Gutcheck

0.9.1

Gutcheck - an honest look inside a slow or unstable Windows PC. Performance and stability diagnostics for Windows clients, driven by data-defined Checks. A technician runs one command at a customer site and reads the report on the spot.

Minimum PowerShell version

5.1

Installation Options

Copy and Paste the following command to install this package using PowerShellGet More Info

Install-Module -Name Gutcheck -RequiredVersion 0.9.1

Copy and Paste the following command to install this package using Microsoft.PowerShell.PSResourceGet More Info

Install-PSResource -Name Gutcheck -Version 0.9.1

You can deploy this package directly to Azure Automation. Note that deploying packages with dependencies will deploy all the dependencies to Azure Automation. Learn More

Manually download the .nupkg file to your system's default download location. Note that the file won't be unpacked, and won't include any dependencies. Learn More

Owners

Merlin

Copyright

Package Details

Author(s)

MERLIN

Functions

Invoke-Gutcheck

PSEditions

Desktop Core

Dependencies

This module has no dependencies.

Release Notes

0.9.1 - No code without what it means.

- A status or an error code is no longer shown bare: service exit codes, print and Group
Policy errors, HTTP statuses, certificate errors, sign-in errors of Windows and of
Microsoft Entra ID, add-in settings and the antivirus and printer states say what they
mean, with the code behind it. The evidence tables are headed in German.
- The Report says who ran the Run and with what rights, and gives the evidence more room.
- Fewer false alarms: a remote desktop session's display adapter is no outdated graphics
driver; a printer whose queues report offline is one printer and is not called
outdated; a virtual disk is not failed for calling itself an HDD; the add-ins Office
installs itself do not count as many add-ins.
- Failed connections that are a program going through the network address by address
are recognised as that, and the Report says what to look for.
- An elevated window of an account that has no lesser rights is not offered a restart.

0.9 - What the Findings point to together.

- "Verdacht": where two Findings observed two different things that point to one cause,
the Report says so before anything else - a failing drive, failing memory, the graphics
driver, this machine's network connection, or one Server. It names the Findings it
rests on, says once what to do, and says what would have supported it and was not
checked. It is no Finding and is in no count.
- A Finding says what it means ("Bedeutung") apart from what to do about it ("Was tun"),
for the Findings of Stability, Network and Outlook that can warn or fail.
- What a Hint assumes about the machine is found out once and stated at the top of the
Report: connected by cable, Wi-Fi or VPN, notebook or desktop, docked, on battery, in a
domain. No docking station is named on a desktop, and a slow measurement says when it
was taken on battery.
- A Finding links to the evidence to read with it and to the Findings that belong with
it, and every piece of evidence says which Findings it belongs to.
- findings.csv has new columns at the end: References, Signals, Meaning, Subject,
Unobserved. The graphics driver and its date are a Finding of their own.

0.8.3 - Hints that fit the machine, and a Run in the right session.

- A Run started "as administrator" says so before it examines anything and asks whether
to start again in the logged-on user's session, where it asks for the rights itself.
Started in another account it would read the wrong profile; in the user's own it would
not see the user's network drives. -NoUserSwitch keeps a Run where it was started.
- What to do about a lossy ping or a slow Server follows how the machine reaches it: by
cable, Wi-Fi or VPN, inside its own network or beyond. A machine at a cable is no
longer told to try a cable. One lost ping is a WARN and not a FAIL.
- Blue screens and live kernel events say what the code means and what to do about it,
where "2: 0x193 x2" said neither.
- Scheduled tasks that are not Windows' own are listed with account, trigger, last run
and how it ended. A program a task starts from a share says so and points there.
- An ODBC data source is named with whose driver it uses, which is as near to the
program as a data source gets.
- Every Finding in the Report has a button that copies it as text, for a ticket.
- The Report says "Notiz" where it said "Was tun".

0.8.2 - A stress test that loads the machine.

- The stress test could not load a processor fully: its load was PowerShell loops, which
reach about three quarters of a healthy machine, and the Report then said that
something was limiting the CPU. The load is compiled threads now and reaches 100 %.
"Lasttest: Durchsatz" is on another scale; numbers from earlier Reports do not compare.
- A Server that lost its connection or could not be reached is named by name and by
address, and the evidence sets apart which of the two the machine asked for.
- An example in a code comment no longer uses a name from a real machine.

0.8.1 - What four machines in one afternoon showed.

- Disk errors name the drive: which disk or volume, how many events, and when. Errors on
a drive the machine no longer has - a memory stick, an external disk - no longer fail
the machine, and with admin rights the drive is named by model and serial number.
- A connection to a Server that was lost and one that never came about are two Findings.
A retired server that something still asks for at every start is no longer listed among
the Servers whose connection dropped.
- Two antivirus products are confirmed by asking Defender itself: listed as active in
Security Center, and passive by its own account, it is not a second scanner.
- A Run started in another account than the user's says so in a banner under the
machine's box, and puts its folder on the Desktop all users share.
- A Run that was given admin rights reads the network adapters' power management in the
admin part; "nicht gelesen: Get-NetAdapterPowerManagement" appeared in spite of them.

0.8 - Which machine this is, at the top of the Report.

- A box under the machine's name says what a reader wants first: manufacturer, model,
serial number, board and BIOS; the Windows edition, version, build, when it was
installed and last started, and its domain; processor, memory, graphics and drives.
- The network as ipconfig /all says it, for every adapter that has an address: IPv4 and
IPv6 addresses, gateway, DNS servers, DHCP server and lease, MAC address, link speed.
The same as a table among the evidence.
- The graphics driver with its version and date, and a table of every driver that is
not Microsoft's.

0.7.2 - An update that reaches the window it was started from.

- A PowerShell window keeps the Gutcheck it loaded for as long as it is open. One that
had loaded an old version said "Aktualisierung von 0.4 auf 0.7.1" on every Run,
installed the new version again and started a second process - each time. A Run now
looks at what is installed, installs nothing that is there, and moves the window to
the new version when the restarted Run has finished. A window that still has an older
version loaded needs "Remove-Module Gutcheck", or closing, once more.
- A Run says that it is asking the PowerShell Gallery for a newer version, and what the
Gallery answered. The question takes a few seconds, and the window used to stay empty.

0.7.1 - The database server an application talks to, and what it wrote into its own log.

- AppConnection: the SQL Server and the web service an application is configured for,
read from the application's own configuration file - never its user name or password.
Each is measured like any Server, and a SQL Server is asked who it is: version, whether
it is still supported, whether it encrypts, how long it takes to answer. A named
instance is looked up through the SQL Server Browser, as the application does.
- AppLog: the errors an application caught and wrote into its own log file, which Windows
knows nothing about - counted for the period and grouped by where they came from.
- AppRuntime: which .NET an application runs on. One that ships its own runtime is not
helped by updating .NET on the machine; one that needs an installed runtime is held
against what is installed. Either is held against the day Microsoft's support ends.
- Shipped for c-entron.NET, and usable for any application that keeps its server in an
XML file, logs to a text file, or is built on .NET.
- A Hint that sends a Technician to a piece of evidence names it by its title, and the
Report makes a link of it that opens the piece. "Die Liste der Verzögerungen unten"
named nothing anybody could find.

Versions 0.1 to 0.6.2: https://github.com/kort3x/gutcheck/blob/main/docs/release-notes-earlier.md

FileList

Version History

Version	Downloads	Last updated
0.11.1	8	10/10/2026
0.11	5	10/10/2026
0.10	5	10/10/2026
0.9.1 (current version)	10	10/10/2026
0.9	8	10/10/2026
0.8.3	5	10/9/2026
0.8.2	4	10/9/2026
0.8.1	3	10/9/2026
0.8	3	10/9/2026
0.7.2	4	10/9/2026
0.7.1	5	10/9/2026
0.6.2	6	10/8/2026
0.6.1	5	10/8/2026
0.6	4	10/8/2026
0.5.2	6	10/7/2026
0.5.1	8	10/7/2026
0.5	5	10/7/2026
0.4	19	9/25/2026
0.3	7	9/25/2026
0.2	7	9/24/2026