Gutcheck

Author(s)

• MERLIN

Tags

Windows Diagnostics Performance Support Troubleshooting Helpdesk Hardware Reporting

Functions

Invoke-Gutcheck

PSEditions

Desktop Core

Dependencies

This module has no dependencies.

Release Notes

0.10 - Every running program.

- A new Check looks at every running program, not only at the applications that have a
 Check of their own: a table of all of them with memory, handles, GDI and USER objects,
 and a Finding for one near the limit of 10,000 GDI or USER objects or holding
 unusually many handles. The programs of other accounts are read with admin rights;
 what stays unread is said to be unread.
- A status of Windows or a WinHTTP error Gutcheck has no wording for is said as Windows
 says it; each print service error has its own meaning; four sign-in errors of
 Microsoft Entra ID are worded as Microsoft documents them.
- Where a program was found is one Finding per application, and a shortcut to a program
 on a share is information, not a warning.

0.9.1 - No code without what it means.

- A status or an error code is no longer shown bare: service exit codes, print and Group
 Policy errors, HTTP statuses, certificate errors, sign-in errors of Windows and of
 Microsoft Entra ID, add-in settings and the antivirus and printer states say what they
 mean, with the code behind it. The evidence tables are headed in German.
- The Report says who ran the Run and with what rights, and gives the evidence more room.
- Fewer false alarms: a remote desktop session's display adapter is no outdated graphics
 driver; a printer whose queues report offline is one printer and is not called
 outdated; a virtual disk is not failed for calling itself an HDD; the add-ins Office
 installs itself do not count as many add-ins.
- Failed connections that are a program going through the network address by address
 are recognised as that, and the Report says what to look for.
- An elevated window of an account that has no lesser rights is not offered a restart.

0.9 - What the Findings point to together.

- "Verdacht": where two Findings observed two different things that point to one cause,
 the Report says so before anything else - a failing drive, failing memory, the graphics
 driver, this machine's network connection, or one Server. It names the Findings it
 rests on, says once what to do, and says what would have supported it and was not
 checked. It is no Finding and is in no count.
- A Finding says what it means ("Bedeutung") apart from what to do about it ("Was tun"),
 for the Findings of Stability, Network and Outlook that can warn or fail.
- What a Hint assumes about the machine is found out once and stated at the top of the
 Report: connected by cable, Wi-Fi or VPN, notebook or desktop, docked, on battery, in a
 domain. No docking station is named on a desktop, and a slow measurement says when it
 was taken on battery.
- A Finding links to the evidence to read with it and to the Findings that belong with
 it, and every piece of evidence says which Findings it belongs to.
- findings.csv has new columns at the end: References, Signals, Meaning, Subject,
 Unobserved. The graphics driver and its date are a Finding of their own.

0.8.3 - Hints that fit the machine, and a Run in the right session.

- A Run started "as administrator" says so before it examines anything and asks whether
 to start again in the logged-on user's session, where it asks for the rights itself.
 Started in another account it would read the wrong profile; in the user's own it would
 not see the user's network drives. -NoUserSwitch keeps a Run where it was started.
- What to do about a lossy ping or a slow Server follows how the machine reaches it: by
 cable, Wi-Fi or VPN, inside its own network or beyond. A machine at a cable is no
 longer told to try a cable. One lost ping is a WARN and not a FAIL.
- Blue screens and live kernel events say what the code means and what to do about it,
 where "2: 0x193 x2" said neither.
- Scheduled tasks that are not Windows' own are listed with account, trigger, last run
 and how it ended. A program a task starts from a share says so and points there.
- An ODBC data source is named with whose driver it uses, which is as near to the
 program as a data source gets.
- Every Finding in the Report has a button that copies it as text, for a ticket.
- The Report says "Notiz" where it said "Was tun".

0.8.2 - A stress test that loads the machine.

- The stress test could not load a processor fully: its load was PowerShell loops, which
 reach about three quarters of a healthy machine, and the Report then said that
 something was limiting the CPU. The load is compiled threads now and reaches 100 %.
 "Lasttest: Durchsatz" is on another scale; numbers from earlier Reports do not compare.
- A Server that lost its connection or could not be reached is named by name and by
 address, and the evidence sets apart which of the two the machine asked for.
- An example in a code comment no longer uses a name from a real machine.

0.8.1 - What four machines in one afternoon showed.

- Disk errors name the drive: which disk or volume, how many events, and when. Errors on
 a drive the machine no longer has - a memory stick, an external disk - no longer fail
 the machine, and with admin rights the drive is named by model and serial number.
- A connection to a Server that was lost and one that never came about are two Findings.
 A retired server that something still asks for at every start is no longer listed among
 the Servers whose connection dropped.
- Two antivirus products are confirmed by asking Defender itself: listed as active in
 Security Center, and passive by its own account, it is not a second scanner.
- A Run started in another account than the user's says so in a banner under the
 machine's box, and puts its folder on the Desktop all users share.
- A Run that was given admin rights reads the network adapters' power management in the
 admin part; "nicht gelesen: Get-NetAdapterPowerManagement" appeared in spite of them.

0.8 - Which machine this is, at the top of the Report.

- A box under the machine's name says what a reader wants first: manufacturer, model,
 serial number, board and BIOS; the Windows edition, version, build, when it was
 installed and last started, and its domain; processor, memory, graphics and drives.
- The network as ipconfig /all says it, for every adapter that has an address: IPv4 and
 IPv6 addresses, gateway, DNS servers, DHCP server and lease, MAC address, link speed.
 The same as a table among the evidence.
- The graphics driver with its version and date, and a table of every driver that is
 not Microsoft's.

0.7.2 - An update that reaches the window it was started from.

- A PowerShell window keeps the Gutcheck it loaded for as long as it is open. One that
 had loaded an old version said "Aktualisierung von 0.4 auf 0.7.1" on every Run,
 installed the new version again and started a second process - each time. A Run now
 looks at what is installed, installs nothing that is there, and moves the window to
 the new version when the restarted Run has finished. A window that still has an older
 version loaded needs "Remove-Module Gutcheck", or closing, once more.
- A Run says that it is asking the PowerShell Gallery for a newer version, and what the
 Gallery answered. The question takes a few seconds, and the window used to stay empty.

0.7.1 - The database server an application talks to, and what it wrote into its own log.

- AppConnection: the SQL Server and the web service an application is configured for,
 read from the application's own configuration file - never its user name or password.
 Each is measured like any Server, and a SQL Server is asked who it is: version, whether
 it is still supported, whether it encrypts, how long it takes to answer. A named
 instance is looked up through the SQL Server Browser, as the application does.
- AppLog: the errors an application caught and wrote into its own log file, which Windows
 knows nothing about - counted for the period and grouped by where they came from.
- AppRuntime: which .NET an application runs on. One that ships its own runtime is not
 helped by updating .NET on the machine; one that needs an installed runtime is held
 against what is installed. Either is held against the day Microsoft's support ends.
- Shipped for c-entron.NET, and usable for any application that keeps its server in an
 XML file, logs to a text file, or is built on .NET.
- A Hint that sends a Technician to a piece of evidence names it by its title, and the
 Report makes a link of it that opens the piece. "Die Liste der Verzögerungen unten"
 named nothing anybody could find.

Versions 0.1 to 0.6.2: https://github.com/kort3x/gutcheck/blob/main/docs/release-notes-earlier.md