azcomputerguru/claudetools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sync: auto-sync from HOWARD-HOME at 2026-07-08 12:39:04

Browse Source 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-08 12:39:04
This commit is contained in:
Howard Enos
2026-07-08 12:39:32 -07:00
parent c0d304485a
commit d037d82f5e
2 changed files with 975 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

762
clients/four-paws/onboarding-baselines/4PAWS-DOC-20260708T193830.json Normal file
View File

@@ -0,0 +1,762 @@
{
"host": "4PAWS-DOC",
"collected_at_utc": "2026-07-08T19:37:48Z",
"os": {
"caption": "Microsoft Windows 11 Pro",
"version": "10.0.26200",
"build": "26200",
"install_date": "2025-01-28T17:35:43Z",
"last_boot_utc": "2026-07-08T04:47:17Z",
"architecture": "64-bit"
},
"facts": {
"builtin_admin_enabled": false,
"os_eol": {
"eol_date": "2027-10-12",
"release": "Win11 25H2"
},
"pending_updates": 2,
"pending_reboot": false,
"uptime_days": 0.6,
"acg_managed_tools": "ScreenConnect / ConnectWise Control",
"hardware": {
"model": "Vostro 3910",
"manufacturer": "Dell Inc.",
"bios_date": "2026-04-23",
"cpu_logical": 12,
"bios_version": "1.40.0",
"cpu_cores": 6,
"ram_gb": 15.7,
"serial": "FDQ5Y04",
"cpu": "12th Gen Intel(R) Core(TM) i5-12400"
},
"third_party_av_active": false,
"os_build": "26200",
"secure_boot": false,
"backup_agents": null,
"autoruns_run_keys": [
{
"key": "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
"name": "SecurityHealth",
"value": "C:\\WINDOWS\\system32\\SecurityHealthSystray.exe"
},
{
"key": "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
"name": "WavesSvc",
"value": "\"C:\\WINDOWS\\System32\\DriverStore\\FileRepository\\wavesapo10de.inf_amd64_db3f3288eba6a142\\WavesSvc64.exe\" -Jack"
},
{
"key": "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
"name": "DYMOWebApi",
"value": "\"C:\\Program Files (x86)\\DYMO\\DYMO Connect\\DYMO.WebApi.Win.Host.exe\" /auto"
},
{
"key": "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
"name": "DymoOfficeHelper",
"value": "\"C:\\Program Files (x86)\\DYMO\\DYMO Connect\\DYMO.OfficeHelper.exe\" /w"
},
{
"key": "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
"name": "M22A",
"value": "C:\\WINDOWS\\twain_64\\Brimm22a\\Common\\TwDsUiLaunch.exe"
},
{
"key": "HKLM:\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run",
"name": "DYMOWebApi",
"value": "\"C:\\Program Files (x86)\\DYMO\\DYMO Connect\\DYMO.WebApi.Win.Host.exe\" /auto"
},
{
"key": "HKLM:\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run",
"name": "M22A",
"value": "C:\\WINDOWS\\twain_32\\Brimm22a\\Common\\TwDsUiLaunch.exe"
},
{
"key": "HKLM:\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run",
"name": "BrStsMon00",
"value": "C:\\Program Files (x86)\\Browny02\\Brother\\BrStMonW.exe /AUTORUN"
},
{
"key": "HKLM:\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run",
"name": "BrotherSoftwareUpdateNotification",
"value": "C:\\Program Files (x86)\\Brother\\SoftwareUpdateNotification\\SoftwareUpdateNotificationService.exe /Autorun"
}
],
"physical_disks": [
{
"health": "Healthy",
"model": "SK hynix BC901 HFS512GEJ9X108N",
"media_type": "SSD"
}
],
"local_users": [
{
"last_logon": "2025-01-15",
"name": "Administrator",
"password_never_expires": false,
"enabled": false
},
{
"last_logon": "",
"name": "DefaultAccount",
"password_never_expires": false,
"enabled": false
},
{
"last_logon": "",
"name": "Guest",
"password_never_expires": false,
"enabled": false
},
{
"last_logon": "2026-07-08",
"name": "staff",
"password_never_expires": false,
"enabled": true
},
{
"last_logon": "",
"name": "WDAGUtilityAccount",
"password_never_expires": false,
"enabled": false
}
],
"scheduled_tasks_count": 15,
"volumes": [
{
"drive": "[unlabeled]",
"size_gb": 0.1,
"free_pct": 30.8,
"free_gb": 0
},
{
"drive": "[unlabeled]",
"size_gb": 0.8,
"free_pct": 14.2,
"free_gb": 0.1
},
{
"drive": "C:",
"size_gb": 476,
"free_pct": 82.5,
"free_gb": 392.8
}
],
"network_adapters": [
{
"dhcp": true,
"description": "Realtek PCIe GbE Family Controller",
"gateway": [
"192.168.0.1",
"fe80::10:18ff:fe13:98e0"
],
"mac": "20:88:10:8E:C7:FA",
"ip": [
"192.168.0.148",
"fe80::2635:722c:b187:5043",
"2001:579:83bc:aa0:28ca:10c6:a604:300a",
"2001:579:83bc:aa0:e1eb:2999:7092:bb44",
"2001:579:83bc:aa0:cb54:157:d896:fd93"
],
"dns": [
"68.105.28.15",
"68.105.29.15",
"68.105.28.17"
]
}
],
"failed_autostart_services": {
"name": "Intel(R) Platform License Manager Service",
"display": "Intel(R) Platform License Manager Service",
"state": "Stopped"
},
"stability_14d": {
"unexpected_shutdowns": 0,
"disk_errors": 0,
"bugchecks": 0
},
"exposure": {
"smb1_enabled": false,
"laps_present": true,
"rdp_enabled": false,
"uac_enabled": true,
"rdp_nla": true
},
"accounts_password_never_expires": [],
"installed_software": [
{
"publisher": "Brother Industries Ltd.",
"name": "BrLauncher",
"version": "2.0.36.0"
},
{
"publisher": "Brother Industries Ltd.",
"name": "BrLogRx",
"version": "1.0.5.0"
},
{
"publisher": "Brother Industries, Ltd.",
"name": "Brother iPrint&Scan",
"version": "13.1.0.85"
},
{
"publisher": "Brother Industries Ltd.",
"name": "Brother PCFax Driver",
"version": "1.4.2.3"
},
{
"publisher": "Brother Industries Ltd.",
"name": "Brother Printer Driver",
"version": "2.1.0.0"
},
{
"publisher": "Brother Industries Ltd.",
"name": "Brother Scanner Driver",
"version": "1.0.11.1"
},
{
"publisher": "Brother Industries Ltd.",
"name": "Brother Scanner Driver",
"version": "1.0.21.1"
},
{
"publisher": "Brother Industries Ltd.",
"name": "BrSupportTools",
"version": "1.0.44.0"
},
{
"publisher": "Microsoft Corporation",
"name": "Copilot",
"version": "149.0.4022.80"
},
{
"publisher": "Dell Technologies, Inc.",
"name": "Dell Connected Service Delivery",
"version": "1.1.1.0"
},
{
"publisher": "Dell Technologies, Inc.",
"name": "Dell Connected Service Delivery SubAgent",
"version": "1.1.0.0"
},
{
"publisher": "Dell, Inc.",
"name": "Dell Core Services",
"version": "1.13.21.0"
},
{
"publisher": "Dell Inc.",
"name": "Dell SupportAssist PC Analytics",
"version": "4.10.6.48716"
},
{
"publisher": "DYMO",
"name": "DYMO Connect",
"version": "1.4.8.3"
},
{
"publisher": "DYMO",
"name": "DYMO Connect Web Service",
"version": "1.4.8.3"
},
{
"publisher": "Brother Industries Ltd.",
"name": "HowToGuide",
"version": "1.0.3.0"
},
{
"publisher": "Brother Industries Ltd.",
"name": "HttpToUsbBridge",
"version": "2.5.108.1"
},
{
"publisher": "Microsoft Corporation",
"name": "Microsoft .NET 8.0.12 - Windows Server Hosting",
"version": "8.0.12.24603"
},
{
"publisher": "Microsoft Corporation",
"name": "Microsoft .NET Host - 8.0.12 (x86)",
"version": "64.48.26165"
},
{
"publisher": "Microsoft Corporation",
"name": "Microsoft .NET Host - 8.0.23 (x64)",
"version": "64.92.45415"
},
{
"publisher": "Microsoft Corporation",
"name": "Microsoft .NET Host FX Resolver - 8.0.12 (x64)",
"version": "64.48.26165"
},
{
"publisher": "Microsoft Corporation",
"name": "Microsoft .NET Host FX Resolver - 8.0.12 (x86)",
"version": "64.48.26165"
},
{
"publisher": "Microsoft Corporation",
"name": "Microsoft .NET Host FX Resolver - 8.0.23 (x64)",
"version": "64.92.45415"
},
{
"publisher": "Microsoft Corporation",
"name": "Microsoft .NET Runtime - 8.0.12 (x64)",
"version": "64.48.26165"
},
{
"publisher": "Microsoft Corporation",
"name": "Microsoft .NET Runtime - 8.0.12 (x86)",
"version": "64.48.26165"
},
{
"publisher": "Microsoft Corporation",
"name": "Microsoft .NET Runtime - 8.0.23 (x64)",
"version": "64.92.45415"
},
{
"publisher": "Microsoft Corporation",
"name": "Microsoft 365 Apps for business - en-us",
"version": "16.0.20131.20112"
},
{
"publisher": "Microsoft Corporation",
"name": "Microsoft ASP.NET Core 8.0.12 Hosting Bundle Options",
"version": "8.0.12.24603"
},
{
"publisher": "Microsoft Corporation",
"name": "Microsoft ASP.NET Core 8.0.12 Shared Framework (x64)",
"version": "8.0.12.24603"
},
{
"publisher": "Microsoft Corporation",
"name": "Microsoft ASP.NET Core 8.0.12 Shared Framework (x86)",
"version": "8.0.12.24603"
},
{
"publisher": "Microsoft Corporation",
"name": "Microsoft Edge",
"version": "150.0.4078.48"
},
{
"publisher": "Microsoft Corporation",
"name": "Microsoft Edge WebView2 Runtime",
"version": "150.0.4078.48"
},
{
"publisher": "Microsoft Corporation",
"name": "Microsoft OneDrive",
"version": "26.108.0607.0002"
},
{
"publisher": "Microsoft Corporation",
"name": "Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319",
"version": "10.0.30319"
},
{
"publisher": "Microsoft Corporation",
"name": "Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319",
"version": "10.0.30319"
},
{
"publisher": "Microsoft Corporation",
"name": "Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.44.35211",
"version": "14.44.35211.0"
},
{
"publisher": "Microsoft Corporation",
"name": "Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.44.35211",
"version": "14.44.35211.0"
},
{
"publisher": "Microsoft Corporation",
"name": "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.44.35211",
"version": "14.44.35211"
},
{
"publisher": "Microsoft Corporation",
"name": "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.44.35211",
"version": "14.44.35211"
},
{
"publisher": "Microsoft Corporation",
"name": "Microsoft Visual C++ 2022 X86 Additional Runtime - 14.44.35211",
"version": "14.44.35211"
},
{
"publisher": "Microsoft Corporation",
"name": "Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.44.35211",
"version": "14.44.35211"
},
{
"publisher": "Microsoft Corporation",
"name": "Microsoft Windows Desktop Runtime - 8.0.12 (x86)",
"version": "64.48.26178"
},
{
"publisher": "Microsoft Corporation",
"name": "Microsoft Windows Desktop Runtime - 8.0.12 (x86)",
"version": "8.0.12.34404"
},
{
"publisher": "Microsoft Corporation",
"name": "Microsoft Windows Desktop Runtime - 8.0.23 (x64)",
"version": "64.92.45458"
},
{
"publisher": "Microsoft Corporation",
"name": "Microsoft Windows Desktop Runtime - 8.0.23 (x64)",
"version": "8.0.23.35609"
},
{
"publisher": "Brother Industries, Ltd.",
"name": "NetworkRepairTool",
"version": "1.2.29.0"
},
{
"publisher": "Microsoft Corporation",
"name": "Office 16 Click-to-Run Extensibility Component",
"version": "16.0.20131.20112"
},
{
"publisher": "Brother Industries, Ltd.",
"name": "PC-FAXReceive",
"version": "1.9.11.0"
},
{
"publisher": "Brother Industries Ltd.",
"name": "PCFaxTx",
"version": "3.7.17.1"
},
{
"publisher": "IDrive Inc",
"name": "RemotePC Printer",
"version": "3.0.2"
},
{
"publisher": "IDrive Inc",
"name": "RemotePC version 7.6.96",
"version": "7.6.96"
},
{
"publisher": "Brother",
"name": "ScannerUtilityInstaller",
"version": "1.20.0.1"
},
{
"publisher": "ScreenConnect Software",
"name": "ScreenConnect Client (1912bf3444b41a08)",
"version": "26.4.3.9662"
},
{
"publisher": "Brother Industries, Ltd.",
"name": "SoftwareUpdateNotification",
"version": "1.0.26.0"
},
{
"publisher": "Brother Industries, Ltd.",
"name": "StatusMonitor",
"version": "1.42.0.0"
},
{
"publisher": "Brother Industries, Ltd.",
"name": "UsbRepairTool",
"version": "1.4.0.0"
}
],
"tpm": {
"enabled": true,
"ready": true,
"present": true
},
"local_groups": [
"Access Control Assistance Operators",
"Administrators",
"Backup Operators",
"Cryptographic Operators",
"Device Owners",
"Distributed COM Users",
"Event Log Readers",
"Guests",
"Hyper-V Administrators",
"IIS_IUSRS",
"Network Configuration Operators",
"OpenSSH Users",
"Performance Log Users",
"Performance Monitor Users",
"Power Users",
"Remote Desktop Users",
"Remote Management Users",
"Replicator",
"System Managed Accounts Group",
"User Mode Hardware Operators",
"Users"
],
"battery": {
"present": false
},
"activation": {
"edition": "Microsoft Windows 11 Pro",
"description": "Windows(R) Operating System, OEM_DM channel",
"licensed": true,
"license_status_code": 1
},
"time_source": "The following error occurred: The service has not been started. (0x80070426)",
"chassis_types": [
3
],
"last_hotfix": {
"hotfix_id": "KB5094126",
"installed_on": "2026-07-08T07:00:00Z"
},
"scheduled_tasks": [
{
"path": "\\",
"name": "Dell SupportAssistAgent AutoUpdate",
"state": "Ready"
},
{
"path": "\\",
"name": "MicrosoftEdgeUpdateTaskMachineCore{EB845478-3E63-44EA-9AFA-363DC485B96A}",
"state": "Ready"
},
{
"path": "\\",
"name": "MicrosoftEdgeUpdateTaskMachineUA{9982F269-BC64-4D3B-B5D1-5279CD631569}",
"state": "Ready"
},
{
"path": "\\",
"name": "OneDrive Per-Machine Standalone Update Task",
"state": "Ready"
},
{
"path": "\\",
"name": "OneDrive Reporting Task-S-1-5-21-4096311219-2282814006-369346320-1002",
"state": "Ready"
},
{
"path": "\\",
"name": "OneDrive Reporting Task-S-1-5-21-4096311219-2282814006-369346320-500",
"state": "Ready"
},
{
"path": "\\",
"name": "OneDrive Startup Task-S-1-5-21-4096311219-2282814006-369346320-1002",
"state": "Ready"
},
{
"path": "\\",
"name": "RemotePC",
"state": "Ready"
},
{
"path": "\\",
"name": "RPCServiceHealthCheck",
"state": "Ready"
},
{
"path": "\\",
"name": "ServiceMonitor",
"state": "Ready"
},
{
"path": "\\",
"name": "StartRPCPerformanceService",
"state": "Ready"
},
{
"path": "\\",
"name": "StartRPCPerformanceServiceOnStart",
"state": "Ready"
},
{
"path": "\\",
"name": "StartRPCService",
"state": "Ready"
},
{
"path": "\\SoftLanding\\S-1-5-21-4096311219-2282814006-369346320-1002\\",
"name": "SoftLandingCreativeManagementTask",
"state": "Ready"
},
{
"path": "\\SoftLanding\\S-1-5-21-4096311219-2282814006-369346320-1002\\",
"name": "SoftLandingDeferralTask-{93c07fc1-8e63-4b72-8d15-e30d3bfad5e0}",
"state": "Ready"
}
],
"antivirus_products": [
"Windows Defender"
],
"domain_joined": false,
"defender": {
"antispyware_signature_age": 0,
"tamper_protected": true,
"real_time_protection": true,
"nis_enabled": true,
"available": true,
"antivirus_enabled": true,
"am_service_enabled": true
},
"bitlocker": {
"os_volume": "C:",
"key_protectors": [],
"recovery_key_present": false,
"available": true,
"encryption_percent": 0,
"protection_status": "Off"
},
"is_laptop": false,
"installed_software_count": 56,
"local_administrators": [
"4PAWS-DOC\\Administrator",
"4PAWS-DOC\\staff"
],
"firewall_profiles": {
"Private": true,
"Domain": true,
"Public": true
},
"domain": "WORKGROUP",
"foreign_agents": null
},
"findings": [
{
"id": "sec.defender.ok",
"category": "security",
"severity": "info",
"title": "Defender active and current",
"detail": "Real-time protection on, service running, signatures current.",
"evidence": "RealTimeProtectionEnabled=True; AMServiceEnabled=True; AntispywareSignatureAge=0 days; IsTamperProtected=True"
},
{
"id": "sec.av_products.defender_only",
"category": "security",
"severity": "info",
"title": "Defender is the only registered AV",
"detail": "Only Microsoft/Windows Defender is registered in Security Center.",
"evidence": "Windows Defender"
},
{
"id": "sec.foreign_agents.none",
"category": "security",
"severity": "info",
"title": "No competitor/leftover management agents detected",
"detail": "No known competitor RMM or unmanaged remote-access agents found in installed programs or services.",
"evidence": "Scanned uninstall hives (HKLM + WOW6432Node) and Win32_Service"
},
{
"id": "sec.foreign_agents.acg.screenconnect_connectwise_control",
"category": "security",
"severity": "info",
"title": "Expected ACG management tooling present: ScreenConnect / ConnectWise Control",
"detail": "This is Arizona Computer Guru managed/remote-access tooling that we deploy. Its presence is expected and not a foreign-agent risk.",
"evidence": "program: ScreenConnect Client (1912bf3444b41a08) 26.4.3.9662\nservice: ScreenConnect Client (1912bf3444b41a08) (ScreenConnect Client (1912bf3444b41a08)) Running"
},
{
"id": "sec.firewall.ok",
"category": "security",
"severity": "info",
"title": "All firewall profiles enabled",
"detail": "Domain, Private, and Public firewall profiles are all enabled.",
"evidence": "Private=True; Domain=True; Public=True"
},
{
"id": "sec.bitlocker.unencrypted",
"category": "security",
"severity": "warning",
"title": "OS volume is NOT encrypted with BitLocker",
"detail": "The operating system volume is unencrypted. Data is exposed if the disk is removed or the device is lost. Enable BitLocker and escrow the recovery key.",
"evidence": "Volume=C:; ProtectionStatus=Off; EncryptionPercentage=0; KeyProtectors="
},
{
"id": "sec.local_admins.list",
"category": "security",
"severity": "info",
"title": "Local administrators (2)",
"detail": "Members of the local Administrators group. Review for unexpected or unknown accounts (especially leftover MSP/vendor accounts from a prior provider).",
"evidence": "4PAWS-DOC\\Administrator\n4PAWS-DOC\\staff"
},
{
"id": "sec.patch.os_supported",
"category": "security",
"severity": "info",
"title": "OS build supported: Win11 25H2",
"detail": "Build 26200 (Win11 25H2) is in support until 2027-10-12.",
"evidence": "Microsoft Windows 11 Pro build 26200"
},
{
"id": "sec.patch.pending",
"category": "security",
"severity": "warning",
"title": "2 pending Windows updates",
"detail": "Windows Update reports pending (not installed, not hidden) updates. Some may be security updates. Approve/install on the next maintenance window.",
"evidence": "Microsoft.Update.Session search IsInstalled=0 and IsHidden=0 -> 2"
},
{
"id": "sec.patch.last_hotfix",
"category": "security",
"severity": "info",
"title": "Last hotfix: KB5094126",
"detail": "Most recently installed update (from Get-HotFix; reflects CBS/MSU packages, not all cumulative metadata).",
"evidence": "KB5094126 installed 2026-07-08T07:00:00Z"
},
{
"id": "sec.exposure.smb1_off",
"category": "security",
"severity": "info",
"title": "SMBv1 disabled",
"detail": "SMBv1 server protocol is disabled.",
"evidence": "EnableSMB1Protocol=False"
},
{
"id": "sec.exposure.laps_present",
"category": "security",
"severity": "info",
"title": "LAPS detected",
"detail": "A LAPS mechanism is present.",
"evidence": "Windows LAPS reg key"
},
{
"id": "health.stability.clean",
"category": "health",
"severity": "info",
"title": "No stability events in the last 14 days",
"detail": "No unexpected shutdowns, BSODs, or disk errors logged.",
"evidence": "Unexpected shutdowns (id 41)=0; Bugchecks/BSOD (id 1001)=0; Disk errors (id 7/51/153)=0"
},
{
"id": "health.failed_services.stopped",
"category": "health",
"severity": "warning",
"title": "1 auto-start service(s) not running",
"detail": "These services are set to start automatically but are not running. Some may be benign; review for security agents, backup agents, or AV that should be running.",
"evidence": "Intel(R) Platform License Manager Service (Intel(R) Platform License Manager Service) = Stopped"
},
{
"id": "health.domain.workgroup",
"category": "health",
"severity": "info",
"title": "Not domain-joined (workgroup)",
"detail": "This machine is in workgroup/Azure AD only mode (Domain=WORKGROUP). No on-prem AD secure channel applies.",
"evidence": "PartOfDomain=False; Domain=WORKGROUP"
},
{
"id": "health.time.source",
"category": "health",
"severity": "info",
"title": "Time service source",
"detail": "Current Windows Time service source.",
"evidence": "Source=The following error occurred: The service has not been started. (0x80070426)"
},
{
"id": "health.backup.none",
"category": "health",
"severity": "info",
"title": "No backup agent detected",
"detail": "No known backup agent service found. Backup expectation varies by endpoint; confirm whether this machine is supposed to have local/cloud backup and whether server-side or M365 backup covers it.",
"evidence": "No matching backup service in Win32_Service"
}
]
}

213
clients/four-paws/onboarding-baselines/4PAWS-DOC-20260708T193830.md Normal file
View File

@@ -0,0 +1,213 @@
# Onboarding Diagnostic Baseline - 4PAWS-DOC
- **Grade:** AMBER
- **Host:** 4PAWS-DOC
- **Client:** Four Paws (`four-paws`)
- **Collected (UTC):** 2026-07-08T19:37:48Z
- **Agent ID:** 79d5243b-1b7d-4097-82f6-17b7b701bee5
- **Command ID:** b7a2000e-6e4d-48ee-b578-98418a94c671
- **Findings:** 0 critical / 3 warning / 14 info / 0 unknown
- **OS:** Microsoft Windows 11 Pro (build 26200)
---
## WARNING (3)
### OS volume is NOT encrypted with BitLocker
- **Category:** security
- **ID:** `sec.bitlocker.unencrypted`
- The operating system volume is unencrypted. Data is exposed if the disk is removed or the device is lost. Enable BitLocker and escrow the recovery key.
```
Volume=C:; ProtectionStatus=Off; EncryptionPercentage=0; KeyProtectors=
```
### 2 pending Windows updates
- **Category:** security
- **ID:** `sec.patch.pending`
- Windows Update reports pending (not installed, not hidden) updates. Some may be security updates. Approve/install on the next maintenance window.
```
Microsoft.Update.Session search IsInstalled=0 and IsHidden=0 -> 2
```
### 1 auto-start service(s) not running
- **Category:** health
- **ID:** `health.failed_services.stopped`
- These services are set to start automatically but are not running. Some may be benign; review for security agents, backup agents, or AV that should be running.
```
Intel(R) Platform License Manager Service (Intel(R) Platform License Manager Service) = Stopped
```
## INFO (14)
### Defender active and current
- **Category:** security
- **ID:** `sec.defender.ok`
- Real-time protection on, service running, signatures current.
```
RealTimeProtectionEnabled=True; AMServiceEnabled=True; AntispywareSignatureAge=0 days; IsTamperProtected=True
```
### Defender is the only registered AV
- **Category:** security
- **ID:** `sec.av_products.defender_only`
- Only Microsoft/Windows Defender is registered in Security Center.
```
Windows Defender
```
### No competitor/leftover management agents detected
- **Category:** security
- **ID:** `sec.foreign_agents.none`
- No known competitor RMM or unmanaged remote-access agents found in installed programs or services.
```
Scanned uninstall hives (HKLM + WOW6432Node) and Win32_Service
```
### Expected ACG management tooling present: ScreenConnect / ConnectWise Control
- **Category:** security
- **ID:** `sec.foreign_agents.acg.screenconnect_connectwise_control`
- This is Arizona Computer Guru managed/remote-access tooling that we deploy. Its presence is expected and not a foreign-agent risk.
```
program: ScreenConnect Client (1912bf3444b41a08) 26.4.3.9662
service: ScreenConnect Client (1912bf3444b41a08) (ScreenConnect Client (1912bf3444b41a08)) Running
```
### All firewall profiles enabled
- **Category:** security
- **ID:** `sec.firewall.ok`
- Domain, Private, and Public firewall profiles are all enabled.
```
Private=True; Domain=True; Public=True
```
### Local administrators (2)
- **Category:** security
- **ID:** `sec.local_admins.list`
- Members of the local Administrators group. Review for unexpected or unknown accounts (especially leftover MSP/vendor accounts from a prior provider).
```
4PAWS-DOC\Administrator
4PAWS-DOC\staff
```
### OS build supported: Win11 25H2
- **Category:** security
- **ID:** `sec.patch.os_supported`
- Build 26200 (Win11 25H2) is in support until 2027-10-12.
```
Microsoft Windows 11 Pro build 26200
```
### Last hotfix: KB5094126
- **Category:** security
- **ID:** `sec.patch.last_hotfix`
- Most recently installed update (from Get-HotFix; reflects CBS/MSU packages, not all cumulative metadata).
```
KB5094126 installed 2026-07-08T07:00:00Z
```
### SMBv1 disabled
- **Category:** security
- **ID:** `sec.exposure.smb1_off`
- SMBv1 server protocol is disabled.
```
EnableSMB1Protocol=False
```
### LAPS detected
- **Category:** security
- **ID:** `sec.exposure.laps_present`
- A LAPS mechanism is present.
```
Windows LAPS reg key
```
### No stability events in the last 14 days
- **Category:** health
- **ID:** `health.stability.clean`
- No unexpected shutdowns, BSODs, or disk errors logged.
```
Unexpected shutdowns (id 41)=0; Bugchecks/BSOD (id 1001)=0; Disk errors (id 7/51/153)=0
```
### Not domain-joined (workgroup)
- **Category:** health
- **ID:** `health.domain.workgroup`
- This machine is in workgroup/Azure AD only mode (Domain=WORKGROUP). No on-prem AD secure channel applies.
```
PartOfDomain=False; Domain=WORKGROUP
```
### Time service source
- **Category:** health
- **ID:** `health.time.source`
- Current Windows Time service source.
```
Source=The following error occurred: The service has not been started. (0x80070426)
```
### No backup agent detected
- **Category:** health
- **ID:** `health.backup.none`
- No known backup agent service found. Backup expectation varies by endpoint; confirm whether this machine is supposed to have local/cloud backup and whether server-side or M365 backup covers it.
```
No matching backup service in Win32_Service
```
---
## Inventory Baseline Summary
- **Manufacturer / Model:** Dell Inc. / Vostro 3910
- **Serial:** FDQ5Y04
- **CPU:** 12th Gen Intel(R) Core(TM) i5-12400 (6 cores / 12 logical)
- **RAM (GB):** 15.7
- **BIOS:** 1.40.0 (2026-04-23)
- **Chassis is laptop:** false
- **TPM present / Secure Boot:** true / ?
- **Domain joined:** false (WORKGROUP)
- **OS activation licensed:** true
- **Uptime (days):** 0.6
- **Pending reboot:** false
- **Installed software count:** 56
- **Scheduled tasks (non-MS, enabled):** 15
- **Local administrators:** 4PAWS-DOC\Administrator, 4PAWS-DOC\staff
### Fixed volumes
- [unlabeled] - 0 GB free of 0.1 GB (30.8%)
- [unlabeled] - 0.1 GB free of 0.8 GB (14.2%)
- C: - 392.8 GB free of 476 GB (82.5%)
### Network adapters
- Realtek PCIe GbE Family Controller - IP: 192.168.0.148, fe80::2635:722c:b187:5043, 2001:579:83bc:aa0:28ca:10c6:a604:300a, 2001:579:83bc:aa0:e1eb:2999:7092:bb44, 2001:579:83bc:aa0:cb54:157:d896:fd93 - DNS: 68.105.28.15, 68.105.29.15, 68.105.28.17 - DHCP: true
---
## Diff vs Prior Baseline
- No prior baseline found for this host. This is the first baseline.
---
_Generated by run-onboarding-diagnostic.sh (GuruRMM onboarding diagnostic, Phase 1). Raw snapshot: `4PAWS-DOC-20260708T193830.json` (immutable)._