaker 1: cloud native identity.
Speaker 2: Exactly that Azure eight join models becoming increasingly important for
Speaker 2: cloud first strategies.
Speaker 1: And underpinning all of this communication is, of course TCPAP.
Speaker 1: We know IPP four the dotted decimals. IPv six is
Speaker 1: the future massive address base. But for an admin, it's
Speaker 1: not just knowing the difference, it's managing that transition right,
Speaker 1: ensuring things work side by side, maybe using tunneling.
Speaker 2: Like Terretto precisely dual stack implementations, understanding tunneling mechanisms like
Speaker 2: Terrato for carrying IPv six over udpipv four networks where
Speaker 2: native IPVC six isn't available. That's key operational knowledge for
Speaker 2: future proofing. And yeah, we know static versus dynamic DHCP addressing,
Speaker 2: but don't forget eighties IPA automatic private IP addressing.
Speaker 1: Ah the one sixty nine point twenty five to four
Speaker 1: address right.
Speaker 2: If you see that, it's a big clue the machine
Speaker 2: couldn't find a DHDP server. It's in troubleshooting pointer.
Speaker 1: Okay, what about newer wireless stuff and remote management?
Speaker 2: For wireless, you've got things like Wi Fi direct device
Speaker 2: to device connection, no access point needed, uses near field
Speaker 2: proximity NFP oftener for pairing, and broadband tethering letting you
Speaker 2: share a mobile device's Internet connection. Very handy for remote
Speaker 2: work and.
Speaker 1: For actually managing machines remotely several tools.
Speaker 2: Remote assistance is the one where a user explicitly invites
Speaker 2: an expert to view or control their screen to help them.
Speaker 2: It has an easy connect feature to simplify setup. Remote
Speaker 2: desktop though gives you full keyboard video mouse control without
Speaker 2: the end user needing to be there or interact once
Speaker 2: it's enabled. Great for server management or troubleshooting when no
Speaker 2: one's physically at the machine.
Speaker 1: And secure connections back to the office.
Speaker 2: Network VPNs virtual Private Networks. The source highlights IKEv two
Speaker 2: is a good protocol choice because of its VPN reconnect feature.
Speaker 2: It automatically tries to re establish the connection if you
Speaker 2: temporarily lose network, which is much smoother for users and
Speaker 2: for the command line folks. Powershow remoting is incredibly powerful
Speaker 2: for running scripts and commands on remote machines securely. The
Speaker 2: real takeaway here is how adaptable Windows ten is is
Speaker 2: built to work and be managed across all these different
Speaker 2: network scenarios on prem domains, mobile cloud connected admittans have
Speaker 2: tools for pretty much any situation.
Speaker 1: That flexibility seems absolutely essential. Now, okay, shifting gears slightly,
Speaker 1: let's talk about the data itself and the hardware, keeping
Speaker 1: things healthy recovering when they're not. Starting with filesystems, we
Speaker 1: generally use NTFS now, not older FAT thirty two. Why
Speaker 1: is NTFS so much better for administration?
Speaker 2: Well, intfs has major advantages. Security is a big one.
Speaker 2: You can set permissions on individual files and folders, not
Speaker 2: just shares. Fat thirty two doesn't really have that. Plus
Speaker 2: NTFS supports file compression, encryption using EFS encrypting filesystem and
Speaker 2: disc quotas to limit how much space users can consume.
Speaker 2: These are all critical admin controls that FAT thirty two lacks.
Speaker 1: Right granular control. What about managing the discs themselves?
Speaker 2: Use the disk management tool. You can have basic discs
Speaker 2: or convert them to dynamic discs. Going dynamic lets you
Speaker 2: do cool things like span volumes span volumes yeah, where
Speaker 2: you take space from multiple physical hard drives and make
Speaker 2: them appear as one single larger drive letter or stripe
Speaker 2: volumes where data is written across multiple drives simultaneously for
Speaker 2: better performance.
Speaker 1: AH Striping sounds good but risky if one drive fails exactly.
Speaker 2: Striping gives speed but increases risk. Spanning just pools space.
Speaker 2: You need good backups either way, especially with striped volumes,
Speaker 2: and you also deal with partition styles older NBR Master
Speaker 2: Boot Record versus modern GPT guid Partition table. GPT is
Speaker 2: standard now supports larger discs, more partitions, better boot reliability.
Speaker 1: And for cloud storage. There's one drive built in and
Speaker 1: Hardware issues Device Manager.
Speaker 2: That's your central console for everything. Hardware viewing devices, updating drivers,
Speaker 2: rolling back drivers if an update causes problems, disabling devices,
Speaker 2: uninstalling them. Also where you manage printers, both local and network.
Speaker 1: Okay, so that's keeping things running. What about when they
Speaker 1: stop running?
Speaker 2: Recovery options are crucial? Windows has several layers. First, the
Speaker 2: startup boot options. You've got safe Mode, which loads Windows
Speaker 2: with minimal drivers. Great for diagnosing boot problems caused by
Speaker 2: a bad driver or software. Bootlogging creates a detailed text
Speaker 2: file listing every driver in service that loads, helping pinpoint
Speaker 2: failures and startup prepared tries to automatically fix common boot problems.
Speaker 1: What about role back changes.
Speaker 2: That's system restore. It uses restore points snapshots of system
Speaker 2: files and settings. You can revert back to an earlier
Speaker 2: point if something goes wrong after installing software or a driver.
Speaker 1: But it doesn't touch personal files right correct.
Speaker 2: System restore leaves your documents, pictures, etc. Alone. It also
Speaker 2: doesn't uninstall programs installed after the restore point was created,
Speaker 2: though they might not work correctly. For a full disaster recovery,
Speaker 2: there's system image recovery. This uses as a complete image
Speaker 2: a snapshot of your entire hard drive to restore everything.
Speaker 2: And don't forget basic file recovery. There's the older Backup
Speaker 2: and Restore Windows seven tool, but also one drive recovery
Speaker 2: which often have version history and recycle bin features for
Speaker 2: cloud files.
Speaker 1: Okay, lots of recovery tools. How about preventing problems through monitoring?
Speaker 2: Proactive monitoring is key. Performance monitor is the deep dive tool.
Speaker 2: It tracks hundreds of stats, processor load, memory usage, disc activity,
Speaker 2: network traffic, specific service performance use, performance objects and counters
Speaker 2: sounds detailed.
Speaker 1: What about a quick look?
Speaker 2: That's task manager quick view of running apps, background processes,
Speaker 2: cpu and memory usage, startup apps, services essential first stop
Speaker 2: for what's slowing my machine down. For logging, there's the
Speaker 2: event Viewer. It's the central place for all system messages,
Speaker 2: information warnings, errors, log by applications, services, the operating system
Speaker 2: security audits essential for troubleshooting after a crash or unexpected.
Speaker 1: Behavior and in the cloud era.
Speaker 2: Azure monitor This is Microsoft's big cloud based monitoring solution
Speaker 2: at tracks performance, availability, usage for apps and infrastructure, whether
Speaker 2: they're an Azure or on premises. Includes things like application
Speaker 2: insights for web apps, monitoring for containers and vms, and
Speaker 2: log analytics. Log analytics is powerful. Use queries like qel
Speaker 2: to sift through logs and find specific events, for example
Speaker 2: finding all air events on laptop one. The main point
Speaker 2: here is that combining proactive monitoring with these robust recovery
Speaker 2: tools is absolutely vital for minimizing downtime and data loss.
Speaker 2: It's all about business continuity.
Speaker 1: Absolutely critical. Yeah, especially with remote workforces and cloud dependence growing.
Speaker 1: Which brings us nicely to the final piece, the really
Speaker 1: modern part of this role, cloud integration. Let's talk Microsoft
Speaker 1: in Tune right.
Speaker 2: Intune is Microsoft's cloud native Mobile Device Management MDM and
Speaker 2: Mobile Application Management MAM system operates entirely from the cloud, and.
Speaker 1: A big benefit I hear about is licensing.
Speaker 2: Yeah, that's a key difference. Intune typically licenses users, not
Speaker 2: devices by default. One user license often covers something like
Speaker 2: fifteen devices for organizations with users who have multiple devices,
Speaker 2: though it can be a significant cost saving compared to
Speaker 2: traditional per device licensing makes sense.
Speaker 1: What can in Tune do a lot?
Speaker 2: Device enrollment, setting up secure access to resources like Wi
Speaker 2: Fi or VPNs, deploying applications, enforcing security policies, tracking hardware, software,
Speaker 2: inventory reporting, and crucially, remote wipe. If a device is
Speaker 2: lost or stolen or employee leaves, you can wipe corporate
Speaker 2: data remotely, essential for protecting sensitive information. Plus Intune connectors
Speaker 2: let it integrate with on prem tools like SECM for
Speaker 2: hybrid management scenarios.
Speaker 1: Okay, so in Tune manages devices and apps from the cloud,
Speaker 1: and the identity piece is Azure Active Directory azure AD.
Speaker 2: Exactly, azure AD is the cloud directory. It holds the
Speaker 2: user and group accounts for accessing cloud services like Microsoft
Speaker 2: three sixty five, Azure itself and thousands of other sauce apps.
Speaker 2: And to link your existing on premises active directory with
Speaker 2: Azure AD, you use Azure ad connect. This tool synchronizes identities,
Speaker 2: enabling things like single sign on SSO so users have
Speaker 2: one password for both environments. Foundational for hybrid.
Speaker 1: Identity, got it so within Intune and Azure AD. What
Speaker 1: are some key features admins use.
Speaker 2: In in tune, you can figure policies and profiles. Compliance
Speaker 2: policies set the roles the device must meet to be
Speaker 2: considered compliant and gain access, like needing a certain OS
Speaker 2: version or having encryption enabled. These often work with conditional
Speaker 2: access policies and Azure AD device configuration profiles, push down settings,
Speaker 2: configuring Wi Fi VPNs, email profiles, device restrictions, setting up
Speaker 2: Windows Held for business for secure sign in, or configuring
Speaker 2: KIOSK mode for specialized single app devices and for BIOD
Speaker 2: Bring your own device. Mobile Application management MAM policies are huge.
Speaker 2: They let you protect corporate data within specific apps on
Speaker 2: a personal device without needing to fully enroll and manage
Speaker 2: the entire device. Think restricting copy paste, auted outlook or
Speaker 2: requiring a pin for word flexibility with security.
Speaker 1: Okay, that MAM part sounds really useful for BOD. What
Speaker 1: about as your AD features.
Speaker 2: As your AD has tons Cell service Password reset SSPR
Speaker 2: is a big one. Let's users reset their own forgotten
Speaker 2: password securely, which drastically cuts down help desk calls. Identity protection,
Speaker 2: which is part of the premium P two license, is
Speaker 2: really advanced. It uses machine learning and heuristics to detect
Speaker 2: suspicious sign ins or compromised accounts. You can then trigger
Speaker 2: automated responses like forcing an MFA prompt or even blocking
Speaker 2: access until an admin reviews it.
Speaker 1: Proactive identity Secure security Yeah.
Speaker 2: Then for sinking passwords from on prem you have Password
Speaker 2: hash Synchronization PHS. It sinks a hash of the user's
Speaker 2: password to azure AD. It's reliable and enables cloud authentication
Speaker 2: even if the on prem domain controllers are unreachable. Alternatively,
Speaker 2: passed through authentication PTA validates the user's password directly against
Speaker 2: your on prem active directory in real time. No password
Speaker 2: hash is stored in the cloud. It enforces on prem
Speaker 2: account policies like lockout or hours restrictions, and federation usually
Speaker 2: with ADFS active directory. Federation Services is another option, often
Speaker 2: used for more complex scenarios. It redirects authentication to your
Speaker 2: on prem federation server, which issues security tokens claims to
Speaker 2: azure AD. Useful for specific application requirements or complex SSO needs.
Speaker 1: Lots of authentication options to fit different needs.
Speaker 2: Definitely and in Tune also provides alerts critical warning informational
Speaker 2: which you can configure notifications for so admins know immediately
Speaker 2: if there's a compliance issue, a configuration failure, or some
Speaker 2: other important event. The fascinating thing here really is the
Speaker 2: level of flexibility and control of the cloud offers. Managing
Speaker 2: a diverse fleet of devices users working from anywhere. It
Speaker 2: shifts the whole paradigm from managing servers in a rack
Speaker 2: to orchestrating services in a distributed, highly available cloud model.
Speaker 1: What a journey from basic installs all the way to
Speaker 1: cloud orchestration. So what does this all boil down to
Speaker 1: for you the listener, Well, you should.
Speaker 2: Now have a really solid strategic overview of what it
Speaker 2: takes to be a modern desktop administrator. Today we've covered deployment, security,
Speaker 2: managing users, networking, keeping things healthy with recovery, and that
Speaker 2: crucial cloud integration with Intune and Azure ad. You got
Speaker 2: that shortcut that distilled knowledge about the really critical Windows
Speaker 2: ten administration topics and how they fit together. Absolutely, the
Speaker 2: broad and evolving skill set and looking forward as technology
Speaker 2: keeps changing so fast, you know, think about AI more automation.
Speaker 2: It does raise an important question, how is this role
Speaker 2: the desktop administrator going to continue transforming? What new skills
Speaker 2: might become even more valuable, maybe less hands on fixing
Speaker 2: more about strategic planning, data analysis, orchestrating automated systems.
Speaker 1: That's a great question to ponder. What is next for
Speaker 1: this role? Definitely food for thought. A huge thank you
Speaker 1: for joining us on this deep dive, Keep exploring, keep learning.
Speaker 1: We'll catch you next time on the deep Dive.