claudetools/clients/gonzvar-tax-services/GTS-W0-DISK-ANALYSIS.md

# GTS-W0 "Disk Errors" Analysis - FALSE POSITIVE

**Date:** 2026-06-06
**Machine:** GTS-W0
**Finding:** Initial diagnostic reported "9 disk errors in 14 days" - INCORRECT

---

## Summary

**The "disk errors" are NOT disk errors.** All 9 events are benign VBS (Virtualization-Based Security) boot messages incorrectly counted as disk errors due to Event ID overlap.

**Drive Status:** HEALTHY - No action required

---

## Root Cause Analysis

### What the Diagnostic Probe Reported

- 9 "disk errors" (Event IDs 7/51/153) in last 14 days
- Classified as CRITICAL: "Recurring stability events"
- Recommendation: Replace failing drive immediately

### What Actually Happened

**ALL 9 events are Event ID 153 from source "Microsoft-Windows-Kernel-Boot":**

```
Event ID: 153 | Source: Microsoft-Windows-Kernel-Boot
Message: Virtualization-based security (policies: VBS Enabled,VSM Required,Hvci,
         Boot Chain Signer Soft Enforced) is enabled due to VBS registry configuration.
```

**These are informational boot messages**, not disk errors. They fire on every boot when Windows 11 security features (VBS/HVCI) are enabled.

### Event ID 153 Context Issue

Event ID 153 has **different meanings** depending on the source:

| Source | Meaning | Severity |
|--------|---------|----------|
| **Disk** | Actual disk I/O error | CRITICAL - Hardware failure |
| **Microsoft-Windows-Kernel-Boot** | VBS/HVCI enabled status | INFO - Security feature working |

The diagnostic probe queries `Event IDs 7, 51, 153` **without filtering by source**, so it incorrectly counts VBS boot messages as disk errors.

### Event Timeline (All VBS Messages)

- 2026-06-05 10:05:43 - VBS enabled (boot)
- 2026-06-02 17:39:06 - VBS enabled (boot)
- 2026-06-02 17:34:58 - VBS enabled (boot)
- 2026-06-02 14:30:34 - VBS enabled (boot)
- 2026-06-01 17:55:26 - VBS enabled (boot)
- 2026-05-31 09:48:23 - VBS enabled (boot)
- 2026-05-30 09:47:52 - VBS enabled (boot)
- 2026-05-30 08:59:25 - VBS enabled (boot)
- 2026-05-30 08:55:04 - VBS enabled (boot)

**Pattern:** Multiple reboots (2-4 per day on 05/30, 05/31, 06/01, 06/02) = machines being restarted frequently, not disk failures.

---

## Actual Drive Health

**Query Results (2026-06-06):**

```
FriendlyName        MediaType BusType          Size HealthStatus OperationalStatus
------------        --------- -------          ---- ------------ -----------------
KINGSTON SNV2S1000G SSD       NVMe    1000204886016 Healthy      OK
```

**Drive Details:**
- Model: KINGSTON SNV2S1000G
- Type: 1TB NVMe SSD (M.2, PCIe)
- Health Status: **Healthy**
- Operational Status: **OK**
- No actual disk errors in Event Viewer
- SMART attributes: Healthy (per Windows Storage Spaces)

**Conclusion:** Drive is functioning normally. No replacement needed.

---

## Revised GTS-W0 Assessment

**Grade:** Still RED, but for different reasons

**CRITICAL Issues (Actual):**
1. **All firewalls disabled** (Domain, Private, Public OFF)
2. **RDP enabled WITHOUT Network Level Authentication**

**WARNING Issues:**
- BitLocker not enabled (OS volume unencrypted)
- 1 pending Windows update
- Reboot pending
- 4 auto-start services not running (including Group Policy Client)
- **2 unexpected shutdowns (Event ID 41)** in 14 days - worth investigating but not drive-related

**REMOVED:**
- ~~9 disk errors~~ (FALSE POSITIVE)
- ~~Failing hard drive~~ (INCORRECT)
- ~~Backup data immediately~~ (NOT NEEDED)
- ~~Replace drive~~ (NOT NEEDED)

---

## Diagnostic Probe Bug

**Issue:** `onboarding-diagnostic.ps1` queries Event IDs 7, 51, 153 without filtering by source.

**Current Code (Problematic):**
```powershell
$DiskErrors = (Get-WinEvent -FilterHashtable @{
    LogName = 'System'
    ID = 7,51,153
    StartTime = $14DaysAgo
} -ErrorAction SilentlyContinue | Measure-Object).Count
```

**Fix Needed:**
```powershell
$DiskErrors = (Get-WinEvent -FilterHashtable @{
    LogName = 'System'
    ID = 7,51,153
    StartTime = $14DaysAgo
} -ErrorAction SilentlyContinue |
Where-Object { $_.ProviderName -ne 'Microsoft-Windows-Kernel-Boot' } |
Measure-Object).Count
```

**OR** use a more specific query:
```powershell
$DiskErrors = (Get-WinEvent -FilterHashtable @{
    LogName = 'System'
    ProviderName = 'disk'
    StartTime = $14DaysAgo
} -ErrorAction SilentlyContinue | Measure-Object).Count
```

**Impact:** This bug likely affects other machines too. Any Windows 11 machine with VBS/HVCI enabled (default on modern hardware) will show false disk errors.

**Action Required:**
1. Fix `onboarding-diagnostic.ps1` probe script
2. Re-run diagnostics on all Gonzvar machines to get accurate baseline
3. Update grading logic to account for corrected disk error counts

---

## Lessons Learned

1. **Always verify critical findings** - Don't trust automated diagnostics blindly
2. **Event ID alone is insufficient** - Must include source/provider filtering
3. **Context matters** - Same Event ID can mean completely different things
4. **Windows 11 defaults** - VBS/HVCI enabled by default on 12th gen Intel and newer
5. **Question patterns** - 9 errors in 14 days with "Healthy" SMART seemed contradictory (good instinct to question)

---

## Next Steps

1. ✓ Verify drive health (COMPLETED - drive is healthy)
2. Update diagnostic probe script to fix Event ID 153 false positive
3. Re-run diagnostics on all 6 Gonzvar machines for accurate baselines
4. Focus remediation on actual issues (firewall, RDP, BitLocker)
5. Document this finding as a diagnostic probe improvement

---

**Analysis Completed:** 2026-06-06
**Drive Replacement:** NOT NEEDED
**Data Backup Urgency:** REMOVED
**Actual Priority:** Fix firewall and RDP security issues