azcomputerguru/claudetools
1
0
Fork 0
Code Issues 73 Pull Requests Actions Packages Projects Releases Wiki Activity

sync: auto-sync from HOWARD-HOME at 2026-07-17 10:24:46

Browse Source 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-17 10:24:46
This commit is contained in:
Howard Enos
2026-07-17 10:25:18 -07:00
parent 56a8b9f2ab
commit 22c54f7307
13 changed files with 474 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
.syncro-diag4-bo2.ps1 Normal file
View File

@@ -0,0 +1,22 @@
$ErrorActionPreference = 'Continue'
$today = (Get-Date).Date
Write-Output '=== App log: errors/crashes today mentioning Syncro/Kabuto/Squirrel/.NET ==='
Get-WinEvent -FilterHashtable @{LogName='Application'; StartTime=$today} -ErrorAction SilentlyContinue |
Where-Object { $_.LevelDisplayName -in 'Error','Warning' -and $_.Message -match 'Syncro|Kabuto|Squirrel|Update\.exe|RepairTech' } |
Sort-Object TimeCreated | Select-Object -Last 15 |
ForEach-Object { Write-Output ($_.TimeCreated.ToString('HH:mm:ss') + ' [' + $_.ProviderName + '/' + $_.Id + '] ' + (($_.Message -replace '\s+',' ').Substring(0, [math]::Min(220, $_.Message.Length)))) }
Write-Output '=== Defender blocks today (ASR 1121/1122, CFA 1123/1124, 5007) ==='
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Windows Defender/Operational'; Id=1121,1122,1123,1124,1126,1127,5007; StartTime=$today} -ErrorAction SilentlyContinue |
Sort-Object TimeCreated | Select-Object -Last 15 |
ForEach-Object { Write-Output ($_.TimeCreated.ToString('HH:mm:ss') + ' [' + $_.Id + '] ' + (($_.Message -replace '\s+',' ').Substring(0, [math]::Min(220, $_.Message.Length)))) }
Write-Output '=== ASR / CFA / policy state ==='
$mp = Get-MpPreference -ErrorAction SilentlyContinue
Write-Output ('ASR rule count enabled: ' + (@($mp.AttackSurfaceReductionRules_Actions | Where-Object { $_ -eq 1 }).Count))
Write-Output ('ControlledFolderAccess: ' + $mp.EnableControlledFolderAccess)
Write-Output ('AppLocker policy: ' + ((Get-AppLockerPolicy -Effective -ErrorAction SilentlyContinue).RuleCollections | Measure-Object).Count + ' rule collections')
$sac = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\CI\Policy' -Name VerifiedAndReputablePolicyState -ErrorAction SilentlyContinue
Write-Output ('SmartAppControl state: ' + $sac.VerifiedAndReputablePolicyState)
Write-Output '=== free space / drives ==='
Get-PSDrive -PSProvider FileSystem | ForEach-Object { Write-Output ($_.Name + ': used=' + [math]::Round($_.Used/1GB,1) + 'GB free=' + [math]::Round($_.Free/1GB,1) + 'GB') }