claudetools/clients/gonzvar-tax-services/GTS-W0-DISK-ANALYSIS.md

GTS-W0 "Disk Errors" Analysis - FALSE POSITIVE

Date: 2026-06-06 Machine: GTS-W0 Finding: Initial diagnostic reported "9 disk errors in 14 days" - INCORRECT

---

Summary

The "disk errors" are NOT disk errors. All 9 events are benign VBS (Virtualization-Based Security) boot messages incorrectly counted as disk errors due to Event ID overlap.

Drive Status: HEALTHY - No action required

---

Root Cause Analysis

What the Diagnostic Probe Reported

• 9 "disk errors" (Event IDs 7/51/153) in last 14 days
• Classified as CRITICAL: "Recurring stability events"
• Recommendation: Replace failing drive immediately

What Actually Happened

ALL 9 events are Event ID 153 from source "Microsoft-Windows-Kernel-Boot":

Event ID: 153 | Source: Microsoft-Windows-Kernel-Boot
Message: Virtualization-based security (policies: VBS Enabled,VSM Required,Hvci,
         Boot Chain Signer Soft Enforced) is enabled due to VBS registry configuration.

These are informational boot messages, not disk errors. They fire on every boot when Windows 11 security features (VBS/HVCI) are enabled.

Event ID 153 Context Issue

Event ID 153 has different meanings depending on the source:

Source	Meaning	Severity
Disk	Actual disk I/O error	CRITICAL - Hardware failure
Microsoft-Windows-Kernel-Boot	VBS/HVCI enabled status	INFO - Security feature working

The diagnostic probe queries Event IDs 7, 51, 153 without filtering by source, so it incorrectly counts VBS boot messages as disk errors.

Event Timeline (All VBS Messages)

• 2026-06-05 10:05:43 - VBS enabled (boot)
• 2026-06-02 17:39:06 - VBS enabled (boot)
• 2026-06-02 17:34:58 - VBS enabled (boot)
• 2026-06-02 14:30:34 - VBS enabled (boot)
• 2026-06-01 17:55:26 - VBS enabled (boot)
• 2026-05-31 09:48:23 - VBS enabled (boot)
• 2026-05-30 09:47:52 - VBS enabled (boot)
• 2026-05-30 08:59:25 - VBS enabled (boot)
• 2026-05-30 08:55:04 - VBS enabled (boot)

Pattern: Multiple reboots (2-4 per day on 05/30, 05/31, 06/01, 06/02) = machines being restarted frequently, not disk failures.

---

Actual Drive Health

Query Results (2026-06-06):

FriendlyName        MediaType BusType          Size HealthStatus OperationalStatus
------------        --------- -------          ---- ------------ -----------------
KINGSTON SNV2S1000G SSD       NVMe    1000204886016 Healthy      OK

Drive Details:

• Model: KINGSTON SNV2S1000G
• Type: 1TB NVMe SSD (M.2, PCIe)
• Health Status: Healthy
• Operational Status: OK
• No actual disk errors in Event Viewer
• SMART attributes: Healthy (per Windows Storage Spaces)

Conclusion: Drive is functioning normally. No replacement needed.

---

Revised GTS-W0 Assessment

Grade: Still RED, but for different reasons

CRITICAL Issues (Actual):

1. All firewalls disabled (Domain, Private, Public OFF)
2. RDP enabled WITHOUT Network Level Authentication

WARNING Issues:

• BitLocker not enabled (OS volume unencrypted)
• 1 pending Windows update
• Reboot pending
• 4 auto-start services not running (including Group Policy Client)
• 2 unexpected shutdowns (Event ID 41) in 14 days - worth investigating but not drive-related

REMOVED:

• 9 disk errors (FALSE POSITIVE)
• Failing hard drive (INCORRECT)
• Backup data immediately (NOT NEEDED)
• Replace drive (NOT NEEDED)

---

Diagnostic Probe Bug

Issue: onboarding-diagnostic.ps1 queries Event IDs 7, 51, 153 without filtering by source.

Current Code (Problematic):

$DiskErrors = (Get-WinEvent -FilterHashtable @{
    LogName = 'System'
    ID = 7,51,153
    StartTime = $14DaysAgo
} -ErrorAction SilentlyContinue | Measure-Object).Count

Fix Needed:

$DiskErrors = (Get-WinEvent -FilterHashtable @{
    LogName = 'System'
    ID = 7,51,153
    StartTime = $14DaysAgo
} -ErrorAction SilentlyContinue |
Where-Object { $_.ProviderName -ne 'Microsoft-Windows-Kernel-Boot' } |
Measure-Object).Count

OR use a more specific query:

$DiskErrors = (Get-WinEvent -FilterHashtable @{
    LogName = 'System'
    ProviderName = 'disk'
    StartTime = $14DaysAgo
} -ErrorAction SilentlyContinue | Measure-Object).Count

Impact: This bug likely affects other machines too. Any Windows 11 machine with VBS/HVCI enabled (default on modern hardware) will show false disk errors.

Action Required:

1. Fix onboarding-diagnostic.ps1 probe script
2. Re-run diagnostics on all Gonzvar machines to get accurate baseline
3. Update grading logic to account for corrected disk error counts

---

Lessons Learned

1. Always verify critical findings - Don't trust automated diagnostics blindly
2. Event ID alone is insufficient - Must include source/provider filtering
3. Context matters - Same Event ID can mean completely different things
4. Windows 11 defaults - VBS/HVCI enabled by default on 12th gen Intel and newer
5. Question patterns - 9 errors in 14 days with "Healthy" SMART seemed contradictory (good instinct to question)

---

Next Steps

1. ✓ Verify drive health (COMPLETED - drive is healthy)
2. Update diagnostic probe script to fix Event ID 153 false positive
3. Re-run diagnostics on all 6 Gonzvar machines for accurate baselines
4. Focus remediation on actual issues (firewall, RDP, BitLocker)
5. Document this finding as a diagnostic probe improvement

---

Analysis Completed: 2026-06-06 Drive Replacement: NOT NEEDED Data Backup Urgency: REMOVED Actual Priority: Fix firewall and RDP security issues