$ErrorActionPreference = 'Continue'
Write-Output '=== MsiInstaller events today (install/uninstall history) ==='
Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='MsiInstaller'; StartTime=(Get-Date).Date} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'Syncro' } |
    Sort-Object TimeCreated |
    ForEach-Object { Write-Output ($_.TimeCreated.ToString('HH:mm:ss') + ' id=' + $_.Id + ' :: ' + (($_.Message -replace '\s+',' ').Substring(0,[math]::Min(160,$_.Message.Length)))) }

Write-Output '=== Syncro bootstrapper / agent logs ==='
$logDirs = @('C:\Windows\Temp','C:\ProgramData\Syncro','C:\ProgramData\Syncro\logs')
foreach ($d in $logDirs) {
    Get-ChildItem $d -Filter '*ncro*' -ErrorAction SilentlyContinue | ForEach-Object { Write-Output ('FOUND: ' + $_.FullName + ' (' + $_.Length + 'b, ' + $_.LastWriteTime.ToString('HH:mm:ss') + ')') }
}
$bl = Get-ChildItem 'C:\Windows\Temp' -Filter 'Syncro*.log' -ErrorAction SilentlyContinue | Sort-Object LastWriteTime -Descending | Select-Object -First 1
if (-not $bl) { $bl = Get-ChildItem 'C:\ProgramData\Syncro' -Filter '*.log' -Recurse -ErrorAction SilentlyContinue | Sort-Object LastWriteTime -Descending | Select-Object -First 1 }
if ($bl) { Write-Output ('--- tail of ' + $bl.FullName + ' ---'); Get-Content $bl.FullName -Tail 40 }

Write-Output '=== Defender detections (last 24h) ==='
Get-MpThreatDetection -ErrorAction SilentlyContinue | Where-Object { $_.InitialDetectionTime -gt (Get-Date).AddDays(-1) } |
    ForEach-Object { Write-Output ($_.InitialDetectionTime.ToString('HH:mm:ss') + ' ' + $_.ThreatID + ' res=' + ($_.Resources -join ';')) }

Write-Output '=== 3rd-party AV registered ==='
Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct -ErrorAction SilentlyContinue |
    ForEach-Object { Write-Output ($_.displayName + ' state=' + $_.productState) }
