Gutcheck

Author(s)

• MERLIN

Tags

Windows Diagnostics Performance Support Troubleshooting Helpdesk Hardware Reporting

Functions

Invoke-Gutcheck

PSEditions

Desktop Core

Dependencies

This module has no dependencies.

Release Notes

0.8.2 - A stress test that loads the machine.

- The stress test could not load a processor fully: its load was PowerShell loops, which
 reach about three quarters of a healthy machine, and the Report then said that
 something was limiting the CPU. The load is compiled threads now and reaches 100 %.
 "Lasttest: Durchsatz" is on another scale; numbers from earlier Reports do not compare.
- A Server that lost its connection or could not be reached is named by name and by
 address, and the evidence sets apart which of the two the machine asked for.
- An example in a code comment no longer uses a name from a real machine.

0.8.1 - What four machines in one afternoon showed.

- Disk errors name the drive: which disk or volume, how many events, and when. Errors on
 a drive the machine no longer has - a memory stick, an external disk - no longer fail
 the machine, and with admin rights the drive is named by model and serial number.
- A connection to a Server that was lost and one that never came about are two Findings.
 A retired server that something still asks for at every start is no longer listed among
 the Servers whose connection dropped.
- Two antivirus products are confirmed by asking Defender itself: listed as active in
 Security Center, and passive by its own account, it is not a second scanner.
- A Run started in another account than the user's says so in a banner under the
 machine's box, and puts its folder on the Desktop all users share.
- A Run that was given admin rights reads the network adapters' power management in the
 admin part; "nicht gelesen: Get-NetAdapterPowerManagement" appeared in spite of them.

0.8 - Which machine this is, at the top of the Report.

- A box under the machine's name says what a reader wants first: manufacturer, model,
 serial number, board and BIOS; the Windows edition, version, build, when it was
 installed and last started, and its domain; processor, memory, graphics and drives.
- The network as ipconfig /all says it, for every adapter that has an address: IPv4 and
 IPv6 addresses, gateway, DNS servers, DHCP server and lease, MAC address, link speed.
 The same as a table among the evidence.
- The graphics driver with its version and date, and a table of every driver that is
 not Microsoft's.

0.7.2 - An update that reaches the window it was started from.

- A PowerShell window keeps the Gutcheck it loaded for as long as it is open. One that
 had loaded an old version said "Aktualisierung von 0.4 auf 0.7.1" on every Run,
 installed the new version again and started a second process - each time. A Run now
 looks at what is installed, installs nothing that is there, and moves the window to
 the new version when the restarted Run has finished. A window that still has an older
 version loaded needs "Remove-Module Gutcheck", or closing, once more.
- A Run says that it is asking the PowerShell Gallery for a newer version, and what the
 Gallery answered. The question takes a few seconds, and the window used to stay empty.

0.7.1 - The database server an application talks to, and what it wrote into its own log.

- AppConnection: the SQL Server and the web service an application is configured for,
 read from the application's own configuration file - never its user name or password.
 Each is measured like any Server, and a SQL Server is asked who it is: version, whether
 it is still supported, whether it encrypts, how long it takes to answer. A named
 instance is looked up through the SQL Server Browser, as the application does.
- AppLog: the errors an application caught and wrote into its own log file, which Windows
 knows nothing about - counted for the period and grouped by where they came from.
- AppRuntime: which .NET an application runs on. One that ships its own runtime is not
 helped by updating .NET on the machine; one that needs an installed runtime is held
 against what is installed. Either is held against the day Microsoft's support ends.
- Shipped for c-entron.NET, and usable for any application that keeps its server in an
 XML file, logs to a text file, or is built on .NET.
- A Hint that sends a Technician to a piece of evidence names it by its title, and the
 Report makes a link of it that opens the piece. "Die Liste der Verzögerungen unten"
 named nothing anybody could find.

0.6.2 - A mailbox is where Outlook found it.

- A mailbox on the company's own Exchange is no longer taken for one in Microsoft 365
 because Microsoft knows its address too, and the Autodiscover entry in Active Directory
 it is found through is no longer reported as left over from a migration. Gutcheck reads
 where Outlook itself was last told the mailbox is. With one mailbox on each side, the
 Report names which is where.
- Outlook's cached Autodiscover answers are listed. They are hidden files, and the table
 was empty on every Run before this one.
- The evidence at the end of the Report is grouped by what was checked: every
 application's processes together, every application's servers together.
- A crashing program is held against network disruptions only where the network concerns
 it: it runs or loads from a share, its exceptions are those of a lost share, or a crash
 did coincide with a disruption. A program installed on the machine is no longer told to
 enlarge its SMB event logs, nor that the evidence against it is incomplete.

0.6.1 - Four Findings say what they left unsaid.

- A default printer under a warning says what is wrong with it: offline, connection
 attempts that failed, or a slow connection.
- Disk health names the counters a drive does not report, instead of leaving a gap.
- Check Definitions published shortly before midnight read "gestern um 23:58 Uhr
 erstellt" rather than "1 Tag alt".
- Findings that were still in English are German: skipped and failed Checks, folder
 size, name resolution, the stress test's errors.

0.6 - A Report that says what to do, and what it is talking about.

- The Report is rebuilt. What needs doing comes first: every FAIL and WARN as a card,
 with what was found taken apart into lines and what to do as a list. Then every Check,
 folded by area and by application; then the evidence, folded and searchable. Dark on a
 screen, light on paper, and still one file that needs no network.
- Every Finding and every evidence table names the application it is about. Five tables
 called "Laufzeitmessungen (Server)" now each say whose Servers.
- Event messages are whole. They used to be cut at 500 characters, in mid-sentence.
- What stands under "Was tun" says what to do: the Hints for crash codes named the code,
 in English, and are now instructions. An application's crashes are counted in words.
- findings.csv has two new columns at the end, App and CheckName.
- A program on a share does not crash the second its connection drops: it runs on from
 memory and dies when it next reads from the share, minutes later. A drop up to ten
 minutes before a crash now counts, and so does the connection being re-established
 within two minutes after it. On the notebook this was built for, that is six of eight
 crashes where it used to be one.
- Lost connections are counted, not the events that report them: one loss is logged as
 five events or more, and the Report said a Server had dropped 86 times when it had
 dropped sixteen. The Finding now says both numbers.
- A drive letter is no longer listed as a Server that dropped.

0.5.2 - Which Check Definitions did this Run use?

- Every Report shows a Kennung beside the version of its Check Definitions: eight
 characters worked out from the document the Run read. Two Reports with the same Kennung
 used the same Checks, whether or not anybody updated the version.
- A document that carries a time says when today it was created.

0.5.1 - A click no longer freezes a Run.

- A click in the admin window, or in the window Gutcheck was started from, started a text
 selection, and Windows then held the Run still until somebody pressed Enter. Gutcheck
 switches that behaviour off for its windows while a Run lasts, and puts the Technician's
 own window back as it was afterwards.

0.5 - Did the application crash because its server dropped?

- A Run finds out which programs depend on which Servers, with no Check Definition per
 application: running programs and the DLLs they load, services, scheduled tasks,
 startup entries, shortcuts, redirected folders, offline files, printers, ODBC sources
 and the configuration files beside a program. Each Server is measured. A program
 running from a share is a warning before the first crash.
- Crashes are counted as incidents - the events of one crash are one row - and every
 program that crashes repeatedly gets a Finding of its own: where it runs from, what
 the exceptions were, how many incidents coincided with a network disruption, and a
 verdict drawn from that evidence. Where the evidence does not reach, it says so.
- What Windows logged about the network going away is read with admin rights: SMB
 disconnects and timeouts, adapter and Wi-Fi drops, standby and resume.
- Network adapters: whether the machine is on a USB adapter, and its power saving.
- Installed .NET versions, held against the version a crash happened on.
- The admin part runs again. In 0.4 it ended within a second on every machine, without
 results and without saying why.
- No more false alarms from healthy-volume messages counted as disk errors, old driver
 hangs reported again and again, or one antivirus registered several times.

Versions 0.1 to 0.4: https://github.com/kort3x/gutcheck/blob/main/docs/release-notes-earlier.md