Gutcheck
0.28.0
Gutcheck - an honest look inside a slow or unstable Windows PC. Performance and stability diagnostics for Windows clients, driven by data-defined Checks. A technician runs one command at a customer site and reads the report on the spot.
Minimum PowerShell version
5.1
Installation Options
Owners
Copyright
(c) 2026 MERLIN. Licensed under the MIT License.
Package Details
Author(s)
- MERLIN
Tags
Windows Diagnostics Performance Support Troubleshooting Helpdesk Hardware Reporting
Functions
PSEditions
Dependencies
This module has no dependencies.
Release Notes
0.28.0 - More of the network on the Weg, and the past beside the present.
- The Weg groups the servers by subnet: this machine's own, read from each adapter,
then beyond the gateway the other subnets (their prefix assumed), the VPN and the
internet. Each card says the server's other addresses and names, a port where one
value was measured on two, and how many events the 30 days hold for it, from when to
when, in the colour of their worst Finding: the stripe is now, that line the past.
- On the Weg and the 30 days besides SMB: Remote Desktop connections that failed or
dropped; Group Policy, Netlogon, Kerberos and time-sync events about a domain
controller or the time source; the clock offset of the time source and of each
controller, with its sign; each DNS server's answer to the domain's controller
lookup; the SYSVOL answer of each controller; the ping to each mapped drive's server;
the Autodiscover requests; every print server and network printer, at most five.
- The internet probe is OK where it answers and says so in German where it does not.
A server that never answers a ping is not pinged (Server-Eye's console).
- Two controllers logged under the domain's name are no longer drawn as one. A failed
or dropped SMB connection names the address it went to, also where the name has
several. measurements.csv gains the column PrefixLength.
0.27.0 - The network in pictures.
- New chapter "Netzwerk im Bild" under "Netz & Domäne", drawn from what the Run
measured: the way from this machine through its network services (gateway, DNS,
DHCP) to the domain controllers, servers, internet services and websites, each
value in the colour of the Finding it belongs to; 30 days of connection failures per
server with crashes and sign-ins and a day-by-hour strip; a waterfall per website
and HTTPS service; every value ranked, the worst first. Each over the whole window,
and each saying what the Scope left out.
- The numbers beside the Report: measurements.csv and timeline.csv. findings.csv
gains the columns Id and Subjects.
- The admin half sends back everything: the times of its Checks, missing from the
table since 0.25.0, and the network disruptions the timeline is drawn from. A Run
whose admin half sent two times no longer breaks.
- The DHCP server is measured; a Finding about several servers says each one's own
Severity; a ping under a millisecond reads "< 1 ms".
0.26.0 - The browsers, and a website as a browser loads it.
- New Check "Browsers": for Edge, Chrome and Firefox, in each profile, how the browser
last closed, the crash reports it holds, its size and cache, the extensions somebody
or a policy installed, the policies set for it and the proxy they force beside the
User's. WebView2, which new Outlook and Teams draw in: installed, version, crashes.
Each stands under its browser, where its App Check stands; the three FolderSize
Checks of the browser profiles are gone.
- New: a website loaded as a browser loads it. "gutcheck -Url <Adresse>" starts an Edge
of Gutcheck's own, with a profile thrown away after, and says whether the page loaded,
what happened at each host it needed, the proxy it went through and how Edge found
it, its certificate - for whom, from when to when - the sign-in, and where the time
went. The net log stays in the Report folder. "-Scope Web" without an address asks
for one.
- The stress test reads the processor while it is loaded: a reading that came back
after the load had it say "21 %", something holding the CPU back.
- A Checks-Hash beside the Kennung, the same for every build of the same Checks.
- MERLIN's logo in the head of the Report and on its tab.
0.25.0 - A Report to find your way in.
- A drive through a DFS-Namespace names the server it is on, and the connection is
measured to that server.
- The search speaks a language: ODER, -without, brackets, "a phrase", Spalte:Wert, the
states in capitals. It looks in the part picked in the tree, everywhere on request, and
a "?" beside it says how.
- Tables of the evidence can be grouped by a column, a month, a day, an hour, a network
or a server, copied as shown, and opened over the window. The evidence follows the
tree, and the tables the cards point to come first.
- A term of the glossary is explained on the pointer where it stands.
- The Report opens on its overview, the browser's back and forward go from view to view,
and what the Run says of itself stands in the box of the system.
- How long each Check took, in the window as it goes and as a table; how long the Run
took, in the box at the top. The path of the Report is a link in Windows Terminal.
- Network disruptions: every one of the period in the table, up to 2,000.
- A suspicion the Scope kept from forming names the Scope to run again in.
0.24.1 - A search where you are.
- The search looks in the part picked in the tree - an area, an application, the hints, the
cards, the evidence, the terms - and says so in front of it. "überall suchen" searches the
whole Report. A pick while something is searched for searches there.
0.24.0 - What still points at a server that does not answer.
- New Finding "Verweise auf Server, die nicht antworten": for each server the machine
asked for a share in vain, where the signed-in User's profile still points at it -
quick access, the lists of recently used files, shortcuts, network places, Office's
settings, typed addresses, drives and printer connections - with what to do at each.
It reads the server and the share, never a file's name, and says where it looked
where it found nothing.
- "Group Policy Client-Side Extensions: die langsamsten" no longer fails for what has
stopped: slow runs in the background with five or more quick runs since are a note
that says so. What somebody waited for at a sign-in is graded as before.
- The Report names things as Windows names them and a search finds them -
"DFS-Namespace", "Windows-Zeitgeber (W32Time)", "NCSI", "AAD Broker Plugin",
"TLS-Handshake" - and no longer by German words made up for them.
- New chapter "Begriffe": each technical term the Report uses, explained in plain words;
only those it uses.
- Picked for one application, the head of an area counts that application's Findings, and
not every application's.
- A long first line of a closed Finding ends in "..." inside its box, and no longer runs
past it.
- Live kernel events say what each code means beside it: "2x Code 0x193" said nothing.
- The tree beside the Report groups the areas by the question a Technician comes with:
"Gerät", "Netz & Domäne", "Anmeldung & Benutzer", "Anwendungen". What the
applications have in common leads the applications as "Alle Anwendungen", and what
the Run says of itself stands in the overview as "Zum Durchlauf". The areas have German
names in the Report; findings.csv keeps their values.
- A search above the Report finds in every Finding, every row of the evidence and every
term, and marks each place: several words, "a phrase", -without, FAIL/WARN/INFO/OK.
Enter goes from one place to the next, / goes to the search.
- "Nachweise" keeps the width of the rest of the Report. A table wider than its box
scrolls in it with its first column fixed, and "breit anzeigen" shows it over the window.
0.23.0 - A Report with a way through it.
- Beside the Report stands a tree that does not scroll away: the chapters, the areas of
the machine and the applications, each with how it stands and how many Findings it
has. Picking an entry shows that part and nothing else.
- A Finding is one line until it is opened. What is in order is one line of the tree.
- An application is one place to look, with its Findings from every area.
- Printed, and without its script, the Report is whole as before.
- "Handlungsbedarf" is called "Auffälligkeiten": it says what stands out, and not yet
that something has to be done.
- "Arbeitsspeicher belegt" names the five largest programs where the memory is short,
each summed over all its processes, and says what it means and what to do.
0.22.0 - A log kept in a database, and a Report that reads easier.
- The Check of an application's own log reads a log kept in an SQLite database, where
a Check Definition names its table. New Check "App: Securepoint VPN service log".
- New Scope "Apps": the applications, with what their Checks read - crashes, recent
changes, .NET, running programs - and nothing else about the machine.
- New Checks for Bitwarden: the application, the errors in its log, and its browser
extension - in which browser and profile it is installed and switched on, and whether
its link to the desktop application is intact.
- New Checks "App: Nextcloud" and "App: Nextcloud sync": the files the client could not
transfer and why, open conflicts, and how each folder is set up.
- New Check "App: OneDrive sync": what OneDrive says of its own synchronisation - files
that failed, files that wait, whether it is stalled - and how it is set up.
- New Check "App: SwyxIt! Outlook access": the crashes of the helper that reads Outlook
for SwyxIt!, each beside what Outlook did in the same minute.
- New Check "App: SwyxIt! trace log". A log that writes a stack trace line by line
counts an error once, and errors without a kind are told apart by what they say.
- "Netzabhängigkeiten: nicht untersucht" is called "... was nicht gelesen werden
konnte": it says in words what could not be asked, names the processes Windows opens
to nobody apart as nothing to do, and asks for admin rights only where they help.
- A list of things with how often each ("3x", "2 von 9") is shown as rows in the Report.
- Addresses, names with their domain and paths on a share are set apart a little in
"Handlungsbedarf" and "Alle Prüfungen nach Bereich".
- An adapter with nothing against it is OK and no longer grey, and its power saving
alone no longer makes a "Kein Verdacht möglich".
- "Richtlinienerweiterung" was a word of ours: the Report says "Client-Side Extension".
- A program that an application's own Check judges is counted among the crashes and
no longer warned of a second time there.
- An application that is closed, or installed where a program is expected, is in order
and no longer stands among what needs doing.
Versions 0.1 to 0.21.0: https://github.com/kort3x/gutcheck/blob/main/docs/release-notes-earlier.md
FileList
- Gutcheck.nuspec
- Definitions\checks.json
- Gutcheck.psd1
- Gutcheck.psm1
- Invoke-GutcheckElevated.ps1
- Private\Account.ps1
- Private\AppSelection.ps1
- Private\Autoupdate.ps1
- Private\BrowserProfile.ps1
- Private\Code.ps1
- Private\Console.ps1
- Private\Data.ps1
- Private\DataShape.ps1
- Private\Definition.ps1
- Private\Elevation.ps1
- Private\Finding.ps1
- Private\KeepSignIn.ps1
- Private\Kind.ps1
- Private\Kinds\App.ps1
- Private\Kinds\AppConnection.ps1
- Private\Kinds\AppLog.ps1
- Private\Kinds\AppRuntime.ps1
- Private\Kinds\Autodiscover.ps1
- Private\Kinds\Battery.ps1
- Private\Kinds\BootPerformance.ps1
- Private\Kinds\Browser.ps1
- Private\Kinds\BrowserExtension.ps1
- Private\Kinds\Change.ps1
- Private\Kinds\Companion.ps1
- Private\Kinds\Cpu.ps1
- Private\Kinds\CrashDump.ps1
- Private\Kinds\DiskHealth.ps1
- Private\Kinds\DiskTest.ps1
- Private\Kinds\Domain.ps1
- Private\Kinds\DotNet.ps1
- Private\Kinds\Firewall.ps1
- Private\Kinds\FolderSize.ps1
- Private\Kinds\GroupPolicy.ps1
- Private\Kinds\HttpsEndpoint.ps1
- Private\Kinds\ImageIntegrity.ps1
- Private\Kinds\Logon.ps1
- Private\Kinds\Memory.ps1
- Private\Kinds\Network.ps1
- Private\Kinds\NetworkDependency.ps1
- Private\Kinds\NetworkDependencyElevated.ps1
- Private\Kinds\NetworkDependencyReference.ps1
- Private\Kinds\NetworkDependencySource.ps1
- Private\Kinds\NetworkDisruption.ps1
- Private\Kinds\NetworkProtocol.ps1
- Private\Kinds\Nextcloud.ps1
- Private\Kinds\Odbc.ps1
- Private\Kinds\OfficeAddins.ps1
- Private\Kinds\OneDrive.ps1
- Private\Kinds\OutlookAuth.ps1
- Private\Kinds\OutlookData.ps1
- Private\Kinds\Power.ps1
- Private\Kinds\Printing.ps1
- Private\Kinds\Program.ps1
- Private\Kinds\ProgramElevated.ps1
- Private\Kinds\RemoteDesktop.ps1
- Private\Kinds\Security.ps1
- Private\Kinds\Server.ps1
- Private\Kinds\Service.ps1
- Private\Kinds\Session.ps1
- Private\Kinds\SessionElevated.ps1
- Private\Kinds\Stability.ps1
- Private\Kinds\StabilityChange.ps1
- Private\Kinds\StabilityCrash.ps1
- Private\Kinds\StabilityHardware.ps1
- Private\Kinds\StabilityIncident.ps1
- Private\Kinds\StabilityNetwork.ps1
- Private\Kinds\Startup.ps1
- Private\Kinds\Storage.ps1
- Private\Kinds\Stress.ps1
- Private\Kinds\System.ps1
- Private\Kinds\Temperature.ps1
- Private\Kinds\Updates.ps1
- Private\Kinds\UserProfile.ps1
- Private\Kinds\UserProfileElevated.ps1
- Private\Kinds\UserProfileOther.ps1
- Private\Kinds\UserSetting.ps1
- Private\Kinds\WebFolder.ps1
- Private\Kinds\Website.ps1
- Private\Lead.ps1
- Private\Measurement.ps1
- Private\Parameter.ps1
- Private\Probe.ps1
- Private\Progress.ps1
- Private\PublishedDefinitions.ps1
- Private\QrCode.ps1
- Private\Reading.ps1
- Private\Report.ps1
- Private\ReportGlossary.ps1
- Private\ReportNetwork.ps1
- Private\ReportNetworkPath.ps1
- Private\ReportNetworkRanking.ps1
- Private\ReportNetworkTimeline.ps1
- Private\ReportNetworkWaterfall.ps1
- Private\ReportScript.ps1
- Private\ReportStyle.ps1
- Private\RunTiming.ps1
- Private\Sampling.ps1
- Private\Scope.ps1
- Private\Section.ps1
- Private\Signal.ps1
- Private\Situation.ps1
- Private\Sqlite.ps1
- Private\Text.ps1
- Private\TimedEvent.ps1
- Private\TokenCache.ps1
- Private\WebsiteNetLog.ps1
- Public\Invoke-Gutcheck.ps1
- Vendor\Lantern.ps1
Version History
| Version | Downloads | Last updated |
|---|---|---|
| 0.28.0 (current version) | 6 | 10/15/2026 |
| 0.27.0 | 7 | 10/15/2026 |
| 0.26.0 | 7 | 10/14/2026 |
| 0.25.0 | 7 | 10/14/2026 |
| 0.24.1 | 3 | 10/14/2026 |
| 0.24.0 | 10 | 10/14/2026 |
| 0.23.0 | 7 | 10/13/2026 |
| 0.22.0 | 6 | 10/13/2026 |
| 0.21.0 | 5 | 10/13/2026 |
| 0.20.0 | 7 | 10/13/2026 |
| 0.19.1 | 7 | 10/12/2026 |
| 0.19.0 | 4 | 10/12/2026 |
| 0.18.1 | 4 | 10/12/2026 |
| 0.18.0 | 5 | 10/12/2026 |
| 0.17.1 | 3 | 10/12/2026 |
| 0.17.0 | 6 | 10/12/2026 |
| 0.16.0 | 7 | 10/12/2026 |
| 0.15.1 | 16 | 10/12/2026 |
| 0.15.0 | 6 | 10/12/2026 |
| 0.14.1 | 7 | 10/11/2026 |
| 0.14.0 | 7 | 10/11/2026 |
| 0.13.0 | 7 | 10/11/2026 |
| 0.12.1 | 8 | 10/11/2026 |
| 0.12.0 | 5 | 10/11/2026 |
| 0.11.3 | 6 | 10/11/2026 |
| 0.11.2 | 8 | 10/10/2026 |
| 0.11.1 | 8 | 10/10/2026 |
| 0.11 | 5 | 10/10/2026 |
| 0.10 | 5 | 10/10/2026 |
| 0.9.1 | 10 | 10/10/2026 |
| 0.9 | 8 | 10/10/2026 |
| 0.8.3 | 5 | 10/9/2026 |
| 0.8.2 | 4 | 10/9/2026 |
| 0.8.1 | 3 | 10/9/2026 |
| 0.8 | 3 | 10/9/2026 |
| 0.7.2 | 4 | 10/9/2026 |
| 0.7.1 | 6 | 10/9/2026 |
| 0.6.2 | 7 | 10/8/2026 |
| 0.6.1 | 6 | 10/8/2026 |
| 0.6 | 4 | 10/8/2026 |
| 0.5.2 | 6 | 10/7/2026 |
| 0.5.1 | 8 | 10/7/2026 |
| 0.5 | 5 | 10/7/2026 |
| 0.4 | 19 | 9/25/2026 |
| 0.3 | 7 | 9/25/2026 |
| 0.2 | 7 | 9/24/2026 |