$ErrorActionPreference = 'Continue'
$today = (Get-Date).Date
Write-Output '=== App log: errors/crashes today mentioning Syncro/Kabuto/Squirrel/.NET ==='
Get-WinEvent -FilterHashtable @{LogName='Application'; StartTime=$today} -ErrorAction SilentlyContinue |
    Where-Object { $_.LevelDisplayName -in 'Error','Warning' -and $_.Message -match 'Syncro|Kabuto|Squirrel|Update\.exe|RepairTech' } |
    Sort-Object TimeCreated | Select-Object -Last 15 |
    ForEach-Object { Write-Output ($_.TimeCreated.ToString('HH:mm:ss') + ' [' + $_.ProviderName + '/' + $_.Id + '] ' + (($_.Message -replace '\s+',' ').Substring(0, [math]::Min(220, $_.Message.Length)))) }

Write-Output '=== Defender blocks today (ASR 1121/1122, CFA 1123/1124, 5007) ==='
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Windows Defender/Operational'; Id=1121,1122,1123,1124,1126,1127,5007; StartTime=$today} -ErrorAction SilentlyContinue |
    Sort-Object TimeCreated | Select-Object -Last 15 |
    ForEach-Object { Write-Output ($_.TimeCreated.ToString('HH:mm:ss') + ' [' + $_.Id + '] ' + (($_.Message -replace '\s+',' ').Substring(0, [math]::Min(220, $_.Message.Length)))) }

Write-Output '=== ASR / CFA / policy state ==='
$mp = Get-MpPreference -ErrorAction SilentlyContinue
Write-Output ('ASR rule count enabled: ' + (@($mp.AttackSurfaceReductionRules_Actions | Where-Object { $_ -eq 1 }).Count))
Write-Output ('ControlledFolderAccess: ' + $mp.EnableControlledFolderAccess)
Write-Output ('AppLocker policy: ' + ((Get-AppLockerPolicy -Effective -ErrorAction SilentlyContinue).RuleCollections | Measure-Object).Count + ' rule collections')
$sac = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\CI\Policy' -Name VerifiedAndReputablePolicyState -ErrorAction SilentlyContinue
Write-Output ('SmartAppControl state: ' + $sac.VerifiedAndReputablePolicyState)
Write-Output '=== free space / drives ==='
Get-PSDrive -PSProvider FileSystem | ForEach-Object { Write-Output ($_.Name + ': used=' + [math]::Round($_.Used/1GB,1) + 'GB free=' + [math]::Round($_.Free/1GB,1) + 'GB') }