sync: auto-sync from HOWARD-HOME at 2026-07-17 10:24:46

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-17 10:24:46

.syncro-diag2-bo2.ps1

@@ -0,0 +1,23 @@
+$ErrorActionPreference = 'Continue'
+Write-Output '=== MsiInstaller events today (install/uninstall history) ==='
+Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='MsiInstaller'; StartTime=(Get-Date).Date} -ErrorAction SilentlyContinue |
+    Where-Object { $_.Message -match 'Syncro' } |
+    Sort-Object TimeCreated |
+    ForEach-Object { Write-Output ($_.TimeCreated.ToString('HH:mm:ss') + ' id=' + $_.Id + ' :: ' + (($_.Message -replace '\s+',' ').Substring(0,[math]::Min(160,$_.Message.Length)))) }
+
+Write-Output '=== Syncro bootstrapper / agent logs ==='
+$logDirs = @('C:\Windows\Temp','C:\ProgramData\Syncro','C:\ProgramData\Syncro\logs')
+foreach ($d in $logDirs) {
+    Get-ChildItem $d -Filter '*ncro*' -ErrorAction SilentlyContinue | ForEach-Object { Write-Output ('FOUND: ' + $_.FullName + ' (' + $_.Length + 'b, ' + $_.LastWriteTime.ToString('HH:mm:ss') + ')') }
+}
+$bl = Get-ChildItem 'C:\Windows\Temp' -Filter 'Syncro*.log' -ErrorAction SilentlyContinue | Sort-Object LastWriteTime -Descending | Select-Object -First 1
+if (-not $bl) { $bl = Get-ChildItem 'C:\ProgramData\Syncro' -Filter '*.log' -Recurse -ErrorAction SilentlyContinue | Sort-Object LastWriteTime -Descending | Select-Object -First 1 }
+if ($bl) { Write-Output ('--- tail of ' + $bl.FullName + ' ---'); Get-Content $bl.FullName -Tail 40 }
+
+Write-Output '=== Defender detections (last 24h) ==='
+Get-MpThreatDetection -ErrorAction SilentlyContinue | Where-Object { $_.InitialDetectionTime -gt (Get-Date).AddDays(-1) } |
+    ForEach-Object { Write-Output ($_.InitialDetectionTime.ToString('HH:mm:ss') + ' ' + $_.ThreatID + ' res=' + ($_.Resources -join ';')) }
+
+Write-Output '=== 3rd-party AV registered ==='
+Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct -ErrorAction SilentlyContinue |
+    ForEach-Object { Write-Output ($_.displayName + ' state=' + $_.productState) }